Add native authenticated MCP support to TrailBase

.cargo/config.toml

@@ -14,3 +14,8 @@
 
 [env]
 TS_RS_EXPORT_DIR = { value = "./crates/assets/js/bindings", relative = true }
+LIBCLANG_PATH = { value = "./.dev-tools/libclang-18/usr/lib/llvm-18/lib", relative = true }
+CLANG_PATH = { value = "./.dev-tools/libclang-18/usr/bin/clang-18", relative = true }
+PKG_CONFIG_PATH = { value = "./.dev-tools/geos/usr/lib/x86_64-linux-gnu/pkgconfig", relative = true }
+PKG_CONFIG_SYSROOT_DIR = { value = "./.dev-tools/geos", relative = true }
+PROTOC = { value = "./.cargo/protoc-wrapper.sh", relative = true }

.cargo/protoc-wrapper.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+REPO_ROOT=$(CDPATH= cd -- "${SCRIPT_DIR}/.." && pwd)
+PROTOBUF_DIR="${REPO_ROOT}/.dev-tools/protobuf"
+
+export LD_LIBRARY_PATH="${PROTOBUF_DIR}/usr/lib/x86_64-linux-gnu${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
+exec "${PROTOBUF_DIR}/usr/bin/protoc" \
+  -I"${PROTOBUF_DIR}/usr/include" \
+  "$@"

.gitignore

@@ -2,6 +2,11 @@
 target/
 node_modules/
 dist/
+.dev-tools/
+.venv*/
+.python-*/
+__pycache__/
+.pytest_cache/
 
 # Dart workspace artifacts
 .dart_tool

Cargo.toml

@@ -70,6 +70,7 @@ minijinja = { version = "2.1.2", default-features = false }
 parking_lot = { version = "0.12.3", default-features = false, features = ["send_guard", "arc_lock"] }
 rand = "^0.10.0"
 reqwest = { version = "0.13.1", default-features = false, features = ["rustls", "json"] }
+rmcp = { version = "3.1.2", features = ["transport-streamable-http-server"] }
 rusqlite = { version = "0.40.0", default-features = false, features = ["bundled", "cache", "column_decltype", "functions", "backup", "preupdate_hook"] }
 rust-embed = { version = "8.4.0", default-features = false, features = ["mime-guess"] }
 serde = { version = "^1.0.203", features = ["derive", "rc"] }

README.md

@@ -141,6 +141,20 @@ trail components add trailbase/auth_ui
 endpoints, e.g.
 [http://localhost:4000/\_/auth/login](http://localhost:4000/_/auth/login).
 
+## MCP
+
+This fork includes an optional native MCP server in the main TrailBase binary.
+It uses TrailBase administrator login through OAuth and runs on the same port as
+TrailBase—no sidecar container or copied bearer token is required.
+
+```sh
+trail --public-url https://trailbase.example.com run --mcp
+```
+
+Connect an OAuth-capable MCP client to
+`https://trailbase.example.com/mcp`. See the [MCP guide](mcp/README.md) for IDE,
+Docker, Portainer, reverse-proxy, authentication, and security configuration.
+
 ## Building
 
 If you have all the necessary build dependencies (Rust, node.js, geos,
@@ -162,6 +176,15 @@ pnpm install
 cargo build --bin trail
 ```
 
+On Debian/Ubuntu-style systems without sudo access to install build packages,
+this fork can populate the repo-local `.dev-tools/` cache used by
+`.cargo/config.toml`:
+
+```sh
+scripts/bootstrap-local-dev-tools.sh
+cargo check --workspace --all-targets
+```
+
 Alternatively, if you want to build a Docker image or don't want to deal with
 build dependencies, you can simply run:
 

crates/cli/src/args.rs

@@ -131,6 +131,10 @@ pub struct ServerArgs {
   #[arg(long)]
   pub demo: bool,
 
+  /// Enable the authenticated MCP endpoint at /mcp on the admin server.
+  #[arg(long, env, default_value_t = false)]
+  pub mcp: bool,
+
   #[arg(long, default_value_t = false)]
   pub stderr_logging: bool,
 

crates/cli/src/bin/trail.rs

@@ -93,6 +93,7 @@ async fn async_main(
           tls_key: None,
           tls_cert: None,
           custom_router: None,
+          enable_mcp: cmd.mcp,
         },
       )
       .await?;

crates/core/Cargo.toml

@@ -81,6 +81,7 @@ quick_cache = "0.7.0"
 rand = { workspace = true }
 regex = "1.11.0"
 reqwest = { workspace = true }
+rmcp = { workspace = true }
 rusqlite = { workspace = true }
 rust-embed = { workspace = true }
 serde = { workspace = true }

crates/core/src/auth/api/login.rs

@@ -356,7 +356,7 @@ pub(crate) async fn build_auth_token_flow_response(
 ///
 /// An example using the two-step "authentication code flow" with PKCE can be found in
 /// `/examples/blog/flutter`.
-async fn build_authorization_code_flow_and_pkce_response(
+pub(crate) async fn build_authorization_code_flow_and_pkce_response(
   state: &AppState,
   db_user: &DbUser,
   redirect: String,

crates/core/src/auth/api/mod.rs

@@ -3,15 +3,15 @@ pub(super) mod change_email;
 pub(super) mod change_password;
 pub(super) mod change_username;
 pub(super) mod delete;
-pub(super) mod login;
+pub(crate) mod login;
 pub(super) mod login_anonymous;
 pub(super) mod logout;
 pub(super) mod otp;
 pub(super) mod promote_anonymous;
-pub(super) mod refresh;
+pub(crate) mod refresh;
 pub(super) mod register;
 pub(super) mod reset_password;
 pub(super) mod status;
-pub(super) mod token;
+pub(crate) mod token;
 pub(super) mod totp;
 pub(super) mod verify_email;

crates/core/src/auth/jwt.rs

@@ -311,6 +311,17 @@ impl JwtHelper {
       .map(|data| data.claims);
   }
 
+  pub(crate) fn decode_with_audience<T: DeserializeOwned + Clone>(
+    &self,
+    token: &str,
+    audience: &str,
+  ) -> Result<T, JwtError> {
+    let mut validation = self.validation.clone();
+    validation.set_audience(&[audience]);
+    return jsonwebtoken::decode::<T>(token, &self.decoding_key, &validation)
+      .map(|data| data.claims);
+  }
+
   pub fn encode<T: Serialize>(&self, claims: &T) -> Result<String, JwtError> {
     return jsonwebtoken::encode::<T>(&self.header, claims, &self.encoding_key);
   }

crates/core/src/lib.rs

@@ -23,6 +23,7 @@ mod encryption;
 mod extract;
 mod init_error;
 mod listing;
+mod mcp;
 mod migrations;
 mod scheduler;
 mod schema_metadata;