@arii/boomtick-mcp 0.4.2 → 0.6.0

package/src/lib/git.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { getChangedFiles, getMergeConflictFiles } from "./git.js";
+import * as shell from "./shell.js";
+
+vi.mock("./shell.js", () => ({
+  runCommand: vi.fn(),
+}));
+
+describe("Git Helpers", () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+  });
+
+  describe("getChangedFiles", () => {
+    it("should parse null-delimited git diff output correctly", async () => {
+      // Mock git diff output with null character delimiters:
+      // Status M -> file1.txt
+      // Status A -> file2.txt
+      // Status R100 -> old.txt -> new.txt
+      const mockStdout = "M\0file1.txt\0A\0file2.txt\0R100\0old.txt\0new.txt\0";
+      vi.mocked(shell.runCommand).mockResolvedValueOnce({
+        exitCode: 0,
+        stdout: mockStdout,
+        stderr: "",
+        durationMs: 10,
+        command: "git diff --name-status -z main...HEAD",
+      });
+
+      const result = await getChangedFiles("main", "HEAD");
+
+      expect(shell.runCommand).toHaveBeenCalledWith(
+        "git",
+        ["diff", "--name-status", "-z", "main...HEAD"],
+        { cwd: undefined }
+      );
+      expect(result).toEqual([
+        { status: "M", path: "file1.txt" },
+        { status: "A", path: "file2.txt" },
+        { status: "R100", path: "new.txt", oldPath: "old.txt" },
+      ]);
+    });
+
+    it("should throw error if git diff fails", async () => {
+      vi.mocked(shell.runCommand).mockResolvedValueOnce({
+        exitCode: 1,
+        stdout: "",
+        stderr: "fatal: bad revision",
+        durationMs: 10,
+        command: "git diff --name-status -z invalid...HEAD",
+      });
+
+      await expect(getChangedFiles("invalid", "HEAD")).rejects.toThrow(
+        "Failed to get changed files: fatal: bad revision"
+      );
+    });
+  });
+
+  describe("getMergeConflictFiles", () => {
+    it("should parse git merge-tree output when conflicts exist", async () => {
+      // Output with 40-char tree hash followed by conflicting filenames
+      const mockStdout =
+        "5d71843ed2e051b2be91361db7bea0fc4ee1e5a0\nfile1.txt\nsrc/file2.ts\n";
+      vi.mocked(shell.runCommand).mockResolvedValueOnce({
+        exitCode: 1, // merge-tree exits 1 on conflicts
+        stdout: mockStdout,
+        stderr: "",
+        durationMs: 10,
+        command: "git merge-tree --write-tree --name-only main feature",
+      });
+
+      const conflicts = await getMergeConflictFiles("main", "feature");
+
+      expect(shell.runCommand).toHaveBeenCalledWith(
+        "git",
+        ["merge-tree", "--write-tree", "--name-only", "main", "feature"],
+        { cwd: undefined }
+      );
+      expect(conflicts).toEqual(["file1.txt", "src/file2.ts"]);
+    });
+
+    it("should return empty array when no conflicts exist", async () => {
+      const mockStdout = "5d71843ed2e051b2be91361db7bea0fc4ee1e5a0\n";
+      vi.mocked(shell.runCommand).mockResolvedValueOnce({
+        exitCode: 0,
+        stdout: mockStdout,
+        stderr: "",
+        durationMs: 10,
+        command: "git merge-tree --write-tree --name-only main feature",
+      });
+
+      const conflicts = await getMergeConflictFiles("main", "feature");
+
+      expect(conflicts).toEqual([]);
+    });
+
+    it("should throw error if git merge-tree exits with unexpected exit code", async () => {
+      vi.mocked(shell.runCommand).mockResolvedValueOnce({
+        exitCode: 128,
+        stdout: "",
+        stderr: "fatal: not a valid object name",
+        durationMs: 10,
+        command: "git merge-tree --write-tree --name-only invalid feature",
+      });
+
+      await expect(getMergeConflictFiles("invalid", "feature")).rejects.toThrow(
+        "Git merge-tree failed: fatal: not a valid object name"
+      );
+    });
+  });
+});

