@4da/mcp-server 4.6.6 → 5.0.1

package/dist/db.js

@@ -635,15 +635,16 @@ export class FourDADatabase {
      * Get relevant content items scored by the Rust pipeline (preferred) or
      * TypeScript fallback scoring when Rust scores are unavailable.
      */
-    getRelevantContent(minScore = 0.35, sourceType, limit = 20, sinceHours = 24) {
+    getRelevantContent(minScore = 0.35, sourceType, limit = 20, sinceHours = 24, requireCurrentVersion = false) {
         const sinceDate = new Date(Date.now() - sinceHours * 60 * 60 * 1000)
             .toISOString()
             .replace("T", " ")
             .slice(0, 19);
         const hasRustScores = this.hasColumn("source_items", "relevance_score");
         if (hasRustScores) {
-            return this.getRelevantContentFromRust(minScore, sourceType, limit, sinceDate);
+            return this.getRelevantContentFromRust(minScore, sourceType, limit, sinceDate, requireCurrentVersion);
         }
+        // TypeScript fallback computes scores fresh per call — current by construction.
         return this.getRelevantContentFallback(minScore, sourceType, limit, sinceDate);
     }
     /**
@@ -722,13 +723,57 @@ export class FourDADatabase {
      * Use Rust-computed relevance_score from the desktop app's scoring pipeline.
      * These scores are from the full 5-axis PASIFA engine — much more accurate.
      */
-    getRelevantContentFromRust(minScore, sourceType, limit, sinceDate) {
+    getRelevantContentFromRust(minScore, sourceType, limit, sinceDate, requireCurrentVersion = false) {
         // Grounding subquery — guarded: older/partial 4DA DBs may have relevance_score
         // (so the Rust path runs) but lack source_item_dependencies. Fall back to 0
         // (→ evidence_class "semantic_only") rather than throwing.
         const depCount = this.hasColumn("source_item_dependencies", "source_item_id")
             ? `(SELECT COUNT(*) FROM source_item_dependencies d WHERE d.source_item_id = source_items.id)`
             : `0`;
+        // Stale-epoch guard for deep-window fallbacks: when the caller widens to the
+        // 30-day window it reaches items whose stored score/signal columns may come
+        // from an OLDER scoring pipeline (a version bump makes the tail stale until
+        // the drain re-scores it). Ranking those raw scores against current ones —
+        // or trusting stale signal_type/signal_priority — produces claims the
+        // current pipeline doesn't stand behind. The MCP server can't import the
+        // Rust PIPELINE_VERSION constant, so the DB itself is the source of truth:
+        // MAX(scored_pipeline_version) IS the current brain's stamp (uncorrelated
+        // subquery, computed once per statement). Guarded on column existence for
+        // older desktop-app DBs.
+        const versionGuard = requireCurrentVersion && this.hasColumn("source_items", "scored_pipeline_version")
+            ? ` AND scored_pipeline_version = (SELECT MAX(scored_pipeline_version) FROM source_items)`
+            : ``;
+        // Curation guard: never return an item the current pipeline EXPLICITLY
+        // rejected. `feed_relevant` is the analysis run's persisted verdict, and a
+        // score threshold alone does not respect it — the desktop content graph hit
+        // exactly this and adopted corpus parity in Phase 95 (W4-5).
+        //
+        // It matters because a verdict can be negative while the score stays above
+        // the threshold. v18's look-alike gate makes ungrounded registry releases
+        // categorically non-relevant while deliberately KEEPING their capped score
+        // (0.37 / 0.42) for ranking and display, so `relevance_score >= 0.35` alone
+        // still surfaces them. Live 2026-07-26: 30 crates_io items inside the
+        // 30-day window were already `feed_relevant = 0` and were still returned.
+        //
+        // NULL is KEPT, not excluded: an unjudged item is "not yet curated", not
+        // "rejected", and dropping it would blank the tool on a fresh corpus
+        // (cold-start doctrine). Guarded on column existence for older 4DA DBs.
