Production MCP servers, shipped.

from mcp.server.fastmcp import FastMCP
from mcp.server.auth.settings import AuthSettings
from .auth import BQTokenVerifier, scoped_bq_client

# A read-only window into the campaigns warehouse, served over HTTP.
mcp = FastMCP(
    "campaigns",
    token_verifier=BQTokenVerifier(),  # validates the caller's OAuth token
    auth=AuthSettings(
        issuer_url="https://auth.acme.corp",
        resource_server_url="https://mcp.acme.corp/mcp",
        required_scopes=["bq:read"],
    ),
)

@mcp.tool()
async def top_creatives(account_id: str, window: str = "7d"):
    """Return the top 10 creatives by ROAS over a window."""
    async with scoped_bq_client() as bq:  # scoped to the signed-in user
        rows = await bq.run(QUERY_TOP_CREATIVES, account_id, window)
    return render(rows)

mcp.run(transport="streamable-http")

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
import { z } from "zod";
import { scopedBQ, verifier } from "./auth.js";

const server = new McpServer({ name: "campaigns", version: "1.5.0" });

server.registerTool("top_creatives", {
  description: "Top 10 creatives by ROAS",
  inputSchema: { accountId: z.string(), window: z.string().default("7d") },
}, async ({ accountId, window }, { authInfo }) => {
  const bq = await scopedBQ(authInfo);  // per-user, not a service account
  const rows = await bq.run(Q_TOP, accountId, window);
  return { content: [{ type: "text", text: render(rows) }] };
});

// Every /mcp request carries a valid OAuth bearer token — or gets a 401
app.post("/mcp", requireBearerAuth({ verifier, requiredScopes: ["bq:read"] }),
  (req, res) => transport.handleRequest(req, res, req.body));

// .mcp.json — point any MCP client at the server.
// OAuth is discovered automatically (RFC 9728) — the client
// opens a browser, the user signs in, tokens stay per-user.
{
  "mcpServers": {
    "campaigns": {
      "type": "http",
      "url": "https://mcp.acme.corp/mcp"
    }
  }
}

// or from the terminal:
// $ claude mcp add --transport http campaigns https://mcp.acme.corp/mcp