@anteros/core 0.0.20 → 0.0.21

package/server/boot.ts

@@ -16,8 +16,12 @@ import { io, engineIo, websocket } from './io'
 import { loadServices } from '../lib/services'
 import { loadSockets } from '../lib/sockets'
 import { syncWorkflows } from '../lib/workflow'
+import { syncMcpTools } from '../lib/mcp'
 import { loadTenantsMiddlewares } from '../lib/middleware'
 import crypto from 'node:crypto';
+import os from 'node:os';
+import { registerMetrics, getMetrics, trackRequest } from './metrics';
+import { startMaster, aggregateMetrics } from './cluster';
 
 /** Check if a TCP port is already bound */
 async function isPortInUse(port: number): Promise<boolean> {
@@ -47,6 +51,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         await loadServices(); // load services
         await loadSockets(); // load websocket handlers
         await syncWorkflows();
+        await syncMcpTools(); // load MCP tools per tenant (mcp/**/*.tool.ts)
         await loadTenantsMiddlewares();
         loadRoutes(); // load routes
         //******************************* */
@@ -76,16 +81,51 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
         const PORT = (cfg.server.port || 4000);
         const NAME = cfg.server.name || process.env.APP_NAME || 'SERVER';
-        const useClusterMode = cfg.clusterMode || false;
-        const env = process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev';
-        // reusePort: cluster mode ON by default, dev mode OFF to detect zombies
-        const reusePort = cfg.server.reusePort ?? (useClusterMode && env !== 'dev');
+        // Widened to `string`: TS narrows `process.env.NODE_ENV` to a literal union
+        // ('development' | 'production' | 'test') and drops the 'dev' fallback branch.
+        const env: string = process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev';
+        // Bun's SO_REUSEPORT: multiple processes can bind the same port (spawn them yourself)
+        const reusePort = cfg.server.reusePort ?? false;
+        const isWorker = process.env.BUN_WORKER !== undefined;
+
+        // ── MASTER (cluster): spawn workers, aggregate metrics, supervise ──
+        if (reusePort && !isWorker) {
+            const workersCount = cfg.server.workers ?? os.availableParallelism();
+            console.log(`[cluster] Master ${process.pid} spawning ${workersCount} workers…`.gray.bold);
+
+            const master = startMaster({
+                workers: workersCount,
+                argv: [process.execPath, ...process.argv.slice(1)],
+                env: { ...(process.env as Record<string, string>) },
+            });
+
+            // Supervision port: aggregated /health (master does NOT serve the main port)
+            const metricsPort = cfg.server.metricsPort ?? PORT + 1;
+            const metricsServer = Bun.serve({
+                port: metricsPort,
+                fetch: (req) => {
+                    if (new URL(req.url).pathname === '/health') {
+                        return Response.json({
+                            status: 'ok',
+                            master: { pid: process.pid },
+                            ...aggregateMetrics(master.metrics()),
+                        });
+                    }
+                    return new Response('Not found', { status: 404 });
+                },
+            });
+
+            console.log(`[cluster] Aggregated /health → http://localhost:${metricsPort}/health`.gray);
+
+            // Keep the master alive
+            return { master, metricsServer } as any;
+        }
 
-        // Detect zombie: check if port is already in use in dev mode
+        // Detect zombie: check if port is already in use when NOT sharing the port
         if (!reusePort && env === 'dev') {
             const occupied = await isPortInUse(PORT);
             if (occupied) {
-                console.error(`\n⚠ Port ${PORT} is already in use. Possible zombie server.\n  → Kill it: lsof -ti :${PORT} | xargs kill -9\n  → Or set server.reusePort: true in config\n`.red.bold);
+                console.error(`\n⚠ Port ${PORT} is already in use. Possible zombie server.\n  → Kill it: lsof -ti :${PORT} | xargs kill -9\n`.red.bold);
                 process.exit(1);
             }
         }
@@ -95,25 +135,47 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
         const server = Bun.serve({
             port: PORT,
-            reusePort,
+            reusePort: reusePort || isWorker,
             fetch: (req, server) => {
                 const url = new URL(req.url);
 
