Chasa MCP Server

Chasa

Paste your unpaid invoices. Get the follow-up email already written, in the right tone for how late it is.

Chasa never emails your clients for you — it drafts follow-ups you copy into Gmail, Outlook, or Apple Mail. Tone escalates with days overdue (friendly → firm → direct).

Live URLs

Worker PUBLIC_APP_URL is https://chasa.io (magic links, OAuth callbacks, Stripe return URLs, digest links).

Go-live checklist

1. Attach chasa.io on Cloudflare Pages project chasa and wait for Active.
2. Redirect www → apex. Pages _redirects cannot match hostnames, so use Bulk Redirects: source www.chasa.io → target https://chasa.io, 301, with preserve query string, subpath matching and preserve path suffix. Needs a proxied www DNS record (CNAME → chasa-71s.pages.dev, or A → 192.0.2.1 if apex-only).
3. DNS helper (needs CLOUDFLARE_API_TOKEN with Zone DNS Edit): ./scripts/go-live-dns.sh
4. Confirm accounting OAuth secrets are set on the worker (QBO_CLIENT_ID / QBO_CLIENT_SECRET, XERO_CLIENT_ID / XERO_CLIENT_SECRET) and redirect URIs registered in Intuit / Xero developer consoles:
   • https://api.chasa.io/api/account/connectors/quickbooks/callback
   • https://api.chasa.io/api/account/connectors/xero/callback
5. Run ./scripts/go-live-verify.sh.

The order does not matter: browser-facing links are built from the origin the request came in on (see “App origin resolution” below), so pages.dev and chasa.io both keep working whichever is deployed first.

App origin resolution

Magic links, post-login redirects, Stripe return URLs and team invites use the origin the user is actually on, not PUBLIC_APP_URL. The Pages /api proxy forwards it as X-Chasa-App-Origin, and the worker honours it only if it matches lib/appUrl.ts's allowlist (PUBLIC_APP_URL, chasa.io, www.chasa.io, *.pages.dev project/preview hosts, localhost). This keeps preview deploys self-contained and makes the domain cutover zero-downtime.

Requests that arrive without a trusted origin — provider OAuth callbacks hitting api.chasa.io directly, and the digest cron — still fall back to PUBLIC_APP_URL, so those links only work once chasa.io resolves.

---

Product specs

Plans & pricing

Stripe price IDs live in apps/worker/wrangler.toml as STRIPE_PRICE_SOLO, STRIPE_PRICE_PRO, STRIPE_PRICE_ENTERPRISE (non-secret). Billing portal and webhooks update accounts.plan and is_paid.

Feature matrix (by plan)

Workspace roles: owner is always admin. Invited members can use Solo+ features; admin-only actions: branding, webhooks, connector OAuth connect/import, API key CRUD, team invites.

App routes (/app/*)

All app routes except /login and /admin require a session. Unauthenticated users redirect to /login. SPA analytics require cookie consent (GDPR).

i18n (EN + ES)

Same path as Docracy: lightweight catalogs in apps/web/app/src/lib/i18n/ (no i18next). LocaleProvider + EN|ES switcher on login, sidebar, and More sheet. P1 covers login / shell / welcome; expand catalogs for the rest of the app next. Preference stored as chasa_locale. Marketing HTML stays English until a later pass.

Marketing & SEO (static HTML in apps/web/public/)

• Homepage with pricing, FAQ JSON-LD, competitor comparison
• SEO landing pages: /invoice-follow-up, /payment-reminder, /overdue-invoice, /chase-invoices, /freelancer-invoice-follow-up
• /features/ (index, AI tone, templates), /docs/, /ai, /about
• /blog/ (3 articles + dynamic post.html)
• /free-templates/ — 15 generated template pages + index
• Legal: /privacy, /terms, /imprint
• sitemap.xml, robots.txt, 404.html, cookie consent, scroll-depth analytics
• Self-hosted fonts (no Google Fonts); enforcing CSP via _headers

Regenerate free templates after editing apps/web/scripts/generate-free-templates.mjs:

npm run generate:templates --workspace apps/web

---

Architecture

Monorepo (npm workspaces):

apps/web/
  app/              React SPA (/app/*) — lazy-loaded routes, AccountProvider
    src/pages/tool/     Tool module (components, CSV import, aging sync)
    src/pages/connector/ Connector module (OAuth, API keys)
  public/           Static marketing site + fonts + _headers
  scripts/          copy-fonts, generate-free-templates, validate-static-html

apps/worker/
  src/routes/       HTTP handlers (auth, billing, emails, aging, mcp, …)
  src/lib/          auth, ai, billing, schemas (Zod), rate limits, webhooks
  migrations/       D1 SQL (0001–0011)

Data: Cloudflare D1 (chasa-db). OAuth tokens encrypted at rest (AES-GCM, TOKEN_SECRET). Sessions in sessions table; magic links single-use (atomic consume).

