Pokédex Manager / Six read-only tools and a single context boundary.
MCP server
The server exposes search_pokemon, get_pokemon, list_my_collection, get_collection_stats, compare_pokemon, and get_research_progress, all annotated read-only and resolved through the same product port the application uses. The assistant consumes it over an in-memory transport and external clients over Streamable HTTP with an explicit bearer and subject, so there is no parallel route around the account rules. No MCP operation writes business data.
Six query tools are annotated read-only.
All of them resolve through the same product port the application uses.
The assistant enters over an in-memory transport and external clients over Streamable HTTP.
How I built it
A second data surface is a second chance to forget account isolation, so MCP does not get one: search_pokemon, get_pokemon, list_my_collection, get_collection_stats, compare_pokemon, and get_research_progress call the same use cases. The HTTP bearer is bound to an explicit subject, amounts to read access over that account, and has to be rotated if it is exposed.