+                // Track every request for the built-in metrics (zero dependency)
+                const respond = (p: Response | Promise<Response>) =>
+                    Promise.resolve(p).then((res) => {
+                        trackRequest(req, res);
+                        return res;
+                    });
+
                 if (url.pathname === "/socket.io/") {
-                    return engineIo.handleRequest(req, server);
-                } else {
-                    return app.fetch(req, server);
+                    return respond(engineIo.handleRequest(req, server));
                 }
-
+                return respond(app.fetch(req, server));
             },
             websocket: websocket,
             maxRequestBodySize: 1024 * 1024 * 100, // 100MB
         })
 
+        // Register server for built-in metrics (GET /health)
+        registerMetrics(server);
+
+        // ── WORKER (cluster): report metrics to the master via IPC ──
+        if (isWorker && typeof process.send === 'function') {
+            setInterval(() => {
+                try {
+                    process.send!({
+                        type: 'metrics',
+                        pid: process.pid,
+                        metrics: getMetrics(),
+                    });
+                } catch {}
+            }, 5000);
+        }
+
         let box = '';
-        box += `${NAME}`.gray.underline + ` (PID: ${process.pid})\n\n`
+        const role = isWorker ? 'worker' : (reusePort ? 'master' : 'standalone');
+        box += `${NAME}`.gray.underline + ` (PID: ${process.pid}) — ${role}\n\n`
         box += `Env: ${env || 'dev'}`.green.bold + '\n'
-        box += `Cluster mode: ${useClusterMode ? 'On'.green.bold : 'Off'.red.bold}\n`.gray.bold
+        box += `reusePort: ${(reusePort || isWorker) ? 'On'.green.bold : 'Off'.red.bold}\n`.gray.bold
         box += `Url: http://localhost:${PORT}`.gray.bold;
         box += '\n\n';
         box += `Last boot: 🔄 ${dayjs().format('YYYY-MM-DD HH:mm:ss')}`.gray;