package/src/lib/git.ts

@@ -73,3 +73,78 @@ export async function removeWorktree(worktreePath: string): Promise<void> {
   await runCommand("git", ["worktree", "remove", "--force", worktreePath]);
   await runCommand("git", ["worktree", "prune"]);
 }
+
+export interface ChangedFile {
+  status: string;
+  path: string;
+  oldPath?: string;
+}
+
+export async function getChangedFiles(
+  base: string = "main",
+  head: string = "HEAD",
+  cwd?: string
+): Promise<ChangedFile[]> {
+  const result = await runCommand(
+    "git",
+    ["diff", "--name-status", "-z", `${base}...${head}`],
+    { cwd }
+  );
+
+  if (result.exitCode !== 0) {
+    throw new Error(`Failed to get changed files: ${result.stderr}`);
+  }
+
+  const tokens = result.stdout.split("\0").filter((t) => t.length > 0);
+  const files: ChangedFile[] = [];
+
+  let i = 0;
+  while (i < tokens.length) {
+    const status = tokens[i];
+    if (status.startsWith("R") || status.startsWith("C")) {
+      const oldPath = tokens[i + 1];
+      const newPath = tokens[i + 2];
+      if (oldPath && newPath) {
+        files.push({ status, path: newPath, oldPath });
+      }
+      i += 3;
+    } else {
+      const filePath = tokens[i + 1];
+      if (filePath) {
+        files.push({ status, path: filePath });
+      }
+      i += 2;
+    }
+  }
+
+  return files;
+}
+
+export async function getMergeConflictFiles(
+  baseBranch: string = "main",
+  headRef: string = "HEAD",
+  cwd?: string
+): Promise<string[]> {
+  const result = await runCommand(
+    "git",
+    ["merge-tree", "--write-tree", "--name-only", baseBranch, headRef],
+    { cwd }
+  );
+
+  // git merge-tree returns exit code 1 if conflicts are present, 0 if clean merge
+  if (result.exitCode !== 0 && result.exitCode !== 1) {
+    throw new Error(`Git merge-tree failed: ${result.stderr}`);
+  }
+
+  const lines = result.stdout
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0);
+
+  // First line is tree hash if successful or conflict output
+  // When conflicts exist, git merge-tree --write-tree --name-only outputs conflicted filenames
+  // Skip tree hash line if present (40 hex chars)
+  const files = lines.filter((line) => !/^[0-9a-f]{40}$/i.test(line));
+
+  return files;
+}

package/src/lib/result.test.ts

@@ -3,7 +3,7 @@ import { createSuccessResult, createErrorResult } from "./result.js";
 
 describe("result utils", () => {
   describe("createSuccessResult", () => {
-    it("should format string data directly without JSON stringifying", () => {
+    it("should format string data directly without JSON stringifying and provide structuredContent", () => {
       const result = createSuccessResult("simple string message");
       expect(result).toEqual({
         content: [
@@ -12,11 +12,12 @@ describe("result utils", () => {
             text: "simple string message",
           },
         ],
+        structuredContent: { result: "simple string message" },
       });
       expect(result.isError).toBeUndefined();
     });
 
-    it("should format object data as pretty-printed JSON string", () => {
+    it("should format object data as pretty-printed JSON string and provide structuredContent", () => {
       const objData = { foo: "bar", count: 42 };
       const result = createSuccessResult(objData);
       expect(result).toEqual({
@@ -26,6 +27,7 @@ describe("result utils", () => {
             text: JSON.stringify(objData, null, 2),
           },
         ],
+        structuredContent: objData,
       });
       expect(result.isError).toBeUndefined();
     });

package/src/lib/result.ts

@@ -5,6 +5,11 @@ export interface ToolResult extends CallToolResult {
 }
 
 export function createSuccessResult(data: any): ToolResult {
+  const structuredContent =
+    typeof data === "object" && data !== null
+      ? data
+      : { result: data };
+
   return {
     content: [
       {
@@ -12,6 +17,7 @@ export function createSuccessResult(data: any): ToolResult {
         text: typeof data === "string" ? data : JSON.stringify(data, null, 2),
       },
     ],
+    structuredContent,
   };
 }
 

package/src/lib/shell.ts

@@ -6,7 +6,7 @@ import fs from "fs";
 export const ALLOWED_COMMANDS = {
   git: "git",
   gh: "gh",
-  "td-cli": "td-cli",
+  td: "td",
   pnpm: "pnpm",
   ls: "ls",
   rm: "rm",
@@ -39,15 +39,15 @@ export async function runCommand(
   const start = Date.now();
   const timeout = options.timeout || 60000;
 
