Space Context

app.spacecontextPublished by spacecontext.appOfficial publisherv0.2.1Updated Oct 30, 2026

The context layer for the physical world: filmed spaces as cited context for agents.

VerifiedStreamable HTTPWeb executableKnowledge & MemoryMedia & Design

Overview

AI-generated overview

Remote MCP server that gives assistants read access to your filmed Space Context spaces, with cited answers, scan comparisons and photo evidence.

What you can do
  • List, search and read spaces by section or as one Markdown page
  • Ask a space a question and get a short answer with citations
  • Review scan history, compare two scans and fetch the original evidence photo
  • Check scan status and follow a running scan's progress
  • With scan permission: check a frame, create, upload, start or cancel a scan, and read wallet balance and capture checklists
When to use it
Useful when you document real places, vehicles or appliances by filming them and want an assistant to answer questions about them, compare before-and-after scans, or check what changed, with evidence it can point to.
Requirements
A remote endpoint over Streamable HTTP with OAuth 2.1 sign-in; no key is pasted. A Space Context account (Apple, Google or emailed code, same as the iPhone app). Scanning additionally needs a card on file in the account, and the user must tick the scan permission during consent.
Before you install
Consent decides whether the assistant may see sensitive values such as Wi-Fi passwords, door and alarm codes and the narration; both are off by default. Starting a scan charges $1.00 from the balance after the free scan, and uploads send images through the server. Each connection creates an API key that can be revoked in the console.

Installation

In SourceWeft

  1. Open Space Context in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/app.spacecontext%2Fspacecontext/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "space-context": {
      "type": "http",
      "url": "https://mcp.spacecontext.app/mcp"
    }
  }
}

README

[Space Context]

Space Context MCP server

[License: MIT] [MCP] [OAuth 2.1] [Cloudflare Workers] [Docs]

A remote MCP server that gives Claude, ChatGPT, Codex, Cursor, VS Code or any MCP client access to your Space Context spaces. The assistant can list spaces, search them, read them by section or as one page, ask them questions, compare scans and show the photo evidence. Every item, issue and key location says whether a second, independent check found it on its own photo (verified, unconfirmed or from the narration), so the assistant knows what to state and what to hedge. If you allow it, it can also scan spaces for you.

text
https://mcp.spacecontext.app/mcp

It speaks MCP over Streamable HTTP and authorizes with OAuth 2.1 (dynamic client registration and client ID metadata documents). It's stateless (createMcpHandler from agents, MCP SDK v2) behind @cloudflare/workers-oauth-provider. This package isn't published to npm. Use the hosted server above, or deploy your own.

Connect an assistant

ClientHow
Claude (claude.ai, Desktop)Settings → Connectors → Add custom connector, paste the URL, Connect
Claude Codeclaude mcp add --transport http --scope user spacecontext https://mcp.spacecontext.app/mcp, then /mcp → Authenticate
Codexcodex mcp add spacecontext --url https://mcp.spacecontext.app/mcp, then codex mcp login spacecontext
ChatGPTSettings → Apps & Connectors → Advanced → Developer mode, then create a connector with the URL and OAuth
Cursor"spacecontext": { "url": "https://mcp.spacecontext.app/mcp" } under mcpServers in ~/.cursor/mcp.json, then Login in Cursor's MCP settings
VS Codecode --add-mcp '{"name":"spacecontext","type":"http","url":"https://mcp.spacecontext.app/mcp"}' (or servers in a workspace's .vscode/mcp.json), then MCP: List Servers → start it and sign in

You never paste a key. Connecting works like this:

  1. Your assistant opens a Space Context page. You sign in with Apple, Google or a code sent to your email, using the same account as the iPhone app.
  2. You choose whether the assistant may see sensitive values (Wi-Fi passwords, door and alarm codes, the narration) and whether it may scan spaces for you. By default it can do neither. Scanning needs a card on file in your account (added in the console, nothing charged): without one, the page offers to connect read-only instead, or to try again once the card is added.
  3. The server creates an API key for this connection only, listed as MCP · <assistant> in the console. Its scopes are spaces:read and scans:read, plus spaces:sensitive and scans:write if you ticked them.

Revoking that key in the console ends the connection, and the assistant asks you to sign in again. Connecting the same assistant again replaces its previous key. The assistant sees your live spaces, including the ones scanned with the iPhone app. A space from the app becomes readable once it has been screened for sensitive values: the first read starts the screening, which takes a minute or two. Full guide: Connect an assistant.

