DEV Community: gia ly bui

How to Build an MCP Server in Python and Connect It to Claude Code

gia ly bui — Sun, 04 Oct 2026 14:45:16 +0000

Claude Code is powerful out of the box, but it's blind to your world. It can read files and run commands, but it can't query your database, hit your internal API, or look up an order in your ERP — until you give it tools.

MCP (Model Context Protocol) is how you do that. Think of it as a USB-C port for AI agents: a standard way to expose any function in your codebase as a tool an agent can call.

Here's the path from zero to "Claude Code can now talk to my backend", in Python.

What MCP actually is

An MCP server is just a small program that exposes a list of tools (functions with descriptions). Claude Code, Cursor, and other MCP clients connect to it and can call those tools when they decide it helps.

Three concepts, that's it:

Server — your program, exposing tools
Client — Claude Code / Cursor, calling tools
Tools — named functions with docstrings
The minimal server (Python)

Install the official SDK:

pip install mcp

Then a server in about 20 lines:

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-backend-tools")

@mcp.tool()
def get_order_status(order_id: str) -> str:
    """Look up an order's status by its ID."""
    # Replace with a real DB query or API call
    orders = {"1001": "shipped", "1002": "packing"}
    return orders.get(order_id, "not found")

@mcp.tool()
def add(a: int, b: int) -> int:
    """Add two integers."""
    return a + b

if __name__ == "__main__":
    mcp.run()

The docstring is the important part. Claude Code reads it to decide when to use the tool. "Look up an order's status by its ID" is what makes it actually get called — write it like you're explaining the tool to a coworker.

Wire it into Claude Code

Claude Code reads .mcp.json from your project root:

{
  "mcpServers": {
    "my-backend-tools": {
      "command": "python",
      "args": ["server.py"]
    }
  }
}

Restart Claude Code. Now when you ask "what's the status of order 1002", it can call your tool instead of telling you it can't.

That's the whole local setup — under 15 minutes once you've done it once.

From "works on my machine" to "your team uses it"

The local stdio setup above is fine for you alone. But the moment another person (or another machine) needs the same tools, a process running on your laptop doesn't scale.

That's when you expose the MCP server over HTTP and deploy it — same FastMCP server, but run it as a service on Fly.io (or any host) and point clients at the URL. Now your whole team's Claude Code / Cursor instances share one source of truth, and you can add tools, auth, and monitoring in one place.

This is the version people actually pay for: a deployed, multi-tool MCP server with auth and logging, not a script on a dev's laptop.

Build it yourself, or hand it off

If you need one tool for yourself, the 20-line script above is all you need — go build it.

If you need a multi-tool MCP server deployed for a team (FastAPI backend, auth, monitoring, wired into Claude Code and Cursor), that's a bigger build. I do exactly this as a service: ai agents, mcp servers and claude code automation

I run a 28-tool MCP server in production myself, so this is the thing I do daily, not a tutorial I'm paraphrasing.

How to Get Real-Time Stock Prices in 5 Minutes (Free API)

gia ly bui — Sat, 03 Oct 2026 09:23:36 +0000

Real-time stock quotes don't have to mean signing up for an expensive
market-data feed. Here's a dead-simple API that returns a full quote —
price, daily change, open/high/low, volume, exchange — in one call.

Step 1: Get a key (optional free tier)

The API has a free tier (100 requests/month) at:
https://api.market/store/viv-data/stock

Grab an x-api-key, no credit card needed for the free tier.

Step 2: Make a request

curl "https://prod.api.market/api/v1/viv-data/stock/quote?symbol=AAPL" \
  -H "x-api-key: YOUR_KEY"

Step 3: Read the response

{
  "symbol": "AAPL",
  "name": "Apple Inc.",
  "price": 333.79,
  "change": 3.47,
  "change_percent": 1.05,
  "open": 333.20,
  "high": 334.54,
  "low": 330.61,
  "volume": 54430322,
  "previous_close": 330.32,
  "exchange": "NASDAQ",
  "currency": "USD"
}

Step 4: Use it in your project

async function getQuote(symbol) {
  const res = await fetch(
    `https://prod.api.market/api/v1/viv-data/stock/quote?symbol=${symbol}`,
    { headers: { "x-api-key": process.env.API_MARKET_KEY } }
  );
  return res.json();
}

That's it. One endpoint, one parameter. Works for US and
international symbols (0700.HK, TSLA, 7203.T).

Pricing: free tier for testing, then $9.99/mo for 10k calls.
Results are cached 5 minutes.

[Link: https://api.market/store/viv-data/stock]

How to Deobfuscate JavaScript in One API Call (No Local Tooling)

gia ly bui — Sat, 03 Oct 2026 01:12:22 +0000

Obfuscated JavaScript is everywhere — webpack bundles, obfuscator.io output,
malware payloads. Decoding it usually means installing Babel, writing
transforms, or pasting into a web tool one file at a time.

