MCP server · npm

A read-only retreat companion.

Connect an MCP-compatible assistant to the information your Aroha account is allowed to read. Business writes stay outside the MCP surface.

View npm package ↗Source on GitHub

Install through your MCP host

Requires Node 22 or later. Create a read-only token, store it in a private file with chmod 600, then add this configuration to your MCP host. Your host's configuration location varies.

MCP host configuration

{
  "mcpServers": {
    "aroha": {
      "command": "npx",
      "args": [
        "--yes",
        "@theharithsa/aroha-mcp@0.1.0"
      ],
      "env": {
        "AROHA_API_URL": "https://aroha-retreat-preprod.web.app/api/external/v1",
        "AROHA_API_TOKEN_FILE": "/absolute/private/path/aroha-token"
      }
    }
  }
}

Codex configuration

Codex uses TOML for stdio servers. Add the following to your private MCP configuration, or use its MCP settings UI. The token itself stays in the private file.

Codex · config.toml

[mcp_servers.aroha]
command = "npx"
args = ["--yes", "@theharithsa/aroha-mcp@0.1.0"]

[mcp_servers.aroha.env]
AROHA_API_URL = "https://aroha-retreat-preprod.web.app/api/external/v1"
AROHA_API_TOKEN_FILE = "/absolute/private/path/aroha-token"

Configuration format: official OpenAI MCP documentation. The JSON example above is for hosts using an mcpServers-style configuration.

Available read tools

Tool	Reads
`aroha_get_runtime`	Environment and allowed capabilities
`aroha_get_availability`	Computed availability; no hold or quote
`aroha_get_calendar`	Aggregate dates; no guest identities
`aroha_list_reservations`	One redacted permitted page
`aroha_get_reservation`	One permitted reservation
`aroha_list_units`	Operating room metadata
`aroha_get_unit`	One room record
`aroha_get_published_content`	Published website copy only
`aroha_list_communications`	Delivery status; no bodies or recipients

Discovery is filtered by your token's actual capabilities. Each tool has bounded inputs and results. The server never automatically reads every page.

Read-only at every boundary

The registry exposes GET mappings only. Credentials have read-only scopes and an API-enforced operation ceiling. The adapter has no direct Firestore access, generic fetch tool, upload, quote creation, booking mutation or email-send tool. Contact information, private notes, feedback and document binaries are excluded.

Telemetry and protocol

Every tool call records a real SDK trace, count, duration and completion log. Configure your own approved OTLP destination to export signals; no Aroha/Dynatrace secret is bundled. See telemetry setup. Stdout is reserved for JSON-RPC; completion logs use stderr. This release uses stdio. Remote HTTP/OAuth is deferred.