# Handoff

## State
Wired up `wfdash-mcp` in `.mcp.json` pointing at `https://wfdash.apphub.co.za/api/mcp` with the user-provided `AGENT_API_KEY` (Bearer auth — matches `assertAgentAuth` in `src/lib/server/agent-auth.ts`). Verified `tools/list` returns 200 with the full catalog. `.mcp.json` is gitignored, so the key is safe.

## Next
1. User restarts Claude Code so the new MCP server actually loads (new `.mcp.json` entries only take effect at session start).
2. User has "a couple of things" they want to try via MCP — none attempted yet. They prefer MCP over direct API calls because their Hermes agent keeps losing API keys.
3. If any requested action isn't covered by existing tools in `src/app/api/mcp/route.ts`, register new tool handlers there.

## Context
- New MCP tools are added in `src/app/api/mcp/route.ts` (~3100 lines, JSON-RPC style, ~50+ tools already registered). `jsonRpcOk` helper centralises the response envelope.
- Auth gate is `AGENT_API_KEY` env var compared against `Authorization: Bearer <key>` — exact string match, no hashing.
- CORS is wide-open by design (per route comment) — Origin is not the gate, the key is.
- User uses Hermes agents in n8n that hit this MCP — they previously had issues with API keys getting dropped, hence the MCP preference.