Here's a one-call way to do it programmatically.

The API

One endpoint. Send obfuscated code, get readable source back.

curl -X POST "https://prod.api.market/api/v1/viv-data/javascript-deobfuscator/deobfuscate" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code": "var _0x4a2b=[\"log\",\"Hello\\x20World\"];(function(_0x2e8f,_0x4a2b){var _0x5a3c=function(_0x1a2b){while(--_0x1a2b){_0x2e8f[\"push\"](_0x2e8f[\"shift\"]());}};_0x5a3c(++_0x4a2b);}(_0x4a2b,0x1b3));console[_0x4a2b[0]](_0x4a2b[1]);"}'

What comes back

{
  "ok": true,
  "code": "console.log(\"Hello World\");",
  "stats": { "passes": 7, "strings_decrypted": 2 }
}

What it actually does (7 passes)

String-array decryption (obfuscator.io-style rotated arrays → plain strings)
Constant folding (1 + 2 * 3 → 7)
Boolean reduction (![] → false)
Dead-code removal
Escape-sequence restore (\x48\x69 → Hi)
Numeric-literal restore (0x12 → 18)
Bracket-to-dot (obj["prop"] → obj.prop)

Why it's safe

Every pass runs on the AST (Babel). String decryption runs in a
sandboxed VM with hard timeouts. It never evals your input — so you
can throw untrusted/malicious scripts at it without fear.

Use it from any language

const res = await fetch("https://prod.api.market/api/v1/viv-data/javascript-deobfuscator/deobfuscate", {
  method: "POST",
  headers: { "x-api-key": process.env.API_MARKET_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({ code: obfuscatedCode })
});
const { code } = await res.json();

Free tier is 100 calls/mo; Pro is $19/mo for 10k. Details:
https://api.market/store/viv-data/javascript-deobfuscator

Deobfuscate JavaScript with a single API call (no local tooling)

gia ly bui — Mon, 28 Sep 2026 13:06:42 +0000

Obfuscated JavaScript is everywhere — malware samples, scraped webpack bundles, and "protected" third-party scripts. Reading it by hand is a nightmare: string arrays, hex escapes, _0x4a2b identifiers, dead code.

You can deobfuscate locally (Babel, de4js), but that means setting up Node, pulling dependencies, and writing your own transforms. Here's how to do it with one HTTP call instead.

What the API runs

Seven automated AST passes, in order:

String-array decryption — obfuscator.io-style rotated arrays → plain strings
Constant folding — 1 + 2 * 3 → 7
Boolean reduction — ![] → false, !![] → true
Dead-code removal — unreachable branches, empty statements
Escape-sequence restore — \x48\x65\x6c\x6c\x6f → "Hello"
Numeric-literal restore — 0x12 → 18
Bracket-to-dot — obj["prop"] → obj.prop

Every pass runs on the AST (Babel). It never evals untrusted code — string decryption runs in a sandboxed VM with hard timeouts, so malformed input returns a clean error instead of crashing.

One call

curl -X POST \
  https://mega-api-mellowed-tidepool-1271.fly.dev/deobfuscate/deobfuscate \
  -H 'Content-Type: application/json' \
  -d '{"code":"var _0x4a2b=[\"Hello\",\"World\"];function _0x1f3a(n){return _0x4a2b[n-0];}var r=_0x1f3a(0)+\" \"+_0x1f3a(1);"}'

Response:

{
  "ok": true,
  "code": "var _0x4a2b = [\"Hello\", \"World\"];\nfunction _0x1f3a(n) {\n  return _0x4a2b[n - 0];\n}\nvar r = _0x1f3a(0) + \" \" + _0x1f3a(1);",
  "stats": { "stringArray": 0, "foldRounds": 1, "bracketToDot": 0 }
}

Use cases

Security researchers analyzing suspicious scripts before they run
Developers recovering lost or over-minified source
Scraping teams decoding obfuscated webpack bundles

Free tier gets you started; higher limits and an interactive playground are on RapidAPI:

https://rapidapi.com/buigialy30206/api/javascript-deobfuscator

Buy CS2 Skins or Open Cases? The Math Nobody Shows You

gia ly bui — Wed, 09 Sep 2026 01:08:29 +0000

Every new CS2 player hits the same fork: buy the skin you want, or open cases and gamble for it. The case sites make opening look like a shortcut to a knife. The math says otherwise, and it's worth seeing the numbers before you deposit.

Case drop odds are public, and they're brutal:

A covert (red) skin is about a 0.64% drop.
A knife is about a 0.26% drop — roughly 1 in 384 cases.
At a typical $2.50 per case, that's an expected cost around $960 per knife.

