MCP para Integraciones Empresariales: Conecta tus Sistemas con IA

import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
import express from "express";
 
const app = express();
const server = new Server(
  { name: "empresa-erp-mcp", version: "1.0.0" },
  { capabilities: { tools: {} } }
);
 
app.get("/sse", async (req, res) => {
  const transport = new SSEServerTransport("/messages", res);
  await server.connect(transport);
});
 
app.post("/messages", async (req, res) => {
  // handle incoming messages
});

import { z } from "zod";
 
server.setRequestHandler(ListToolsRequestSchema, async () => ({
  tools: [
    {
      name: "buscar_cliente",
      description: "Busca un cliente en el CRM por RUT, nombre o email",
      inputSchema: {
        type: "object",
        properties: {
          query: {
            type: "string",
            description: "RUT (12.345.678-9), nombre o email del cliente",
          },
          limit: {
            type: "number",
            description: "Numero maximo de resultados (default: 5, max: 20)",
            default: 5,
          },
        },
        required: ["query"],
      },
    },
    {
      name: "obtener_pedidos",
      description: "Obtiene los pedidos de un cliente en un rango de fechas",
      inputSchema: {
        type: "object",
        properties: {
          cliente_id: { type: "string" },
          fecha_desde: { type: "string", format: "date" },
          fecha_hasta: { type: "string", format: "date" },
          estado: {
            type: "string",
            enum: ["pendiente", "procesado", "enviado", "entregado"],
          },
        },
        required: ["cliente_id"],
      },
    },
  ],
}));

server.setRequestHandler(CallToolRequestSchema, async (request) => {
  const { name, arguments: args } = request.params;
 
  switch (name) {
    case "buscar_cliente": {
      const { query, limit = 5 } = args as { query: string; limit?: number };
 
      // Llamar a tu CRM o base de datos
      const clientes = await crmClient.buscarCliente(query, Math.min(limit, 20));
 
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify(clientes, null, 2),
          },
        ],
      };
    }
    case "obtener_pedidos": {
      const { cliente_id, fecha_desde, fecha_hasta, estado } = args as {
        cliente_id: string;
        fecha_desde?: string;
        fecha_hasta?: string;
        estado?: string;
      };
 
      const pedidos = await erpClient.getPedidos({
        clienteId: cliente_id,
        desde: fecha_desde ? new Date(fecha_desde) : undefined,
        hasta: fecha_hasta ? new Date(fecha_hasta) : undefined,
        estado,
      });
 
      return {
        content: [{ type: "text", text: JSON.stringify(pedidos, null, 2) }],
      };
    }
    default:
      throw new Error(`Herramienta desconocida: ${name}`);
  }
});

import jwt from "jsonwebtoken";
 
// Middleware de autenticacion para Express
function authenticateMCP(req: express.Request, res: express.Response, next: express.NextFunction) {
  const token = req.headers.authorization?.replace("Bearer ", "");
  
  if (!token) {
    return res.status(401).json({ error: "Token requerido" });
  }
 
  try {
    const payload = jwt.verify(token, process.env.MCP_JWT_SECRET!) as {
      sub: string;
      scope: string[];
    };
    
    // El scope determina que herramientas puede usar este cliente
    (req as express.Request & { mcpUser: typeof payload }).mcpUser = payload;
    next();
  } catch {
    return res.status(401).json({ error: "Token invalido" });
  }
}
 
app.use("/sse", authenticateMCP);
app.use("/messages", authenticateMCP);

const BuscarClienteSchema = z.object({
  query: z.string().min(3).max(100).trim(),
  limit: z.number().int().min(1).max(20).default(5),
});
 
case "buscar_cliente": {
  const parsed = BuscarClienteSchema.safeParse(args);
  if (!parsed.success) {
    return {
      content: [{ type: "text", text: `Parametros invalidos: ${parsed.error.message}` }],
      isError: true,
    };
  }
  // usar parsed.data con confianza
}

import rateLimit from "express-rate-limit";
 
const mcpRateLimit = rateLimit({
  windowMs: 60 * 1000, // 1 minuto
  max: 100, // 100 llamadas por minuto por token
  keyGenerator: (req) => {
    return (req as express.Request & { mcpUser: { sub: string } }).mcpUser.sub;
  },
  message: { error: "Rate limit excedido. Reintenta en 1 minuto." },
});
 
app.use("/messages", mcpRateLimit);

import { Pool } from "pg";
 
const readonlyPool = new Pool({
  connectionString: process.env.DATABASE_URL_READONLY,
  max: 5, // limite bajo para pool readonly
});
 
async function ejecutarConsultaSegura(
  query: string,
  params: unknown[]
): Promise<unknown[]> {
  // Solo permitir SELECT — nunca UPDATE, INSERT, DELETE, DROP
  const queryNormalizado = query.trim().toUpperCase();
  if (!queryNormalizado.startsWith("SELECT")) {
    throw new Error("Solo se permiten consultas SELECT");
  }
  
  const result = await readonlyPool.query(query, params);
  return result.rows;
}

import axios from "axios";
 
class ERPClient {
  private client: ReturnType<typeof axios.create>;
  
  constructor() {
    this.client = axios.create({
      baseURL: process.env.ERP_API_URL,
      headers: {
        Authorization: `Bearer ${process.env.ERP_API_KEY}`,
        "Content-Type": "application/json",
      },
      timeout: 10000,
    });
  }
  
  async getPedidos(params: PedidoQuery): Promise<Pedido[]> {
    try {
      const { data } = await this.client.get("/api/v2/pedidos", { params });
      return data.items;
    } catch (error) {
      if (axios.isAxiosError(error)) {
        throw new Error(`Error ERP: ${error.response?.data?.message ?? error.message}`);
      }
      throw error;
    }
  }
}

FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build
 
FROM node:20-alpine AS runner
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]

import pino from "pino";
 
const logger = pino({ level: process.env.LOG_LEVEL ?? "info" });
 
// En cada ejecucion de herramienta:
logger.info({
  tool: name,
  args: sanitizedArgs, // sin datos PII
  duration_ms: Date.now() - startTime,
  success: true,
  result_count: Array.isArray(result) ? result.length : 1,
}, "tool_executed");