@absolutejs/mcp 0.17.3 → 0.17.4

package/CHANGELOG.md

@@ -6,6 +6,12 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.17.4 — 2026-09-11
+
+### Added
+
+- **Ship an authenticated two-account staging canary for read isolation, credential rejection and session reconnect with private credentials and aggregate-only results**
+
 ## 0.17.3 — 2026-09-11
 
 ### Fixed

package/canary/authenticated.ts

@@ -0,0 +1,192 @@
+/** Authenticated staging checks. Tokens/results remain in memory and are never logged. */
+import type { McpToolResult } from "@absolutejs/mcp";
+export type AuthenticatedCanaryOptions = {
+  url: string;
+  accounts: readonly [string, string];
+  tool: { name: string; arguments?: Record<string, unknown> };
+  /** Select stable account-owned data, excluding timestamps and shared metadata. */
+  fingerprint: (result: McpToolResult) => string;
+  request?: typeof fetch;
+};
+export const runAuthenticatedCanary = async (
+  options: AuthenticatedCanaryOptions,
+) => {
+  const url = new URL(options.url);
+  if (
+    url.protocol !== "https:" &&
+    !(
+      url.protocol === "http:" &&
+      ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+    )
+  )
+    throw Error("HTTPS required outside loopback");
+  if (
+    !options.accounts[0] ||
+    !options.accounts[1] ||
+    options.accounts[0] === options.accounts[1]
+  )
+    throw Error("Two distinct credentials required");
+  const request = options.request ?? fetch;
+  const checks: { name: string; passed: boolean }[] = [];
+  const sessions: { token: string; id: string; protocol: string }[] = [];
+  const send = async (
+    token: string | null,
+    session: (typeof sessions)[number] | undefined,
+    method: string,
+    params: unknown = {},
+  ) =>
+    request(options.url, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+        ...(session
+          ? {
+              "mcp-session-id": session.id,
+              "mcp-protocol-version": session.protocol,
+            }
+          : {}),
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+    });
+  const body = async (response: Response) => {
+    if (
+      !response.ok ||
+      !response.headers.get("content-type")?.includes("application/json")
+    )
+      throw Error("Canary requires successful JSON responses");
+    const value = await response.json();
+    if (value.error || !value.result || value.result.isError)
+      throw Error("Canary RPC failed");
+    return value.result;
+  };
+  const initialize = async (token: string) => {
+    const response = await send(token, undefined, "initialize", {
+      protocolVersion: "2025-11-25",
+      clientInfo: { name: "absolute-authenticated-canary", version: "1" },
+      capabilities: {
+        elicitation: {},
+        extensions: {
+          "io.modelcontextprotocol/ui": {
+            mimeTypes: ["text/html;profile=mcp-app"],
+          },
+        },
+      },
+    });
+    const result = await body(response);
+    const id = response.headers.get("mcp-session-id");
+    if (!id || typeof result.protocolVersion !== "string")
+      throw Error("Stateful MCP session required");
+    const session = { token, id, protocol: result.protocolVersion };
+    sessions.push(session);
+    await request(options.url, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json",
+        "mcp-session-id": id,
+        "mcp-protocol-version": session.protocol,
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        method: "notifications/initialized",
+      }),
+    });
+    return session;
+  };
+  const drop = (session: (typeof sessions)[number], authorized = true) =>
+    request(options.url, {
+      method: "DELETE",
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        "mcp-session-id": session.id,
+        "mcp-protocol-version": session.protocol,
+        ...(authorized ? { authorization: `Bearer ${session.token}` } : {}),
+      },
+    });
+  const read = async (token: string, session: (typeof sessions)[number]) =>
+    options.fingerprint(
+      await body(await send(token, session, "tools/call", options.tool)),
+    );
+  try {
+    const a = await initialize(options.accounts[0]);
+    const b = await initialize(options.accounts[1]);
+    for (const session of [a, b]) {
+      const discovery = await body(
+        await send(session.token, session, "tools/list"),
+      );
+      if (
+        !discovery.tools?.some(
+          (tool: { name: string; annotations?: { readOnlyHint?: boolean } }) =>
+            tool.name === options.tool.name &&
+            tool.annotations?.readOnlyHint === true,
+        )
+      )
+        throw Error("Explicitly read-only tool required for both accounts");
+    }
+    const first = await read(a.token, a);
+    const second = await read(b.token, b);
+    if (!first || !second || first === second)
+      throw Error(
+        "Distinct stable account-owned results required; isolation is inconclusive",
+      );
+    checks.push({ name: "distinct-account-results", passed: true });
+    for (const [session, expected] of [
+      [a, first],
+      [b, second],
+    ] as const)
+      checks.push({
+        name: "stable-account-result",
+        passed: (await read(session.token, session)) === expected,
+      });
+    for (const [token, session, expected] of [
+      [b.token, a, second],
+      [a.token, b, first],
+    ] as const) {
+      const response = await send(token, session, "tools/call", options.tool);
+      // Binding a session to its owner is also safe; otherwise current credentials must select the data.
+      checks.push({
+        name: "cross-session-account-isolation",
+        passed:
+          [401, 403, 404].includes(response.status) ||
+          options.fingerprint(await body(response)) === expected,
+      });
+    }
+    for (const token of [null, "invalid-canary-credential"])
+      checks.push({
+        name: "invalid-credential-rejected",
+        passed: (await send(token, a, "tools/list")).status === 401,
+      });
+    checks.push({
+      name: "unauthenticated-delete-rejected",
+      passed: (await drop(a, false)).status === 401,
+    });
+    checks.push({
+      name: "session-survives-rejected-delete",
+      passed: (await send(a.token, a, "tools/list")).status === 200,
+    });
+    const deletion = await drop(b);
+    checks.push({
+      name: "own-session-deletion",
+      passed: deletion.status === 204,
+    });
+    checks.push({
+      name: "terminated-session-404",
+      passed: (await send(b.token, b, "tools/list")).status === 404,
+    });
+    const fresh = await initialize(b.token);
+    checks.push({
+      name: "fresh-session-read",
+      passed: fresh.id !== b.id && (await read(b.token, fresh)) === second,
+    });
+    return { passed: checks.every((check) => check.passed), checks };
+  } finally {
+    for (const session of sessions) await drop(session).catch(() => undefined);
+  }
+};

