Precogly MCP

MCP server for Precogly threat modeling.

Status

Early. One tool, read-only:

• list_threat_models — threat models in the caller's organizations, most recently updated first. Returns the first page of twenty and cannot page past it.

Authentication is not finished. The server forwards a bearer token it does not own and never mints; today that token is a Precogly access token with a 60-minute lifetime, which is fine for development and cannot drive anything unattended. 0003 records what replaces it and why.

Configuration

Two environment variables, both read by the server process:

PRECOGLY_TOKEN	Bearer token for the Precogly API. Required.
PRECOGLY_URL	Base URL of the deployment. Defaults to http://localhost:8000.

Against a locally seeded instance, a token comes from the login endpoint:

export PRECOGLY_URL=http://localhost:8000
export PRECOGLY_TOKEN=$(curl -s -X POST "$PRECOGLY_URL/api/auth/login/" \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@precogly.dev","password":"admin123"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access'])")

Running it

The server speaks stdio. Either entry point works:

uv run precogly-mcp                  # console script
uv run python -m precogly_mcp.server # equivalent

Under the MCP Inspector, for poking at schemas by hand. --with-editable . is required — mcp dev runs the file in an ephemeral environment containing only mcp, so without it nothing in this package imports:

uv run mcp dev src/precogly_mcp/server.py --with-editable .

Connecting a client

Any MCP client that can launch a local stdio server. For opencode, an opencode.json in the project root, with the token interpolated rather than written in:

{
  "mcp": {
    "precogly": {
      "type": "local",
      "command": ["uv", "run", "python", "-m", "precogly_mcp.server"],
      "enabled": true,
      "environment": {
        "PRECOGLY_TOKEN": "{env:PRECOGLY_TOKEN}",
        "PRECOGLY_URL": "{env:PRECOGLY_URL}"
      }
    }
  }
}

Development

This project uses uv for dependencies and tooling.

uv sync                    # create .venv and install deps + dev tools
uv run pytest              # run tests
uv run ruff check .        # lint
uv run ruff format .       # format
uv run mypy src            # type-check (strict)
uv run pip-audit           # scan dependencies for CVEs

Install the git hooks once:

uv run pre-commit install

Tests need no running Precogly. mcp.client.Client drives the server over in-memory streams, so tools/list and tools/call are exercised as a client sees them, and httpx2.MockTransport stands in for the API.

Design

• 0001 — service token model (partially superseded by 0003)
• 0002 — tool implementation order
• 0003 — Precogly is the authorization server
• 0004 — where the user authorizes