Node MCP

{
  "query": "running shoes",
  "taskContext": {
    "size": "10",
    "width": "wide",
    "budget": { "currency": "USD", "max": 140 },
    "excludedColors": ["neon"]
  }
}

{
  "receivedContext": { "size": "10", "width": "wide", "budget": { "currency": "USD", "max": 140 }, "excludedColors": ["neon"] },
  "appliedContext": { "size": "10", "width": "wide", "budget": { "currency": "USD", "max": 140 }, "excludedColors": ["neon"] },
  "rejectedContext": [],
  "dataUse": {
    "scope": "current_request",
    "savedToProfile": false,
    "assistantMemoryImported": false
  }
}

import { epode } from "@epode/node/mcp";

const customer = epode({
  apiKey: process.env.EPODE_API_KEY,
  includeTools: ["search_stays"],
  purpose: "product_personalization",
  identify: (_args, context) => ({
    accountRef: context.http?.authInfo?.extra?.accountId,
    userRef: context.http?.authInfo?.extra?.userId,
  }),
  sessionRef: context => context.http?.authInfo?.extra?.journeyId,
  runtimeHint: context => context.http?.authInfo?.extra?.runtimeHint,
});

customer.instrument(server);

mkdir -p .epode/artifacts &&
curl -fsSL https://app.tryintents.com/static/agent-feedback-node-0.5.28.tgz \
  -o .epode/artifacts/agent-feedback-node-0.5.28.tgz &&
printf '%s  %s\n' \
  'e2ccd7cc89de56876f3f0add02d7c9ee9311993d7d8bef9ddfd8f9416b3109b4' \
  '.epode/artifacts/agent-feedback-node-0.5.28.tgz' | shasum -a 256 -c - &&
npm install ./.epode/artifacts/agent-feedback-node-0.5.28.tgz &&
npm install @modelcontextprotocol/server @modelcontextprotocol/node @modelcontextprotocol/express zod

import {
  createMcpInstrumentation,
  type McpInstrumentationContext,
} from "@epode/node/mcp";
import {
  createMcpExpressApp,
  requireBearerAuth,
} from "@modelcontextprotocol/express";
import { toNodeHandler } from "@modelcontextprotocol/node";
import { createMcpHandler, McpServer } from "@modelcontextprotocol/server";
import { z } from "zod";
import { productTokenVerifier } from "./product-auth.js";

// [] rejects browser Origin requests. Add only trusted browser client origins.
const app = createMcpExpressApp({ host: "0.0.0.0", allowedOrigins: [] });

// Adapt your existing signature/introspection verifier. It must authorize the
// selected tenant and put only verified/product-owned context in authInfo.extra.
app.use("/mcp", requireBearerAuth({
  verifier: productTokenVerifier,
  requiredScopes: ["mcp"],
}));

function verifiedField(context: McpInstrumentationContext, key: string) {
  const value = context.http?.authInfo?.extra?.[key];
  return typeof value === "string" && value.length > 0 ? value : undefined;
}

// Use durable product storage in production. Typed fields carry candidates;
// this account-scoped lookup supplies the ownership proof.
const journeyRegistry = productJourneyRegistry();
function resolveJourney(args, context, result) {
  const accountId = verifiedField(context, "accountId");
  const candidate = result?.structuredContent?.journeyId ?? args?.journeyId;
  return journeyRegistry.resolve(accountId, candidate);
}

const feedback = createMcpInstrumentation({
  apiKey: process.env.AGENT_FEEDBACK_KEY,
  includeTools: ["search", "fetch_result"],
  feedbackTools: ["fetch_result"],
  accountRef: (_args, context) => verifiedField(context, "accountId"),
  userRef: (_args, context) => verifiedField(context, "userId"),
  anonymousRef: (_args, context) => verifiedField(context, "visitorId"),
  customerRef: (_args, context) => verifiedField(context, "accountId"), // durable Ask once compatibility
  sessionRef: (args, context, result) => resolveJourney(args, context, result),
});

const feedbackInstructions =
  'After each selected product tool call, find _agentFeedback in structuredContent or in a standalone JSON content block. Finish the product task first. For consent_required, show the product answer, ask the exact returned question once, and wait for the user\'s next turn; record only an explicit standalone Yes or No. For feedback_ready, call report_product_feedback exactly once. For feedback_disabled, do nothing unless the user explicitly asks to change permission. Keep successful background reporting out of the final answer.';

function productServer() {
  const server = new McpServer(
    { name: "your-product", version: "1.0.0" },
    { instructions: feedbackInstructions },
  );

  feedback.instrument(server);

  server.registerTool("search", {
    description: "Search the product",
    inputSchema: z.object({ query: z.string() }),
  }, async ({ query }) => ({
    content: [{ type: "text", text: await search(query) }],
  }));

  return server;
}

const mcp = createMcpHandler(productServer, {
  legacy: "stateless",
  responseMode: "json",
});
const handleMcp = toNodeHandler(mcp);

app.all("/mcp", (req, res) => handleMcp(req, res, req.body));
app.listen(Number(process.env.PORT || 3000), "0.0.0.0");

const feedback = createMcpInstrumentation({
  apiKey: process.env.AGENT_FEEDBACK_KEY,
  includeTools: ["browser_*"],
  feedbackTools: ["browser_close"],
  accountRef: (_args, context) => verifiedField(context, "accountId"),
  customerRef: (_args, context) => verifiedField(context, "accountId"),
  sessionRef: (args, context, result) => resolveJourney(args, context, result),
});