@chrischall/eventbrite-mcp 0.0.0

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@chrischall/eventbrite-mcp",
+  "version": "0.0.0",
+  "mcpName": "io.github.chrischall/eventbrite-mcp",
+  "description": "Eventbrite MCP server for Claude — developed and maintained by AI (Claude Code)",
+  "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chrischall/eventbrite-mcp.git"
+  },
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "claude",
+    "ai",
+    "eventbrite",
+    "events",
+    "tickets",
+    "event-discovery",
+    "orders"
+  ],
+  "type": "module",
+  "bin": {
+    "eventbrite-mcp": "dist/index.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    ".claude-plugin",
+    "skills/",
+    ".mcp.json",
+    "server.json"
+  ],
+  "scripts": {
+    "build": "tsc && npm run bundle",
+    "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --banner:js='import { createRequire as __createRequire } from \"module\"; const require = __createRequire(import.meta.url);' --outfile=dist/bundle.js",
+    "dev": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "worker:dev": "wrangler dev",
+    "worker:deploy": "wrangler deploy",
+    "worker:test": "vitest run --config vitest.workers.config.ts"
+  },
+  "dependencies": {
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/server": "^1.7.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "dotenv": "^17.4.0",
+    "zod": "^4.4.2"
+  },
+  "devDependencies": {
+    "@chrischall/mcp-connector": "^1.1.1",
+    "@cloudflare/vitest-pool-workers": "^0.19.0",
+    "@cloudflare/workers-oauth-provider": "^0.8.1",
+    "@cloudflare/workers-types": "^5.20260708.1",
+    "@types/node": "^26.0.0",
+    "@vitest/coverage-v8": "^4.1.2",
+    "agents": "^0.19.0",
+    "esbuild": "^0.28.0",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.2",
+    "wrangler": "^4.110.0"
+  },
+  "allowScripts": {
+    "esbuild@0.28.1": true,
+    "workerd@1.20260722.1": true
+  }
+}

package/server.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.chrischall/eventbrite-mcp",
+  "description": "Eventbrite for Claude — your tickets/orders, organizer data, and public event discovery",
+  "repository": {
+    "url": "https://github.com/chrischall/eventbrite-mcp",
+    "source": "github"
+  },
+  "version": "0.0.0",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "@chrischall/eventbrite-mcp",
+      "version": "0.0.0",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "EVENTBRITE_TOKEN",
+          "description": "Personal OAuth token (eventbrite.com/platform/api-keys); needed for account tools",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": true
+        }
+      ]
+    }
+  ]
+}

package/skills/eventbrite/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: eventbrite
+description: "Query eventbrite.com from a shell — your tickets/orders, your organizations' events and attendees via the documented token API (curl), and public event discovery/search via the fpx browser bridge (the search API is WAF-walled and absent from the documented API). Use when you want Eventbrite data without an MCP server, in a script, or one-shot."
+---
+
+# Eventbrite access (curl + fpx)
+
+Two surfaces, two tools — match the tool to reachability:
+
+1. **Documented API `https://www.eventbriteapi.com/v3`** — reachable
+   server-side with a personal OAuth token. Use plain `curl`. Covers your
+   identity, your orders/tickets, organizations you own (events, attendees,
+   orders), and any event **by id**. It has **no public event search** —
+   Eventbrite removed it from the documented API in 2019.
+2. **Consumer site API `https://www.eventbrite.com/api/v3/destination/…`** —
+   WAF-blocked for any server-side client (returns an HTML "Whoops!" page).
+   Public event **search/discovery** lives only here, so those calls route
+   through the user's signed-in browser tab with `fpx`.
+
+## One-time setup
+
+**Token (curl surface):** create a private token at
+<https://www.eventbrite.com/platform/api-keys> (free for any Eventbrite
+account) and export it as `EVENTBRITE_TOKEN`.
+
+**Bridge (fpx surface):**
+
+```sh
+npm install -g @fetchproxy/cli                  # provides `fpx`
+fpx profile add eventbrite --domain eventbrite.com
+fpx pair -p eventbrite    # prints a pair code → approve in the Transporter popup
+```
+
+Requires the **Transporter** extension with Chrome site access for
+`eventbrite.com` and an open (signed-in for account data) eventbrite.com tab.
+Pairing persists after the first approval.
+
+## Core calls
+
+Token surface — every request is:
+
+```sh
+curl -sS "https://www.eventbriteapi.com/v3/users/me/" \
+  -H "Authorization: Bearer $EVENTBRITE_TOKEN" | jq
+```
+
+Bridge surface — stdout is data only, ready for `jq`:
+
+```sh
+fpx get 'https://www.eventbrite.com/api/v3/destination/events/?event_ids=<id>&expand=event_sales_status,primary_venue' \
+  -p eventbrite | jq '.events[0]'
+```
+
+Ready-to-run request bodies and `jq` recipes: `references/token-api.md`
+(curl surface) and `references/discovery-api.md` (fpx surface, incl. event
+search). Read the relevant reference before composing a call — the search
+body shape and the resolve-location-first rule live there.
+
+## Rules
+
+- **Resolve places before searching**: destination search takes place ids,
+  not free-text locations — autocomplete first (see `discovery-api.md`).
+- **Pagination**: v3 responses carry a `pagination` envelope; loop with
+  `?continuation=<token>` while `has_more_items` is true.
+- **fpx exit codes**: `2` bridge down (pair/approve in Transporter), `3` bot
+  wall (refresh a signed-in eventbrite.com tab), `4` upstream non-2xx.
+- **Read-only**: these recipes only read data. The documented API supports
+  organizer writes (create/update events etc.) but they are out of scope
+  here — don't improvise write calls from this skill.
+- Never log or commit the token or captured cookies.

