Skip to main content

:::warning AUTO-GENERATED — do not edit This page is generated from the MCP server snapshot content/backend-mcp.json. Edit the source MCP server (not this file), then run npm run generate. :::

Add a new Flask blueprint route (schema-validated, auth-guarded)

When to use: You need to expose a new backend HTTP route on the Rystad Flask API and it must validate its input and be protected by auth.

Prerequisites​

  • You know the business domain and the exact data the route must return.
  • The rystad-backend MCP server is connected.
  • You have confirmed the route does not already exist (avoid duplicate paths).

Steps​

Step 1: Read the non-negotiable backend rules before writing any code.​

Tools: get_backend_guardrails

Step 2: List existing backend endpoints so you target the right blueprint and avoid a duplicate path.​

Tools: list_backend_endpoints

Step 3: Validate the proposed method + path against the real codebase BEFORE writing it.​

Tools: validate_backend_endpoint

Step 4: Fetch the canonical endpoint handler skeleton and copy its structure.​

Tools: get_endpoint_template

Step 5: Add the blueprint route, validate the request payload/query against a schema, and return the standard JSON envelope.​

Step 6: Apply the auth guard to the new route (see add-auth-guard recipe).​

Tools: get_auth_pattern

Step 7: Re-validate the finished route and run the verify gate.​

Tools: validate_backend_endpoint

Full recipe definition​

The complete machine-readable recipe as returned by the MCP server:

{
  "id": "create-endpoint",
  "title": "Add a new Flask blueprint route (schema-validated, auth-guarded)",
  "when": "You need to expose a new backend HTTP route on the Rystad Flask API and it must validate its input and be protected by auth.",
  "prerequisites": [
    "You know the business domain and the exact data the route must return.",
    "The `rystad-backend` MCP server is connected.",
    "You have confirmed the route does not already exist (avoid duplicate paths)."
  ],
  "steps": [
    {
      "action": "Read the non-negotiable backend rules before writing any code.",
      "tools": [
        "get_backend_guardrails"
      ],
      "note": "Confirms the anti-hallucination policy: never invent Flask helpers, wrapper APIs, or DB calls."
    },
    {
      "action": "List existing backend endpoints so you target the right blueprint and avoid a duplicate path.",
      "tools": [
        "list_backend_endpoints"
      ],
      "note": "Returns {method, path, summary, source} for real routes. Reuse the blueprint the domain already lives in."
    },
    {
      "action": "Validate the proposed method + path against the real codebase BEFORE writing it.",
      "tools": [
        "validate_backend_endpoint"
      ],
      "note": "A failed result means STOP — the path collides or is malformed. Do not build the route."
    },
    {
      "action": "Fetch the canonical endpoint handler skeleton and copy its structure.",
      "tools": [
        "get_endpoint_template"
      ],
      "note": "Use the returned template.template verbatim as the starting point instead of hand-writing boilerplate."
    },
    {
      "action": "Add the blueprint route, validate the request payload/query against a schema, and return the standard JSON envelope.",
      "files": [
        "src/routes/<domain>_routes.py"
      ],
      "note": "Reject invalid input with 400 before any DB work. Keep one responsibility per handler."
    },
    {
      "action": "Apply the auth guard to the new route (see add-auth-guard recipe).",
      "tools": [
        "get_auth_pattern"
      ],
      "note": "Every new route must be decorated with @require_auth (and @require_role where needed)."
    },
    {
      "action": "Re-validate the finished route and run the verify gate.",
      "tools": [
        "validate_backend_endpoint"
      ],
      "note": "Then follow run-verify before declaring done."
    }
  ],
  "filesToCreate": [
    "src/routes/<domain>_routes.py"
  ],
  "validation": [
    "`validate_backend_endpoint` returns valid for the final method + path.",
    "Route rejects a missing/invalid payload with 400 and never touches the DB on bad input.",
    "Route returns 401 when called without a valid token."
  ],
  "doneCriteria": [
    "Route registered on a real blueprint and reachable at the validated path.",
    "Input is schema-validated; auth guard is applied.",
    "run-verify passes with zero errors."
  ],
  "commonMistakes": [
    "Inventing a blueprint or route path instead of grounding it in `list_backend_endpoints`.",
    "Skipping schema validation and trusting request.json directly.",
    "Returning a bare dict instead of the standard response envelope.",
    "Forgetting the auth decorator so the route is publicly reachable."
  ],
  "relatedRecipes": [
    "add-auth-guard",
    "wire-db-read",
    "add-pagination",
    "add-tests",
    "run-verify"
  ]
}