{
  "markdown": "# CDT Express MCP Server\n\nInteract with climate metrics through Riskthinking.AI's CDT Express API in\nsupported AI chat experiences.\n\nThis project contains:\n\n- The core MCP server for the Riskthinking.AI CDT Express API.\n- A remote Streamable HTTP server that users can connect to by URL and\n  authorize with their VELO account.\n- A distributable MCPB extension for Claude Desktop, published through\n  [GitHub releases](https://github.com/RiskThinking/cdt-express-mcp/releases).\n\n## Remote MCP\n\nAdd this URL as a custom MCP server in a compatible AI app:\n\n```text\nhttps://mcp.riskthinking.ai/mcp\n```\n\nThe app opens VELO for sign-in or sign-up. After consent, authorization\ncompletes automatically: the CDT API key is provided to the MCP server through\na server-to-server backchannel and is never shown to the AI app, browser URL,\nor MCP logs.\n\n- **ChatGPT:** enable Developer mode, create a custom app, and enter the URL.\n- **Claude web/desktop:** add a custom connector using the URL.\n- **Gemini:** eligible Gemini Spark users can add a custom app using the URL.\n  Gemini CLI can also connect to it as a Streamable HTTP MCP server.\n\nSee the [remote MCP live-testing guide](docs/remote-mcp-live-testing.md) for\ncurrent platform requirements, setup steps, and acceptance checks.\n\nThe existing MCPB/stdio package remains available for local-only use.\n\n### Run the remote server\n\n```bash\ncp .env.example .env\n# Set MCP_OAUTH_SECRET in .env to the output of: openssl rand -base64 48\nnpm ci\nnpm run build\nnpm run start:http\n```\n\nAlternatively, build and run the included `Dockerfile`. Production requires\nHTTPS at `MCP_PUBLIC_BASE_URL`. The [Cloud Run disaster-recovery\nguide](docs/cloud-run-deployment.md) covers WIF/IAM provisioning, GitHub\nconfiguration, and Cloudflare DNS. Configure the `visual-eyes` deployment with\n`CDT_MCP_URL=https://mcp.riskthinking.ai/mcp` so its `/mcp/authorize` route can\ncomplete the authenticated hand-off.\n\nThe HTTP server provides:\n\n- Streamable HTTP at `/mcp`, with JSON responses for broad client\n  compatibility.\n- OAuth protected-resource and authorization-server discovery.\n- OAuth 2.1 authorization code flow with S256 PKCE and RFC 8707 resource\n  binding.\n- Client ID Metadata Documents (CIMD) for any standards-compliant HTTPS client,\n  with public-IP-pinned fetching, redirect rejection, strict size/time limits,\n  and dynamic client registration for backward compatibility.\n- One-hour encrypted access tokens and 30-day encrypted refresh tokens, with\n  no credential database required.\n- Exact callback validation against each client's registered or fetched\n  metadata, bearer checks on every MCP request, per-authorization session\n  binding, host/origin validation, and bounded request bodies.\n\n`MCP_OAUTH_SECRET` is the only durable secret and must be shared by all remote\nMCP instances. Rotating it invalidates existing client registrations and\ntokens. The current TypeScript SDK negotiates MCP through `2025-11-25`, which\nthe major hosted clients currently use. The endpoint is structured for the\nstateless `2026-07-28` transport and can switch when the stable TypeScript SDK\nexposes that protocol revision.\n\n## MCPB Extension Installation\n\n1. Download and install\n   [Claude Desktop](https://claude.ai/download).\n2. Download `cdt-express.mcpb` from the\n   [GitHub releases](https://github.com/RiskThinking/cdt-express-mcp/releases)\n   page.\n3. In Claude Desktop, open **Settings > Extensions > Advanced settings**.\n4. Select **Install Extension** and choose the downloaded MCPB file.