@asif2bd/umami-mcp 0.1.0

package/dist/config.js

@@ -0,0 +1,121 @@
+/**
+ * Configuration is read exclusively from the process environment.
+ *
+ * Nothing here is ever transmitted anywhere except to the single Umami
+ * instance named by UMAMI_URL. There is no telemetry, no phone-home, and no
+ * remote credential broker. If you self-host this server, your credentials
+ * stay on your machine.
+ */
+export class ConfigError extends Error {
+}
+const MODES = ['read', 'write', 'admin'];
+function bool(v, fallback) {
+    if (v === undefined || v === '')
+        return fallback;
+    return ['1', 'true', 'yes', 'on'].includes(v.trim().toLowerCase());
+}
+function int(v, fallback, name) {
+    if (v === undefined || v === '')
+        return fallback;
+    const n = Number(v);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new ConfigError(`${name} must be a positive integer, got ${JSON.stringify(v)}`);
+    }
+    return n;
+}
+export function loadConfig(env = process.env) {
+    // In OAuth mode this server is multi-tenant: each user supplies their own
+    // Umami and their own login at consent time, so the process itself holds no
+    // instance URL and no credentials.
+    const oauthEnabled = bool(env.UMAMI_MCP_OAUTH, false);
+    const rawUrl = (env.UMAMI_URL ?? '').trim().replace(/\/+$/, '');
+    if (!rawUrl && !oauthEnabled) {
+        throw new ConfigError('UMAMI_URL is required (e.g. https://analytics.example.com). ' +
+            'See .env.example for the full list of settings.');
+    }
+    let parsed;
+    if (rawUrl) {
+        try {
+            parsed = new URL(rawUrl);
+        }
+        catch {
+            throw new ConfigError(`UMAMI_URL is not a valid URL: ${JSON.stringify(rawUrl)}`);
+        }
+    }
+    if (parsed && parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new ConfigError(`UMAMI_URL must be http(s), got ${parsed.protocol}`);
+    }
+    // Credentials over plaintext HTTP are only tolerated on the loopback
+    // interface, where there is no network to sniff.
+    const loopback = parsed ? ['localhost', '127.0.0.1', '::1', '[::1]'].includes(parsed.hostname) : false;
+    if (parsed && parsed.protocol === 'http:' && !loopback) {
+        throw new ConfigError(`Refusing to send credentials over plaintext HTTP to ${parsed.hostname}. ` +
+            'Use https://, or point UMAMI_URL at localhost for local development.');
+    }
+    const username = env.UMAMI_USERNAME?.trim() || undefined;
+    const password = env.UMAMI_PASSWORD ?? undefined;
+    const apiKey = env.UMAMI_API_KEY?.trim() || undefined;
+    if (!oauthEnabled && !apiKey && !(username && password)) {
+        throw new ConfigError('No credentials found. Set UMAMI_USERNAME and UMAMI_PASSWORD (self-hosted), ' +
+            'or UMAMI_API_KEY (Umami Cloud). ' +
+            'Alternatively set UMAMI_MCP_OAUTH=true to run multi-tenant, where each user brings their own.');
+    }
+    let oauth;
+    if (oauthEnabled) {
+        const issuer = (env.UMAMI_MCP_ISSUER ?? '').trim().replace(/\/+$/, '');
+        if (!issuer) {
+            throw new ConfigError('UMAMI_MCP_OAUTH is on, so UMAMI_MCP_ISSUER must be the public HTTPS URL of this server ' +
+                '(e.g. https://umami-mcp.example.com). Clients build their redirect back from it.');
+        }
+        const issuerUrl = new URL(issuer);
+        if (issuerUrl.protocol !== 'https:' && !['localhost', '127.0.0.1'].includes(issuerUrl.hostname)) {
+            throw new ConfigError('UMAMI_MCP_ISSUER must be https (or localhost for development).');
+        }
+        const tokenKey = env.UMAMI_MCP_TOKEN_KEY ?? '';
+        if (tokenKey.length < 16) {
+            throw new ConfigError('UMAMI_MCP_TOKEN_KEY must be set to at least 16 characters and kept stable. ' +
+                'It encrypts user credentials inside access tokens; changing it invalidates every issued token. ' +
+                'Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'base64url\'))"');
+        }
+        oauth = {
+            enabled: true,
+            issuer,
+            tokenKey,
+            ttlSeconds: int(env.UMAMI_MCP_TOKEN_TTL, 30 * 24 * 3600, 'UMAMI_MCP_TOKEN_TTL'),