And here's the part most guides skip: the knife you finally unbox usually resells for less than that expected cost. The house edge is structural. Opening cases is entertainment with a lottery ticket attached — not a way to acquire skins cheaply.

So when does opening make sense? Only when the value isn't the skin but the experience, and only with free cases (several sites give one free daily case — that's pure expected value with zero deposit). When you want a specific skin, buying it directly is almost always cheaper.

The honest rule of thumb: if you want a specific skin, buy it. If you want a few minutes of fun with a free daily case, open that. Mixing the two — chasing a knife with paid cases — is how balances disappear.

I ran the full comparison, including which cases have the best resale value and where the free daily cases are: https://cs2caseguide.com/case-vs-buy

How to Make YouTube Videos Without a Camera (Full AI Workflow)

gia ly bui — Mon, 07 Sep 2026 23:24:23 +0000

You don't need a camera, a mic, or editing skills to publish on YouTube in 2026. The whole faceless-channel stack has collapsed into a few tools, and the workflow is shorter than most people expect.

Here's the exact flow I use:

Write the script first. The video is only as good as the words. Aim for a tight, conversational script — under 500 words for a 3-minute video.
Turn the script into a talking head. Paste it into an AI avatar tool and pick a stock presenter. The tool lip-syncs the avatar to your script in 140+ languages. This is the step that used to require a face on camera; now a stock avatar reads it naturally enough that most viewers never flag it.
Generate b-roll if you want movement. For explainer-style content, a few generated clips between talking-head sections keep retention up. Skip this if you're doing pure commentary.
Add captions. Burned-in captions are the single biggest retention lever for short content. Most platforms auto-generate them; a quick cleanup pass is all it takes.
Publish and repurpose. One video becomes a Short, a TikTok, and a Reel with minimal extra work.

The biggest mistake beginners make is buying a text-to-video generator when they actually needed an avatar — those are two different jobs. For a faceless talking-head channel, the avatar tool is the one that matters.

I wrote the full step-by-step setup, including which avatar tool to start with and how to avoid burning your monthly credits: https://aivideotest.com/no-camera

Online Dating Scams Are Getting Smarter. Here's How to Spot Them

gia ly bui — Sat, 05 Sep 2026 08:29:09 +0000

Online dating is convenient, but the scams on these platforms have gotten noticeably more sophisticated. They target the same thing: your trust, then your money.

The red flags to learn first:

They won't video-call. A real person can jump on a call. Scammers always have an excuse — broken camera, bad signal, "not ready yet."
They need money fast. The story varies (medical emergency, travel to meet you, business deal), but the ask is the same: an urgent transfer, usually untraceable.
They push you off-platform. Moving to WhatsApp or Telegram fast is a red flag — they want to get outside the app's safety features.

Privacy rules that protect you: keep your full name, address, and workplace off your profile until you've met in person, and never send money to someone you've only met online, no matter the story.

A few platforms do a better job of verifying identities than others — that alone filters out a meaningful chunk of the fake accounts. I put together the full checklist of red flags and the safer platforms here: Online Dating Safety Guide 2026: Avoid Scams & Stay Safe — Honest Adult Lifestyle Reviews

I Tracked 500 CS2 Case Openings. Here's What the Math Actually Says

gia ly bui — Fri, 04 Sep 2026 08:35:31 +0000

CS2 case opening feels like it should be profitable — the big wins get all the attention. So I tracked 500 openings across official and third-party cases to see what actually comes back.

The short version: opening cases is entertainment, not an investment. Here's the math.

Official cases are the worst value. The $2.50 key fee alone means $50 opens roughly 20 cases, and the published drop rates are brutal — a knife is about 0.26% (roughly 1 in 385), a red covert about 0.64%.

Third-party sites change the math by removing the key fee and adding deposit bonuses. My tracking showed $50 on a third-party site returns about $30–45 of skins, versus $12–18 on official cases.

But here's the part nobody frames well: if you want a specific skin, opening cases for it is a losing game. Buying it directly means $50 buys exactly $50 of value — and on third-party marketplaces you often get $65–70 worth below Steam Market price.

The sane strategy is a hybrid: use free daily cases for the thrill, buy the skins you actually want directly. Full ROI comparison with the exact numbers: CS2 Case Opening vs Buying Skins — ROI Comparison 2026

How I Make Videos With No Camera, No Mic, and No Editing Skills

gia ly bui — Thu, 03 Sep 2026 14:18:27 +0000

I used to think making videos required a camera, decent lighting, and hours in an editor. Then I built a full faceless channel without any of it.

The workflow comes down to three jobs, and the #1 mistake people make is buying a tool for the wrong job.

Job 1: The talking head. You don't need a camera — AI avatar tools let you type a script and a realistic digital presenter reads it. One tool (Synthesia) has the most natural stock avatars I've tested across 140+ languages; its main competitor is the pick if you want to clone your own face and voice from a 2-minute video.