+        //
+        // Deliberately NOT extended with `feed_verdict_version = <current>` even
+        // though Phase 101 added that stamp, and even though the 720h deep-fallback
+        // above DOES gate on `scored_pipeline_version`. The asymmetry is intentional:
+        // the version guard there narrows a last-resort widening, whereas this guard
+        // sits on the PRIMARY path, so excluding not-yet-reconciled verdicts would
+        // empty the tool after every pipeline bump until the reconciliation pass
+        // caught up (measured on the desktop: 94% of live graph nodes held a stale
+        // verdict immediately after the v18 bump). The reconciliation converging is
+        // the fix — see `analysis_backfill::reconcile_stale_verdicts_cycle`. This
+        // note exists because `check-mcp-server-sync.cjs` asks "do MCP queries need
+        // updating?" on every db-layer change; the answer for the verdict stamp is
+        // no, by design.
+        const curationGuard = this.hasColumn("source_items", "feed_relevant")
+            ? ` AND (feed_relevant IS NULL OR feed_relevant = 1)`
+            : ``;
         let query = `
       SELECT id, source_type, source_id, url, title, content, content_hash,
              created_at, last_seen, relevance_score, content_type,
@@ -736,7 +781,7 @@ export class FourDADatabase {
              ${depCount} AS dep_match_count
       FROM source_items
       WHERE relevance_score >= ?
-        AND datetime(created_at) >= datetime(?)
+        AND datetime(created_at) >= datetime(?)${versionGuard}${curationGuard}
     `;
         const params = [minScore, sinceDate];
         if (sourceType) {
@@ -1008,12 +1053,13 @@ export class FourDADatabase {
                 context.ace.detected_tech.filter((dt) => itemTopics.some((t) => this.topicMatches(t, dt.name))).length *
                     0.05
             : 0;
-        const learnedScore = context.learned
-            ? context.learned.topic_affinities
-                .filter((ta) => ta.affinity_score > 0 && itemTopics.some((t) => this.topicMatches(t, ta.topic)))
-                .reduce((sum, ta) => sum + ta.affinity_score * 0.1 * ta.confidence, 0)
-            : 0;
-        // Anti-penalty from exclusions and anti-topics
+        // Learned affinity score DEMOTED in v19 (AD-029) — must mirror
+        // computeRelevanceScore so the explanation matches what actually
+        // scored (the two previously diverged on the anti-penalty weight too:
+        // scorer used *0.3, this explanation used *0.5).
+        const learnedScore = 0;
+        // Anti-penalty from user-authored exclusions only (learned anti-topics
+        // demoted with the rest of the behavioral stack, AD-029).
         let antiPenalty = 0;
         for (const exclusion of context.exclusions) {
             if (itemTopics.some((t) => this.topicMatches(t, exclusion))) {
@@ -1021,13 +1067,6 @@ export class FourDADatabase {
                 break;
             }
         }
-        if (antiPenalty === 0 && context.learned) {
-            for (const antiTopic of context.learned.anti_topics) {
-                if (itemTopics.some((t) => this.topicMatches(t, antiTopic.topic))) {
-                    antiPenalty = Math.max(antiPenalty, antiTopic.confidence * 0.5);
-                }
-            }
-        }
         const finalScore = Math.max(0, Math.min(1, staticScore + aceScore + learnedScore - antiPenalty));
         const scoreBreakdown = {
             embedding_similarity: null, // Not computing embedding similarity in MCP server
@@ -1087,12 +1126,17 @@ export class FourDADatabase {
                 message: `Item ${itemId} of type ${sourceType} not found`,
             };
         }
-        // Map action to signal strength
+        // Map action to signal strength — v19: unified onto the canonical ACE
+        // scale (src-tauri/src/ace/behavior/types.rs). The old MCP-only scale
+        // (click 0.3 / save 0.8 / dismiss -0.2 / mark_irrelevant -0.5) meant an
+        // agent-recorded rejection never crossed the Rust side's explicit-
+        // negative (-0.8) or anti-topic (-0.5 exclusive) thresholds, so agent
+        // feedback could never register a real rejection.