package/server/cluster.ts

@@ -0,0 +1,177 @@
+import type { Subprocess } from "bun";
+import type { MetricsSnapshot } from "./metrics";
+
+// ─── Master/worker cluster over Bun.reusePort + IPC ──────────────────────────
+//
+// Each worker is a full server bound to the same port (SO_REUSEPORT, round-robin
+// by the kernel). The master only supervises workers and aggregates their
+// metrics — it never serves the main HTTP port.
+
+export type MasterMetrics = Record<number, MetricsSnapshot>;
+
+export type MasterHandle = {
+  /** Currently running worker PIDs */
+  workers: { pid: number }[];
+  /** Latest metrics snapshot per worker PID (may be empty until first report) */
+  metrics(): MasterMetrics;
+  /** Kill + respawn a specific worker */
+  restart(pid: number): void;
+  /** Kill all workers */
+  shutdown(): void;
+};
+
+export type AggregatedMetrics = {
+  workers: number;
+  uptime: { min: number; max: number };
+  requests: {
+    total: number;
+    active: number;
+    errors: number;
+    perSecond: number;
+    byMethod: Record<string, number>;
+    byStatus: Record<string, number>;
+  };
+  memory: { rss: number; heapUsed: number };
+  cpu: { percent: number; cores: number };
+  pids: number[];
+};
+
+type WorkerEntry = {
+  proc: Subprocess;
+  metrics: MetricsSnapshot | null;
+  restarts: number;
+};
+
+const MAX_RESTARTS = 10;
+
+export function startMaster(options: {
+  workers: number;
+  argv: string[];
+  env: Record<string, string>;
+}): MasterHandle {
+  const { workers, argv, env } = options;
+  const entries = new Map<number, WorkerEntry>();
+  let stopping = false;
+
+  const spawn = (): number => {
+    const proc = Bun.spawn(argv, {
+      env: { ...env, BUN_WORKER: '1' },
+      stdout: 'inherit',
+      stderr: 'inherit',
+      ipc: (message: any) => {
+        if (message && typeof message === 'object' && message.type === 'metrics') {
+          const entry = entries.get(message.pid as number);
+          if (entry && message.metrics) {
+            entry.metrics = message.metrics as MetricsSnapshot;
+          }
+        }
+      },
+    });
+
+    entries.set(proc.pid, { proc, metrics: null, restarts: 0 });
+
+    proc.exited.then((code) => {
+      const entry = entries.get(proc.pid);
+      if (!entry) return;
+      entries.delete(proc.pid);
+
+      console.log(`[cluster] Worker ${proc.pid} exited (code ${code})`.yellow);
+      if (stopping) return;
+
+      if (entry.restarts >= MAX_RESTARTS) {
+        console.error(`[cluster] Worker ${proc.pid} exceeded ${MAX_RESTARTS} restarts — giving up`.red.bold);
+        return;
+      }
+
+      // Auto-respawn
+      const newPid = spawn();
+      const fresh = entries.get(newPid);
+      if (fresh) fresh.restarts = entry.restarts + 1;
+      console.log(`[cluster] Respawned worker ${proc.pid} → ${newPid} (attempt ${entry.restarts + 1})`.gray);
+    });
+
+    return proc.pid;
+  };
+
+  for (let i = 0; i < workers; i++) {
+    spawn();
+  }
+
+  return {
+    get workers() {
+      return [...entries.keys()].map((pid) => ({ pid }));
+    },
+
+    metrics() {
+      const out: MasterMetrics = {};
+      for (const [pid, entry] of entries) {
+        if (entry.metrics) out[pid] = entry.metrics;
+      }
+      return out;
+    },
+
+    restart(pid: number) {
+      const entry = entries.get(pid);
+      if (!entry) return;
+      entry.proc.kill();
+      // respawn happens in the proc.exited handler
+    },
+
+    shutdown() {
+      stopping = true;
+      for (const [, entry] of entries) {
+        entry.proc.kill();
+      }
+      entries.clear();
+    },
+  };
+}
+
+/** Merge per-worker snapshots into a single cluster-wide view. */
+export function aggregateMetrics(metrics: MasterMetrics): AggregatedMetrics {
+  const snapshots = Object.values(metrics);
+  const empty: AggregatedMetrics = {
+    workers: 0,
+    uptime: { min: 0, max: 0 },
+    requests: { total: 0, active: 0, errors: 0, perSecond: 0, byMethod: {}, byStatus: {} },
+    memory: { rss: 0, heapUsed: 0 },
+    cpu: { percent: 0, cores: 0 },
+    pids: [],
+  };
+
+  if (!snapshots.length) return empty;
+
+  const workers = snapshots.length;
+  const maxUptime = Math.max(...snapshots.map((m) => m.uptime));
+  const minUptime = Math.min(...snapshots.map((m) => m.uptime));
+  const totalReqs = snapshots.reduce((sum, m) => sum + m.requests.total, 0);
+
+  const byMethod: Record<string, number> = {};
+  const byStatus: Record<string, number> = {};
+  for (const m of snapshots) {
+    for (const [k, v] of Object.entries(m.requests.byMethod)) byMethod[k] = (byMethod[k] ?? 0) + v;
+    for (const [k, v] of Object.entries(m.requests.byStatus)) byStatus[k] = (byStatus[k] ?? 0) + v;
+  }
+
+  return {
+    workers,
+    uptime: { min: minUptime, max: maxUptime },
+    requests: {
+      total: totalReqs,
+      active: snapshots.reduce((sum, m) => sum + m.pendingRequests, 0),
+      errors: snapshots.reduce((sum, m) => sum + m.requests.errors, 0),
+      perSecond: maxUptime > 0 ? Math.round(totalReqs / maxUptime) : 0,
+      byMethod,
+      byStatus,
+    },
+    memory: {
+      rss: snapshots.reduce((sum, m) => sum + m.memory.rss, 0),
+      heapUsed: snapshots.reduce((sum, m) => sum + m.memory.heapUsed, 0),
+    },
+    cpu: {
+      percent: Math.round((snapshots.reduce((sum, m) => sum + m.cpu.percent, 0) / workers) * 10) / 10,
+      cores: snapshots[0]?.cpu.cores ?? 0,
+    },
+    pids: snapshots.map((m) => m.pid),
+  };
+}

package/server/config.ts

@@ -15,7 +15,6 @@ const cfg: Config = { // app Config
 
 function formatConfig(config: ServerConfig) { // format the config
 
-    cfg.clusterMode = config.clusterMode ?? true;
     cfg.server = {
         ...cfg.server,
         ...config.server,