Job 2: The b-roll. Instead of shooting footage, text-to-video models generate it from a prompt. The cinematic-grade option here produces clips creators use for music videos and ads.

Job 3: The captions. Most people watch short-form on mute, so auto-captions are non-negotiable.

My actual stack: one avatar tool for the talking head, one generation tool for b-roll, and auto-captions on top. That's the whole pipeline — no camera, no mic, no manual editing.

I broke down the full ranking of every tool I tested, with real pricing and what each is actually good for: Best AI Video Generators 2026 — Ranked & Compared

How to Withdraw CS2 Skins from Any Case Site (and the Steam Guard Trap)

gia ly bui — Fri, 28 Aug 2026 14:00:07 +0000

If you've ever opened CS2 cases and hit a wall trying to get your skins out, you're not alone — the search logs are full of "how to withdraw from X" for a hundred different sites. The good news: the process is the same everywhere. The bad news: one Valve rule trips up almost everyone.

Here's the universal withdrawal flow, step by step:

Enable Steam Guard Mobile Authenticator — this is the step that decides whether you wait minutes or 7 days.
Log in with official Steam OpenID (steamcommunity.com, never a lookalike domain).
Open your inventory, select the skins, and accept the trade offer from the site's bot.
Confirm with your mobile authenticator, and the skins land in your Steam inventory.

The #1 thing players get wrong is skipping Steam Guard Mobile. Steam's 7-day trade hold is a Valve anti-fraud rule — no case site can bypass it. Enable the mobile authenticator (not just email guard) at least 7 days before you plan to withdraw, and your trades clear in minutes.

The bigger question is which site you trust. There are sites with real track records (Hellcase has run since 2016 with 5M+ users), and there are parked domains and clones buying ads on popular names.

I put together a site-by-site withdrawal directory covering the sites players search for most — which ones are verified and which ones you should treat as "verify before you deposit." If you want the short version: the full walkthrough is in my CS2 withdrawal guide.

Stop Paying for 5 Video Tools — Here's the Only 3 You Actually Need

gia ly bui — Wed, 26 Aug 2026 10:18:21 +0000

AI video tools exploded this year, but most people waste money on overlapping subscriptions.

After testing a dozen, I keep coming back to three that cover 100% of use cases:

Runway — best for text-to-video and motion editing. The Gen-4 model is the closest thing to "type a prompt, get a scene."
Pictory — best for turning blog posts into short-form videos. Paste a URL, get a talking-head video with captions.
Synthesia — best for avatar/explainer videos. 140+ languages, no camera needed.

The mistake isn't buying these — it's buying three tools that do the same thing.

My rule: one for raw generation, one for repurposing content, one for explainers. Anything else is overlap.

What's your stack? Drop it below.

If you want the full comparison (pricing, use cases, which to skip), I put everything on one page: aivideotest.com

I Cloned Myself with AI — The Honest, Step-by-Step Breakdown

gia ly bui — Tue, 25 Aug 2026 02:12:53 +0000

AI cloning sounded like sci-fi to me until I actually did it. Upload a two-minute video of yourself, and a digital twin does your on-camera work forever after. In 2026 this is not just real — it's shockingly easy.

First, a clarification: you cannot physically clone yourself. What tools like HeyGen do is build an AI clone — a digital twin that looks and sounds like you in videos. It's the closest thing to cloning yourself that exists today.

What you actually need

Two minutes of footage. That's it. But those two minutes should be your best take, because the clone inherits how you look in that clip forever.

Good lighting — face fully lit, no harsh shadows
A plain background — solid color, nothing distracting
A stable camera — tripod or propped phone
Clear audio — quiet room, minimal echo

The workflow

Create an account (avatar cloning requires a paid plan — not on the free tier)
Record two minutes of yourself talking naturally, looking at the camera
Upload it to the avatar builder — it processes the footage in minutes to an hour
Test your clone with a short script and check the lip-sync
Use it everywhere — talking-head videos, translated into 40+ languages

What it costs

HeyGen starts around $24/month, and cloning consumes credits each time you generate. The clone isn't a one-time buy — it's tied to the plan.

What it's good for (and not)

Good for: faceless YouTube channels, multi-language content, client work, course content.

Not good for: emotional or personal content (a clone can't replicate genuine human warmth), and real-time interaction (clones are for pre-scripted video, not live).

The one rule that matters

Clone quality depends entirely on your source footage. Garbage in, garbage out. If the lip-sync looks off, it's almost always a source-footage problem, not a tool problem.

One compliance note if you publish to YouTube: flag realistic AI-generated content through YouTube's altered-content disclosure.

Full step-by-step guide: https://aivideotest.com/clone-yourself