package/changelog.json

@@ -2,6 +2,16 @@
   "contract": 1,
   "name": "@absolutejs/mcp",
   "releases": [
+    {
+      "version": "0.17.4",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Ship an authenticated two-account staging canary for read isolation, credential rejection and session reconnect with private credentials and aggregate-only results"
+        }
+      ]
+    },
     {
       "version": "0.17.3",
       "date": "2026-09-11",

package/docs/host-canaries.md

@@ -76,3 +76,20 @@ Native Windows VS Code 1.135.0 advertised Apps MIME support but omitted MCP-Prot
 Three report views rendered in the signed-in isolated Copilot workspace. Balance and usage refresh, daily expansion and receipt pagination passed. There were six report calls: three initial calls and three explicit button actions. Reloading restored the original report results with no extra report calls. All app documents measured 242px without horizontal document overflow. The first balance webview was blank until a window reload; its cause is not isolated, so this is a qualified rendering result, not proof of reliable first-load behavior. Reviewed aggregate evidence: `canary/results/2026-09-11-vscode.json`.
 
 Package regressions verify authorization before session deletion, per-request account selection, expired-session HTTP 404, and fresh explicit client initialization. HTTP failures now produce McpClientError with status (and a JSON-RPC code when available), including empty/non-JSON responses. After a session 404, call client.initialize() to negotiate a fresh session before further operations. The failed tool is never automatically replayed; callers must decide whether retrying is appropriate. Synthetic credentials prove handler behavior, not OAuth correctness or real-tenant isolation. Authenticated staging remains a separate release gate.
+
+## Authenticated two-account staging canary
+
+Import `runAuthenticatedCanary` from `@absolutejs/mcp/canary/authenticated` in a local Bun script. Supply an HTTPS endpoint, two distinct access tokens obtained through the application's normal OAuth flow, an explicitly read-only tool, and a fingerprint function selecting stable account-owned data. Credentials, fingerprints and results remain in memory; the returned report contains only check names and booleans. Keep the calling script and tokens outside the repository.
+
+```ts
+const report = await runAuthenticatedCanary({
+  url: stagingMcpUrl,
+  accounts: [firstAccessToken, secondAccessToken],
+  tool: { name: accountReadTool, arguments: {} },
+  fingerprint: (result) => JSON.stringify(result.content),
+});
+```
+
+Choose two accounts with known distinct data. The canary refuses identical results as inconclusive and verifies repeated reads remain stable. It checks both directions of session-ID substitution: rejecting the foreign session or returning the currently authenticated account's result is acceptable. It also checks missing/invalid credentials, unauthorized DELETE, authorized deletion, terminated-session 404, and fresh initialization/read. It creates and cleans up only its own MCP sessions, never purchases or modifies account data. Read-only annotations are a prerequisite, not a substitute for the operator selecting a known non-billable read tool. The current harness requires JSON RPC responses; SSE-only servers are not certified by it.
+
+This verifies the selected read path, not every tenant resource, token revocation, automatic host reconnect, or billing permissions. Session termination is explicit DELETE; timed TTL expiry needs a separate store test. Use dedicated test clients and remove their grants after verification. Do not publish tokens, transcripts, fingerprints, or raw account data.

package/package.json

@@ -46,7 +46,8 @@
       "types": "./dist/src/apps.d.ts",
       "import": "./dist/apps.js",
       "default": "./dist/apps.js"
-    }
+    },
+    "./canary/authenticated": "./canary/authenticated.ts"
   },
   "publishConfig": {
     "access": "public"
@@ -83,8 +84,8 @@
     "prepublishOnly": "bun run check:package",
     "build:apps": "bun scripts/build-apps.ts",
     "canary": "bun canary/server.ts",
-    "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts"
+    "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts canary/authenticated.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.17.3"
+  "version": "0.17.4"
 }