package/server/env.ts

@@ -1,6 +1,8 @@
 /**
  * Hono context variables shared by middleware and route handlers.
  */
+import type { ConnInfo } from "hono/conninfo";
+
 export type HonoVariables = {
     /** Present when `Authorization: Bearer <jwt>` was sent and verification succeeded. */
     token?: {
@@ -13,4 +15,8 @@ export type HonoVariables = {
         /** Whether the token is expired */
         expired: boolean;
     };
+    /** Best-effort client IP, resolved once per request (real socket, or trusted proxy header when cfg.server.trustProxy). */
+    clientIp?: string;
+    /** Connection info (real socket address) — set once per request by the IP middleware. */
+    connInfo?: ConnInfo;
 };

package/server/hono.ts

@@ -1,22 +1,111 @@
-import { Hono } from "hono";
+import { Hono, type Context } from "hono";
 import { cors } from "hono/cors"
 import { compress } from 'hono/compress'
 import { ipRestriction } from "hono/ip-restriction"
 import { bodyLimit } from "hono/body-limit"
 import { secureHeaders } from "hono/secure-headers"
+import { HTTPException } from "hono/http-exception"
 import { getConnInfo } from "hono/bun"
+import type { ConnInfo, GetConnInfo } from "hono/conninfo"
+import { Redis } from "ioredis"
 import { cfg } from "./config"
-import { rateLimit } from "./security"
+import { rateLimit, createRedisStore, createMemoryStore, type RateLimitStore } from "./security"
 import { initializeRoutes } from "./routes";
-import { sessionCtxStorage, asyncContextStorage, requestCtxStorage } from "../lib/asyncContextStorage";
+import { asyncContextStorage, requestCtxStorage } from "../lib/asyncContextStorage";
 import { initializeApi } from "./api";
+import { initializeMcp } from "./mcp";
 import { getGlobalMiddlewares } from "../lib/middleware";
 import { jwt } from "../utils/func";
 import { AppError } from "../lib/error";
+import { getMetrics } from "./metrics";
 import type { HonoVariables } from "./env";
 
-const app = new Hono<{ Variables: HonoVariables }>();
+// ─── Redis-backed rate limiting (C3) ─────────────────────────────────────────
+// Lazy singleton: created once per process and reused across createApp() calls.
+// Each increment falls back to the in-memory store if Redis is unavailable,
+// so the limiter keeps working during a Redis outage.
+let redisRateLimitStore: RateLimitStore | null | undefined;
+let redisRateLimitSignature: string | undefined;
+
+function getRedisRateLimitStore(): RateLimitStore | null {
+    const rl = cfg.server.rateLimit;
+    // Re-evaluate only when the rate-limit config or Redis env vars change,
+    // so multiple createApp() calls (tests, hot reload) reuse the same client.
+    const signature = JSON.stringify([
+        rl?.useRedis,
+        rl?.redis,
+        process.env.REDIS_URL,
+        process.env.REDIS_HOST,
+        process.env.REDIS_PORT,
+        process.env.REDIS_PASSWORD,
+    ]);
+    if (redisRateLimitSignature === signature && redisRateLimitStore !== undefined) return redisRateLimitStore;
+    redisRateLimitSignature = signature;
+
+    if (!rl) {
+        redisRateLimitStore = null;
+        return null;
+    }
+
+    // Redis is used AUTOMATICALLY when connection info is present (rateLimit.redis
+    // block or REDIS_* env vars) — no need for useRedis: true.
+    //   - useRedis: false  → force the in-memory store
+    //   - useRedis: true   → force Redis even without connection info (localhost)
+    //   - unset            → auto: Redis if configured, else memory
+    const conn = rl.redis ?? {};
+    const hasRedisConfig =
+        Boolean(conn.url || conn.host || conn.port || conn.password) ||
+        Boolean(process.env.REDIS_URL || process.env.REDIS_HOST || process.env.REDIS_PORT || process.env.REDIS_PASSWORD);
+    const useRedis = rl.useRedis === true || (rl.useRedis !== false && hasRedisConfig);
+
+    if (!useRedis) {
+        redisRateLimitStore = null;
+        return null;
+    }
+
+    try {
+        const conn = rl.redis ?? {};
+        // Stop reconnecting after a few attempts: a dead Redis must not spam logs
+        // or keep the process alive — the limiter falls back to memory meanwhile.
+        const retryStrategy = (times: number) => (times > 5 ? null : Math.min(times * 500, 3000));
+        const client = conn.url
+            ? new Redis(conn.url, { retryStrategy, maxRetriesPerRequest: 2 })
+            : new Redis({
+                host: conn.host ?? process.env.REDIS_HOST ?? 'localhost',
+                port: conn.port ?? (Number(process.env.REDIS_PORT) || 6379),
+                password: conn.password ?? process.env.REDIS_PASSWORD,
+                retryStrategy,
+                maxRetriesPerRequest: 2,
+            });
+        let errorLogged = false;
+        client.on('error', (err) => {
+            if (errorLogged) return;
+            errorLogged = true;
+            console.error('[rateLimit] Redis connection error:', err?.message);
+        });
+
+        const redisStore = createRedisStore(client);
+        const memoryFallback = createMemoryStore();
+        redisRateLimitStore = {
+            async increment(key: string, windowMs: number) {
+                try {
+                    return await redisStore.increment(key, windowMs);
+                } catch (err: any) {
+                    console.error('[rateLimit] Redis store failed, falling back to in-memory:', err?.message);
+                    return memoryFallback.increment(key, windowMs);
+                }
+            },
+        };
+        console.log('[rateLimit] store: Redis (with in-memory fallback)');
+    } catch (err: any) {
+        console.error('[rateLimit] Redis init failed, using in-memory store:', err?.message);
+        redisRateLimitStore = null;
+    }
+    return redisRateLimitStore;
+}
+
 function createApp(): Hono<{ Variables: HonoVariables }> {
+    const app = new Hono<{ Variables: HonoVariables }>();
     const allowHeaders = [
         "Tenant-Id",
         "Content-Type",
@@ -43,17 +132,78 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
         "HEAD",
         ...(cfg.server.cors?.allowMethods as string[] || []),
     ]
-    // cors
-    const corsOrigin = cfg.server.cors?.origin as string[] | undefined;
-    const corsCredentials = cfg.server.cors?.credentials as boolean | undefined ?? false;
+    // cors — origin accepts string | string[] | function (see ServerConfig type)
+    const corsConfig = cfg.server.cors?.origin;
+    const corsCredentials = cfg.server.cors?.credentials ?? false;
+
+    // Detect a wildcard in any supported form without breaking on string/function origins
+    const hasWildcardOrigin =
+        corsConfig === '*' ||
+        (Array.isArray(corsConfig) && corsConfig.includes('*'));
 
