1feature:
2 name: server
3 product: cooked-mcp
4 description: Start Cooked as a single-user MCP server over stdio or local HTTP.
5components:
6 IDENTITY:
7 requirements:
8 1: The MCP server identifies itself as Cooked.
9 2: The command starts the MCP server without requiring subcommands.
10 TRANSPORT:
11 requirements:
12 1: The server starts with stdio transport by default.
13 2: The server accepts an explicit transport selection through a --transport flag.
14 2-1: The --transport stdio value selects stdio transport.
15 2-2: The --transport http value selects Streamable HTTP.
16 3: HTTP transport listens on a configurable address.
17 3-1: HTTP transport defaults to 127.0.0.1:8123.
18 4: The server rejects unknown transport selections before serving.
19 5: HTTP transport serves MCP requests at /mcp.
20 CONFIG:
21 requirements:
22 1: The server loads configuration from environment variables.
23 2: The server loads configuration from a TOML configuration file.
24 3: Environment variables take precedence over TOML configuration values for the same setting.
25 4: The Cooked base URL defaults to https://cooked.wiki.
26 4-1: COOKED_BASE_URL configures the Cooked base URL.
27 4-2: TOML cooked.base_url configures the Cooked base URL.
28 5: The server validates configured HTTP URLs before serving.
29 6: The server can be pointed at a specific TOML configuration file with --config.
30 7: If no TOML configuration path is supplied, the server loads config.toml from $XDG_CONFIG_HOME/cooked-mcp.
31 7-1: If XDG_CONFIG_HOME is unset, the server loads config.toml from ~/.config/cooked-mcp.
32 7-2: If XDG_CONFIG_HOME is unset and the home directory cannot be determined, startup reports a configuration path error.
33 8: HTTP transport address is configurable with --http-addr.
34 8-1: COOKED_MCP_HTTP_ADDR configures the HTTP transport address.
35 8-2: TOML mcp.http_addr configures the HTTP transport address.
36constraints:
37 SINGLE_USER:
38 requirements:
39 1: The server supports exactly one configured Cooked account per process.
40 2: MCP requests do not provide or select Cooked usernames.
41 3: Multi-account routing, per-client users, and per-request Cooked credentials are out of scope.
42 SECURITY:
43 requirements:
44 1:
45 requirement: HTTP transport refuses non-loopback listeners unless MCP HTTP authentication is configured.
46 deprecated: true
47 1-1: HTTP transport accepts any configured listen address without requiring MCP HTTP authentication.
48 2: HTTP authentication secrets are never logged.
49 3: HTTP transport supports bearer-token authentication.
50 4: HTTP bearer tokens can be configured through COOKED_MCP_HTTP_TOKEN.
51 5: HTTP bearer tokens can be configured through TOML mcp.http_token.
52 6: HTTP bearer authentication uses the Authorization header with the Bearer scheme.
53 7: When an HTTP token is configured, every MCP HTTP request must provide the matching bearer token.
54 8:
55 requirement: TOML mcp.http_token and mcp.http_token_cmd are mutually exclusive.
56 deprecated: true
57 9: COOKED_MCP_HTTP_TOKEN takes precedence over TOML mcp.http_token.
58 10: TOML mcp.http_token follows the same config value resolution, trimming, timeout, and secrecy rules as Cooked credential settings.
59 11: Empty HTTP bearer tokens are rejected before serving.
60 12: TOML mcp.http_token uses config-values.RESOLUTION.1.
61 13: TOML mcp.http_token may reference any existing environment variable through config value syntax.
62 14: Separate TOML mcp.http_token_cmd is not supported in this version.
63 COMPATIBILITY:
64 requirements:
65 1: The server does not require MCP resource support from clients.
66 2: Every operation described by the cooked-mcp feature specs is available through MCP tools.
67 3: Agents do not need to call Cooked REST endpoints directly.
68 VERIFICATION:
69 requirements:
70 1: Startup and configuration behaviour is verified without contacting the real Cooked service.