add api key

README.md

@@ -185,11 +185,8 @@ Edit your `claude_desktop_config.json`:
       "command": "npx",
       "args": [
         "mcp-remote",
-        "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse"
-      ],
-      "env": {
-        "FLEETMIND_API_KEY": "fm_your_api_key_here"
-      }
+        "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse?api_key=fm_your_api_key_here"
+      ]
     }
   }
 }
@@ -197,6 +194,8 @@ Edit your `claude_desktop_config.json`:
 
 ⚠️ **Important:** Replace `fm_your_api_key_here` with your actual API key from Step 1!
 
+💡 **Note:** The API key is passed as a **query parameter** (`?api_key=...`) in the URL. This is because `mcp-remote` doesn't forward environment variables to remote servers.
+
 **For Local Development (with API Key):**
 ```json
 {
@@ -205,11 +204,8 @@ Edit your `claude_desktop_config.json`:
       "command": "npx",
       "args": [
         "mcp-remote",
-        "http://localhost:7860/sse"
-      ],
-      "env": {
-        "FLEETMIND_API_KEY": "your_local_api_key"
-      }
+        "http://localhost:7860/sse?api_key=your_local_api_key"
+      ]
     }
   }
 }
@@ -237,17 +233,17 @@ Edit your `claude_desktop_config.json`:
   "mcpServers": {
     "fleetmind_local": {
       "command": "npx",
-      "args": ["mcp-remote", "http://localhost:7860/sse"],
-      "env": {
-        "FLEETMIND_API_KEY": "your_local_key"
-      }
+      "args": [
+        "mcp-remote",
+        "http://localhost:7860/sse?api_key=your_local_key"
+      ]
     },
     "fleetmind": {
       "command": "npx",
-      "args": ["mcp-remote", "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse"],
-      "env": {
-        "FLEETMIND_API_KEY": "your_production_key"
-      }
+      "args": [
+        "mcp-remote",
+        "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse?api_key=your_production_key"
+      ]
     }
   }
 }

app.py

@@ -155,21 +155,21 @@ if __name__ == "__main__":
       "command": "npx",
       "args": [
         "mcp-remote",
-        "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse"
-      ],
-      "env": {
-        "FLEETMIND_API_KEY": "fm_your_api_key_here"
-      }
+        "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse<strong style="color: #60a5fa;">?api_key=fm_your_api_key_here</strong>"
+      ]
     }
   }
 }</pre>
+        <p style="background: #1e3a5f; padding: 10px; border-radius: 6px; margin: 10px 0; border-left: 4px solid #3b82f6;">
+            💡 <strong>Important:</strong> Add your API key as a query parameter (<code>?api_key=...</code>) in the URL, not in the <code>env</code> section!
+        </p>
 
         <h3>📋 Step 3: Connect</h3>
         <ol>
             <li><strong>Generate your API key</strong> using the button above</li>
             <li>Install <a href="https://claude.ai/download" target="_blank">Claude Desktop</a></li>
             <li>Locate your <code>claude_desktop_config.json</code> file</li>
-            <li>Add the configuration (replace <code>fm_your_api_key_here</code> with your actual key)</li>
+            <li>Add the configuration, replacing <code>fm_your_api_key_here</code> with your actual API key <strong>in the URL</strong></li>
             <li>Restart Claude Desktop</li>
             <li>Look for "FleetMind" in the 🔌 tools menu</li>
         </ol>
@@ -349,14 +349,14 @@ if __name__ == "__main__":
       "command": "npx",
       "args": [
         "mcp-remote",
-        "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse"
-      ],
-      "env": {{
-        "FLEETMIND_API_KEY": "{result["api_key"]}"
-      }}
+        "https://mcp-1st-birthday-fleetmind-dispatch-ai.hf.space/sse?api_key={result["api_key"]}"
+      ]
     }}
   }}
 }}</pre>
+        <p style="background: #1e3a5f; padding: 10px; border-radius: 6px; margin: 10px 0; border-left: 4px solid #3b82f6;">
+            💡 <strong>Important:</strong> The API key is included in the URL as a query parameter (<code>?api_key=...</code>)
+        </p>
 
         <h2>🚀 Next Steps:</h2>
         <ol>

database/user_context.py

@@ -1,69 +1,9 @@
 """
-User Context and Authentication Module
-Handles Stytch authentication and user permission checks
+User Context and Permission Module
+Handles permission checks for API key authentication
 """
 
-from typing import Optional, Dict, Any
-import os
-from stytch import Client
-
-# Initialize Stytch client
-stytch_client = None
-if os.getenv('STYTCH_PROJECT_ID') and os.getenv('STYTCH_SECRET'):
-    try:
-        stytch_client = Client(