         const signalStrength = {
-            click: 0.3,
-            save: 0.8,
-            dismiss: -0.2,
-            mark_irrelevant: -0.5,
+            click: 0.55,
+            save: 1.0,
+            dismiss: -0.8,
+            mark_irrelevant: -1.0,
         };
         try {
             const stmt = this.db.prepare(`
@@ -1311,21 +1355,12 @@ export class FourDADatabase {
                 }
             }
         }
-        // Learned affinities
-        if (context.learned) {
-            for (const affinity of context.learned.topic_affinities) {
-                if (affinity.affinity_score > 0 &&
-                    itemTopics.some((t) => this.topicMatches(t, affinity.topic))) {
-                    score += affinity.affinity_score * 0.1 * affinity.confidence;
-                }
-            }
-            // Anti-topics penalty
-            for (const antiTopic of context.learned.anti_topics) {
-                if (itemTopics.some((t) => this.topicMatches(t, antiTopic.topic))) {
-                    score -= antiTopic.confidence * 0.3;
-                }
-            }
-        }
+        // Learned affinity/anti-topic weighting DEMOTED in v19 (AD-029) to
+        // mirror the Rust pipeline: this TypeScript fallback scorer applied
+        // its own behavioral weights (+affinity*0.1*confidence,
+        // -anti_confidence*0.3) whenever Rust scores were absent — a second,
+        // uncalibrated ranking regime fed by the same untrusted capture layer.
+        // Static identity + ACE stack matching above remain the scoring basis.
         return Math.max(0, Math.min(1, score));
     }
     /**

package/dist/http-transport.d.ts

@@ -1,25 +1,87 @@
 /**
  * 4DA MCP Server — Streamable HTTP Transport
  *
- * Implements the MCP Streamable HTTP transport (spec 2025-03-26) using
- * Node's built-in http module. No express or other framework needed.
+ * Serves MCP over HTTP using the v2 `createMcpHandler` entry (one factory,
+ * one endpoint, both protocol eras): 2026-07-28 requests are served natively;
+ * 2025-era requests get the established stateless serving (fresh instance per
+ * request — the same behavior as the previous per-request
+ * `StreamableHTTPServerTransport` wiring). Node's built-in http module only;
+ * no express or other framework needed.
  *
  * Security:
- * - Binds to 127.0.0.1 only (localhost)
- * - DNS rebinding protection via Origin header check
- * - Stateless mode (no session tracking)
+ * - Binds to 127.0.0.1 by default. `--host` can widen that; a non-loopback
+ *   bind is refused unless a shared auth secret is configured, and forces
+ *   authentication on for every request.
+ * - DNS rebinding protection via a `Host` header allowlist, applied to EVERY
+ *   request. This is the primary guard: a rebinding attack necessarily
+ *   presents the attacker's hostname in `Host`, and unlike `Origin` the header
+ *   is mandatory, so a request cannot skip the check by omitting it.
+ * - `Origin`, when present, must also be localhost-class. A missing `Origin`
+ *   is not a pass — it is simply not additional evidence, so such requests are
+ *   admitted only on the strength of the `Host` check above, and only ever
+ *   without credentials on a loopback bind.
+ * - Bearer tokens are HMAC-SHA256 verified (see auth.ts) before any claim is
+ *   read, and the verified role is enforced on tool dispatch.
+ * - Stateless (no session tracking)
  */
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { type Server as HttpServer } from "node:http";
+import { type Server } from "@modelcontextprotocol/server";
 export interface HttpServerOptions {
     port: number;
     host: string;
 }
+/** Handle for a running HTTP transport, so callers (and tests) can shut it down. */
+export interface HttpServerHandle {
+    server: HttpServer;
+    close(): Promise<void>;
+}
+/** Security posture derived from the bind address plus environment config. */
+export interface HttpSecurityPolicy {
+    /** True when the server is bound to a loopback address only. */
+    loopback: boolean;
+    /** True when every non-health request must carry a verified Bearer token. */
+    authRequired: boolean;
+    /** Hostnames accepted in the `Host` header (port-agnostic). */
+    allowedHostnames: string[];
+    /** Hostnames accepted in the `Origin` header, when one is sent. */
+    allowedOrigins: string[];
+}
+/** Loopback bind addresses — everything else reaches the network. */
+export declare function isLoopbackBind(host: string): boolean;
+/**
+ * Resolve the security policy for a bind address.
+ *
+ * A loopback bind keeps the historical behaviour: auth is opt-in via
+ * `MCP_AUTH_REQUIRED`. Any other bind is network-exposed, so authentication is
+ * mandatory regardless of that variable.
+ */
+export declare function resolveSecurityPolicy(host: string): HttpSecurityPolicy;
+export interface GuardRejection {
+    status: number;
+    error: string;
+}
+/**
+ * DNS rebinding guard. Runs on every request, before routing and before auth.