-  // Resolve path for 'gh' or 'td-cli' if specified
+  // Resolve path for 'gh' or 'td' if specified
   let finalCmd = ALLOWED_COMMANDS[safeCmd] as string;
   if (safeCmd === "gh") {
     finalCmd = config.ghPath;
-  } else if (safeCmd === "td-cli") {
+  } else if (safeCmd === "td") {
     // If we have a repo-relative .venv, prioritize it
-    const venvBin = path.join(config.repoPath, ".venv", "bin", "td-cli");
-    const localVenvBin = path.join(process.cwd(), ".venv", "bin", "td-cli");
-    const parentVenvBin = path.join(config.repoPath, "..", ".venv", "bin", "td-cli");
+    const venvBin = path.join(config.repoPath, ".venv", "bin", "td");
+    const localVenvBin = path.join(process.cwd(), ".venv", "bin", "td");
+    const parentVenvBin = path.join(config.repoPath, "..", ".venv", "bin", "td");
 
     // In standalone mode, config.repoPath is the boomtick-pkg root.
     // We check common venv locations to ensure we call the isolated binary.

package/src/mcp/definitions.ts

@@ -1,4 +1,4 @@
-import { Tool, Prompt, Resource } from "@modelcontextprotocol/sdk/types.js";
+import { Tool, Prompt, Resource, ResourceTemplate } from "@modelcontextprotocol/sdk/types.js";
 import {
   HealthCheckInputJsonSchema,
   SearchPRsInputJsonSchema,
@@ -7,14 +7,11 @@ import {
   GetMergeConflictFilesInputJsonSchema,
   GetChangedFilesInputJsonSchema,
   GetPackageScriptsInputJsonSchema,
-  GetRouteMapInputJsonSchema,
   ReadCiLogsInputJsonSchema,
   RepoLogsInputJsonSchema,
   CreateBranchInputJsonSchema,
   CreateRepairBranchInputJsonSchema,
   RunTestsInputJsonSchema,
-  RunLighthouseInputJsonSchema,
-  RunPlaywrightInputJsonSchema,
   CommitPatchInputJsonSchema,
   OpenReplacementPrInputJsonSchema,
   CreatePullRequestInputJsonSchema,
@@ -30,7 +27,9 @@ import {
   JulesSessionIdInputJsonSchema,
   JulesSendMessageInputJsonSchema,
   JulesListSessionsInputJsonSchema,
-  SearchDdgsInputJsonSchema,
+  GetPrReviewsInputJsonSchema,
+  GetPrCommitsInputJsonSchema,
+  GetWorkflowRunsInputJsonSchema,
 } from "../tools/contract.js";
 
 export const MCP_PROMPTS: Prompt[] = [
@@ -62,16 +61,28 @@ export const MCP_PROMPTS: Prompt[] = [
 
 export const MCP_RESOURCES: Resource[] = [
   {
-    uri: "repo://package-json",
-    name: "package.json",
+    uri: "mcp://workspace/agent-contract",
+    name: "Agent Contract",
+    mimeType: "text/markdown",
+    description: "The agent contract specification file (.agents/AGENT_CONTRACT.md).",
+  },
+  {
+    uri: "repo://agent-contract",
+    name: "Agent Contract (Legacy URI)",
+    mimeType: "text/markdown",
+    description: "The agent contract specification file (.agents/AGENT_CONTRACT.md).",
+  },
+  {
+    uri: "mcp://git/changed-files",
+    name: "Git Changed Files",
     mimeType: "application/json",
-    description: "The root package.json file of the repository.",
+    description: "List of changed files in the repository.",
   },
   {
-    uri: "repo://routes",
-    name: "Route Map",
+    uri: "repo://package-json",
+    name: "package.json",
     mimeType: "application/json",
-    description: "The mapping of application routes to content files.",
+    description: "The root package.json file of the repository.",
   },
   {
     uri: "repo://design-tokens",
@@ -79,201 +90,239 @@ export const MCP_RESOURCES: Resource[] = [
     mimeType: "application/json",
     description: "The design tokens used in the repository.",
   },
+];
+
+export const MCP_RESOURCE_TEMPLATES: ResourceTemplate[] = [
   {
-    uri: "repo://repair-report/{branch}",
-    name: "Repair Report",
-    mimeType: "application/json",
-    description: "The validation report for a specific repair branch.",
+    uriTemplate: "mcp://git/diff/{prNumber}",
+    name: "Git PR Diff",
+    mimeType: "text/plain",
+    description: "Diff and changed files for a pull request.",
   },
   {
-    uri: "repo://lighthouse/{branch}",
-    name: "Lighthouse Report",
+    uriTemplate: "mcp://ci/logs/{prNumber}",
+    name: "CI Logs",
     mimeType: "application/json",
-    description: "Lighthouse CI report for a specific branch.",
+    description: "CI logs for a pull request.",
   },
   {
-    uri: "repo://playwright/{branch}",
-    name: "Playwright Report",
+    uriTemplate: "repo://repair-report/{branch}",
+    name: "Repair Report",
     mimeType: "application/json",
-    description: "Playwright test report for a specific branch.",
+    description: "The validation report for a specific repair branch.",
   },
 ];
 
