AI Agents & Developers Portal

WebMCP & Model Context Protocol Guide

Alex Moreno Personal Training natively supports in-browser WebMCP (via document.modelContext and navigator.modelContext) and a standardized Model Context Protocol (MCP) server at https://www.alexmoreno-demo.site/mcp.

Machine-Readable Agent Directive

<ai_agent_instructions>
  <protocol>WebMCP & Model Context Protocol (MCP)</protocol>
  <site>Alex Moreno Personal Training (Barcelona)</site>
  <directives>
    <rule>WebMCP is active in-browser via document.modelContext and navigator.modelContext.</rule>
    <rule>Structured tools provide deterministic booking, schedule queries, and user state.</rule>
    <rule>External agents: call JSON-RPC 2.0 at POST https://www.alexmoreno-demo.site/mcp</rule>
    <rule>Authenticated tools (book_session, get_my_bookings): external agents supply Authorization: Bearer &lt;user_token&gt;. In-browser agents inherit visitor session automatically.</rule>
    <rule>Streamable HTTP: connect via SSE at GET https://www.alexmoreno-demo.site/mcp with Accept: text/event-stream</rule>
  </directives>
</ai_agent_instructions>

Available WebMCP & MCP Tools

Tool Name	Layer	Description	Parameters & Auth
book_session	MCP Server & WebMCP	Reserve a spot in an active session for the authenticated client. Requires user session.	sessionId: string (required) Auth: Bearer JWT (external) or browser session (WebMCP)
get_available_sessions	MCP Server & WebMCP	Query active scheduled training sessions with real-time remaining capacity.	startDate?: string, endDate?: string, category?: string Auth: None (Public)
get_session_details	MCP Server & WebMCP	Retrieve full details, coach info, base price, and remaining spots for a session.	sessionId: string (required) Auth: None (Public)
get_my_bookings	MCP Server & WebMCP	Retrieve the authenticated client's upcoming and past bookings. Requires user session.	none Auth: Bearer JWT (external) or browser session (WebMCP)
filter_schedule	Page-Local (DOM)	Filter currently displayed training sessions by day of week, category, location, or reset.	day?: string, category?: string, location?: string, reset?: boolean
get_displayed_sessions	Page-Local (DOM)	Query displayed sessions with details (spots left, times, weekdaysOnly, timeOfDay).	timeOfDay?: string, weekdaysOnly?: boolean, day?: string, category?: string
toggle_schedule_view	Page-Local (DOM)	Switch the schedule layout between grid and calendar views.	view: "grid" \| "calendar" (required)

Authentication for External Callers & MCP Clients

Tools that manage user-specific data or reserve spots (book_session and get_my_bookings) require an authenticated client session. Depending on how your agent connects, provide authentication as follows:

1. External MCP Clients (Claude Desktop, Cursor, AI Agents, cURL)

External callers provide a Supabase Access Token (JWT) in the standard HTTP Authorization header:

Authorization: Bearer <SUPABASE_USER_JWT>

MCP Client Configuration (e.g. claude_desktop_config.json or Cursor):

{
  "mcpServers": {
    "session-booker-pro": {
      "url": "https://www.alexmoreno-demo.site/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_SUPABASE_USER_JWT>"
      }
    }
  }
}

Direct JSON-RPC 2.0 Tool Call Example:

curl -X POST "https://www.alexmoreno-demo.site/mcp" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <YOUR_SUPABASE_USER_JWT>" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "book_session",
      "arguments": { "sessionId": "<SESSION_UUID>" }
    }
  }'

How to obtain a user token: Authenticate with Supabase Auth (e.g., via POST https://uzsqldfpnwapyxrmvldt.supabase.co/auth/v1/token?grant_type=password or using the Supabase client SDK supabase.auth.signInWithPassword({ email, password })), which returns an access_token JWT.

2. In-Browser WebMCP (Browser Agents & Extensions)

When interacting within an active browser tab on alexmoreno-demo.site where the user has logged in, the user session is stored in localStorage (sb-*-auth-token) and cookie (sb-access-token). In-browser WebMCP tool calls automatically bridge this token to /mcp — no manual header setup is required for in-tab agents.

Connecting via Model Context Protocol (MCP)

The server endpoint supports JSON-RPC 2.0 and Streamable HTTP / Server-Sent Events (SSE):

Endpoint URL: https://www.alexmoreno-demo.site/mcp
Manifest / Health Check: GET /mcp returns the full tool manifest and capabilities.
List Tools (GET query): GET /mcp?method=tools/list returns the standard JSON-RPC tools list.
Streamable HTTP / SSE: GET /mcp with Accept: text/event-stream initiates an SSE connection.
JSON-RPC 2.0 (POST): Send standard MCP requests (initialize, tools/list, tools/call). For authenticated tools (book_session, get_my_bookings), supply Authorization: Bearer <token>.

Conversational AI Agent Endpoint (/api/chat)

In addition to structured MCP tools and REST endpoints, the platform exposes a dual-layer conversational assistant at POST /api/chat powered by OpenAI.

Guest Layer (Unauthenticated): Answers visitor questions about session schedules, categories, pricing rates, and business knowledge base FAQs. Prompts guests to log in to book spots.
Client Layer (Authenticated): When passed Authorization: Bearer <token> or a valid browser cookie, the agent personalizes answers with the client's upcoming bookings and can book available sessions on their behalf via internal function tools.
Format: Accepts { "messages": [{ "role": "user", "content": "..." }] } and returns { "message": { "role": "assistant", "content": "..." }, "isAuthenticated": boolean }.

curl -X POST "https://www.alexmoreno-demo.site/api/chat" \
  -H "Content-Type: application/json" \
  -d '{"messages": [{"role": "user", "content": "What sessions are available this week?"}]}'

Admin & Serverless Data API (/api/v1/*)

Server-to-server operations and administrative automation use cryptographic API keys (sbp_...) passed via Authorization: Bearer <key>. Access is governed by 29 granular read, write, and delete scopes across 10 categories:

Users (users:read, users:write, users:delete): /api/v1/users — User profile management and role assignments.
Login History (login_history:read, login_history:delete): /api/v1/login-history — Authentication audit logs and IP tracing.
Clients (clients:read, clients:write, clients:delete): /api/v1/clients — Customer client records (strictly isolates customer profiles from admin/team).
Session Types (session_types:read, session_types:write, session_types:delete): /api/v1/session-types — Training types, pricing, and capacity.
Categories (categories:read, categories:write, categories:delete): /api/v1/categories — Session workout categories.
Sessions (sessions:read, sessions:write, sessions:delete): /api/v1/sessions — Schedule administration.
Bookings (bookings:read, bookings:write, bookings:delete): /api/v1/bookings — Reservation management.
Refund Requests (refund_requests:read, refund_requests:write, refund_requests:delete): /api/v1/refund-requests — Refund processing.
AI Tool Calls (tool_calls:read, tool_calls:write, tool_calls:delete): /api/v1/tool-calls — Agent tool execution telemetry.
Email Outbox (email_outbox:read, email_outbox:write, email_outbox:delete): /api/v1/email-outbox — Notification dispatch queue.

API keys can be generated and managed directly from the admin dashboard under Admin Settings → API Keys. Interactive documentation is available at /api-docs (Swagger UI).