ROAST MCP App
Skybridge MCP / ChatGPT app for authenticated ROAST users.
The app exposes a protected /mcp endpoint, maps the OAuth identity to a ROAST user_firebase_id, and calls the existing ROAST backend with a server-side backend bearer token. Tool inputs never accept user_firebase_id; user scope is always derived from auth.
Current Tools
show_roast_dashboard: dashboard view with account summary, recent profiles,
photoshoots, and images.
list_my_profiles: recent profile reviews for the authenticated user.list_my_photoshoots: recent photoshoots for the authenticated user.list_my_images: recent visible images for the authenticated user.
Setup
Requires Node.js 24+.
npm install
cp .env.example .env
npm run devSkybridge runs the MCP endpoint at http://localhost:3000/mcp and DevTools at http://localhost:3000.
Auth Modes
Production: Firebase OAuth Bridge
Use ROAST_MCP_AUTH_MODE=firebase.
The MCP app exposes OAuth-compatible endpoints for ChatGPT/MCP clients:
GET/POST /oauth/authorizePOST /oauth/tokenPOST /oauth/register
The authorization page signs users into Firebase with their ROAST email and password, then issues an MCP bearer token whose subject is the Firebase UID. That UID is used directly as ROAST user_firebase_id, so paid users keep access to their subscription, coins, products, and photoshoots.
Required variables:
ROAST_MCP_AUTH_MODE=firebase
FIREBASE_WEB_API_KEY=...
MCP_AUTH_JWT_SECRET=...
ROAST_API_BEARER_TOKEN=...Optional: Auth0
Use ROAST_MCP_AUTH_MODE=auth0 if you want to fall back to Auth0. The access token is verified against Auth0 JWKS, then mapped to ROAST by ROAST_USER_ID_CLAIM or verified email lookup.
Local: Dev Token
Use ROAST_MCP_AUTH_MODE=dev with:
ROAST_MCP_DEV_TOKEN=dev-roast-token
ROAST_MCP_DEV_USER_FIREBASE_ID=<existing-roast-user-firebase-id>Then connect with:
Authorization: Bearer dev-roast-tokenEnvironment
See .env.example.
Important variables:
SERVER_URL: public Skybridge server URL.APP_DOMAIN: public domain for rendered views.ROAST_API_BASE_URL: ROAST backend API base URL.ROAST_API_BEARER_TOKEN: backend-to-backend token accepted by ROAST.AUTH0_DOMAIN: Auth0 tenant domain.AUTH0_AUDIENCE: Auth0 API audience used for MCP access tokens.
Verify
npm run build
