mcp-api-key-auth

Purpose

Enable external MCP clients (Claude Code, Cursor, PicoClaw, DeepSeek Harness) to authenticate with the stock data service using independent API keys, and track per-tool usage (table name, record count) for monitoring.

When to Use

• User wants to create or manage MCP API keys
• User wants to configure an external MCP client to connect to this service
• User wants to view MCP tool usage statistics (which tools called, which tables queried, how many records)
• User needs to troubleshoot MCP authentication errors (401, invalid key, expired key)

Architecture

• API Key management is on the HTTP server (port 8000), protected by JWT login
• MCP protocol is on the MCP server (port 8001), protected by API key in request headers
• Usage tracking records are stored in ClickHouse mcp_tool_usage_log table

Workflow

1) Create an API Key

First login to get a JWT token, then create an API key:

# Login
JWT=$(curl -s -X POST http://<host>:8000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"yourpassword"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

# Create API key
curl -s -X POST http://<host>:8000/api/mcp-keys/create \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -d '{"key_name": "my-cursor-key", "expires_days": 90}'

The response contains the full API key (e.g., sk-a1b2c3d4...). Save it immediately — it is only shown once.

2) Configure MCP Client

Claude Code / Claude Desktop

Add to your MCP configuration (claude_desktop_config.json or project .mcp.json):

{
  "mcpServers": {
    "stock-data": {
      "url": "http://<host>:8001/messages",
      "transport": "streamable-http",
      "headers": {
        "Authorization": "Bearer sk-your-api-key-here"
      }
    }
  }
}

Cursor

In Cursor settings, add an MCP server with:

• URL: http://<host>:8001/messages
• Header: Authorization: Bearer sk-your-api-key-here