adam/sh-mcp
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/sh-mcp.git synced 2026-10-07 12:48:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
Sea Haven MCP platform — trust-tiered MCP servers + Cognito/Google auth broker, replacing seahaven-slack-bot and exec-aide (design phase)
6 commits 3 branches 0 tags 5 MiB
TypeScript 99%
JavaScript 1%
Find a file
Adam Moussa 9bf85aef29 Add runnable sh-mcp-ops and sh-mcp-finance servers 
Two thin composition-root servers over the shared transport (design.md §3):
- ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks,
  reminders. finance: qbo, payments (audited + redacted on egress).
- config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects
  LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs
  (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5).
- index.ts is the only place .listen() is called; a Lambda handler placeholder
  is exported but not depended on.
- synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app
  (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector.
2026-06-26 12:48:26 -04:00
.github/workflows Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
docs Add Agentforce migration & architecture plan (#1) 2026-06-26 12:47:04 -04:00
packages Add in-memory dev clients; make package tool exports lazy 2026-06-26 12:48:26 -04:00
servers Add runnable sh-mcp-ops and sh-mcp-finance servers 2026-06-26 12:48:26 -04:00
.editorconfig Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
.gitignore Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
.prettierrc Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
eslint.config.js Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
package-lock.json Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
package.json Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
README.md Initial commit: sh-mcp design and plan 2026-06-09 19:25:24 -04:00
tsconfig.base.json Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
tsconfig.json Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00
vitest.config.ts Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) 2026-06-26 12:42:17 -04:00

README.md

sh-mcp

Sea Haven MCP platform. A TypeScript monorepo of trust-tiered MCP servers that expose Sea Haven's proprietary integrations as tools, plus the Cognito/Google auth broker and the rebuilt scheduled jobs. This service replaces seahaven-slack-bot and exec-aide, which are deprecated completely; the conversational surface becomes a configurable Slack task agent.

Status: DESIGN / PLANNING. Not built. No stack deployed. The full design, auth architecture, scope matrix, and build plan live in docs/design.md. Read it before writing any code.

Shape (planned)

  • MCP servers (trust-tiered, remote HTTP, per-server IAM):
    • sh-mcp-ops — read-mostly, agent-facing (WO/PO/site lookups, KB search, Google Maps, Gmail/Calendar, tasks, reminders).
    • sh-mcp-finance — sensitive, read-only, audited (QBO vendor search, payment lookups).
    • sh-mcp-physical — DEFERRED, admin/out-of-band only (Lenel/Yealink/3CX control).
  • Auth — Google Workspace is the single IdP; an Amazon Cognito user pool federated to Google issues scoped, audience-bound JWTs; group → scope mapping via a pre-token Lambda. See design §2.
  • Jobs — rebuilt proactive Lambdas (email classify/digest, KB syncs).
  • Language — TypeScript everywhere (servers, packages, CDK, jobs).

Open decisions

  • Task-agent surface: Agentforce (recommended) vs marketplace Claude app vs custom Bolt assistant (design §12). Drives the model + guardrail story.
  • Endpoint exposure specifics (Slack egress ranges / WAF) — design §9 / §11.

Layout (target)

packages/   shared + one package per integration
servers/    sh-mcp-ops, sh-mcp-finance  (CDK stacks)
auth/       cognito, pre-token-lambda, group-sync-lambda
jobs/       rebuilt scheduled Lambdas
docs/       design.md  (the canonical plan)

See docs/design.md for the authoritative spec.