\n5. When prompted, enter the CDT Express API key from\n   [VELO](https://velo.riskthinking.ai/cdt-express).\n6. Review and enable the extension, then close the preview.\n7. On its first tool call, select **Allow once** or **Always allow**. Tool\n   permissions can also be configured under **Settings > Extensions**.\n\nTo update the extension, install the newer MCPB file and select **Update**.\n\n## Roadmap\n\nCDT Express Climate API:\n\n- [x] Since `v0.1.0`:\n  [Climate exposure metrics](https://api.riskthinking.ai/v4/climate/metrics/exposure)\n- [x] Since `v0.2.0`:\n  [Climate impact metrics](https://api.riskthinking.ai/v4/climate/metrics/impact)\n- [x] Since `v0.2.0`:\n  [Probability-adjusted impact](https://api.riskthinking.ai/v4/climate/metrics/probability_adjusted_impact)\n- [x] Since `v0.2.0`:\n  [Climate exposure distribution](https://api.riskthinking.ai/v4/climate/distribution/exposure)\n- [x] Since `v0.2.0`:\n  [Climate impact distribution](https://api.riskthinking.ai/v4/climate/distribution/impact)\n\nOther CDT Express APIs:\n\n- [x] Since `v0.3.0`:\n  [Physical Assets API](https://api.docs.riskthinking.ai/#tag/Assets)\n- [x] Since `v0.3.0`:\n  [Companies API](https://api.docs.riskthinking.ai/#tag/Companies)\n- [x] Since `v0.3.0`:\n  [Markets API](https://api.docs.riskthinking.ai/#tag/Markets)\n\nIntegration:\n\n- [x] Since `v0.1.0`: stdio transport for local MCP connectivity, including\n  the Claude Desktop extension and IDEs such as Cursor.\n- [x] Since `v0.6.0`: authenticated Streamable HTTP transport for remote MCP\n  connectivity to web AI chat experiences.\n\n## Development\n\n- Optionally use [nvm](https://github.com/nvm-sh/nvm) with `nvm use` to select\n  the Node.js version in `.nvmrc`.\n- Install dependencies with `npm install`.\n- Build and package the extension with `npm run pack`. The resulting\n  `cdt-express.mcpb` file is written to the repository root. The command bundles\n  only the local stdio server into an isolated staging directory, leaving the\n  remote HTTP/OAuth server and its dependencies out of the extension.\n- Run the remote OAuth and MCP integration tests with `npm test`.\n\n## Release\n\n1. Run `npm run bump:version -- <version>`. The command treats `package.json`\n   as the source of truth and synchronizes the lockfile, `server.json`,\n   `manifest.json`, and the runtime `SERVER_VERSION` constant. It does not\n   create a Git tag; the GitHub release does that after the change is merged.\n2. Create a GitHub release and tag using the version with a `v` prefix, such as\n   `v0.5.2`, from the\n   [new release page](https://github.com/RiskThinking/cdt-express-mcp/releases/new).\n3. The release workflow validates the versions, builds the MCPB extension, and\n   publishes it to the MCP Registry.\n\n### MCP Registry `server.json`\n\nThe checked-in file is a valid remote-only server definition. The release\nworkflow calculates the MCPB hash and download URL, adds the complete\n`packages[0]` record, validates the result, and publishes both installation\noptions together. See the [MCP Registry documentation](https://github.com/modelcontextprotocol/registry)\nfor the current publishing process.\n\n### MCPB `manifest.json`\n\n`npm run pack` synchronizes the staged manifest version from `package.json`\nwithout modifying the checked-in `manifest.json`. See the\n[MCPB manifest specification](https://github.com/modelcontextprotocol/mcpb/blob/main/MANIFEST.md)\nfor current requirements.\n",
  "bytes": 6924,
  "sha": "fbe73f8e43210dace9ded14de64c1b63374489f3edb00c8975767fde96050990",
  "repo_slug": "riskthinking/cdt-express-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_riskthinking_cdt_express_mcp_ac2f801b/readme"
}