LeapSurge MCP — PRODUCTION Entra (Claude, ChatGPT & Copilot)

LeapSurge / Alkem Sales MCP Endpoint — PRODUCTION Entra

Users sign in with the PRODUCTION Entra app (real M365 users). The
Entra-verified email scopes the real business data. This is the endpoint to
validate the actual numbers.

Curated primary-sales analytics over `datamarts.sandbox`. The endpoint
exposes one flexible analytics tool plus entity resolution, guarded SQL,
schema inspection and KPI-definition tools.

**URL:** `POST /api/mcp/LeapSurgeR`

**Header:**
- `Mcp-Session-Id` (optional but recommended) — echoed in every response.

**Methods Supported (`method`):**
- `initialize` — advertises `LEAPSURGE_SYSTEM_PROMPT` as MCP instructions
- `notifications/initialized`
- `ping`
- `tools/list`
- `tools/call`

**Example — List tools:**

    {"jsonrpc":"2.0","method":"tools/list","params":{},"id":1}

**Example — Sales by division for FY2026:**

    {
      "jsonrpc": "2.0",
      "method": "tools/call",
      "params": {
        "name": "Sales",
        "arguments": {
          "measures": ["net_sales", "sale_qty"],
          "group_by": ["division"],
          "period": {"type": "fy", "value": "FY2026"},
          "top_n": 10
        }
      },
      "id": 1
    }

**Tools**
- `Sales`
- `ResolveEntity`
- `RunSQL`
- `DescribeTable`
- `GetKpiDefinition`

**Security**
- Curated `Sales` SQL builder for normal analytics
- `RunSQL` is read-only, single-statement, table-allowlisted and row-limited
- Same Databricks connection as `/api/mcp/databricks`
- Session ID echoed to prevent connector session expiry
- OAuth 2.1 federated to Microsoft Entra ID (`require_mcp_auth`): each user
  signs in with their M365 account and the Entra-verified email scopes every
  secured dataset to that user. Claude/ChatGPT self-register (DCR, paste the
  URL only); Copilot Studio uses a static client.