feat(mcp): add get_api_key tool

Merged
SW
5mo ago
+128-0

Summary

New MCP tool: `get_api_key`. Returns the bearer token the caller authenticated this MCP connection with, so an LLM can use it for direct HTTP requests (x-api-key header) to api.recoupable.com endpoints.

Why

MCP Bearer headers are opaque to the LLM by design — that's the security model. But skills that call our REST API directly (the `recoup-api` skill, etc.) need an actual API key value to put in their requests. Today, without this tool, MCP-stored credentials can't be reused by direct-HTTP skills.

This unblocks the prototype where a customer configures MCP once with their long-lived API key (or eventually, an OAuth-issued short-lived one), and every skill in the session can fetch the credential and use it without the customer also pasting it into Global Instructions.

What's in this PR

  • `lib/mcp/tools/registerGetApiKeyTool.ts` — new tool. Reads `extra.authInfo.token`, returns `{api_key: }`. Errors cleanly when authInfo or token is missing.
  • `lib/mcp/tools/index.ts` — register it alongside the other no-domain tools.
  • `lib/mcp/tools/tests/registerGetApiKeyTool.test.ts` — 4 tests: registration shape, success path, missing authInfo, empty token edge case. All pass.

What's intentionally not in this PR (v1+ scope)

  • `expires_at` column on `account_api_keys` for short-lived keys.
  • Minting fresh short-lived keys per-call (today this just returns the long-lived key verbatim).
  • Rate limiting on `get_api_key` calls.
  • OAuth on the MCP server (separate, larger workstream).

This is the smallest possible v0 to validate that the LLM → MCP → token → direct-HTTP round-trip works at all. If the prototype passes the directional test ("fresh Cowork conversation, MCP-only auth, recoup-api skill can list orgs"), the v1 expansions follow.

Test plan

  • `pnpm test lib/mcp/tools/tests/registerGetApiKeyTool.test.ts` — 4 passing locally
  • `pnpm lint:check` clean on changed files
  • After deploy: from Cowork with the Recoup MCP configured, run `get_api_key` directly via MCP tool call. Confirm it returns the API key value used to authenticate the connection.
  • After deploy: with recoup-api skill updated (separate PR on `recoup-platform-plugin`), confirm a skill-driven HTTP call to `/api/accounts/id` succeeds using the MCP-issued credential.

🤖 Generated with Claude Code

Summary by cubic

Adds the get_api_key MCP tool to expose the session’s API key so skills can call api.recoupable.com with an x-api-key or Bearer header. Enables direct HTTP skills when MCP is the only auth.

  • New Features
    • Added get_api_key: reads extra.authInfo.token, returns { api_key }; errors when missing or empty.
    • Tool description links to docs at https://developers.recoupable.com and /llms.txt for endpoint lookup.
    • Registered in lib/mcp/tools/index.ts.
    • Tests cover registration, success, missing auth, and empty token.

Summary by CodeRabbit

Release Notes

  • New Features
    • Added a new API key retrieval tool. Authenticated users can now obtain their API key for use in direct API requests.

Review Change Stack