package/skills/eventbrite/references/discovery-api.md

@@ -0,0 +1,113 @@
+# Eventbrite discovery API (`www.eventbrite.com/api/v3/destination/…`) — fpx recipes
+
+Public event search/discovery. WAF-blocked server-side; every call here goes
+through the fpx bridge (`-p eventbrite`). Request shapes below were captured
+live from the site's own network traffic (2026-07-30, web_app discover
+v10.14.65).
+
+## CSRF (search POST only)
+
+GETs need nothing extra. The search POST requires the Django CSRF header,
+whose value is the `csrftoken` cookie (32 chars, JS-readable). Read it
+through the bridge — the profile must declare the cookie scope (see SKILL.md
+setup):
+
+```sh
+CSRF=$(fpx cookies csrftoken -p eventbrite | jq -r '.csrftoken')
+```
+
+If the cookie is absent, load any eventbrite.com page in the browser first.
+
+## Resolve a place id first
+
+Searches take internal place ids (e.g. Charlotte NC = `85981333`), never
+place names. The site itself resolves locations via Google Places, but the
+scriptable route is the SSR page store: fetch the browse page for the
+location slug and pull `placeId` out of the embedded `__SERVER_DATA__`:
+
+```sh
+# slug format: <state>--<city> (US) or <country>--<city>
+fpx get 'https://www.eventbrite.com/d/co--denver/events/' -p eventbrite \
+  | grep -oE '"placeId":"[0-9]+"' | head -1
+```
+
+The same SSR page embeds the full first page of results in
+`search_data.events` — for a quick "what's on in <city>" that GET alone may
+be all you need.
+
+## Event search
+
+```sh
+CSRF=$(fpx cookies csrftoken -p eventbrite | jq -r '.csrftoken')
+cat > /tmp/eb-search.json <<'EOF'
+{
+  "browse_surface": "search",
+  "event_search": {
+    "q": "blues",
+    "places": ["85981333"],
+    "dates": ["current_future"],
+    "dedup": true,
+    "page": 1,
+    "page_size": 20
+  },
+  "expand.destination_event": [
+    "primary_venue", "image", "ticket_availability",
+    "event_sales_status", "primary_organizer"
+  ]
+}
+EOF
+fpx post-json 'https://www.eventbrite.com/api/v3/destination/search/' @/tmp/eb-search.json \
+  -p eventbrite -H "X-CSRFToken: $CSRF" -H "X-Requested-With: XMLHttpRequest" \
+  | jq '.events.results[] | {id, name, start: .start_date, venue: .primary_venue.name, url}'
+```
+
+Body knobs (all inside `event_search`, all optional except you want at least
+`q` or `places`):
+
+- `q` — keyword text.
+- `places` — array of place-id strings (resolve first, above).
+- `dates` — array; `"current_future"` plus optionally one of `"today"`,
+  `"tomorrow"`, `"this_weekend"`; or `date_range: {from, to}` (ISO dates).
+- `tags` — category/format filters: `"EventbriteCategory/<id>"` (103 =
+  Music …), `"EventbriteSubCategory/<id>"`, `"EventbriteFormat/<id>"`. Ids
+  match the documented API's `/categories/` etc. (see token-api.md).
+- `online_events_only` — bool.
+- `price` — `"free"` or `"paid"`.
+- `page`, `page_size` (site uses 20), `dedup: true`.
+
+Response: `{events: {pagination: {object_count, page_count, continuation},
+results: [...]}, ...}` — paginate by incrementing `page`.
+
+## Event detail by id (GET, no CSRF)
+
+```sh
+fpx get 'https://www.eventbrite.com/api/v3/destination/events/?event_ids=<id>,<id>&expand=primary_venue,image,ticket_availability,event_sales_status,primary_organizer' \
+  -p eventbrite | jq '.events[]'
+```
+
+Event ids are the trailing digits in event URLs (`…-tickets-<id>`). For
+full ticket-class detail prefer the documented API (`token-api.md`) —
+`/events/<id>/` works for any public event with just a token.
+
+## Your account data through the bridge (no token needed)
+
+The www host proxies the documented v3 API with the browser session's auth,
+so the whole `token-api.md` surface also works session-authed via fpx —
+same paths, `www.eventbrite.com` host (live-verified: `/api/v3/users/me/`):
+
+```sh
+fpx get 'https://www.eventbrite.com/api/v3/users/me/orders/?expand=event&time_filter=current_future' \
+  -p eventbrite | jq '.orders[] | {id, event: .event.name.text}'
+```
+
+Prefer the token + curl for scripts (no browser dependency); use this when
+no token is configured.
+
+## Gotchas
+
+- A non-JSON 2xx body from any of these = the WAF interstitial leaked
+  through — refresh a signed-in eventbrite.com tab and retry.
+- `log_requests` / `log_engagement` endpoints seen in captures are
+  analytics — don't call them.
+- The `?stable_id=` query param on the site's own search calls is a client
+  analytics uuid — omit it.

