@apiosk/mcp 1.3.1 → 1.7.0

package/server.mjs

@@ -1,16 +1,31 @@
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { fileURLToPath } from "node:url";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import {
   SERVER_INFO,
   createApioskMcpServer,
   listApioskTools,
 } from "./src/create-server.mjs";
-import { createHostedOAuthSupport, resolveHostedMcpUrls } from "./src/oauth.mjs";
+import {
+  createHostedOAuthSupport,
+  createMcpWalletAuthNonce,
+  resolveHostedMcpUrls,
+} from "./src/oauth.mjs";
 import { createApioskMcpRuntime } from "./src/runtime.mjs";
+import { openSession, closeSession } from "./src/observability.mjs";
 import {
   resolveOpenAiAppsChallengeToken,
   sendOpenAiAppsChallenge,
 } from "./well-known.mjs";
+import {
+  buildDiscoveryDocument,
+  getOpenApiRouteDocument,
+} from "./src/publisher.mjs";
+import {
+  SETTLEMENT_DISCLOSURE_PATH,
+  createSettlementDisclosurePage,
+} from "./src/settlement-disclosure.mjs";
 
 const CONTROL_PLANE_BACKEND_URL = (
   process.env.APIOSK_CONTROL_PLANE_BACKEND_URL ||
@@ -46,10 +61,11 @@ function normalizeControlPlanePath(pathname = "") {
 }
 
 function shouldProxyControlPlanePath(pathname = "") {
+  // Hosted sign-in is wallet-only now (see src/oauth.mjs); the email/password
+  // /api/auth/mcp-sign-in|sign-up routes never existed on the control plane, so
+  // they are no longer proxied.
   const normalizedPath = normalizeControlPlanePath(pathname);
   return (
-    normalizedPath === "/api/auth/mcp-sign-in" ||
-    normalizedPath === "/api/auth/mcp-sign-up" ||
     normalizedPath.startsWith("/api/credits/") ||
     normalizedPath === "/api/agent-wallets" ||
     normalizedPath.startsWith("/api/agent-wallets/")
@@ -111,7 +127,7 @@ function renderMcpWelcomeHtml(mcpUrl) {
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <meta name="robots" content="noindex" />
-<title>Apiosk MCP</title>
+<title>Apiosk Connect</title>
 <style>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
@@ -152,7 +168,7 @@ function renderMcpWelcomeHtml(mcpUrl) {
 <main>
   <div class="card">
     <span class="badge">Model Context Protocol</span>
-    <h1>Welcome to Apiosk MCP</h1>
+    <h1>Welcome to Apiosk Connect</h1>
     <p class="lead">
       This is the Apiosk MCP server endpoint &mdash; it lets AI agents discover, pay for,
       execute, and publish APIs through the Apiosk gateway. It is a machine endpoint, not a
@@ -166,6 +182,9 @@ function renderMcpWelcomeHtml(mcpUrl) {
       <li><strong>Pay</strong> per call automatically in USDC (x402 on Base).</li>
       <li><strong>Execute</strong> any listing through a uniform contract or its API-specific tool.</li>
       <li><strong>Publish &amp; manage</strong> your own APIs so other agents can find and pay for them.</li>
+      <li><strong>Ship paid x402 routes from a coding agent</strong> &mdash; connect with
+        <code>Authorization: Bearer sk_live_&hellip;</code> (a provider API key) and use
+        <code>publish_x402_route</code>, <code>test_x402_route</code>, and friends.</li>
     </ul>
 
     <h2>Endpoint</h2>
@@ -174,12 +193,18 @@ function renderMcpWelcomeHtml(mcpUrl) {
     <h2>Connect from Claude Code</h2>
     <code>claude mcp add --transport http apiosk ${mcpUrl}</code>
 
+    <h2>Connect from ChatGPT</h2>
+    <code class="endpoint">${mcpUrl}</code>
+
+    <h2>Legacy SSE fallback</h2>
+    <code class="endpoint">${mcpUrl.replace(/\/mcp$/, "/sse")}</code>
+
     <div class="links">
       <a href="/health">Health</a>
       <a href="https://dashboard.apiosk.com" target="_blank" rel="noopener">Dashboard</a>
       <a href="https://github.com/obcraft/apiosk-mcp" target="_blank" rel="noopener">Docs &amp; source</a>
     </div>
-    <footer>Apiosk MCP &middot; ${SERVER_INFO.name} v${SERVER_INFO.version}</footer>
+    <footer>Apiosk Connect &middot; ${SERVER_INFO.name} v${SERVER_INFO.version}</footer>
   </div>
 </main>
 </body>
@@ -199,12 +224,13 @@ function sendMcpWelcome(req, res) {
   }
 