AI: Cloudflare Workers AI (@cf/meta/llama-3.1-8b-instruct-fp8). Prompts wrap user content in delimiters to reduce injection.

API surface (worker)

---

Security & compliance (implemented)

• Free-tier quota: 5 AI drafts/month enforced in D1 (ai_usage), not client-side
• Rate limits: AI drafts, MCP, analytics, admin login (D1 buckets)
• Turnstile: fail-closed in production HTTPS when secret is set; 60s magic-link cooldown per email
• HKDF token purposes: separate keys for session, magic-link, API key, admin, invite, OAuth state, webhook signing (legacy hash fallback on lookup)
• Session rotation: prior sessions invalidated on magic-link login; admin sessions cleared on admin login
• Session cleanup: daily cron purges expired sessions, magic links, rate-limit buckets
• RBAC: workspace admin for branding, webhooks, connector OAuth, API keys, team invites
• Input validation: Zod schemas on all JSON API routes (auth, emails, clients, team, webhooks, billing, admin, MCP draft args)
• Stripe webhooks: event-id deduplication (stripe_events)
• Outbound webhooks: X-Chasa-Signature: sha256=… HMAC
• Click tracking: redirects only to URLs stored when the tracked email was created
• Webhook URLs: SSRF checks (no localhost / private IPs)
• OAuth state: timing-safe HMAC compare
• CSP: enforcing policy on Pages; report-uri → /api/csp-report
• GDPR: cookie consent gates SPA analytics; no visitor IDs on page views (aggregate only)
• Secrets: never committed — wrangler secret put …

---

Local development

npm install
npm run dev:worker   # wrangler dev --local, http://127.0.0.1:8787
npm run dev:web      # vite, http://localhost:5173 (proxies /api to worker)

Without RESEND_API_KEY, magic links log to the worker console — copy the URL into your browser.

Quality checks

npm run lint          # ESLint (web app + worker)
npm run test          # Vitest (schemas, crypto, dates)
npm run typecheck     # tsc worker + vite build web

CI (.github/workflows/ci.yml) runs lint → test → static HTML validation → typecheck on every PR; auto-deploys worker + web on push to main when CLOUDFLARE_API_TOKEN is set.

Deploy manually

npm run deploy:worker
npm run deploy:web    # builds (copies fonts) then pages deploy

After schema changes:

cd apps/worker
wrangler d1 migrations apply chasa-db --local    # dev
wrangler d1 migrations apply chasa-db --remote   # production

Migrations 0001–0011 include plans, admin/analytics, branding, webhooks, API keys, cloud connectors, clients/aging, parity features, and security hardening (rate limits, AI usage, Stripe idempotency, tracking link allowlist).

---

Cloudflare Turnstile (bot protection)

Protects /api/auth/request and admin login.

1. Cloudflare Dashboard → Turnstile → Add widget
2. Hostnames: chasa-71s.pages.dev, chasa.io, localhost
3. Site key → TURNSTILE_SITE_KEY in wrangler.toml [vars]
4. Secret → wrangler secret put TURNSTILE_SECRET_KEY
5. Redeploy worker. Login UI reads config from GET /api/auth/config.

Local / without keys: verification bypassed with console warning. Test keys:

---

One-time cloud setup

1. cd apps/worker && wrangler d1 create chasa-db — paste database_id into wrangler.toml

2. wrangler d1 migrations apply chasa-db --remote

3. Stripe (test mode first): create three recurring Prices (Solo $7, Pro $17, Enterprise). Copy price_… IDs into wrangler.toml:

   • STRIPE_PRICE_SOLO, STRIPE_PRICE_PRO, STRIPE_PRICE_ENTERPRISE

4. wrangler secret put TOKEN_SECRET — openssl rand -hex 32

5. wrangler secret put STRIPE_SECRET_KEY (test key first)

6. Stripe webhook → https://api.chasa.io/api/billing/webhook — events: checkout.session.completed, customer.subscription.deleted → wrangler secret put STRIPE_WEBHOOK_SECRET