+            fixedUrl: rawUrl || undefined,
+        };
+    }
+    const rawMode = (env.UMAMI_MCP_MODE ?? 'read').trim().toLowerCase();
+    if (!MODES.includes(rawMode)) {
+        throw new ConfigError(`UMAMI_MCP_MODE must be one of ${MODES.join(' | ')}, got ${JSON.stringify(rawMode)}`);
+    }
+    const rawTransport = (env.UMAMI_MCP_TRANSPORT ?? env.TRANSPORT ?? 'stdio').trim().toLowerCase();
+    if (rawTransport !== 'stdio' && rawTransport !== 'http') {
+        throw new ConfigError(`transport must be "stdio" or "http", got ${JSON.stringify(rawTransport)}`);
+    }
+    return {
+        url: rawUrl,
+        username,
+        password,
+        apiKey,
+        teamId: env.UMAMI_TEAM_ID?.trim() || undefined,
+        mode: rawMode,
+        allowDestructive: bool(env.UMAMI_MCP_ALLOW_DESTRUCTIVE, false),
+        transport: rawTransport,
+        host: (env.UMAMI_MCP_HOST ?? '127.0.0.1').trim(),
+        port: int(env.UMAMI_MCP_PORT ?? env.PORT, 3334, 'UMAMI_MCP_PORT'),
+        timeoutMs: int(env.UMAMI_MCP_TIMEOUT_MS, 30_000, 'UMAMI_MCP_TIMEOUT_MS'),
+        oauth,
+    };
+}
+/** Human-readable summary for startup logs. Never includes secrets. */
+export function describeConfig(c) {
+    if (c.oauth?.enabled) {
+        const scope = c.oauth.fixedUrl ? `pinned to ${c.oauth.fixedUrl}` : 'multi-tenant';
+        return `OAuth mode, ${scope} (issuer=${c.oauth.issuer}, transport=${c.transport})`;
+    }
+    const auth = c.apiKey ? 'api-key' : `user:${c.username}`;
+    const destructive = c.allowDestructive ? ' +destructive' : '';
+    return `${c.url} (auth=${auth}, mode=${c.mode}${destructive}, transport=${c.transport})`;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6BH,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,MAAM,KAAK,GAAW,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjD,SAAS,IAAI,CAAC,CAAqB,EAAE,QAAiB;IACpD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,GAAG,CAAC,CAAqB,EAAE,QAAgB,EAAE,IAAY;IAChE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,0EAA0E;IAC1E,4EAA4E;IAC5E,mCAAmC;IACnC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,WAAW,CACnB,8DAA8D;YAC5D,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1E,MAAM,IAAI,WAAW,CAAC,kCAAkC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvG,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,WAAW,CACnB,uDAAuD,MAAM,CAAC,QAAQ,IAAI;YACxE,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,IAAI,SAAS,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAEtD,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,WAAW,CACnB,6EAA6E;YAC3E,kCAAkC;YAClC,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,KAA8B,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CACnB,yFAAyF;gBACvF,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,WAAW,CAAC,gEAAgE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACnB,6EAA6E;gBAC3E,iGAAiG;gBACjG,uGAAuG,CAC1G,CAAC;QACJ,CAAC;QACD,KAAK,GAAG;YACN,OAAO,EAAE,IAAI;YACb,MAAM;YACN,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,qBAAqB,CAAC;YAC/E,QAAQ,EAAE,MAAM,IAAI,SAAS;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAU,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,WAAW,CAAC,iCAAiC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAe,CAAC;IAC7G,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACxD,MAAM,IAAI,WAAW,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,OAAO;QACL,GAAG,EAAE,MAAM;QACX,QAAQ;QACR,QAAQ;QACR,MAAM;QACN,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9C,IAAI,EAAE,OAAO;QACb,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC;QAC9D,SAAS,EAAE,YAAY;QACvB,IAAI,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW,CAAC,CAAC,IAAI,EAAE;QAChD,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACjE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,EAAE,sBAAsB,CAAC;QACxE,KAAK;KACN,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QAClF,OAAO,eAAe,KAAK,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,CAAC,SAAS,GAAG,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,GAAG,UAAU,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,WAAW,eAAe,CAAC,CAAC,SAAS,GAAG,CAAC;AAC3F,CAAC"}

package/dist/envfile.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Optional env-file loading.
