You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Refactor code formatting and improve consistency across multiple files
- Standardize import statements to use single quotes
- Adjust spacing and indentation for better readability
- Ensure consistent use of semicolons and line breaks
- Miscellaneous style enhancements
This project provides a prototype implementation of a Model Context Protocol (MCP) server for Apache OFBiz® that:
4
-
3
+
This project provides a prototype implementation of a Model Context Protocol (MCP) server for Apache OFBiz® that:
4
+
5
5
- receives requests from an MCP client (usually hosted in a generative AI application such as Claude Desktop) and forwards those requests to a remote backend via RESTful API endpoints,
6
6
- exposes a template tool that invokes the findProductById OFBiz endpoint.
7
7
8
-
This project can be used as a platform to implement your own tools and enable generative AI applications to interact with any backend system that exposes REST API endpoints, such as [**Apache OFBiz**](https://ofbiz.apache.org) or [**Moqui**](https://www.moqui.org).
8
+
This project can be used as a platform to implement your own tools and enable generative AI applications to interact with any backend system that exposes REST API endpoints, such as [**Apache OFBiz**](https://ofbiz.apache.org) or [**Moqui**](https://www.moqui.org).
9
9
10
10
The server is implemented in two versions, one that runs as a local MCP server (stdio transport) and one that runs as a remote MCP server (Streamable HTTP transport).
11
11
12
-
The project leverages the **Anthropic TypeScript SDK**, and requires:
12
+
The project leverages the **Anthropic TypeScript SDK**, and requires:
13
13
14
-
- Node.js
14
+
- Node.js
15
15
- npm
16
16
17
17
This software is licensed under the Apache License, Version 2.0.
18
18
19
-
Apache OFBiz® is a trademark of the [Apache Software Foundation](https://www.apache.org)
20
-
19
+
Apache OFBiz® is a trademark of the [Apache Software Foundation](https://www.apache.org)
21
20
22
21
---
23
22
24
23
## Table of Contents
25
-
1.[Features](#features)
26
-
2.[Configuration](#configuration)
27
-
3.[Project Structure](#project-structure)
28
-
4.[Build the Project](#build-the-project)
29
-
5.[Test the Local MCP Server](#test-the-local-mcp-server)
24
+
25
+
1.[Features](#features)
26
+
2.[Configuration](#configuration)
27
+
3.[Project Structure](#project-structure)
28
+
4.[Build the Project](#build-the-project)
29
+
5.[Test the Local MCP Server](#test-the-local-mcp-server)
30
30
6.[Test the Remote MCP Server](#test-the-remote-mcp-server)
31
31
7.[Inspect the MCP servers](#inspect-the-mcp-servers)
32
32
33
33
---
34
34
35
35
## Features
36
36
37
-
The project includes two alternative MCP servers:
37
+
The project includes two alternative MCP servers:
38
38
39
-
-**Local MCP server** (`src/server-local.ts`) — communicates with the MCP client via stdio transport.
40
-
-**Remote MCP server** (`src/server-remote.ts`) — communicates with the MCP client via MCP Streamable HTTP transport.
39
+
-**Local MCP server** (`src/server-local.ts`) — communicates with the MCP client via stdio transport.
40
+
-**Remote MCP server** (`src/server-remote.ts`) — communicates with the MCP client via MCP Streamable HTTP transport.
41
41
42
-
The servers dynamically discover MCP tools contained in the `tools` directory.
42
+
The servers dynamically discover MCP tools contained in the `tools` directory.
43
43
44
-
Each tool is defined and implemented in its own file. For example, the sample tool `tools/findProductById.ts` invokes an endpoint in Apache OFBiz to retrieve product information for a given product ID. This works with an out-of-the-box (OOTB) OFBiz instance with the `rest-api` plugin installed.
44
+
Each tool is defined and implemented in its own file. For example, the sample tool `tools/findProductById.ts` invokes an endpoint in Apache OFBiz to retrieve product information for a given product ID. This works with an out-of-the-box (OOTB) OFBiz instance with the `rest-api` plugin installed.
45
45
46
46
New tools can be published by simply including their definition files in the `tools` folder.
47
47
48
48
The remote server:
49
+
49
50
- is compliant with the latest MCP specifications (2025-06-18)
50
51
- supports authorization according to the MCP recommendations (OAuth Authorization Code Flow with support for Metadata discovery, Dynamic Client Registration, etc...)