-    if (corsCredentials && (!corsOrigin || corsOrigin.includes('*'))) {
+    if (corsCredentials && (!corsConfig || hasWildcardOrigin)) {
         throw new Error(
             'CORS misconfiguration: credentials: true is incompatible with origin: *. '
             + 'Set explicit origins in cfg.server.cors.origin.'
         );
     }
 
+    // Config function form: (ctx: { origin, c }) => string | string[]
+    // Hono expects: (origin, c) => string | Promise<string | null | undefined> | null | undefined
+    type CorsOriginOption = NonNullable<Parameters<typeof cors>[0]>['origin'];
+    const corsOrigin =
+        typeof corsConfig === 'function'
+            ? ((origin: string, c: Context) => corsConfig({ origin, c })) as unknown as CorsOriginOption
+            : corsConfig;
+
+    // Global error handler — maps AppError thrown by user routes, global
+    // middlewares and useRest to their proper status/code/message.
+    // (API routes keep their own errorResponse() for backward compat.)
+    app.onError((err, c) => {
+        // Let Hono's HTTPException respond with its own status (401/413/…)
+        if (err instanceof HTTPException) {
+            return err.getResponse();
+        }
+
+        const isAppError = err instanceof AppError;
+        // Always log unexpected errors (default Hono behavior preserved)
+        if (!isAppError) console.error(err);
+
+        const status = isAppError ? Number(err.status) || 500 : 500;
+        return c.json({
+            message: isAppError ? err.message : 'Internal server error',
+            code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
+            meta: isAppError ? err.meta : undefined,
+        }, status as any);
+    });
+
+    // ── Client IP: resolved once per request and shared by all middlewares ──
+    // getConnInfo(c) = server.requestIP() → the real socket address. Proxy headers
+    // (CF-Connecting-IP / X-Forwarded-For) are ONLY trusted when cfg.server.trustProxy
+    // is explicitly enabled, otherwise they are spoofable.
+    // getConnInfo throws when the app runs outside a real Bun.serve (e.g. app.request()
+    // in tests) → fall back to an empty address.
+    const safeGetConnInfo = (c: Context): ConnInfo => {
+        try {
+            return getConnInfo(c);
+        } catch {
+            return { remote: {} };
+        }
+    };
+
+    app.use(async (c, next) => {
+        const connInfo = safeGetConnInfo(c);
+        c.set('connInfo', connInfo);
+        c.set('clientIp', cfg.server.trustProxy
+            ? c.req.header('CF-Connecting-IP') ?? c.req.header('X-Forwarded-For') ?? connInfo.remote.address ?? 'unknown'
+            : connInfo.remote.address ?? 'unknown');
+        await next();
+    });
+
+    // Reuse the cached connInfo instead of re-querying the socket per middleware
+    const cachedGetConnInfo: GetConnInfo = (c) =>
+        (c as Context<{ Variables: HonoVariables }>).get('connInfo') ?? safeGetConnInfo(c);
+
 
