Blueprint · beginner · 7 steps
Build a Team-Token MCP Server
The easy sibling of the Shared-Skills server: the same team snippet library as a remote MCP server, but auth is one shared token you paste into a header — no OAuth, no consent page, no signing-key migration. One Supabase Edge Function, one RLS-locked table, live in ~15 minutes.
All steps
01Step 1: What We're BuildingA remote MCP server that gives your team a shared prompt-snippet library Claude can read and write — secured by a single shared token you paste into a header, no OAuth, live in about fifteen minutes.→02Step 2: Project SetupCreate the Supabase project, scaffold the Edge Function repo, install the MCP SDK + Hono, and verify the toolchain before we touch the schema or the token.→03Step 3: The Database — One Table, Locked DownA single `snippets` table with an `updated_at` trigger and RLS enabled with *no policies*, so the public anon key can't touch it and the only way in is the service-role key our function holds.→04Step 4: The Shared Team TokenGenerate a strong shared token, and write the middleware that checks it in constant time — accepting it from a header or the URL, and returning a *plain* 401 (never an OAuth challenge) when it's wrong.→05Step 5: MCP Server SkeletonWire the Hono skeleton to the MCP SDK's Streamable HTTP transport, gate the RPC route on the token middleware, and build the one shared service-role client every tool will use.→06Step 6: The Snippet Tools + ResourceRegister the four tools (`list`, `get`, `save`, `delete`) and the `snippet://{id}` resource, every query going through the shared service-role client.→07Step 7: Deploy, Connect the Team, and Know the LimitsPush the function, connect Claude Code with the token in a header (and Claude Desktop with the token on the URL), hand the command to your team, and walk the short list of what this design does and doesn't protect.→