# RPG Toolbox

> Collaborative campaign builder for tabletop RPGs. Humans manage characters, locations, quests, and notes in the web app. Agents talk to the same campaign over MCP — the same tools as the in-app assistant, no second LLM hop.

RPG Toolbox is at https://rpgtoolbox.org. Campaigns are passphrase accounts (no email). MCP authenticates with OAuth 2.1 + PKCE; never a session cookie or passphrase in the agent config.

## Pages

- [Home](https://rpgtoolbox.org/): Sign in with a passphrase, then build and share campaigns.
- [Add this to your agent](https://rpgtoolbox.org/agents): How to connect Cursor, Claude Code, or any MCP client. Human-readable. OAuth — never a session cookie.
- [About](https://rpgtoolbox.org/about): What the app does.
- [Changelog](https://rpgtoolbox.org/changelog): Release notes.
- [Mindmap](https://rpgtoolbox.org/mindmap): Campaign relationship map.
- [OAuth connector setup](https://rpgtoolbox.org/mcp/setup): Claude.ai / ChatGPT custom connector walkthrough.

## For agents

- [MCP server](https://rpgtoolbox.org/mcp): Model Context Protocol, stateless Streamable HTTP (`2026-07-28`). POST JSON-RPC only. GET/DELETE return 405 (no SSE, no sessions). Dual-stack: modern clients use `server/discover` plus `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers; current Cursor may send `initialize` (no `Mcp-Session-Id` is minted). All tools require OAuth. Human setup: https://rpgtoolbox.org/agents.
- Auth: OAuth 2.1 authorization code + PKCE S256 + RFC 8707 resource indicators. Dynamic client registration is open. Access tokens go in `Authorization: Bearer …`. Missing/invalid token → HTTP 401 with `WWW-Authenticate`. **Do not paste a web session cookie or account passphrase.** The MCP server rejects them.
- [OAuth metadata](https://rpgtoolbox.org/.well-known/oauth-authorization-server): RFC 8414. Protected resource: https://rpgtoolbox.org/.well-known/oauth-protected-resource
- [Server info](https://rpgtoolbox.org/mcp/info): JSON capabilities, protocol versions, endpoints.
- Campaign context is the authenticated user's `current_campaign_id`, not a protocol session. Call `list_campaigns` then `select_campaign` before mutating if none is selected. Destructive tools require `confirm=true`.
- Tools (same as the in-app assistant): campaign info and selection; characters and inventory; locations; notebook / journal / quests / session logs; dice; mind maps; search. Resources under `rpg://`. Prompts: `summarize_session`, `generate_npc`, `prep_next_session`, `recap_arc`.

## Notes

- Cursor mcp.json: `{ "rpg-toolbox": { "type": "http", "url": "https://rpgtoolbox.org/mcp" } }`
- Claude Code: `claude mcp add --transport http rpg-toolbox https://rpgtoolbox.org/mcp`
- The agent completes OAuth in the browser. Do not put `rpgbuilder-session-token` or a passphrase in `headers`.
- Setup walkthrough for humans: https://rpgtoolbox.org/agents
- Local: http://localhost:3000/mcp
- Operated by Carbonitex. Source: https://github.com/Carbonitex/matts-rpg-builder