 
     app.use(cors({
@@ -67,7 +217,7 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     app.use(compress());
 
     // ip restriction
-    app.use(ipRestriction(getConnInfo, {
+    app.use(ipRestriction(cachedGetConnInfo, {
         denyList: cfg.server?.ipRestriction?.denyList || [],
         allowList: cfg.server?.ipRestriction?.allowList || [],
     }))
@@ -88,19 +238,38 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
         maxSize: cfg.server.body?.maxSize ?? 1024 * 1024 * 100, // 100MB
     }));
 
+    // ── Health & metrics (built-in, zero dependency) ──
+    app.get('/health', (c) => {
+        return c.json({
+            ...getMetrics(),
+            ip: c.get('clientIp') ?? 'unknown',
+        });
+    });
+
 
 
     // rate limiting (global)
     if (cfg.server.rateLimit?.enabled !== false) {
+        // Redis-backed store when configured (C3), in-memory otherwise
+        const store = getRedisRateLimitStore() ?? undefined;
+
+        // Distinct keys so the stricter login limit never shares counters with the global one
+        const keyByClientIp = (prefix: string) => (c: Context) =>
+            `rn:rl:${prefix}${(c as any).get('clientIp') ?? 'unknown'}`;
+
         app.use('*', rateLimit({
             windowMs: cfg.server.rateLimit?.windowMs ?? 60_000,
             max: cfg.server.rateLimit?.max ?? 100,
+            store,
+            keyGenerator: keyByClientIp(''),
         }));
 
         // stricter limit for login endpoints
         app.use('/api/*/login', rateLimit({
             windowMs: cfg.server.rateLimit?.login?.windowMs ?? 60_000,
             max: cfg.server.rateLimit?.login?.max ?? 10,
+            store,
+            keyGenerator: keyByClientIp('login:'),
         }));
     }
 
@@ -108,7 +277,6 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     app.use(async (c, next) => {
         return asyncContextStorage.run(new Map(), async () => {
             const traceId = crypto.randomUUID();
-            const connInfo = getConnInfo(c);
             requestCtxStorage.set('trace', { id: traceId });
             requestCtxStorage.set('internal', false);
 
@@ -120,7 +288,7 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             delete requestCtx.cookie;
             requestCtxStorage.set('meta', {
                 request: {
-                    ip: connInfo.remote.address ?? c.req.header('CF-Connecting-IP') ?? c.req.header('True-Client-IP') ?? c.req.header('X-Forwarded-For') ?? 'unknown',
+                    ip: c.get('clientIp') ?? 'unknown',
                     user_agent: c.req.header('User-Agent') ?? '',
                     headers: requestCtx,
                     method: c.req.method,
@@ -140,7 +308,8 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
                     value: isValid ? bearer : null,
                     decoded: isValid ? (value as Record<string, unknown>) : null,
                     provided: true,
-                    expired: expired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
+                    // jwt.verify already flags expiry (expired: true, value: null)
+                    expired,
                 };
 
                 requestCtxStorage.set('token', tokenData);
@@ -166,6 +335,9 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     // initialize api
     initializeApi(app);
 
+    // initialize MCP (tools served at /mcp/:tenant_id)
+    initializeMcp(app);
+
 
     return app;
 }
@@ -174,6 +346,5 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
 
 
 export {
-    createApp,
-    app
+    createApp
 }