+ *
+ * Returns null when the request may proceed, or the rejection to send.
+ */
+export declare function evaluateRequestGuard(headers: {
+    host?: string | string[];
+    origin?: string | string[];
+}, policy: HttpSecurityPolicy): GuardRejection | null;
+/**
+ * Refuse to start a network-exposed server that cannot authenticate anyone,
+ * and make a non-loopback bind impossible to do accidentally.
+ */
+export declare function enforceBindPolicy(host: string, policy: HttpSecurityPolicy): void;
 /**
  * Start a Streamable HTTP server for the MCP protocol.
  *
- * Uses stateless mode (sessionIdGenerator: undefined) — each request
- * gets its own transport instance. This is the simplest approach and
- * is compatible with serverless environments.
+ * Takes a server factory: `createMcpHandler` builds a fresh instance per
+ * request (stateless — compatible with serverless environments and simple
+ * round-robin load balancing).
+ *
+ * Resolves once the server is accepting connections.
  */
-export declare function startHttpServer(server: Server, options?: HttpServerOptions): Promise<void>;
+export declare function startHttpServer(factory: () => Server, options?: HttpServerOptions): Promise<HttpServerHandle>;
 //# sourceMappingURL=http-transport.d.ts.map

package/dist/http-transport.js

@@ -2,146 +2,222 @@
 /**
  * 4DA MCP Server — Streamable HTTP Transport
  *
- * Implements the MCP Streamable HTTP transport (spec 2025-03-26) using
- * Node's built-in http module. No express or other framework needed.
+ * Serves MCP over HTTP using the v2 `createMcpHandler` entry (one factory,
+ * one endpoint, both protocol eras): 2026-07-28 requests are served natively;
+ * 2025-era requests get the established stateless serving (fresh instance per
+ * request — the same behavior as the previous per-request
+ * `StreamableHTTPServerTransport` wiring). Node's built-in http module only;
+ * no express or other framework needed.
  *
  * Security:
- * - Binds to 127.0.0.1 only (localhost)
- * - DNS rebinding protection via Origin header check
- * - Stateless mode (no session tracking)
+ * - Binds to 127.0.0.1 by default. `--host` can widen that; a non-loopback
+ *   bind is refused unless a shared auth secret is configured, and forces
+ *   authentication on for every request.
+ * - DNS rebinding protection via a `Host` header allowlist, applied to EVERY
+ *   request. This is the primary guard: a rebinding attack necessarily
+ *   presents the attacker's hostname in `Host`, and unlike `Origin` the header
+ *   is mandatory, so a request cannot skip the check by omitting it.
+ * - `Origin`, when present, must also be localhost-class. A missing `Origin`
+ *   is not a pass — it is simply not additional evidence, so such requests are
+ *   admitted only on the strength of the `Host` check above, and only ever
+ *   without credentials on a loopback bind.
+ * - Bearer tokens are HMAC-SHA256 verified (see auth.ts) before any claim is
+ *   read, and the verified role is enforced on tool dispatch.
+ * - Stateless (no session tracking)
  */
 import { createServer } from "node:http";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { extractAuthClaims } from "./auth.js";
+import { createMcpHandler, localhostAllowedHostnames, localhostAllowedOrigins, validateHostHeader, validateOriginHeader, } from "@modelcontextprotocol/server";
+import { toNodeHandler } from "@modelcontextprotocol/node";
+import { extractAuthClaims, getAuthSecret } from "./auth.js";
+import { runWithAuthContext } from "./auth-context.js";
 const DEFAULT_PORT = 4840;
 const DEFAULT_HOST = "127.0.0.1";
 const __ht_dirname = dirname(fileURLToPath(import.meta.url));
 const SERVER_VERSION = JSON.parse(readFileSync(join(__ht_dirname, "..", "package.json"), "utf-8")).version;
+/** Strip IPv6 brackets and zone id so "[::1]" and "::1" compare equal. */
+function normalizeHostname(host) {
+    return host.trim().replace(/^\[|\]$/g, "").split("%")[0].toLowerCase();
+}
+/** Loopback bind addresses — everything else reaches the network. */
+export function isLoopbackBind(host) {
+    const h = normalizeHostname(host);
+    return h === "localhost" || h === "::1" || /^127\./.test(h);
+}
 /**
- * Parse JSON body from an incoming HTTP request.