+ *
+ * MCP clients configure servers by embedding environment variables in a JSON
+ * config file -- ~/.claude.json, mcp.json, and friends. Those files are widely
+ * readable, are routinely pasted into issues and screen-shares, and several
+ * clients sync them between machines. Self-hosted Umami has no API keys, so the
+ * value being embedded is a real account password.
+ *
+ * Loading credentials from a file the operator controls means the client config
+ * can name the server and nothing else.
+ *
+ * Precedence: real environment variables always win, so an explicit
+ * `UMAMI_PASSWORD=...` in the client config still overrides the file.
+ */
+export interface EnvFileResult {
+    path?: string;
+    loaded: number;
+    warnings: string[];
+}
+export declare function loadEnvFile(env?: NodeJS.ProcessEnv): EnvFileResult;

package/dist/envfile.js

@@ -0,0 +1,72 @@
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+function parse(text) {
+    const out = {};
+    for (const rawLine of text.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim().replace(/^export\s+/, '');
+        if (!key)
+            continue;
+        let value = line.slice(eq + 1).trim();
+        // Strip one layer of matching quotes; leave inner content untouched so
+        // passwords containing '#' or spaces survive intact.
+        if ((value.startsWith('"') && value.endsWith('"') && value.length >= 2) ||
+            (value.startsWith("'") && value.endsWith("'") && value.length >= 2)) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
+}
+function candidatePaths(env) {
+    if (env.UMAMI_MCP_ENV_FILE)
+        return [env.UMAMI_MCP_ENV_FILE];
+    return [
+        join(env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'umami-mcp', 'env'),
+        join(process.cwd(), '.env'),
+    ];
+}
+export function loadEnvFile(env = process.env) {
+    const explicit = Boolean(env.UMAMI_MCP_ENV_FILE);
+    const warnings = [];
+    for (const path of candidatePaths(env)) {
+        let text;
+        try {
+            text = readFileSync(path, 'utf8');
+        }
+        catch {
+            // An explicitly named file that cannot be read is an operator error worth
+            // surfacing; the implicit locations are just absent.
+            if (explicit)
+                warnings.push(`UMAMI_MCP_ENV_FILE is set to ${path} but it could not be read.`);
+            continue;
+        }
+        try {
+            const mode = statSync(path).mode & 0o077;
+            if (mode !== 0) {
+                warnings.push(`${path} is readable by other users (mode ${(statSync(path).mode & 0o777).toString(8)}). ` +
+                    `Run: chmod 600 ${path}`);
+            }
+        }
+        catch {
+            /* stat failing is not fatal */
+        }
+        let loaded = 0;
+        for (const [k, v] of Object.entries(parse(text))) {
+            // Real environment wins.
+            if (env[k] === undefined) {
+                env[k] = v;
+                loaded++;
+            }
+        }
+        return { path, loaded, warnings };
+    }
+    return { loaded: 0, warnings };
+}
+//# sourceMappingURL=envfile.js.map

package/dist/envfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envfile.js","sourceRoot":"","sources":["../src/envfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAwBjC,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,uEAAuE;QACvE,qDAAqD;QACrD,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;YACnE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,EACnE,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAsB;IAC5C,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5D,OAAO;QACL,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,qDAAqD;YACrD,IAAI,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,IAAI,4BAA4B,CAAC,CAAC;YAC9F,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;YACzC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,qCAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBACxF,kBAAkB,IAAI,EAAE,CAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjD,yBAAyB;YACzB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACX,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,7 @@
+import http from 'node:http';
+import type { Config } from './config.js';
+export interface HttpDeps {
+    config: Config;
+    log: (...args: unknown[]) => void;
+}
+export declare function startHttp({ config, log }: HttpDeps): Promise<http.Server>;

package/dist/http.js

@@ -0,0 +1,133 @@
+import http from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { UmamiClient } from './client.js';
+import { redactUnknown } from './redact.js';
+import { buildServer } from './server.js';
+import { OAuthProvider } from './oauth/router.js';
+import { deriveKey, SealError } from './oauth/seal.js';
+async function readJsonBody(req, limit = 4 * 1024 * 1024) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > limit)
+            throw new Error('Request body too large.');
+        chunks.push(chunk);
+    }
+    if (chunks.length === 0)
+        return undefined;
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+export async function startHttp({ config, log }) {
+    const oauth = config.oauth?.enabled
+        ? new OAuthProvider({
+            issuer: config.oauth.issuer,
+            key: deriveKey(config.oauth.tokenKey),
+            fixedUrl: config.oauth.fixedUrl,
+            tokenTtlSeconds: config.oauth.ttlSeconds,
+            baseConfig: config,
+        })
+        : undefined;
+    // Single-tenant mode keeps one long-lived server, as before.
