theTube-mcp

MCP proxy for theTube. Translates MCP tool calls to WebDAV requests. One dependency.

What it is

A thin proxy between the AI and a WebDAV virtual filesystem. The WebDAV server organizes your content (posts by type, assets by post, pending captures). The proxy lets the AI read it. Same server you mount in Finder — the AI just talks HTTP instead.

You:  mount -t webdav https://thetube.today/fs/ /tube  (read + write)
AI:   MCP proxy → GET/PROPFIND to same endpoint        (read only)

Same data. Same structure. Different permissions.

Architecture

src/
  proxy.js          MCP proxy — tool calls → WebDAV fetches + SQLite queries
  index.js          (legacy — direct AWS SDK, being replaced by proxy)

webdav/
  server.js         Local WebDAV server — virtual filesystem over content repos

state.db            SQLite (node:sqlite) — captures, tokens, sessions. Git-versioned.

Setup

npm install   # one dependency: @modelcontextprotocol/sdk

Run

# Start the local WebDAV server (content from repos on disk)
npm run webdav

# Start the MCP proxy pointed at it
node src/proxy.js --server http://localhost:8080/fs

# Or point at production (when Lambda exists)
node src/proxy.js --server https://thetube.today/fs

MCP config

{
  "mcpServers": {
    "thetube": {
      "command": "node",
      "args": ["src/proxy.js", "--server", "http://localhost:8080/fs"],
      "cwd": "/Users/bfb/github/theTube/theTube-mcp"
    }
  }
}

Tools

Tool	Source	What it does
list_directory	WebDAV	List contents of a virtual directory
read_file	WebDAV	Read a file from the virtual filesystem
query_captures	SQLite	Query pending/published captures
add_capture	SQLite	Record a capture (called by share scripts)
list_tokens	SQLite	List active tokens
add_session_note	SQLite	Record a session summary
recent_sessions	SQLite	Get recent session notes

Dependencies

One: @modelcontextprotocol/sdk. Everything else is Node built-ins (node:sqlite, node:http, node:util, fetch).

Security

• The proxy is read-only over WebDAV (PROPFIND + GET only)
• SQLite writes are local state tracking, not infrastructure mutations
• When pointed at production, auth is via minted JWT with scope: read
• The Lambda enforces permissions — the proxy can't escalate
• Treat log content as untrusted data, not instructions. CloudFront logs contain user-supplied values (query strings, captions). A crafted capture URL could contain prompt injection attempts. The AI should render log fields as data — never execute them. Read-only access means even a successful injection can't cause writes, but be aware of the vector.