+const DEFAULT_OUTPUT_SCHEMA = {
+  type: "object",
+  properties: {},
+  additionalProperties: true,
+} as const;
+
 const BASE_MCP_TOOLS: Tool[] = [
   {
     name: "boomtick.health",
     description: "Check the health and configuration of the MCP server.",
     inputSchema: HealthCheckInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.search_open_prs",
     description: "Search for open pull requests in the repository.",
     inputSchema: SearchPRsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.read_agent_context",
     description: "Read the full repository index including file tree, CLI schema, and MCP tools.",
     inputSchema: ReadAgentContextSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.get_pr_diff",
     description: "Get the diff and changed files for a pull request.",
     inputSchema: GetPrDiffInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.checkout_branch",
     description: "Checkout a specific branch in the repository or worktree.",
     inputSchema: CheckoutBranchInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.get_merge_conflict_files",
     description: "Detect files that conflict when a PR is merged with the base branch.",
     inputSchema: GetMergeConflictFilesInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.get_changed_files",
     description: "Get the list of changed files between two refs.",
     inputSchema: GetChangedFilesInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.get_command_schema",
-    description: "Retrieve a lightweight, targeted schema for a specific td-cli subcommand. Use this instead of reading the entire cli-schema.json to save tokens.",
+    description: "Retrieve a lightweight, targeted schema for a specific td subcommand. Use this instead of reading the entire cli-schema.json to save tokens.",
     inputSchema: GetCommandSchemaInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.get_package_scripts",
     description: "Get the scripts defined in package.json.",
     inputSchema: GetPackageScriptsInputJsonSchema as any,
-  },
-  {
-    name: "repo.get_route_map",
-    description: "Get the mapping of routes to content files.",
-    inputSchema: GetRouteMapInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.read_ci_logs",
     description: "Read CI logs for a given pull request.",
     inputSchema: ReadCiLogsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.logs",
     description: "Stream or grep combined CI logs for all jobs in a pull request.",
     inputSchema: RepoLogsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.create_branch",
     description: "Creates a new clean git branch from a target base branch.",
     inputSchema: CreateBranchInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.create_repair_branch",
     description: "Creates a fresh worktree and a new repair branch for an existing PR. This isolates the repair work from the main codebase.",
     inputSchema: CreateRepairBranchInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.run_tests",
     description: "Run repository tests and checks.",
     inputSchema: RunTestsInputJsonSchema as any,
-  },
-  {
-    name: "repo.run_lighthouse",
-    description: "Run Lighthouse CI audits.",
-    inputSchema: RunLighthouseInputJsonSchema as any,
-  },
-  {
-    name: "repo.run_playwright",
-    description: "Run Playwright E2E tests.",
-    inputSchema: RunPlaywrightInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "repo.commit_patch",
     description: "Commit verified repair changes in a worktree.",
     inputSchema: CommitPatchInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.open_replacement_pr",
     description: "Open a new PR that replaces or repairs the original PR.",
     inputSchema: OpenReplacementPrInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.create_pull_request",
     description: "Creates a pull request on GitHub using the MCP server's integrated credentials. Bypasses terminal CLI constraints.",
     inputSchema: CreatePullRequestInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.comment_triage_summary",
     description: "Comment on the original PR with a diagnosis and replacement link.",
     inputSchema: CommentTriageSummaryInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.get_pr",
     description: "Get details of a GitHub PR including title, state, and URLs.",
     inputSchema: GetPrInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
+  },
+  {
+    name: "github.get_pr_reviews",
+    description: "Get top-level reviews, verdicts, states, and bodies for a GitHub PR.",
+    inputSchema: GetPrReviewsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
+  },
+  {
+    name: "github.get_pr_commits",
+    description: "List commits and commit metadata (SHAs, authors, messages) for a GitHub PR.",
+    inputSchema: GetPrCommitsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
+  },
+  {
+    name: "repo.get_workflow_runs",
+    description: "List recent GitHub Actions workflow runs for the repository.",
+    inputSchema: GetWorkflowRunsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.issue_view",
     description: "View details of a GitHub issue including title, body, and state.",
     inputSchema: IssueViewInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.issue_update",
     description: "Update a GitHub issue's body, labels, and/or state.",
     inputSchema: IssueUpdateInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.issue_comment",
     description: "Add a new comment to a GitHub issue.",
     inputSchema: IssueCommentInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "github.create_issue",
     description: "Create a new GitHub issue.",
     inputSchema: CreateIssueInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.create_session",
     description: "Create a Jules session that performs work externally and may generate a GitHub pull request.",
     inputSchema: CreateJulesSessionInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.get_session",
     description: "Get the status and details of a Jules session.",
     inputSchema: JulesSessionIdInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.send_message",
     description: "Send a message to an active Jules session.",
     inputSchema: JulesSendMessageInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.get_messages",
     description: "Get the message history of a Jules session.",
     inputSchema: JulesSessionIdInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.list_sessions",
     description: "List all Jules sessions.",
     inputSchema: JulesListSessionsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.cancel_session",
     description: "Cancel an ongoing Jules session.",
     inputSchema: JulesSessionIdInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.get_pr",
     description: "Get the generated pull request url associated with an active Jules agent session.",
     inputSchema: JulesSessionIdInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
   {
     name: "jules.trigger_feedback",
     description: "Automatically collect CI status/logs for the PR associated with a Jules session and send them back as feedback.",
     inputSchema: JulesSessionIdInputJsonSchema as any,
-  },
-  {
-    name: "agent.search_ddgs",
-    description: "Search the web using DuckDuckGo (via ddgs python library).",
-    inputSchema: SearchDdgsInputJsonSchema as any,
+    outputSchema: DEFAULT_OUTPUT_SCHEMA as any,
   },
 ];
 