-            project_id=os.getenv('STYTCH_PROJECT_ID'),
-            secret=os.getenv('STYTCH_SECRET')
-        )
-        print(f"Stytch client initialized with project: {os.getenv('STYTCH_PROJECT_ID')[:20]}...")
-    except Exception as e:
-        print(f"Warning: Stytch client initialization failed: {e}")
-
-
-def verify_token(token: str) -> Optional[Dict[str, Any]]:
-    """
-    Verify authentication token and return user info
-
-    Args:
-        token: Bearer token from Authorization header
-
-    Returns:
-        User info dict with user_id, email, scopes
-        None if token is invalid
-    """
-    # Development mode: Skip authentication
-    if os.getenv('ENVIRONMENT') == 'development' and os.getenv('SKIP_AUTH') == 'true':
-        return {
-            'user_id': 'dev-user',
-            'email': 'dev@fleetmind.local',
-            'scopes': ['admin'],
-            'name': 'Development User'
-        }
-
-    if not stytch_client:
-        print("Error: Stytch client not initialized")
-        return None
-
-    if not token:
-        return None
-
-    try:
-        # Verify session token with Stytch
-        result = stytch_client.sessions.authenticate(session_token=token)
-
-        # Extract user information
-        user_info = {
-            'user_id': result.user.user_id,
-            'email': result.user.emails[0].email if result.user.emails else 'unknown',
-            'scopes': result.session.custom_claims.get('scopes', ['orders:read', 'drivers:read']),
-            'name': result.user.name if hasattr(result.user, 'name') else 'Unknown User'
-        }
-
-        return user_info
-
-    except Exception as e:
-        print(f"Token validation failed: {e}")
-        return None
+from typing import Optional
 
 
 def check_permission(user_scopes: list, required_scope: str) -> bool:

server.py

@@ -65,18 +65,43 @@ def get_authenticated_user():
     """
     Extract and verify user via API Key authentication
 
-    Supports 2 authentication methods:
-    1. API Key (from FLEETMIND_API_KEY env var) - Production & user auth
-    2. Development Mode (SKIP_AUTH=true) - Local testing only
+    Supports 3 authentication methods (in order):
+    1. Request context (from FastMCP request, if available)
+    2. Server environment variable FLEETMIND_API_KEY
+    3. Development Mode (SKIP_AUTH=true)
 
     Returns:
         User info dict with user_id, email, scopes, name or None if not authenticated
     """
     try:
-        # METHOD 1: API Key Authentication
-        # Users set this in their Claude Desktop config:
-        # "env": {"FLEETMIND_API_KEY": "fm_xxxxx"}
-        api_key = os.getenv("FLEETMIND_API_KEY")
+        api_key = None
+
+        # METHOD 1: Try to get API key from request context (SSE/HTTP)
+        # This is populated by FastMCP from query params or headers
+        try:
+            from fastmcp.server.dependencies import get_request_context
+            context = get_request_context()
+            if context and hasattr(context, 'query_params'):
+                api_key = context.query_params.get('api_key')
+                if api_key:
+                    logger.debug("API key found in query params")
+            elif context and hasattr(context, 'headers'):
+                # Try Authorization header
+                auth_header = context.headers.get('authorization', '')
+                if auth_header.startswith('Bearer '):
+                    api_key = auth_header[7:]
+                    logger.debug("API key found in Authorization header")
+        except (ImportError, RuntimeError, AttributeError) as e:
+            logger.debug(f"No request context available: {e}")
+            pass
+
+        # METHOD 2: Try server environment variable (for local development)
+        if not api_key:
+            api_key = os.getenv("FLEETMIND_API_KEY")
+            if api_key:
+                logger.debug("API key found in server environment")
+
+        # Verify the API key if we found one
         if api_key:
             from database.api_keys import verify_api_key
             user_info = verify_api_key(api_key)
@@ -87,7 +112,7 @@ def get_authenticated_user():
                 logger.warning(f"❌ Invalid API key provided")
                 return None
 
-        # METHOD 2: Development bypass mode (local testing only)
+        # METHOD 3: Development bypass mode (local testing only)
         if os.getenv("SKIP_AUTH") == "true":
             logger.debug("SKIP_AUTH enabled - using development user")
             return {