Dreambooth Studio

What Dreambooth Studio MCP server does

Dreambooth Studio MCP server exposes the Studio API through MCP tools for operators managing photobooths. It can retrieve sessions, gallery statistics, projects, revenue summaries, credit balances, wallet transactions, and booth-related information. It also includes documentation search that does not require an account connection.

The server does not maintain a separate database or duplicate Studio business logic. Each operation delegates to an existing Studio API route, keeping calculations such as revenue summaries in the Studio system. Withdrawals, payout accounts, MFA or step-up flows, subscription token regeneration, and administrative API routes are outside its scope.

How it works

The service is available through Streamable HTTP at https://mcp.dreamboothstudio.com/mcp and can also run over stdio. The repository provides separate development commands for the HTTP and stdio transports, along with build and inspection commands.

Account access is initiated by calling connect_account. That starts the Studio's device flow and returns a Google link for the operator to open. The server polls in the background instead of keeping the tool call open. Device-flow credentials remain in memory and are isolated per MCP session; restarting the service requires accounts to connect again.

Clients that send their own bearer token use the OAuth path. OAuth access tokens expire after one hour, carry approved scopes, and can be revoked. Device-flow tokens can read data but cannot perform connector write operations. The write tools remain visible in the tool list, while an unauthorized call receives the Studio's refusal response.

Setup and configuration

Install dependencies with npm install, copy .env.example to .env, and run npm run dev for Streamable HTTP or npm run dev:stdio for stdio. The HTTP development server uses PORT, defaulting to 8080. Build with npm run build before starting the production process.

Deployment configuration uses DREAMBOOTH_API_URL and ALLOWED_HOSTS. The host allow-list should include every public hostname serving the MCP endpoint, including both a custom domain and any active platform-generated hostname. An empty ALLOWED_HOSTS value disables this protection.

The service is stateless and has no volume or credential store. Leave MCP_DIAGNOSTICS unset in production; setting it to 1 registers the session_info diagnostic tool.

Tools and capabilities

Read-oriented tools include get_sessions, get_gallery_stats, list_projects, get_project, get_revenue_summary, get_credits, and get_wallet_transactions. search_docs is available without authentication. Booth and creative-workflow tools cover create_booth, start_booth, refine_booth, get_booth_draft, update_booth_draft, create_filter, preview_filter, duplicate_project, start_frame, refine_frame, check_generation, and save_frame.

Operations that create or edit Studio resources require the booths:write permission in addition to bearer authentication. Read access alone is sufficient for inspection tools and filter previews.

Limitations and notes

The tool inventory is fixed across connections rather than changing based on whether a bearer token is present. Authentication is checked when protected tools are called. A session that has not connected an account can use only search_docs.

The older device-flow credential lasts for one year, has no scopes, and cannot be revoked. Its access is intentionally restricted so it cannot perform write operations. OAuth provides shorter-lived, scoped credentials instead.

The repository includes smoke checks for stdio and HTTP behavior, including unauthenticated error handling and session isolation. The production service does not store account tokens, so operators must reconnect after a restart when using the device flow.