# Read-only Basecamp MCP server

A tiny, dependency-free Go MCP server for the Agency Client Brain. It exposes **read-only** Basecamp tools and performs only HTTP GET requests against Basecamp data endpoints.

## Included tools

- `basecamp_list_projects`
- `basecamp_find_project`
- `basecamp_get_open_todos`
- `basecamp_get_overdue_todos`
- `basecamp_get_recent_messages`
- `basecamp_get_recent_activity`
- `basecamp_project_status`

There are no create, edit, complete, comment, archive, assign, move, or delete tools.

## Build on a modern Mac/Linux machine

```bash
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags='-s -w' -o basecamp-mcp-linux-amd64 .
```

The project uses only Go's standard library, so there are no external packages to download.

## Server installation

Upload this folder and the compiled binary to the server, then as root:

```bash
bash install.sh ./basecamp-mcp-linux-amd64
nano /opt/basecamp-mcp/.env
systemctl start basecamp-mcp
systemctl status basecamp-mcp
curl http://127.0.0.1:3100/health
```

Generate the MCP key:

```bash
openssl rand -hex 32
```

## Basecamp OAuth app

Create/register a Basecamp OAuth integration and configure this callback:

```text
https://basecamp-mcp.example.com/oauth/callback
```

Set the client ID and secret in `/opt/basecamp-mcp/.env`, restart the service, then visit:

```text
https://basecamp-mcp.example.com/oauth/start
```

The resulting Basecamp token is saved as mode `0600` in `/opt/basecamp-mcp/data/basecamp-token.json`.

## Apache

Use `apache-vhost.conf` as a reference. On cPanel, creating an account/subdomain and using an Apache include is generally safer than directly editing generated vhost files. The required modules are `proxy`, `proxy_http`, `headers`, `rewrite`, and `ssl`.

Test externally:

```bash
curl https://basecamp-mcp.example.com/health
```

## ChatGPT custom MCP app

Use this endpoint:

```text
https://basecamp-mcp.example.com/mcp?key=YOUR_LONG_MCP_API_KEY
```

Scan tools and verify that every tool is marked read-only. Attach the custom app to the Client Brain Agent and publish the updated Agent.

## Security notes

- Use HTTPS only.
- Use a long random `MCP_API_KEY`.
- Authorize a dedicated Basecamp user with access only to the pilot projects.
- The Basecamp OAuth token itself may possess broader API rights; read-only behavior is enforced by this server exposing only GET-based tools.
- Do not publish the `.env` file or token JSON.
- Because the host is disk-constrained, configure log rotation and avoid verbose access logging.
