Build your own D MALL ONLINE MCP server

How it fits together

AI client (Claude Desktop, Cursor, VS Code…)
   │  MCP over stdio or HTTP
   ▼
your MCP server  ──  HTTPS + Authorization: Bearer <your API key>  ──▶  https://dmall.online/api/v1/…
                                                                           │
                                                                           ▼
                                                              your private sandbox database

The API key is the only thing that tells the server who you are, so each student’s MCP server sees and changes only that student’s data. Nothing in the MCP code has to filter by user: the platform enforces it.

Option 1 · Use the ready-made server (5 minutes)

1. Sign in and create an API key under Account → API keys. Start with a read-only key while experimenting.
2. Download the server from Account → MCP server and unzip it. It needs Python 3.11+.
3. Install it once: python -m venv .venv then .venv\Scripts\pip install -r requirements.txt (macOS/Linux: .venv/bin/pip).
4. Add it to your AI client with two environment variables:

{
  "mcpServers": {
    "mahabazaar": {
      "command": "C:\\path\\to\\mcp_server\\.venv\\Scripts\\python.exe",
      "args": ["C:\\path\\to\\mcp_server\\server.py"],
      "env": {
        "MAHABAZAAR_API_URL": "https://dmall.online",
        "MAHABAZAAR_API_KEY": "mbz_…paste your key…"
      }
    }
  }
}

Claude Desktop: Settings → Developer → Edit Config. Claude Code:

claude mcp add mahabazaar -e MAHABAZAAR_API_URL=https://dmall.online -e MAHABAZAAR_API_KEY=mbz_… -- python server.py

Optional settings: MAHABAZAAR_TOOLSETS=bank,healthcare exposes only some areas, and MAHABAZAAR_READ_ONLY=true exposes only lookups.

Option 2 · Write your own (the learning path)

With the official Python SDK (pip install mcp httpx), a tool is a decorated function that calls the API:

import os
import httpx
from mcp.server.fastmcp import FastMCP

api = httpx.Client(
    base_url=os.environ["MAHABAZAAR_API_URL"],
    headers={"Authorization": f"Bearer {os.environ['MAHABAZAAR_API_KEY']}"},
    timeout=30,
)
mcp = FastMCP("my-mahabazaar")


@mcp.tool()
def bank_summary(customer_email: str = "dinesh.kumar@mahabazaar.in") -> dict:
    """Balances, card dues, loans and EMIs for one customer."""
    r = api.get("/api/v1/bank/customers/summary", params={"customer_email": customer_email})
    r.raise_for_status()
    return r.json()


@mcp.tool()
def search_flights(origin: str, destination: str, date: str) -> dict:
    """Flights with seats available, cheapest first. Dates are YYYY-MM-DD."""
    r = api.get("/api/v1/flights", params={"origin": origin, "destination": destination, "date": date, "limit": 10})
    r.raise_for_status()
    return r.json()


if __name__ == "__main__":
    mcp.run()

Then grow it: generate tools from openapi.json, add confirmations for money-moving tools, and compare your server with the ready-made one.

Stay safe

• Keep keys secret. Put them in environment variables or a .env file that is in .gitignore. Never commit them, paste them in chat or share screenshots of them. If one leaks, revoke it in your account; it stops working immediately.
• Least privilege. Use a read-only key for agents that only need to look things up.
• Confirm before acting. Tools such as transfer_funds, cancel_* and delete_* change data. Mark them destructive so clients ask first.
• Prompt injection. Text inside the data (product descriptions, notes) can try to steer a model. Treat tool output as data, not instructions.
• Mistakes are cheap. Everything is simulated and private to you. Reset your sandbox from your account to start again.