Tools

Reading tools, on every connection (annotated read-only and idempotent):

Tool
list_spacesSpaces with their latest scan, 50 per page
search_spacesThe records that best answer a question, across all spaces or one, in any language
get_spaceA space by section (areas, items, issues, key locations, instructions, facts, Q&A, coverage), optionally with evidence
get_space_markdownThe whole space as one Markdown page, to load it as context in one call
ask_spaceA short answer with citations, or documented: false
list_scans, compare_scansThe scan history, and what changed between two scans, with evidence from both
get_evidence_photoThe original video frame behind a record, as an image
get_scan_status, follow_scanWhere a scan is; follow_scan waits on the event stream and reports progress
walletBalance, free scans left, price of a scan
capture_checklistWhat to film for a type of space (a flat, a car, a boat, an appliance…), before a scan

These tools work only on a connection where the user ticked let it scan spaces. On any other connection the API refuses them with INSUFFICIENT_SCOPE:

Tool
check_frameIs this photo usable, and which key locations does it show (with space_type, those of that type and the area); nothing is stored or charged
create_scanDeclares a scan of an existing or a new space and returns the upload instructions
upload_frameSends one image of a frames scan through the server, which holds the key
start_scanStarts and charges a scan: the free scan first, then $1.00 from the balance; refunded if it fails
cancel_scanCancels a scan that hasn't started; nothing is charged

Resources: spacecontext://spaces (the list, JSON) and spacecontext://spaces/{space_id} (a space as Markdown). Prompts: check_out_report (compare two scans and write a report that keeps confirmed changes apart from what may be missing) and where_is (find one thing, with its area and evidence photo).

No tool reaches the open web. Space content is returned as data, never as instructions: the server's instructions say so, and so does a note in every result that carries space content. The server card at /.well-known/mcp/server-card.json lists tools, resources and prompts before sign-in. Arguments and results: MCP tools.

Deploy your own

The server is a Cloudflare Worker that talks to a Space Context API (…/v1, with API_V1_ENABLED = "true"). It signs people in through the API's own sign-in endpoints and creates one API key per connection. Everything it keeps is in KV: OAuth clients, grants and tokens (grants carry the connection's API key and are encrypted by the OAuth library), and sign-ins in progress, for ten minutes, encrypted with a key that only the user's browser holds.

1. Install and build the SDK (the server imports it), from the repository root:

bash
npm installnpm run build -w @spacecontext/sdk

2. Create the KV namespace for OAuth clients, grants and tokens, and put its id in kv_namespaces in wrangler.jsonc. This and the next steps run in packages/mcp:

bash
cd packages/mcpnpx wrangler kv namespace create OAUTH_KV

3. Set the configuration in wrangler.jsonc (name, the custom domain in routes, and vars):

API_BASE_URLThe API base, for example https://api.spacecontext.app/v1
PUBLIC_URLThis server's origin. It names the protected resource (/.well-known/oauth-protected-resource/mcp) and is the only origin the consent forms accept posts from
GOOGLE_WEB_CLIENT_IDOptional: the Google web OAuth client for "Continue with Google"
APPLE_SERVICES_IDOptional: the Services ID for "Sign in with Apple"
BACKEND (services)Optional: a service binding to the API Worker. Through it, the API sees each user's own IP for its rate limits and sign-in protection. Without it, the server calls API_BASE_URL over the internet and every user shares the Worker's IP. Remove the entry if the API isn't a Worker in your account

4. Add the secret for Google sign-in:

bash
npx wrangler secret put GOOGLE_WEB_CLIENT_SECRET

5. Register the callback URLs with the providers:

  • Google: add ${PUBLIC_URL}/authorize/google/callback as an authorized redirect URI of the web OAuth client.
  • Apple: add ${PUBLIC_URL}/authorize/apple/callback as a return URL of the Services ID.

Without both GOOGLE_WEB_CLIENT_ID and the secret, the Google button isn't shown, and the same goes for Apple without APPLE_SERVICES_ID. Email sign-in is always offered. The API checks Google and Apple tokens against its own web client ID and Services ID, so use the same ones the API is configured with.

6. Deploy:

bash
npm run deploy     # wrangler deploy of the top-level environment

Keep these settings from wrangler.jsonc:

  • global_fetch_strictly_public stays on. The server fetches client metadata documents from URLs that clients choose, so a plain fetch must never reach private addresses. The API is reached through the BACKEND binding.
  • With workers_dev and preview_urls off, the server answers only on its custom domain.
  • ratelimits limit each client IP to 10 registrations (/register) and 60 sign-in page requests (/authorize…) a minute, answered with 429 and Retry-After: 60 beyond. Rate limits aren't inherited by environments, and each namespace_id must be unique in your Cloudflare account. Without the bindings (as in dev) nothing is limited.
  • Access tokens last one hour. A grant lives for 90 days after its last refresh. A client registered dynamically is deleted after 180 days without a token request.

wrangler.jsonc also defines dev (local, see below) and staging (Space Context's own staging deployment).

Develop

bash
npm run dev -w @spacecontext/mcp     # http://localhost:8788, against an API on 127.0.0.1:8787npm test -w @spacecontext/mcp        # the full OAuth flow and MCP calls in workerd, against a fake API

The API isn't part of this repository. The tests don't need it: they drive registration, PKCE, consent, token and real MCP calls against a fake API. The dev environment sets no Google or Apple client, so local sign-in uses the emailed code. Read CONTRIBUTING.md before adding a tool: any tool that writes or spends must sit behind scans:write and be annotated honestly.

MIT © Finikos S.r.l.

Source: packages/mcp/README.md at commit 0aab27d

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

2
  1. v0.2.1LatestOct 15, 2026
  2. v0.2.0Oct 14, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts