Images for
Claude,
on demand.

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { createClerkClient } from "@clerk/backend";

// Opaque token store — avoids exposing Clerk JWTs to Claude.ai
const tokenStore = new Map();

async function validateToken(req) {
  const token = req.headers["authorization"]?.slice(7);
  if (!token) return null;
  if (token === process.env.INSPECTOR_KEY) return { sub: "inspector" };
  const entry = tokenStore.get(token);
  if (!entry || Date.now() > entry.expiresAt) return null;
  return { sub: entry.sub };
}

// MCP tools — read-only, annotated
server.tool("search_images", "Search by purpose and tags...", {
  purpose: z.enum(["hero", "landing-page", "..."]).optional(),
  tags: z.array(z.string()).default([]),
  limit: z.number().default(10),
}, { title: "Search Images", readOnlyHint: true }, async ({ purpose, tags, limit }) => {
  let query = supabase.from("images").select("*").limit(limit);
  if (purpose) query = query.eq("purpose", purpose);
  if (tags.length) query = query.contains("tags", tags);
  const { data } = await query;
  return { content: [{ type: "text", text: formatResults(data) }] };
});

// Stateless StreamableHTTP — new server per POST request
if (req.method === "POST") {
  const transport = new StreamableHTTPServerTransport({
    sessionIdGenerator: undefined, // stateless
  });
  const mcpServer = createMcpServer();
  await mcpServer.connect(transport);
  await transport.handleRequest(req, res);
}