[aderaaij]

Using the coach meant a second install: uv, a second .env with a token pasted in, a process to keep alive and a second port to expose. The Docker quick start mentioned none of it. The MCP now runs inside the backend process and is served at /mcp on the API's own port, so wherever the dashboard is reachable the coach is too, with nothing to configure.

What changes

• Endpoint. backend/app/mcp_mount.py serves the MCP at /mcp and /mcp/. A request without a bearer token is a 401. MCP_ENABLED=false turns it off.
• Same data path. Embedded, the MCP still calls the API over HTTP (loopback) with the caller's own token, so auth, user scoping and consent filtering are unchanged.
• Package rename. mcp/app → mcp/training_mcp, because the backend process already owns app. This is most of the diff. Its import-time logging setup moved into main() so importing it doesn't reconfigure the host process.
• Dependencies. The MCP is a path dependency of the backend, so the image runs it from backend/uv.lock. fastmcp and the MCP SDK are held to the versions the MCP's own suite tests; unconstrained, the resolver also moved Starlette to 1.x under the API.
• Docs. The README's MCP section now leads with the built-in endpoint; running the MCP on its own is the optional path, with the uv prerequisite stated.

Worth reviewing

• Dispatched, not mounted. A Starlette mount only matches /mcp/..., so a POST to the bare /mcp fell through to the GET-only SPA catch-all and came back 405.
• The door checks only that a bearer token is present. The API verifies it on every call. A made-up token can open a session and list tool descriptions (the consent lookup fails open), but every data call fails.
• Two lockfiles. The pins in backend/pyproject.toml have to move together with mcp/uv.lock.

Checked

• Backend: 278 tests pass, 6 of them new (tests/test_mcp_mount.py). MCP: its 14 tests pass.
• Local demo stack from the built image: a real MCP client listed 40 tools and made tool calls at /mcp; a bogus token got "rejected" on every data call; the dashboard and SPA routes still load.
• On the home server, running this image: the same token returns the same 40 tools and 12 plans as the standalone MCP it replaces, and Claude Desktop works against the new address.

Upgrade note for standalone installs

uv run start is unaffected. An install that runs .venv/bin/start directly needs one uv sync after pulling.