MCP

MCP exposes selected tRPC procedures as tools for IDE agents (Cursor, Claude Desktop, etc.). It shares the same router as REST and tRPC but uses the MCP transport at /api/mcp.

For HTTP integrations and typed clients, use REST and the SDK instead.

Endpoints

Surface	URL
MCP	`/api/mcp`
OAuth discovery	`/.well-known/oauth-protected-resource`
tRPC (first-party)	`/api/trpc`
REST	`/api/rest`
OpenAPI spec	`/api/openapi.json`

Handler: apps/web/src/app/api/[transport]/route.ts (via trpc-to-mcp).

Cursor configuration

{
  "mcpServers": {
    "zts": {
      "url": "http://localhost:3000/api/mcp"
    }
  }
}

For staging or production, replace the host with your deployed URL (e.g. https://zts-monorepo.server.kitze.io/api/mcp).

Authentication

Create an API key in the app (zts_ prefix via Better Auth’s API key plugin).
MCP clients discover OAuth via /.well-known/oauth-protected-resource (routes under apps/web/src/app/.well-known/).
Tool calls use the issued OAuth token or API key.

Better Auth’s MCP plugin (packages/auth) and OAuth helpers under apps/web/src/server/mcp/ back this flow.

After pulling schema changes for API key / MCP OAuth tables, run pnpm db:migrate.

Exposed tools (today)

Only procedures with apiExposure() in packages/trpc/src/openapi-meta.ts become MCP tools.

MCP tool	REST path	tRPC procedure
`get_current_user`	`POST /users/me`	`user.getCurrentUser`
`get_user_for_editing_profile`	`POST /users/me/edit`	`user.getUserForEditingProfile`
`mark_user_onboarded`	`POST /users/me/onboarded`	`user.markUserAsOnboarded`
`reset_user_onboarding`	`POST /users/me/onboarding/reset`	`user.resetUserOnboarding`
`update_user_profile`	`PATCH /users/me`	`user.updateProfile`
`get_user_preferences`	`POST /users/preferences`	`user.getPreferences`
`get_user_preference`	`POST /users/preferences/get`	`user.getSinglePreference`
`update_user_preference`	`PATCH /users/preferences`	`user.updatePreference`
`delete_upload_image`	`DELETE /images/{id}`	`utImage.delete`

Not exposed: admin.*, auth.changePassword, polar.*, and any procedure without apiExposure().

Adding a new MCP tool

Implement the procedure in packages/trpc/src/routers/.
Tag it with apiExposure() — the mcpName becomes the tool name:

import { z } from "zod";
import { apiExposure, emptyInput } from "../openapi-meta";
 
export const myProcedure = protectedProcedure
  .meta(
    apiExposure({
      description: "What this tool does",
      mcpName: "my_tool_name",
      path: "/my-resource",
      summary: "Short label",
      tags: ["MyTag"],
    })
  )
  .input(emptyInput)
  .output(z.any())
  .query(async ({ ctx }) => {
    // ...
  });

Use Zod v4 for inputs (emptyInput for no-body POSTs).
Regenerate OpenAPI and SDK:

pnpm --filter @zts/trpc run generate:openapi
pnpm sdk:build

The same change automatically updates REST, OpenAPI, SDK, and MCP — no separate MCP registration step.

MCP vs in-app AI agent

These are different surfaces:

	MCP (`/api/mcp`)	In-app chat agent
Purpose	External IDE / automation tools	Product chat UI at `/chat`
Auth	API key / MCP OAuth	Session cookie
Tools	`apiExposure()` tRPC procedures	Built-in tools + optional tRPC-as-tools
Docs	This page	AI overview

See Agents for the ToolLoopAgent used inside the web chat route.

REST API — same procedures, HTTP transport
SDK — generated REST client
Better Auth — API keys and MCP OAuth plugin
Product repo: docs/MCP_SETUP.md

MCP