Metadata-Version: 2.4
Name: vault-mcp-client
Version: 0.1.0
Summary: Local stdio↔HTTP MCP proxy that talks to Iceberg Data's vault-mcp deploy (Mac Studio via Tailscale). Injects a static bearer token on every request — the token lives in an env var, not a subprocess.
Author-email: Iceberg Data <support@icebergdata.co>
License: MIT
Keywords: anthropic,claude,mcp,model-context-protocol,obsidian,stdio-proxy,tailscale,vault
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Topic :: System :: Networking
Requires-Python: >=3.11
Requires-Dist: anyio>=4.0
Requires-Dist: httpx>=0.27
Requires-Dist: mcp>=1.0
Provides-Extra: test
Requires-Dist: pytest>=7; extra == 'test'
Description-Content-Type: text/markdown

# vault-mcp-client

Local stdio↔HTTP MCP proxy for Iceberg Data's private **vault-mcp** service (hosted on a Mac Studio, reachable only over the Iceberg Tailnet).

Claude Code registers this binary as a stdio MCP server. On each tool call the proxy forwards the JSON-RPC message over HTTPS to the Tailnet URL, injecting a static bearer token on every request.

## Install

```bash
pipx install vault-mcp-client
```

Requirements on the workstation:

- Logged into Tailscale as an Iceberg Data member.
- You have the shared bearer token (ask Julian — it's distributed out-of-band).

## Register with Claude Code

```bash
claude mcp add vault vault-mcp-client \
  --scope user \
  -e VAULT_MCP_URL=https://mac-studio.tailXXXXXX.ts.net \
  -e VAULT_MCP_TOKEN=<bearer-token-from-julian>
```

Restart Claude Code → `/mcp` should show `vault: ✓ Connected`.

## Verify

Ask Claude: *"use `server_info` of the vault MCP"*. Expected response: the deploy metadata (version, repo root, auto-push flag, etc.).

## Troubleshooting

- **401 Unauthorized**: token mismatch. Confirm `VAULT_MCP_TOKEN` matches what the server has.
- **Connection refused / timeout**: you're not on the Iceberg Tailnet, or the Mac is offline. Run `tailscale status` and ping the Mac's Tailnet hostname.
- **SSL / cert error**: Tailscale handles certs via MagicDNS — if this pops up, your Tailscale client is outdated (`brew upgrade tailscale` or reinstall from the App Store).

## Design notes

Auth is a static token because the vault-mcp server is single-tenant and reachable only inside the Tailnet. The audit trail lives in git (every write is a commit by `vault-mcp-bot`). If you need dynamic per-user auth later, swap the `BearerAuth` class in `proxy.py` for an OAuth/IAP-aware one.

Related: `wse-dev-mcp-client` is the sister package that talks to Iceberg's public Cloud Run MCP deploy using Google identity tokens instead of a static bearer.