+    const shared = oauth ? undefined : buildServer(config);
+    let sharedTransport;
+    if (shared) {
+        sharedTransport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        await shared.server.connect(sharedTransport);
+        log(`${shared.registered.length} tools available, ${shared.withheld.length} withheld by mode "${config.mode}"`);
+    }
+    const server = http.createServer((req, res) => {
+        void handle(req, res).catch((err) => {
+            log('request failed:', redactUnknown(err));
+            if (!res.headersSent) {
+                res.writeHead(500, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: 'internal_error' }));
+            }
+            else {
+                res.end();
+            }
+        });
+    });
+    async function handle(req, res) {
+        const base = config.oauth?.issuer ?? `http://${req.headers.host ?? 'localhost'}`;
+        const url = new URL(req.url ?? '/', base);
+        if (url.pathname === '/health') {
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({
+                ok: true,
+                mode: oauth ? 'oauth' : config.mode,
+                multiTenant: Boolean(oauth && !config.oauth?.fixedUrl),
+            }));
+            return;
+        }
+        if (oauth && (await oauth.handle(req, res, url)))
+            return;
+        if (!url.pathname.startsWith('/mcp')) {
+            res.writeHead(404, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'not found; the MCP endpoint is /mcp' }));
+            return;
+        }
+        if (!oauth) {
+            const body = await readJsonBody(req).catch(() => undefined);
+            await sharedTransport.handleRequest(req, res, body);
+            return;
+        }
+        // --- OAuth mode: authenticate, then serve this one caller only. ---
+        let identity;
+        try {
+            identity = oauth.authenticate(req);
+        }
+        catch (err) {
+            // RFC 9728: point unauthenticated clients at the metadata so they can
+            // start the flow on their own.
+            res.writeHead(401, {
+                'content-type': 'application/json',
+                'www-authenticate': `Bearer resource_metadata="${config.oauth.issuer}/.well-known/oauth-protected-resource"`,
+            });
+            res.end(JSON.stringify({
+                error: 'unauthorized',
+                error_description: err instanceof SealError ? err.message : 'Authentication required.',
+            }));
+            return;
+        }
+        // A per-request server, scoped to exactly this user's Umami. Nothing is
+        // shared between callers -- not the client, not the token, not the tools.
+        const scoped = {
+            ...config,
+            url: identity.url,
+            username: identity.username,
+            password: identity.password,
+            apiKey: identity.apiKey,
+            mode: identity.mode,
+            // Irreversible operations are never reachable over a hosted connection,
+            // whatever the user consented to. A remote caller cannot be shown the
+            // typed confirmation guard the local tools rely on.
