@bicharts/chart-mcp 0.6.69 → 0.6.71

package/README.md

@@ -272,6 +272,36 @@ The server tells the BIC service three things, and nothing else:
 
 Set `BIC_MCP_TELEMETRY=0` in the server's environment to turn all of it off.
 
+## Hosted server (`--http`)
+
+The same server can also run as a remote MCP endpoint over Streamable HTTP, for clients that only take a URL (chat
+connectors, notebook and dashboard tools). It's how the hosted chart server runs behind the RegiaBI site, which
+checks each caller's sign-in before a request reaches it.
+
+```bash
+npx -y @bicharts/chart-mcp --http --host 127.0.0.1 --port 8799
+```
+
+`BIC_MCP_HOSTED=1` starts it the same way, and `BIC_MCP_HTTP_PORT` sets the port. It answers MCP on `POST /mcp`
+and `GET /healthz`. What's different from the local server:
+
+- **Every request needs `Authorization: Bearer <access token>`** (a request without one gets a 401), and that token is
+  the only credential its calls send. A license key in the environment or `~/.bic/credentials.json` isn't used, and no
+  browser sign-in opens. When the service turns the token away, the tool's answer says to reconnect; your MCP
+  client signs in again.
+- **It's stateless:** each request gets a fresh server and no session, so `GET` and `DELETE` on `/mcp` answer 405,
+  and a question a tool would ask the client (hover drop lines on a 3D scatter) goes to the agent instead.
+- **Five tools:** `assess_data_shape`, `list_eligible_charts`, `generate_chart`, `preview_request` and `get_guide`. The
+  tools that work in your project folder (`check_chart`, `check_app`, `setup_fabric_app`, `query_semantic_model`,
+  `suggest_charts`) need the local server, since a remote server can't see your machine.
+- **Tables travel in the request,** as `data` or `csv_text`; `csv_path`, `out_dir`, `preview_html` and `project_dir`
+  are refused with a one-line reason. The server profiles the table in memory, sends only the profile to generation
+  (exactly what the local server sends) and drops the rows: nothing is written to disk or logged. Charts come back
+  inline. With no `language` or `renderer`, it generates JavaScript (D3).
+- **Each request it sends says it came from the hosted server,** and an `X-BIC-Client-IP` header on the incoming
+  request is passed on, so the service's limits apply to the person rather than to the server. Run it yourself only
+  behind something that checks callers, since it trusts that header.
+
 ## The agent skill (recommended)
 
 This package ships `skills/bic-charts/SKILL.md` — the golden path from empty directory to a