AI assistant

The dashboard chat assistant and the MCP endpoint it uses to read and change store data.

Openfront has a chat assistant in the dashboard's right sidebar. It sends your messages to a model on OpenRouter. The model can call tools on the app's MCP endpoint, which run GraphQL as you.

How it works

You send a message

The sidebar posts to /api/completion. Only the last 20 messages are sent.

In shared mode the route requires a signed-in user with dashboard access and uses OPENROUTER_API_KEY, OPENROUTER_MODEL and OPENROUTER_MAX_TOKENS (default 4000). If those are not set, shared mode returns "Shared AI is not available". In local mode the browser sends your own OpenRouter key and model, which the dashboard keeps in localStorage.

The model calls MCP tools

The route connects to /api/mcp-transport/http and forwards only your session cookie. Each tool runs a GraphQL request with that cookie, so it has exactly your permissions.

MCP tools

app/api/mcp-transport/[transport]/route.ts exposes these tools:

Schema and data: listModels, searchModels, getFieldsForType, lookupInputType, queryData, createData, updateData, deleteData, modelSpecificSearch.
Shopping: searchProducts, getProduct, getAvailableRegions, getAvailableCountries, createCart, getCart, addToCart, updateCartItem, removeCartItem, applyDiscount, setShippingAddress, setBillingAddress, getShippingOptions, setShippingMethod, getPaymentProviders, createPaymentSessions, setPaymentMethod, placeOrder, getOrder, getCheckoutLink.

External MCP clients

Other MCP clients can connect to the same endpoint with OAuth. The discovery documents are at /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource and /.well-known/openid-configuration. The flow uses /oauth/register, /oauth/authorize, /oauth/token, /oauth/revoke, and /oauth/connections to review connected apps. Scopes are mcp:read and mcp:write. Access tokens last one hour and refresh tokens 30 days.

An MCP token acts as the user who approved it. Without mcp:write, mutations are refused. Connected apps can never sign in, change passwords, emails, tokens, API keys or OAuth records.

Where to customize

app/api/completion/route.ts
app/api/mcp-transport/[transport]/route.ts
features/keystone/mcp-oauth/
features/dashboard/hooks/use-chat-submission.tsx, use-ai-config.tsx
features/dashboard/components/dual-sidebar/ai-chat-sidebar.tsx
The assistant is only as safe as your roles. It can do anything your user can do, including deletes.
Local-mode keys are stored in the browser's localStorage.
Messages and tool results go to OpenRouter and the model provider you choose. Do not use it with data you cannot send to them.
getCheckoutLink builds a legacy /account/checkout-link?cartId= URL that the current storefront does not accept.