Tarn & Timber documentation
What Tarn & Timber is, and how to read these docs.
Tarn & Timber is the fictional company behind this reference shop. Use the project to build a storefront secured by Auth0 and learn how personal agents can use it through Poppy and MCP. These docs explain how to run a local checkout, adapt the deployment, and follow requests from a shopper or agent to the shop’s data.
How to read these docs
Build your own shop
Run the local demo, connect real providers, and choose your deployment settings.
Understand Poppy
Personal agents, account grants, Sessions and the first sign-in.
System map
The architecture in one diagram, and the two boundaries that must always hold.
Components
What each part does: storefront, API, MCP server, Auth0 proxy, backoffice, Auth0 and storage.
Callers and tokens
Who can call the API, how each caller is recognized, and what authority it gets.
Request flows
Sequence diagrams for checkout, guests, MCP clients, the backoffice and Poppy agents.
The idea in brief
The Shop API owns the shared capabilities, the database schema, the Durable Objects and all scheduled work. The storefront runs the capabilities only it performs against the same database and calls the API for the shared ones; the MCP server, the backoffice and personal agents are clients of the API. Each client proves who it is with an access token, and the API decides what that token is allowed to do.