feat: multi-workspace support via X-Weeek-Token + Claude Desktop compatibility

[ainurminibaev]

Summary

• Multi-workspace support: Single server instance serves multiple Weeek workspaces. Each client passes their own Weeek API token via X-Weeek-Token header — the server uses it per-request instead of the server-level WEEEK_TOKEN env var (which is now optional).
• Query parameter auth: Added support for ?api_key=...&weeek_token=... URL query parameters, since Claude Desktop's connector UI doesn't support custom headers.
• Deploy docs: Added deploy/ folder with production-ready docker-compose, nginx HTTPS reverse proxy config template, and comprehensive setup documentation for Claude Code CLI, Claude Desktop (via mcp-remote bridge), and Cursor IDE.

Changes

File	What changed
src/config.py	WEEEK_TOKEN is now optional (default empty)
src/weeek_client.py	Added ContextVar for per-request token override
src/server.py	Added WeeekTokenMiddleware, query param support in APIKeyAuthMiddleware
deploy/	docker-compose, nginx template, .env.example, full README

How it works

1. Client connects to SSE with Authorization: Bearer <MCP_API_KEY> (server access) and X-Weeek-Token: <personal_token> (Weeek API access)
2. WeeekTokenMiddleware extracts the token and stores it in a ContextVar
3. WeeekClient._request() picks up the per-request token and overrides the Authorization header for Weeek API calls
4. Each user gets their own workspace view through the same server instance

Claude Desktop integration

Claude Desktop connector UI only supports URL + OAuth — no custom headers. Workaround using mcp-remote:

{
  "mcpServers": {
    "weeek": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://your-domain.com/sse",
        "--header", "Authorization: Bearer YOUR_MCP_API_KEY",
        "--header", "X-Weeek-Token: YOUR_WEEEK_TOKEN"
      ]
    }
  }
}

Test plan

• Verified multi-workspace: two different Weeek tokens through one server, each sees their own workspace
• Verified query param auth: ?api_key=... accepted, wrong key returns 401
• Verified backwards compatibility: header-based auth still works
• Health endpoint works without auth
• Running in production behind nginx HTTPS for 4+ days

🤖 Generated with Claude Code