@aetherwealth/mcp 0.1.23 → 0.1.27
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -0
- package/dist/index.js +65 -53
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -59,6 +59,23 @@ No shared API key is configured in your MCP client. All data tools require
|
|
|
59
59
|
OAuth sign-in, including market-data tools. `logout` clears the local
|
|
60
60
|
credential for this device.
|
|
61
61
|
|
|
62
|
+
### Hosted (Remote) Mode
|
|
63
|
+
|
|
64
|
+
Operators can deploy this server as a shared remote MCP endpoint instead of a
|
|
65
|
+
local process. Set `MCP_TRANSPORT=http`, `MCP_HTTP_AUTH=oauth`, and
|
|
66
|
+
`MCP_PUBLIC_ORIGIN=https://<your-host>`. In this mode:
|
|
67
|
+
|
|
68
|
+
- Each request must carry the caller's own OAuth access token
|
|
69
|
+
(`Authorization: Bearer ...`); MCP clients obtain it via the standard MCP
|
|
70
|
+
auth flow, discovered from `/.well-known/oauth-protected-resource`.
|
|
71
|
+
- The `login`/`logout` tools are not registered — the MCP client owns the
|
|
72
|
+
OAuth flow, and nothing is stored server-side (no keychain, no sessions).
|
|
73
|
+
- Requests are rate limited per caller (per token, else per client IP;
|
|
74
|
+
`MCP_RATE_LIMIT_MAX` requests/minute, default 120) — over-limit calls get
|
|
75
|
+
`429` with a `Retry-After` header. Health/discovery routes are exempt.
|
|
76
|
+
- `/healthz` reports liveness for load balancers.
|
|
77
|
+
|
|
78
|
+
|
|
62
79
|
## Tools
|
|
63
80
|
|
|
64
81
|
### Auth
|