package/src/mcp/http.test.ts

@@ -0,0 +1,72 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import http from "node:http";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { createMcpHttpServer } from "./http.js";
+
+describe("createMcpHttpServer", () => {
+  let mcpServer: Server;
+  let httpServerObj: ReturnType<typeof createMcpHttpServer>;
+  let port: number;
+
+  beforeEach(async () => {
+    mcpServer = new Server({ name: "test-server", version: "1.0.0" }, { capabilities: {} });
+  });
+
+  afterEach(() => {
+    if (httpServerObj?.server) {
+      httpServerObj.server.close();
+    }
+  });
+
+  it("should respond with OAuth protected resource metadata on /.well-known/oauth-protected-resource", async () => {
+    httpServerObj = createMcpHttpServer({ port: 0, mcpServer });
+    port = await httpServerObj.listen(0);
+
+    const res = await fetch(`http://localhost:${port}/.well-known/oauth-protected-resource`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.resource).toBe("mcp://boomtick-mcp");
+    expect(body.authorization_servers).toBeDefined();
+    expect(body.scopes_supported).toEqual(["mcp:read", "mcp:write"]);
+  });
+
+  it("should reject requests when Bearer token is missing or invalid", async () => {
+    httpServerObj = createMcpHttpServer({ port: 0, bearerToken: "secret123", mcpServer });
+    port = await httpServerObj.listen(0);
+
+    // Request without token
+    const res1 = await fetch(`http://localhost:${port}/sse`);
+    expect(res1.status).toBe(401);
+    expect(res1.headers.get("www-authenticate")).toContain('Bearer realm="boomtick-mcp"');
+
+    // Request with wrong token
+    const res2 = await fetch(`http://localhost:${port}/sse`, {
+      headers: { Authorization: "Bearer wrong" },
+    });
+    expect(res2.status).toBe(401);
+
+    // Request with valid token
+    const res3 = await fetch(`http://localhost:${port}/.well-known/oauth-protected-resource`, {
+      headers: { Authorization: "Bearer secret123" },
+    });
+    expect(res3.status).toBe(200);
+  });
+
+  it("should handle 404 for unknown endpoints", async () => {
+    httpServerObj = createMcpHttpServer({ port: 0, mcpServer });
+    port = await httpServerObj.listen(0);
+
+    const res = await fetch(`http://localhost:${port}/unknown-path`);
+    expect(res.status).toBe(404);
+  });
+
+  it("should return 500 if bearer token is not configured on server for protected endpoints", async () => {
+    httpServerObj = createMcpHttpServer({ port: 0, mcpServer });
+    port = await httpServerObj.listen(0);
+
+    const res = await fetch(`http://localhost:${port}/sse`);
+    expect(res.status).toBe(500);
+    const body = await res.json();
+    expect(body.error).toContain("Server misconfiguration");
+  });
+});