51
-
- supports the token exchange OAuth flow in order to obtain a valid token for the backend system
52
+
- supports the token exchange OAuth flow in order to obtain a valid token for the backend system
52
53
- performs token validation with configurable scopes and audience verification
53
54
- supports TLS connections (https)
54
55
- provides rate limiting features to protect the MCP server and the backend server from denial of service attacks
@@ -58,38 +59,38 @@ The remote server:
58
59
59
60
## Configuration
60
61
61
-
Server configuration is managed via `config/config.json`, which defines:
62
+
Server configuration is managed via `config/config.json`, which defines:
62
63
63
64
-**`MCP_SERVER_BASE_URL`** — the base URL of the MCP server (Protected Resource Server in OAuth)
64
-
-**`SERVER_PORT`** — the port on which the MCP server listens for client connections (required only for the remote server)
65
-
-**`TLS_CERT_PATH`** — path to the file containing the certificate for TLS
66
-
-**`TLS_KEY_PATH`** — path to the file containing the private key for TLS
67
-
-**`TLS_KEY_PASSPHRASE`** — (optional) passphrase for the **`TLS_KEY_PATH`** file
68
-
-**`MCP_SERVER_CORS_ORIGINS`** — CORS origin allowed
65
+
-**`SERVER_PORT`** — the port on which the MCP server listens for client connections (required only for the remote server)
66
+
-**`TLS_CERT_PATH`** — path to the file containing the certificate for TLS
67
+
-**`TLS_KEY_PATH`** — path to the file containing the private key for TLS
68
+
-**`TLS_KEY_PASSPHRASE`** — (optional) passphrase for the **`TLS_KEY_PATH`** file
69
+
-**`MCP_SERVER_CORS_ORIGINS`** — CORS origin allowed
69
70
-**`RATE_LIMIT_WINDOW_MS`** — time window in ms for the requests rate limiting feature
70
-
-**`RATE_LIMIT_MAX_REQUESTS`** — max number of requests allowed in the time window
71
+
-**`RATE_LIMIT_MAX_REQUESTS`** — max number of requests allowed in the time window
71
72
-**`AUTHZ_SERVER_BASE_URL`** — the base URL of the Authorization (Authz) server (OAuth)
72
-
-**`SCOPES_SUPPORTED`** — the scopes that the MCP client can request
73
-
-**`BACKEND_API_BASE`** — the base URL for backend REST API calls
74
-
-**`MCP_SERVER_CLIENT_ID`** — Client ID required for token exchange, as registered in Authz server
75
-
-**`MCP_SERVER_CLIENT_SECRET`** — the secret associated with **`MCP_SERVER_CLIENT_ID`**
76
-
-**`BACKEND_API_AUDIENCE`** — the OAuth audience paramenter for the backend system
73
+
-**`SCOPES_SUPPORTED`** — the scopes that the MCP client can request
74
+
-**`BACKEND_API_BASE`** — the base URL for backend REST API calls
75
+
-**`MCP_SERVER_CLIENT_ID`** — Client ID required for token exchange, as registered in Authz server
76
+
-**`MCP_SERVER_CLIENT_SECRET`** — the secret associated with **`MCP_SERVER_CLIENT_ID`**
77
+
-**`BACKEND_API_AUDIENCE`** — the OAuth audience paramenter for the backend system
77
78
-**`BACKEND_API_RESOURCE`** — the OAuth resource parameter for the backend system
78
79
-**`TOKEN_EXCHANGE_SCOPE`** — the list of scopes requested in the token exchange
79
80
-**`BACKEND_API_AUTH`** - the URL to get the OFBiz APIs access token used if token exchange is not enabled
80
-
-**`BACKEND_AUTH_TOKEN`** — the token to authorize backend API calls used if token exchange is not enabled
81
+
-**`BACKEND_AUTH_TOKEN`** — the token to authorize backend API calls used if token exchange is not enabled
81
82
82
83
If both **`TLS_CERT_PATH`** and **`TLS_KEY_PATH`** are configured, the MCP server will operate over HTTPS; otherwise, it falls back to HTTP.
83
84
84
85
If either **`MCP_SERVER_BASE_URL`** or **`AUTHZ_SERVER_BASE_URL`** are not set, authorization is disabled and the MCP server is publicly accessible.
85
86
86
87
If authorization is enabled, but either **`MCP_SERVER_CLIENT_ID`** or **`MCP_SERVER_CLIENT_SECRET`** are not set, token exchange is disabled.
87
88
88
-
If token exchange is not enabled, the access token for the OFBiz API can be set **`BACKEND_AUTH_TOKEN`** and can be easily generated and set by running the script:
89
+
If token exchange is not enabled, the access token for the OFBiz API can be set **`BACKEND_AUTH_TOKEN`** and can be easily generated and set by running the script:
89
90
90
-
`update_token.sh <user> <password>`
91
+
`update_token.sh <user> <password>`
91
92
92
-
This script retrieves a JWT for an OOTB OFBiz instance, as specified by **`BACKEND_API_AUTH`** (e.g., `https://demo-stable.ofbiz.apache.org/rest/auth/token`).
93
+
This script retrieves a JWT for an OOTB OFBiz instance, as specified by **`BACKEND_API_AUTH`** (e.g., `https://demo-stable.ofbiz.apache.org/rest/auth/token`).
@@ -178,7 +186,9 @@ Add your local MCP server configuration:
178
186
You can use Anthropic’s **Inspector** to easily test interactions with the local and remote MCP servers. You can do this also when a remote server is executed in your local host or private network, without requiring valid certificates or deploying the server on a publicly accessible host.
179
187
180
188
Run (and install) the Inspector with:
189
+
181
190
```sh
182
191
npx @modelcontextprotocol/inspector
183
192
```
193
+
184
194
This will open a browser window ready to test your MCP servers.
0 commit comments