Metadata-Version: 2.3
Name: trinity-entra-mcp
Version: 0.1.0
Summary: MCP client for Trinity: signs in with your Microsoft work account and forwards tool calls to the hosted knowledge base
Author: Chase Derr
Author-email: Chase Derr <chase.derr@dataninja.com>
Classifier: Programming Language :: Python :: 3.13
Requires-Dist: msal>=1.35.0
Requires-Python: >=3.13
Description-Content-Type: text/markdown

# trinity-entra-mcp

MCP client for Trinity, Dataninja's internal knowledge base. Signs you in with your Microsoft work
account and forwards questions to the hosted server. No AWS account, no access key, nothing in
`~/.aws`.

## Install

    claude mcp add trinity-kb --scope user -- uvx trinity-entra-mcp

Restart Claude Code, then ask a question. A browser tab opens once for a Microsoft sign-in. The
token is cached at `~/.trinity-mcp/msal-cache.json` (mode 0600) and every question after that is
silent.

## Configuration

Defaults point at the live deployment. Override any of them with environment variables:

| variable | what it is |
|---|---|
| `TRINITY_RUNTIME_ARN` | Bedrock AgentCore runtime hosting the MCP server |
| `TRINITY_REGION` | AWS region of that runtime |
| `TRINITY_TENANT` | Entra tenant id whose tokens the runtime accepts |
| `TRINITY_API_APP_ID` | App registration exposing `access_as_user` |
| `TRINITY_TOKEN` | A bearer token to present as-is, skipping the sign-in entirely |

`TRINITY_TOKEN` is the escape hatch for CI and agents, which have no browser.

## What it does

It answers `initialize`, `tools/list`, and `ping` itself so Claude Code starts without a sign-in,
then forwards `tools/call` to the runtime with the token attached. The runtime validates the token
came from the configured tenant before it answers.

Sign-in rides the Azure CLI's public client id, which is pre-authorized on the API app
registration, so there is nothing to register in Entra on your side.
