Getting started

Prerequisites

• A Marques Boxing staff account (owner, staff, or teacher role) — the same login used for app.marquesboxing.devfellowship.com.
• An MCP client that speaks Streamable HTTP with a custom Authorization header (Claude Code, Claude Desktop with a proxy, or any MCP SDK client).

This is not a public API

There is no anonymous access. Every tool call runs as a real Marques Boxing staff account and is scoped by that account’s organization through Postgres RLS — a token for one gym can never see another gym’s data, and an account with no public.users row is refused outright.

1. Get a Supabase access token

The MCP server accepts the same JWT the staff web app uses. The simplest way to get one for a script or a test is the password grant against Supabase Auth:

curl -s -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" \
  -H "apikey: $SUPABASE_PUBLISHABLE_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\"}" \
  | jq -r .access_token

SUPABASE_URL and SUPABASE_PUBLISHABLE_KEY are the same public values apps/web’s .env uses — they identify the project, not a secret credential. The email/password are a real staff account’s own login.

2. Point your MCP client at the server

1. Endpoint: https://mcp-server.marquesboxing.devfellowship.com/mcp
2. Transport: Streamable HTTP
3. Header: Authorization: Bearer <token from step 1>
4. Send an initialize request, then notifications/initialized, then tools/list to confirm you see all 33 tools.

A minimal raw handshake, for debugging without a full MCP client:

curl -s -D - -o /dev/null -X POST https://mcp-server.marquesboxing.devfellowship.com/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{
        "protocolVersion":"2025-06-18","capabilities":{},
        "clientInfo":{"name":"my-client","version":"0.0.1"}}}'
# -> read the `mcp-session-id` response header, then reuse it:
curl -s -X POST https://mcp-server.marquesboxing.devfellowship.com/mcp \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'

3. Call a tool

curl -s -X POST https://mcp-server.marquesboxing.devfellowship.com/mcp \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"list_students","arguments":{}}}'

See the tools reference for every tool’s full argument shape.

Troubleshooting

Symptom	Cause
401 on initialize	Missing/expired/malformed bearer token. Tokens from the password grant expire — mint a fresh one.
Caller is not a registered staff user	The Supabase auth user has no matching public.users row (not staff, or provisioning didn’t complete). Ask an owner to invite the account via invite_staff.
400 Bad Request: No valid session	You called a method other than initialize without an mcp-session-id header from a prior initialize response.
A tool call succeeds but returns nothing	RLS is filtering by organization — you’re authenticated, but scoped to a different (or no) org than you expected.