Agent integrations (MCP)
GANA exposes a Model Context Protocol server so AI clients like ChatGPT, Claude, and Cursor can read the public catalog and — with your permission — your own GANA subscription.
Server endpoint
https://gana-energy-forge.lovable.app/mcp
Transport: MCP Streamable HTTP. Auth: OAuth 2.1 (Supabase authorization server). Dynamic client registration is enabled — compatible clients self-register.
OAuth & scopes
GANA acts as an OAuth 2.1 resource server. The authorization server issues short-lived access tokens for the signed-in GANA user; the MCP server verifies each token before invoking a tool.
- Requested scopes:
openid email profile— identity only. These let the client know who you are; they do not grant blanket data access. - Data permissions: enforced by GANA's row-level security, not by OAuth scope. Tools that touch your data run as you, so you only ever see your own rows.
- Audience:
authenticated. App-session tokens copied from the browser are rejected — only OAuth-client tokens from the GANA authorization server verify. - Token lifetime: managed by the authorization server. Revoke access any time from your GANA account.
Tool catalog
| Tool | Access | Reads |
|---|---|---|
list_products List GANA products Return the GANA catalog: pricing, flavors, sizes, protein details. | Public | Static product data — no user identity required. |
list_journal_posts List published Founder Journal posts Return published essays from the Founder Journal. | Public | Rows in journal_posts where status = 'published'. |
get_my_membership Get my GANA subscription Return the signed-in user's subscription tier, status, and renewal dates. | RLS-scoped | The caller's own row in memberships (RLS enforced as that user). |
list_my_subscriptions List my recurring deliveries Return the signed-in user's recurring deliveries and next-ship dates. | RLS-scoped | The caller's rows in recurring_orders (RLS enforced as that user). |
Public tools return content GANA already publishes on the web. RLS-scoped tools run under Postgres row-level security as the signed-in user — they never return another member's data, even if a client asks.
Consent behavior
When a client requests access, GANA shows a consent screen at/.lovable/oauth/consent that names the client, the GANA account being used, and the identity data being shared.
- You must be signed in to GANA to consent. If not, GANA sends you through sign-in and returns to the same consent request.
- Approve issues a token to the client. It can then call the tools above as you.
- Cancel denies the request. No token is issued and the client is notified.
- Consent is per client. Approving one AI client does not grant access to another.
- Approval does not bypass GANA's permissions or backend policies. RLS still decides what each tool can read.
Connecting a client
- In your MCP-capable client (ChatGPT, Claude, Cursor, Lovable), add a new MCP server with the URL
https://gana-energy-forge.lovable.app/mcp. - The client discovers the OAuth server, self-registers, and opens the GANA consent screen in your browser.
- Sign in to GANA (if needed), review the request, and approve.
- The client can now call the tools listed above.
Reporting an issue
Found a bug or a tool returning data it shouldn't? Emailhello@ganawellness.comand we'll investigate.