ROAST MCP App

Skybridge MCP / ChatGPT app for authenticated ROAST users.

The app exposes a protected /mcp endpoint, maps the OAuth identity to a ROAST user_firebase_id, and calls the existing ROAST backend with a server-side backend bearer token. Tool inputs never accept user_firebase_id; user scope is always derived from auth.

Current Tools

• show_roast_dashboard: dashboard view with account summary, recent profiles, photoshoots, and images.
• list_my_profiles: recent profile reviews for the authenticated user.
• list_my_photoshoots: recent photoshoots for the authenticated user.
• list_my_images: recent visible images for the authenticated user.

Setup

Requires Node.js 24+.

npm install
cp .env.example .env
npm run dev

Skybridge runs the MCP endpoint at http://localhost:3000/mcp and DevTools at http://localhost:3000.

Auth Modes

Production: Auth0

Use ROAST_MCP_AUTH_MODE=auth0.

The access token is verified against Auth0 JWKS, then mapped to ROAST in this order:

1. ROAST_USER_ID_CLAIM, defaulting to https://roast.dating/user_firebase_id.
2. Authenticated email lookup through GET /users?email=....

Required Auth0 scopes default to openid profile email.

Local: Dev Token

Use ROAST_MCP_AUTH_MODE=dev with:

ROAST_MCP_DEV_TOKEN=dev-roast-token
ROAST_MCP_DEV_USER_FIREBASE_ID=<existing-roast-user-firebase-id>

Then connect with:

Authorization: Bearer dev-roast-token

Environment

See .env.example.

Important variables:

• SERVER_URL: public Skybridge server URL.
• APP_DOMAIN: public domain for rendered views.
• ROAST_API_BASE_URL: ROAST backend API base URL.
• ROAST_API_BEARER_TOKEN: backend-to-backend token accepted by ROAST.
• AUTH0_DOMAIN: Auth0 tenant domain.
• AUTH0_AUDIENCE: Auth0 API audience used for MCP access tokens.

Verify

npm run build