Your tools, exposed to every LLM. Via MCP.

01// mcp-server/tools/query-orders.ts (trimmed)02import { Server } from "@modelcontextprotocol/sdk/server/index.js";03import { z } from "zod";04import { db } from "@/lib/db";05 06const QueryOrdersInput = z.object({07  customer_id: z.string().describe("Customer ID to query orders for"),08  status: z.enum(["pending", "paid", "refunded", "all"]).default("all"),09  limit: z.number().int().min(1).max(100).default(20),10});11 12export function registerQueryOrdersTool(server: Server) {13  server.tool(14    "query_orders",15    "List orders for a given customer. Returns up to 100 rows. Read-only; scoped to the authenticated user's tenant.",16    QueryOrdersInput,17    async (input, ctx) => {18      const { tenant_id, user_id } = ctx.auth; // OAuth-scoped from bearer token19      const rows = await db.query.orders.findMany({20        where: {21          tenant_id,22          customer_id: input.customer_id,23          ...(input.status !== "all" && { status: input.status }),24        },25        limit: input.limit,26      });27 28      // Audit: every tool call is logged for later review29      await db.mcpAuditLog.create({30        tenant_id,31        user_id,32        tool: "query_orders",33        input,34        row_count: rows.length,35        timestamp: new Date(),36      });37 38      return { content: [{ type: "text", text: JSON.stringify(rows, null, 2) }] };39    },40  );41}