   res.status(200).json({
-    name: "Apiosk MCP",
+    name: "Apiosk Connect",
     server: SERVER_INFO,
     description:
-      "Apiosk MCP server endpoint. Connect it from an MCP client to discover, pay for, execute, and publish APIs through the Apiosk gateway.",
+      "Apiosk Connect lets MCP clients discover, pay for, execute, and publish APIs through the Apiosk gateway.",
     transport: "streamable-http",
     endpoint: mcpUrl,
+    legacy_sse_endpoint: mcpUrl.replace(/\/mcp$/, "/sse"),
     connect: {
       claude_code: `claude mcp add --transport http apiosk ${mcpUrl}`,
     },
@@ -216,22 +242,27 @@ function sendMcpWelcome(req, res) {
 // Public Fly deployment must accept the Fly hostname instead of localhost-only
 // host validation defaults.
 const app = createMcpExpressApp({ host: "0.0.0.0" });
+// Fly terminates TLS and adds one trusted proxy hop. Without this,
+// express-rate-limit rejects X-Forwarded-For and can surface as MCP -32603.
+app.set("trust proxy", 1);
 const port = Number(process.env.PORT || 3000);
 const { issuerUrl, mcpServerUrl } = resolveHostedMcpUrls({
   env: process.env,
   port,
 });
 const runtime = createApioskMcpRuntime({
-  enableLocalWallets: process.env.APIOSK_ENABLE_LOCAL_WALLETS === "true",
+  // Hosted MCP is multi-tenant and must never read/write machine-local wallet
+  // or config state. Buyer identity and payment capability are request-scoped
+  // through OAuth/connect tokens; local wallets belong only to stdio installs.
+  enableLocalWallets: false,
   hostedAuthEnabled: true,
 });
 const hostedOAuth = createHostedOAuthSupport({
   env: process.env,
-  controlPlaneBaseUrl: CONTROL_PLANE_BACKEND_URL,
   issuerUrl,
   mcpServerUrl,
   appName: "Apiosk",
-  resourceName: "Apiosk MCP",
+  resourceName: "Apiosk Connect",
 });
 const mcpAuthMiddleware = hostedOAuth.createMcpAuthMiddleware(runtime);
 
@@ -249,6 +280,66 @@ app.get(OPENAI_APPS_CHALLENGE_PATH_PATTERN, (req, res) => {
   return sendOpenAiAppsChallenge(res, OPENAI_APPS_CHALLENGE_TOKEN);
 });
 
+app.get("/logo-optimized-light.png", (req, res) => {
+  res.type("png").sendFile(fileURLToPath(new URL("./logo-optimized-light.png", import.meta.url)));
+});
+
+app.get(SETTLEMENT_DISCLOSURE_PATH, (_req, res) => {
+  res
+    .setHeader("cache-control", "public, max-age=300")
+    .type("html")
+    .send(createSettlementDisclosurePage());
+});
+
+// Self-hosted browser bundles for the /authorize wallet flows. Served
+// same-origin because embedded mobile browsers can refuse cross-origin dynamic
+// module imports. Regenerate with scripts/build-wallet-lib.mjs after upgrades.
+const browserBundleFiles = new Map([
+  ["wallet-accounts.mjs", new URL("./src/assets/wallet-accounts.mjs", import.meta.url)],
+  ["walletconnect-provider.mjs", new URL("./src/assets/walletconnect-provider.mjs", import.meta.url)],
+]);
+const browserBundleCache = new Map();
+
+app.get("/assets/:bundle", async (req, res, next) => {
+  const bundleUrl = browserBundleFiles.get(req.params.bundle);
+  if (!bundleUrl) return next();
+
+  try {
+    let bundle = browserBundleCache.get(req.params.bundle);
+    if (!bundle) {
+      const { readFile } = await import("node:fs/promises");
+      bundle = await readFile(bundleUrl);
+      browserBundleCache.set(req.params.bundle, bundle);
+    }
+    res.setHeader("content-type", "text/javascript; charset=utf-8");
+    res.setHeader("cache-control", "public, max-age=3600");
+    res.send(bundle);
+  } catch (error) {
+    res.status(404).json({
+      error: "not_found",
+      message: "Wallet library bundle is not available on this deployment.",
+      status: 404,
+    });
+  }
+});
+
+app.post("/api/auth/mcp-wallet-nonce", async (req, res) => {
+  try {
+    const nonce = await createMcpWalletAuthNonce({ env: process.env });
+    res.status(200).json(nonce);
+  } catch (error) {
+    const status = Number.isFinite(error?.status) ? error.status : 502;
+    res.status(status).json({
+      error: "wallet_auth_unavailable",
+      message:
+        error instanceof Error
+          ? error.message
+          : "Wallet sign-in is temporarily unavailable.",
+      status,
+    });
+  }
+});
+
 app.all("/api/*path", async (req, res) => {
   try {
     const pathname = req.path || req.originalUrl || "";
@@ -270,6 +361,49 @@ app.all("/api/*path", async (req, res) => {
   }
 });
 