+            allowDestructive: false,
+            oauth: undefined,
+        };
+        const built = buildServer(scoped, new UmamiClient(scoped));
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        try {
+            await built.server.connect(transport);
+            const body = await readJsonBody(req).catch(() => undefined);
+            await transport.handleRequest(req, res, body);
+        }
+        finally {
+            await transport.close().catch(() => { });
+            await built.server.close().catch(() => { });
+        }
+    }
+    await new Promise((resolve) => server.listen(config.port, config.host, resolve));
+    log(`ready on http://${config.host}:${config.port}/mcp`);
+    if (oauth) {
+        log(`OAuth issuer: ${config.oauth.issuer}`);
+        log(config.oauth.fixedUrl ? `pinned to ${config.oauth.fixedUrl}` : 'multi-tenant: users bring their own Umami');
+    }
+    else if (config.host !== '127.0.0.1' && config.host !== 'localhost') {
+        log(`WARNING: bound to ${config.host} with no authentication. ` +
+            'Anyone who can reach this port can use your Umami credentials. ' +
+            'Bind to 127.0.0.1 and use an SSH tunnel, enable UMAMI_MCP_OAUTH, or front it with an authenticating proxy.');
+    }
+    return server;
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOvD,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;IACvE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAY;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO;QACjC,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC3B,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YACrC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;YAC/B,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACxC,UAAU,EAAE,MAAM;SACnB,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,6DAA6D;IAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,eAA0D,CAAC;IAC/D,IAAI,MAAM,EAAE,CAAC;QACX,eAAe,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,sBAAsB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAClH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAClC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;QAE1C,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;gBACnC,WAAW,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;aACvD,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO;QAEzD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,eAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,+BAA+B;YAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,6BAA6B,MAAM,CAAC,KAAM,CAAC,MAAM,wCAAwC;aAC9G,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;aACvF,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,MAAM,GAAW;YACrB,GAAG,MAAM;YACT,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,wEAAwE;YACxE,sEAAsE;YACtE,oDAAoD;YACpD,gBAAgB,EAAE,KAAK;YACvB,KAAK,EAAE,SAAS;SACjB,CAAC;QAEF,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvF,GAAG,CAAC,mBAAmB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;IAEzD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,iBAAiB,MAAM,CAAC,KAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,KAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;IACpH,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACtE,GAAG,CACD,qBAAqB,MAAM,CAAC,IAAI,2BAA2B;YACzD,iEAAiE;YACjE,4GAA4G,CAC/G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { startHttp } from './http.js';
+import { loadConfig, describeConfig, ConfigError } from './config.js';
+import { loadEnvFile } from './envfile.js';
+import { UmamiClient } from './client.js';
+import { registerSecrets, redactUnknown } from './redact.js';
+import { buildServer } from './server.js';
+/**
+ * On stdio, stdout carries the JSON-RPC stream and must never be polluted.
+ * All human-facing logging therefore goes to stderr.
+ */
+const log = (...args) => console.error('[umami-mcp]', ...args);
+async function startStdio(config, client) {
+    const { server, registered, withheld } = buildServer(config, client);
+    log(`${registered.length} tools available, ${withheld.length} withheld by mode "${config.mode}"`);
+    await server.connect(new StdioServerTransport());
+    log('ready on stdio');
+}
+async function main() {
+    // Credentials may live in a file the operator controls rather than in the
+    // MCP client's config JSON. Must run before loadConfig reads the env.
+    const envFile = loadEnvFile();
+    if (envFile.path && envFile.loaded > 0) {
+        log(`loaded ${envFile.loaded} setting(s) from ${envFile.path}`);
+    }
+    for (const w of envFile.warnings)
+        log(`WARNING: ${w}`);
+    let config;
+    try {
+        config = loadConfig();
+    }
+    catch (err) {
+        if (err instanceof ConfigError) {
+            log('configuration error:', err.message);
+            process.exit(78); // EX_CONFIG
+        }
+        throw err;
+    }
+    // Must happen before any request can produce output.
+    registerSecrets(config.password, config.apiKey);
+    log(describeConfig(config));
+    if (config.oauth?.enabled) {
+        // Multi-tenant: there is no instance to verify at boot. Each user proves
+        // their own credentials on the consent screen before a token is issued.
+        if (config.transport !== 'http') {
+            log('OAuth mode requires the http transport. Set UMAMI_MCP_TRANSPORT=http.');
+            process.exit(78);
+        }
+        await startHttp({ config, log });
+        return;
+    }
+    const client = new UmamiClient(config);
+    try {
+        const user = await client.verify();
+        log(`connected as ${user.username} (role: ${user.role})`);
+    }
+    catch (err) {
+        log('could not reach Umami:', redactUnknown(err));
+        log('check UMAMI_URL and your credentials, then restart.');
+        process.exit(69); // EX_UNAVAILABLE
+    }
+    if (config.transport === 'http')
+        await startHttp({ config, log });
+    else
+        await startStdio(config, client);
+}
+main().catch((err) => {
+    log('fatal:', redactUnknown(err));
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAe,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,MAAM,GAAG,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;AAE1E,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,MAAmB;IAC3D,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,qBAAqB,QAAQ,CAAC,MAAM,sBAAsB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAClG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,UAAU,OAAO,CAAC,MAAM,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY;QAChC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,qDAAqD;IACrD,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEhD,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5B,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1B,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,GAAG,CAAC,gBAAgB,IAAI,CAAC,QAAQ,WAAW,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,wBAAwB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,qDAAqD,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB;IACrC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM;QAAE,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;;QAC7D,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/oauth/consent.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The consent screen. This is where a user hands over their Umami credentials,
+ * so it must be honest about what happens to them.