package/skills/eventbrite/references/token-api.md

@@ -0,0 +1,102 @@
+# Eventbrite documented API (`eventbriteapi.com/v3`) — curl recipes
+
+Auth on every call: `-H "Authorization: Bearer $EVENTBRITE_TOKEN"`.
+Personal token: <https://www.eventbrite.com/platform/api-keys>.
+All endpoints end with a trailing slash — omitting it 301s.
+
+> Verification status (2026-07-30): `eventbriteapi.com` reachability and the
+> 401 error envelope are live-verified. Endpoint shapes were live-verified
+> through the session-authed www-host variant of the same v3 API
+> (`www.eventbrite.com/api/v3/…`): `/users/me/`, `/users/me/orders/`
+> envelope, `/users/me/organizations/` envelope, `/categories/`, and
+> `/events/<id>/?expand=venue,ticket_availability` on a public event.
+> `/ticket_classes/`, `/description/`, `/attendees/`, `/venues/`,
+> `/subcategories/`, `/formats/` follow the official API reference but
+> weren't exercised — eyeball the first response before building on a field.
+
+Shorthand used below:
+
+```sh
+eb() { curl -sS "https://www.eventbriteapi.com/v3$1" -H "Authorization: Bearer $EVENTBRITE_TOKEN"; }
+```
+
+## Identity
+
+```sh
+eb /users/me/ | jq '{id, name, email: .emails[0].email}'
+```
+
+## Your tickets / orders (attendee side)
+
+```sh
+# upcoming orders with the event expanded
+eb '/users/me/orders/?expand=event&time_filter=current_future' \
+  | jq '.orders[] | {id, status, event: .event.name.text, start: .event.start.local}'
+
+# one order with attendees (barcode-level detail)
+eb '/orders/<order_id>/?expand=attendees' | jq
+```
+
+`time_filter`: `all` | `current_future` | `past`.
+
+## Organizations you belong to (organizer side)
+
+```sh
+eb /users/me/organizations/ | jq '.organizations[] | {id, name}'
+
+# events for an org: status live|draft|started|ended|completed|canceled|all
+eb '/organizations/<org_id>/events/?status=live&order_by=start_asc' \
+  | jq '.events[] | {id, name: .name.text, start: .start.local, url}'
+
+# attendees / orders across the org
+eb '/organizations/<org_id>/attendees/?status=attending' | jq '.attendees[] | {profile: .profile.name, email: .profile.email, event_id}'
+eb '/organizations/<org_id>/orders/' | jq '.orders[] | {id, email, status}'
+```
+
+## Any event by id (works for public events, not just yours)
+
+```sh
+eb '/events/<event_id>/?expand=venue,organizer,ticket_availability' \
+  | jq '{name: .name.text, start: .start.local, end: .end.local, venue: .venue.name, is_free, status, url}'
+
+eb '/events/<event_id>/ticket_classes/' | jq '.ticket_classes[] | {name, free, cost: .cost.display, on_sale_status}'
+eb '/events/<event_id>/description/' | jq -r .description   # full HTML description
+eb '/events/<event_id>/attendees/' | jq                     # your own events only
+```
+
+Event ids are the long digits in any event URL (`…-tickets-<event_id>`).
+
+## Reference data
+
+```sh
+eb /categories/ | jq '.categories[] | {id, name}'
+eb /subcategories/ | jq '.subcategories[] | {id, name}'
+eb /formats/ | jq '.formats[] | {id, name}'
+eb '/venues/<venue_id>/' | jq '{name, address: .address.localized_address_display}'
+```
+
+## Pagination
+
+Every list response carries:
+
+```json
+{"pagination": {"object_count": 123, "page_size": 50, "has_more_items": true, "continuation": "..."}}
+```
+
+Loop with `?continuation=<token>` (repeat the original params) while
+`has_more_items` is true. `page_size` max is generally 100 for org-level
+lists, 50 elsewhere.
+
+## Errors
+
+Non-2xx bodies are JSON: `{"status_code": N, "error": "CODE",
+"error_description": "..."}`. Live-verified examples: bad token →
+`401 INVALID_AUTH`; missing CSRF (www host only) → `401 ACCESS_DENIED`.
+`404 NOT_FOUND` for unknown ids; `429` when rate-limited (token buckets:
+2,000 calls/hour per token by default).
+
+## No search here
+
+`GET /events/search/` was removed from this API (Dec 2019) — it now 404s.
+Public event discovery only exists on the WAF-walled consumer surface; see
+`discovery-api.md` (fpx bridge).