+// Hosted OpenAPI spec for a published x402 route (generate_openapi_spec
+// returns this URL). Built live from the gateway database, so it always
+// reflects the current listing. Accepts /openapi/<route_id> and
+// /openapi/<route_id>.json.
+app.get("/openapi/:routeId", async (req, res) => {
+  try {
+    const document = await getOpenApiRouteDocument(req.params.routeId, {
+      env: process.env,
+    });
+    if (!document) {
+      return res.status(404).json({
+        error: "not_found",
+        message: "No published route matches this id.",
+        status: 404,
+      });
+    }
+    res.setHeader("cache-control", "public, max-age=60");
+    res.json(document);
+  } catch (error) {
+    res.status(502).json({
+      error: "bad_gateway",
+      message: error instanceof Error ? error.message : String(error),
+      status: 502,
+    });
+  }
+});
+
+// Machine-readable index of every paid x402 route published through Apiosk,
+// reshaped from the gateway's /.well-known/x402 document (60s cache).
+app.get(["/.well-known/apiosk-routes.json", "/discovery"], async (req, res) => {
+  try {
+    const document = await buildDiscoveryDocument({ env: process.env });
+    res.setHeader("cache-control", "public, max-age=60");
+    res.json(document);
+  } catch (error) {
+    res.status(502).json({
+      error: "bad_gateway",
+      message: error instanceof Error ? error.message : String(error),
+      status: 502,
+    });
+  }
+});
+
 app.get("/health", async (req, res) => {
   try {
     const tools = await listApioskTools({ runtime });
@@ -354,10 +488,78 @@ app.delete("/mcp", (req, res) => {
   });
 });
 
+// Legacy HTTP+SSE transport (protocol version 2024-11-05), kept alongside
+// Streamable HTTP for older MCP clients. Current ChatGPT and Claude installs
+// should use the preferred /mcp Streamable HTTP endpoint.
+const sseTransports = new Map();
+
+app.get("/sse", async (req, res) => {
+  const server = createApioskMcpServer({ runtime });
+  const transport = new SSEServerTransport("/messages", res);
+  sseTransports.set(transport.sessionId, transport);
+
+  // Observability: record the SSE connection (the "who's connected / installs"
+  // roster) and mark it closed on disconnect. Fire-and-forget.
+  openSession(process.env, {
+    sessionId: transport.sessionId,
+    transport: "sse",
+    ip: req.ip,
+    userAgent: req.headers["user-agent"],
+  });
+
+  res.on("close", () => {
+    sseTransports.delete(transport.sessionId);
+    closeSession(process.env, transport.sessionId);
+    transport.close().catch(() => {});
+    server.close().catch(() => {});
+  });
+
+  try {
+    await server.connect(transport);
+  } catch (error) {
+    console.error("Error establishing /sse stream:", error);
+    sseTransports.delete(transport.sessionId);
+  }
+});
+
+app.post("/messages", mcpAuthMiddleware, async (req, res) => {
+  const sessionId = typeof req.query.sessionId === "string" ? req.query.sessionId : "";
+  const transport = sseTransports.get(sessionId);
+
+  if (!transport) {
+    res.status(400).json({
+      jsonrpc: "2.0",
+      id: null,
+      error: {
+        code: -32000,
+        message: "Bad Request: No SSE session found for the given sessionId.",
+      },
+    });
+    return;
+  }
+
+  try {
+    await transport.handlePostMessage(req, res, req.body);
+  } catch (error) {
+    console.error("Error handling /messages request:", error);
+    if (!res.headersSent) {
+      res.status(500).json({
+        jsonrpc: "2.0",
+        id: null,
+        error: {
+          code: -32603,
+          message: error instanceof Error ? error.message : String(error),
+        },
+      });
+    }
+  }
+});
+
 app.listen(port, "0.0.0.0", async () => {
   console.log(`Apiosk MCP server listening on http://0.0.0.0:${port}`);
   console.log(`Health check: http://0.0.0.0:${port}/health`);
   console.log(`MCP endpoint: http://0.0.0.0:${port}/mcp`);
+  console.log(`Legacy SSE endpoint: http://0.0.0.0:${port}/sse`);
   console.log(`OAuth issuer: ${issuerUrl.href}`);
   console.log(`OAuth protected-resource metadata: ${hostedOAuth.resourceMetadataUrl}`);
   try {