+ * Extra hostnames accepted in `Host`/`Origin`, from `MCP_ALLOWED_HOSTS`
+ * (comma-separated). Needed when binding to `0.0.0.0`, where the hostname
+ * legitimate clients use is not knowable from the bind address.
  */
-function parseBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on("data", (chunk) => chunks.push(chunk));
-        req.on("end", () => {
-            try {
-                const raw = Buffer.concat(chunks).toString("utf-8");
-                resolve(raw ? JSON.parse(raw) : undefined);
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        req.on("error", reject);
-    });
+function configuredExtraHosts() {
+    return (process.env.MCP_ALLOWED_HOSTS ?? "")
+        .split(",")
+        .map((h) => normalizeHostname(h))
+        .filter((h) => h.length > 0);
+}
+/**
+ * Resolve the security policy for a bind address.
+ *
+ * A loopback bind keeps the historical behaviour: auth is opt-in via
+ * `MCP_AUTH_REQUIRED`. Any other bind is network-exposed, so authentication is
+ * mandatory regardless of that variable.
+ */
+export function resolveSecurityPolicy(host) {
+    const loopback = isLoopbackBind(host);
+    const extras = configuredExtraHosts();
+    // A concrete non-loopback bind address is itself a legitimate Host value;
+    // wildcards (0.0.0.0 / ::) name no reachable host, so they add nothing.
+    const bindHostname = normalizeHostname(host);
+    const isWildcard = bindHostname === "0.0.0.0" || bindHostname === "::" || bindHostname === "";
+    const bindExtras = loopback || isWildcard ? [] : [bindHostname];
+    return {
+        loopback,
+        authRequired: loopback ? process.env.MCP_AUTH_REQUIRED === "true" : true,
+        allowedHostnames: [...localhostAllowedHostnames(), ...bindExtras, ...extras],
+        allowedOrigins: [...localhostAllowedOrigins(), ...bindExtras, ...extras],
+    };
+}
+/**
+ * DNS rebinding guard. Runs on every request, before routing and before auth.
+ *
+ * Returns null when the request may proceed, or the rejection to send.
+ */
+export function evaluateRequestGuard(headers, policy) {
+    const pick = (v) => Array.isArray(v) ? v[0] : v;
+    // `Host` is mandatory in HTTP/1.1 and always present in HTTP/2 (as
+    // :authority, which Node surfaces here). Missing means malformed, not
+    // trusted — validateHostHeader rejects it.
+    const hostResult = validateHostHeader(pick(headers.host), policy.allowedHostnames);
+    if (!hostResult.ok) {
+        return { status: 403, error: `Forbidden: DNS rebinding protection (${hostResult.errorCode})` };
+    }
+    // `Origin` is only sent by browsers. A present-but-foreign value is a
+    // cross-origin browser request and is refused; an absent value adds no
+    // evidence either way, and the Host check above has already run.
+    const originResult = validateOriginHeader(pick(headers.origin), policy.allowedOrigins);
+    if (!originResult.ok) {
+        return { status: 403, error: `Forbidden: ${originResult.errorCode}` };
+    }
+    return null;
+}
+function sendJson(res, status, body) {
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+/**
+ * Refuse to start a network-exposed server that cannot authenticate anyone,
+ * and make a non-loopback bind impossible to do accidentally.
+ */
+export function enforceBindPolicy(host, policy) {
+    if (policy.loopback)
+        return;
+    if (!getAuthSecret()) {
+        throw new Error(`Refusing to bind the MCP HTTP transport to a non-loopback address (${host}) with no auth secret.\n` +
+            `  Every 4DA tool (dependency inventory, decisions, agent memory, Developer DNA) would be\n` +
+            `  readable and writable by anyone who can reach this port.\n` +
+            `  Set MCP_AUTH_SECRET (the same value as the relay's JWT_SECRET) to enable token verification,\n` +
+            `  or drop --host and serve on 127.0.0.1.`);
+    }
+    console.error("");
+    console.error("  ############################################################");
+    console.error(`  # WARNING: MCP HTTP transport is bound to ${host}`);
+    console.error("  # This exposes 4DA tools beyond this machine.");
+    console.error("  # Authentication is REQUIRED for every request on this bind.");
+    console.error("  # Put it behind TLS and a trusted network boundary.");
+    console.error("  ############################################################");
+    console.error("");
+    const extras = configuredExtraHosts();
+    const bindHostname = normalizeHostname(host);
+    if ((bindHostname === "0.0.0.0" || bindHostname === "::") && extras.length === 0) {
+        console.error("  NOTE: MCP_ALLOWED_HOSTS is unset, so only localhost-class Host headers are accepted.");
+        console.error("        Set MCP_ALLOWED_HOSTS=<hostname-or-ip[,...]> to the address clients actually use.");
+        console.error("");
+    }
 }
 /**
  * Start a Streamable HTTP server for the MCP protocol.