7. wrangler secret put RESEND_API_KEY — verify sending domain in Resend

8. Turnstile — see above

9. wrangler secret put ADMIN_PASSWORD — for /app/admin

10. Cloud storage OAuth (optional, Solo+):

    Provider	Redirect URI
    Dropbox	https://api.chasa.io/api/account/connectors/dropbox/callback
    OneDrive	https://api.chasa.io/api/account/connectors/onedrive/callback
    Box	https://api.chasa.io/api/account/connectors/box/callback
    Google	https://api.chasa.io/api/account/connectors/google/callback

    Google Sign-In redirect: https://api.chasa.io/api/auth/google/callback

    wrangler secret put DROPBOX_CLIENT_ID
    wrangler secret put DROPBOX_CLIENT_SECRET
    wrangler secret put ONEDRIVE_CLIENT_ID
    wrangler secret put ONEDRIVE_CLIENT_SECRET
    wrangler secret put BOX_CLIENT_ID
    wrangler secret put BOX_CLIENT_SECRET
    wrangler secret put GOOGLE_LOGIN_CLIENT_SECRET
    wrangler secret put GOOGLE_INTEGRATIONS_CLIENT_SECRET
    

11. QuickBooks Online + Xero (optional, Solo+):

    Provider	Redirect URI
    QBO	https://api.chasa.io/api/account/connectors/quickbooks/callback
    Xero	https://api.chasa.io/api/account/connectors/xero/callback

    wrangler secret put QBO_CLIENT_ID
    wrangler secret put QBO_CLIENT_SECRET
    wrangler secret put XERO_CLIENT_ID
    wrangler secret put XERO_CLIENT_SECRET
    

12. Cloudflare Pages project chasa + custom domain chasa.io; Worker custom domain api.chasa.io

13. Switch to Stripe live keys/prices/webhook only after end-to-end test-mode smoke test

Local secrets (apps/worker/.dev.vars, gitignored)

TOKEN_SECRET=dev-secret-not-for-prod
STRIPE_SECRET_KEY=sk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...
ADMIN_PASSWORD=your-dev-admin-password
# Optional Turnstile test keys (or omit to bypass):
# TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA

Stripe CLI for local webhooks:

stripe listen --forward-to localhost:8787/api/billing/webhook

Staging environment

wrangler deploy --env staging

Uses separate D1 (chasa-db-staging) — create and paste ID in wrangler.toml [env.staging].

---

SEO launch checklist

Automated (build)

generate-seo.mjs runs on every npm run build and writes:

• sitemap.xml — all public pages (marketing, templates, blog)
• robots.txt — crawl rules + sitemap URL
• blog/feed.xml — RSS for blog posts
• {indexnow-key}.txt — IndexNow key file for Bing/Yandex
• Verification meta on index.html / ai.html when env vars are set (see below)

Press kit at /press — logos, boilerplate, suggested anchor text for backlinks.

Google Search Console (one-time)

1. Add property https://chasa.io at Search Console

2. Choose HTML tag verification → copy the content="…" value

3. Rebuild with the token:

   GOOGLE_SITE_VERIFICATION=your_token_here npm run build --workspace apps/web
   npm run deploy:web
   

   Or use DNS TXT in Cloudflare (no rebuild needed).

4. Submit sitemap: https://chasa.io/sitemap.xml

5. URL Inspection on /, /app/, /payment-reminder, /free-templates/

Optional Bing: BING_SITE_VERIFICATION=… same as Google.

After deploy, ping IndexNow (Bing):

curl -X POST https://api.indexnow.org/indexnow \
  -H 'Content-Type: application/json' \
  -d '{"host":"chasa.io","key":"chasa-indexnow-20260727","keyLocation":"https://chasa.io/chasa-indexnow-20260727.txt","urlList":["https://chasa.io/sitemap.xml"]}'

Backlinks (founder — use /press)

Site-side done: social links + sameAs schema on all pages, internal links from blog → landing pages, RSS + llms.txt.

Still manual (copy from press kit):

• LinkedIn company page — website field + launch post linking to /app/ or a blog article
• X @chasaHQ — pin launch post
• Product Hunt / Indie Hackers when ready
• RELACON GmbH website cross-link to chasa.io
• 3–5 freelancer communities — link to /blog/ articles or /free-templates/, not just homepage
• Email signature with chasa.io

---

Entity

Chasa is a product of RELACON GmbH, Vienna, Austria. See /imprint and /privacy.

Contact: founder@chasa.io