Model Context Protocol Gateway

Secure, low-token action-router interface for Rock RMS v17.7. Connects Claude, Cursor, and other AI clients to church operations.

View on GitHub

Version: 1.0.0

Cache: Redis Active

Rock Target: https://rock.favor.church

MCP Connections

Exposes OAuth-protected endpoints tailored to different user scopes and security levels.

Smart Gateway POST

Detects user status automatically. Upgrades to read-write mode for admins or active group leaders with write scopes; defaults to readonly.

https://rock-mcp.favor.church/mcp

Min Scope read

Write Access Admins & Group Leaders (Authorized)

Read-Only Gateway POST

Enforces a read-only context. Safe default for standard operations. Ideal for broad, lower-risk LLM access.

https://rock-mcp.favor.church/mcp/readonly

Min Scope read

Write Access Disabled

Key Features

OAuth 2.0 Protection: Secure, PKCE-based authorization flow with Auth0 JWT token verification via JWKS.
Built-in React Report Viewer: Real-time interactive reporting directly inside Cursor/Claude using an embedded MCP Web App.
Church-Tailored Tools: Deep integration with Rock RMS group types, campuses, connection requests, and serving rosters.
Low-Token Action Routing: Normalizes and formats queries to minimize context window consumption on LLM calls.

Security & PII Rules

Fail-Closed Modes: Reverts automatically to read-only mode if permissions or user mapping fails.
Dry-Run by Default: All updates default to dry-run mode and require explicit confirmation via commit: true.
Write Auditing: Every write, patch, or delete operation requires a mandatory human-readable reason string.
Privacy Filters: Automatically strips sensitive PII (emails, phone numbers, addresses) unless explicitly requested.

Integration Guide

To register the Favor Church Rock MCP server in your Claude Desktop app, point the client at the MCP URL. Claude will discover the OAuth metadata and prompt you to sign in with Rock/Auth0.

MacOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "rock-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/sdk",
        "connect",
        "https://rock-mcp.favor.church/mcp"
      ]
    }
  }
}

Cursor can connect to the remote MCP endpoint and complete the OAuth login in-browser through Rock/Auth0.

Use the Smart Gateway URL for normal access:

Open Cursor Settings > Features > MCP.
Click + Add New MCP Server.
Fill in:
- Name: rock-mcp
- Type: command
- Command: npx -y @modelcontextprotocol/sdk connect https://rock-mcp.favor.church/mcp

All MCP endpoints use OAuth Protected Resource metadata and Auth0 authorization server discovery. Configure your client with the /mcp URL, then complete the Rock/Auth0 login flow when prompted.

OAuth discovery:

/.well-known/oauth-protected-resource advertises this MCP resource and supported scopes.
/.well-known/oauth-authorization-server mirrors the Auth0 metadata used for login and token issuance.

Access tokens issued by the login flow must contain at least the read scope. To perform updates/writes via /mcp, the signed-in user also needs the write scope and Rock authorization for the targeted entity (an RSR admin, or a group leader acting on the groups they lead).