  *
- * Uses stateless mode (sessionIdGenerator: undefined) — each request
- * gets its own transport instance. This is the simplest approach and
- * is compatible with serverless environments.
+ * Takes a server factory: `createMcpHandler` builds a fresh instance per
+ * request (stateless — compatible with serverless environments and simple
+ * round-robin load balancing).
+ *
+ * Resolves once the server is accepting connections.
  */
-export async function startHttpServer(server, options = { port: DEFAULT_PORT, host: DEFAULT_HOST }) {
+export async function startHttpServer(factory, options = { port: DEFAULT_PORT, host: DEFAULT_HOST }) {
     const { port, host } = options;
+    const policy = resolveSecurityPolicy(host);
+    enforceBindPolicy(host, policy);
+    const mcpHandler = createMcpHandler(factory);
+    const handleMcpRequest = toNodeHandler(mcpHandler, {
+        onerror: (err) => {
+            console.error("MCP transport error:", err);
+        },
+    });
     const httpServer = createServer(async (req, res) => {
-        // DNS rebinding protection: reject cross-origin requests from non-local origins
-        const origin = req.headers.origin;
-        if (origin) {
-            try {
-                const url = new URL(origin);
-                if (url.hostname !== "localhost" && url.hostname !== "127.0.0.1" && url.hostname !== "::1" && url.hostname !== "[::1]") {
-                    res.writeHead(403, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "Forbidden: DNS rebinding protection" }));
-                    return;
-                }
-            }
-            catch {
-                res.writeHead(403, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ error: "Forbidden: invalid Origin header" }));
-                return;
-            }
+        // DNS rebinding protection — every request, before routing or auth.
+        const rejection = evaluateRequestGuard(req.headers, policy);
+        if (rejection) {
+            sendJson(res, rejection.status, { error: rejection.error });
+            return;
         }
-        // Auth check: if MCP_AUTH_REQUIRED env var is set, validate JWT
-        const authRequired = process.env.MCP_AUTH_REQUIRED === "true";
+        const pathname = new URL(req.url || "/", `http://${host}:${port}`).pathname;
+        // Auth gate. Unauthenticated health checks on "/" stay open so liveness
+        // probes work; the endpoint reveals only name, version and status.
         let claims = null;
-        if (authRequired) {
-            // Allow unauthenticated health checks on root
-            const checkPath = new URL(req.url || "/", `http://${host}:${port}`).pathname;
-            if (checkPath !== "/") {
-                claims = extractAuthClaims(req);
-                if (!claims) {
-                    res.writeHead(401, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "Authentication required" }));
-                    return;
-                }
+        if (policy.authRequired && pathname !== "/") {
+            claims = extractAuthClaims(req);
+            if (!claims) {
+                res.writeHead(401, {
+                    "Content-Type": "application/json",
+                    "WWW-Authenticate": 'Bearer realm="4da-mcp"',
+                });
+                res.end(JSON.stringify({ error: "Authentication required" }));
+                return;
             }
         }
-        // Route requests
-        const pathname = new URL(req.url || "/", `http://${host}:${port}`).pathname;
         // Health check endpoint
         if (pathname === "/" && req.method === "GET") {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({
+            sendJson(res, 200, {
                 name: "4da-mcp",
                 version: SERVER_VERSION,
                 transport: "streamable-http",
                 status: "ok",
-            }));
+            });
             return;
         }
         // Only handle /mcp endpoint
         if (pathname !== "/mcp") {
-            res.writeHead(404, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Not Found" }));
+            sendJson(res, 404, { error: "Not Found" });
             return;
         }
-        // Parse JSON body for POST requests
-        let body = undefined;
-        if (req.method === "POST") {
-            try {
-                body = await parseBody(req);
-            }
-            catch {
-                res.writeHead(400, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ error: "Invalid JSON body" }));
-                return;
-            }
-        }
-        // Stateless mode: new transport per request
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-        });
-        res.on("close", () => {
-            transport.close();
-        });
-        try {
-            await server.connect(transport);
-            await transport.handleRequest(req, res, body);
-        }
-        catch (err) {
-            console.error("MCP transport error:", err);
-            if (!res.headersSent) {
-                res.writeHead(500, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ error: "Internal server error" }));
-            }
-        }
+        // Hand off to the MCP handler — body parsing, era classification, and
+        // per-request instance construction happen inside the entry. The auth
+        // context rides along so tool dispatch can enforce the verified role.
