koma-core-mcp

Koma Core MCP

Expose Koma Core's protected RAG storage as MCP tools for AI agents.

npm install koma-core-mcp

What it demonstrates

Discovery ≠ Authorization. Agents can search the public index, but retrieve private content only with the correct access tier.

Tool	What it does	Access
search_docs	Search the public index — returns metadata, never content	Public
retrieve_doc	Fetch full content by source ID	Requires userTier ≥ document tier

Setup

# Optional: set a master key for token derivation (default is a demo key)
export KOMA_MASTER_KEY=your-32-byte-minimum-secret

Claude Desktop

{
  "mcpServers": {
    "koma-core": {
      "command": "npx",
      "args": ["-y", "koma-core-mcp"]
    }
  }
}

Tools

search_docs

• category (optional) — filter by category
• tag (optional) — filter by tag
• limit (optional) — max results

Returns metadata only: displayName, category, tags, accessTier, preview. No content, no token.

retrieve_doc

• sourceId (required) — the document source ID from search_docs
• userTier (required) — public | premium | enterprise

Returns full content only if userTier ≥ the document's tier.

Seed Data

Three demo documents are ingested on startup:

sourceId	Tier
guide-getting-started	public
api-reference	premium
internal-architecture	enterprise

Security Boundary

This is an in-memory reference implementation — no persistence, demo master key. For production, implement the DatabaseAdapter interface against a real database and provide a real master key. See koma-core's README for the full security boundary.