CoolFace
Apppublic

lovelymango/hwpxkit-mcp-remote

sourceHugging Faceupdated 2h agoView on Hugging Face
0likes
App README

hwpxkit-mcp-remote

Remote MCP editing service for HWPX documents (experimental v0).

  • —Endpoints: POST /mcp, POST /mcp-claude, GET /.well-known/oauth-protected-resource, and the webapp bridge at GET /oauth/consent.
  • —MCP endpoints accept the fixed bearer fallback or a Supabase-issued OAuth access token.
  • —Supabase-authenticated remote sessions keep document generations in private, expiring object storage; the service hydrates bytes only while an operation runs and does not log document content. The fixed bearer fallback keeps the legacy in-process session path.

Required Space secrets

  • —MCP_AUTH_TOKEN — Bearer token; the server refuses to start without it.
  • —PUBLIC_BASE_URL — this Space's public URL (e.g. https://<user>-<space>.hf.space), used for expiring download URLs.
  • —OPENAI_APPS_CHALLENGE — optional; ChatGPT Apps domain challenge value.
  • —SUPABASE_URL and SUPABASE_JWT_AUDIENCE — optional together; enable OAuth discovery and JWT verification. Measure the real token audience before enabling this mode: a wrong value rejects every caller.
  • —SUPABASE_PUBLISHABLE_KEY — no longer consumed by the MCP engine; the consent UI uses the webapp runtime's own Supabase client.
  • —WEBAPP_EPHEMERAL_OBJECT_BASE_URL — required when Supabase authentication is enabled; the separate HTTPS webapp origin that issues owner-bound upload/download capabilities and serves OAuth consent. It must differ from PUBLIC_BASE_URL.
  • —WEBAPP_PUBLIC_ORIGIN — optional; the public HTTPS webapp origin (no path) used in Claude-channel upload links and the direct_upload.issue_url returned by start_document_upload. When set, its origin must equal WEBAPP_EPHEMERAL_OBJECT_BASE_URL's origin or startup fails. Defaults to https://hwpxkit.jhlim.dev.
  • —MCP_TOOL_OUTCOME_INGEST_URL — optional HTTPS endpoint for aggregate MCP tool-outcome telemetry. If this and MCP_TOOL_OUTCOME_INGEST_SECRET are both absent, the service sends no outcome records (fail-closed). Only aggregate outcomes are sent; user identifiers are not sent.
  • —MCP_TOOL_OUTCOME_INGEST_SECRET — optional service secret for the outcome endpoint; it is a service credential, not a user token. If either outcome setting is absent, no outcome records are sent.
  • —MCP_REQUIRED_SCOPES — optional ASCII-space-delimited OAuth scope-token list. The default is the empty set; configure a measured baseline to make OAuth grant tokens missing that baseline fail with HTTP 403 insufficient_scope.

Platform-provided memory observation (provided by the platform — do not configure)

  • —MEMORY is injected by the platform runtime. We do not set or configure it; setting it yourself would make the observation misleading.
  • —The service does not change its behavior from this value. It is recorded only in the startup log as a memory observation.

Optional runtime configuration

  • —PORT — process listen port.
  • —SERVICE_VERSION — automatically baked from the staged repository state and reported by the service.
  • —STATUS_ALLOWED_ORIGIN — allowed origin for public status responses.

Optional resource-limit overrides (defaults built in)

  • —SESSION_TTL_MS (absolute lifetime, measured from open; never refreshed by activity)
  • —SESSION_IDLE_TTL_MS (default 30 minutes; refreshed on every successful session access. A session expires at whichever of the two deadlines comes first.)
  • —MAX_FILE_BYTES
  • —MAX_TARGETS
  • —MAX_CONCURRENT_SESSIONS
  • —MAX_CONCURRENT_SESSIONS_PER_PRINCIPAL (defaults to half of MAX_CONCURRENT_SESSIONS, minimum 1)
  • —MAX_RETAINED_SESSION_BYTES
  • —MAX_RETAINED_SESSION_BYTES_PER_PRINCIPAL
  • —MAX_EDITS_PER_BATCH (default 64)
  • —MAX_STRUCTURAL_EDITS_PER_SESSION (default 200)
  • —MAX_DOWNLOAD_ARTIFACTS_PER_SESSION (default 16)
  • —MAX_ROLLBACK_ENTRIES_PER_SESSION (default 16)

Optional period rate-limit

  • —RATE_LIMIT_WINDOW_MS and RATE_LIMIT_MAX_CALLS are optional overrides. The period call rate-limit is enabled by default: when both are absent the service derives its window and call ceiling from the effective values it already holds. Set them together to override those defaults; the service refuses to start if only one is set.

Apache-2.0. Source of truth lives in a private monorepo; this Space contains the minimal package subset needed to run the service (tests and fixtures excluded).