+        await runWithAuthContext({ claims, enforced: policy.authRequired }, () => handleMcpRequest(req, res));
     });
-    httpServer.listen(port, host, () => {
-        console.error(`4DA MCP Server v${SERVER_VERSION} (Streamable HTTP) listening on http://${host}:${port}/mcp`);
-        console.error(`Health check: http://${host}:${port}/`);
+    await new Promise((resolve, reject) => {
+        httpServer.once("error", reject);
+        httpServer.listen(port, host, () => {
+            httpServer.removeListener("error", reject);
+            resolve();
+        });
     });
+    console.error(`4DA MCP Server v${SERVER_VERSION} (Streamable HTTP) listening on http://${host}:${port}/mcp`);
+    console.error(`Health check: http://${host}:${port}/`);
+    console.error(`Authentication: ${policy.authRequired ? "required (HMAC-SHA256 verified Bearer tokens)" : "disabled (loopback only)"}`);
+    const close = async () => {
+        await mcpHandler.close();
+        await new Promise((resolve) => httpServer.close(() => resolve()));
+    };
     // Graceful shutdown
     const shutdown = () => {
         console.error("Shutting down HTTP server...");
-        httpServer.close();
-        process.exit(0);
+        void close().finally(() => process.exit(0));
     };
-    process.on("SIGINT", shutdown);
-    process.on("SIGTERM", shutdown);
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+    return { server: httpServer, close };
 }
 //# sourceMappingURL=http-transport.js.map

package/dist/index.d.ts

@@ -1,29 +1,12 @@
 #!/usr/bin/env node
+import { Server } from "@modelcontextprotocol/server";
 /**
- * 4DA MCP Server
+ * Build a Server instance with every handler registered.
  *
- * Provides dependency-intelligence tools (CVE scanning, dependency health,
- * upgrade planning, ecosystem news, decision/agent memory) to Claude Code,
- * Claude Desktop, and other MCP hosts. Runs locally; the only data leaving the
- * machine is public package names/versions sent to registries (OSV, npm, etc.).
- *
- * SECURITY: the server trusts its local environment and does NOT implement
- * authentication. The optional --http transport is intended for localhost use;
- * do NOT expose it over a network without putting your own auth in front.
- */
-/**
- * 4DA MCP Server v4.6.3 — Dependency Intelligence for AI Coding Agents
- *
- * 14 tools across 5 categories. Live vulnerability scanning (OSV.dev),
- * ecosystem news, persistent memory, and tech stack awareness for any MCP host.
- *
- * Categories (canonical — matches schema-registry.ts `ToolCategory`):
- *   Security (3)      — vulnerability scanning, dependency health, upgrade planning
- *   Intelligence (7)  — briefing, ecosystem pulse, context, content feed,
- *                       actionable signals, knowledge gaps, feedback
- *   Decisions (2)     — decision memory, alignment checking
- *   Agent (1)         — cross-session persistent memory
- *   Identity (1)      — developer DNA profile
+ * The v2 serving entries take a factory: `serveStdio` pins one instance per
+ * connection; stateless HTTP (`createMcpHandler`) builds one per request.
+ * Handlers close over the module-level database singleton, so every instance
+ * shares the same lazily-initialized database and live-intelligence layer.
  */
-export {};
+export declare function buildServer(): Server;
 //# sourceMappingURL=index.d.ts.map