+ */
+export interface ConsentPageOptions {
+    action: string;
+    hiddenFields: Record<string, string>;
+    clientName?: string;
+    fixedUrl?: string;
+    error?: string;
+}
+export declare function consentPage(o: ConsentPageOptions): string;
+export declare function errorPage(title: string, detail: string): string;

package/dist/oauth/consent.js

@@ -0,0 +1,99 @@
+/**
+ * The consent screen. This is where a user hands over their Umami credentials,
+ * so it must be honest about what happens to them.
+ */
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+export function consentPage(o) {
+    const hidden = Object.entries(o.hiddenFields)
+        .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`)
+        .join('\n      ');
+    const client = o.clientName ? escapeHtml(o.clientName) : 'An MCP client';
+    const urlField = o.fixedUrl
+        ? `<input type="hidden" name="umami_url" value="${escapeHtml(o.fixedUrl)}">
+       <div class="fixed">Connecting to <strong>${escapeHtml(o.fixedUrl)}</strong></div>`
+        : `<label>Your Umami URL
+         <input type="url" name="umami_url" required placeholder="https://analytics.example.com"
+                autocomplete="url" spellcheck="false">
+       </label>`;
+    return `<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Connect your Umami</title>
+<style>
+  :root { color-scheme: light dark; --bg:#fff; --fg:#111; --mut:#666; --line:#ddd; --acc:#2563eb; --warn:#8a5a00; --warnbg:#fff8e6; }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg:#15171a; --fg:#e8e8e8; --mut:#9aa0a6; --line:#33363b; --acc:#5b8cff; --warn:#ffcf70; --warnbg:#2a2416; }
+  }
+  * { box-sizing: border-box; }
+  body { margin:0; padding:2rem 1rem; background:var(--bg); color:var(--fg);
+         font:15px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; }
+  main { max-width: 27rem; margin: 0 auto; }
+  h1 { font-size:1.25rem; margin:0 0 .35rem; }
+  p.sub { color:var(--mut); margin:0 0 1.5rem; }
+  label { display:block; margin:0 0 1rem; font-weight:500; }
+  input[type=url],input[type=text],input[type=password],select {
+    width:100%; margin-top:.35rem; padding:.6rem .7rem; font:inherit; font-weight:400;
+    border:1px solid var(--line); border-radius:8px; background:var(--bg); color:var(--fg); }
+  input:focus,select:focus { outline:2px solid var(--acc); outline-offset:1px; border-color:transparent; }
+  button { width:100%; padding:.7rem; font:inherit; font-weight:600; color:#fff; background:var(--acc);
+           border:0; border-radius:8px; cursor:pointer; margin-top:.5rem; }
+  button:hover { filter:brightness(1.08); }
+  .note { border:1px solid var(--line); border-radius:8px; padding:.8rem .9rem; margin:1.5rem 0 0;
+          color:var(--mut); font-size:.85rem; }
+  .note strong { color:var(--fg); }
+  .warn { background:var(--warnbg); border-color:transparent; color:var(--warn); margin:0 0 1.25rem; }
+  .err { background:#fdecea; color:#a4271c; border:0; border-radius:8px; padding:.7rem .9rem; margin:0 0 1rem; font-size:.9rem; }
+  @media (prefers-color-scheme: dark) { .err { background:#3a1d1a; color:#ffb4a8; } }
+  .fixed { padding:.6rem .7rem; border:1px solid var(--line); border-radius:8px; margin-bottom:1rem; font-size:.9rem; }
+  hr { border:0; border-top:1px solid var(--line); margin:1.5rem 0; }
+</style></head>
+<body><main>
+  <h1>Connect your Umami</h1>
+  <p class="sub">${client} is asking to read your Umami Analytics.</p>
+
+  ${o.error ? `<div class="err">${escapeHtml(o.error)}</div>` : ''}
+
+  <div class="note warn">
+    Self-hosted Umami has no API keys, so this is your <strong>account password</strong>.
+    Only continue if you trust whoever runs this server. Prefer a dedicated,
+    limited Umami account over your admin login.
+  </div>
+
+  <form method="POST" autocomplete="off">
+      ${hidden}
+      ${urlField}
+      <label>Username
+        <input type="text" name="umami_username" required autocomplete="username" spellcheck="false">
+      </label>
+      <label>Password
+        <input type="password" name="umami_password" required autocomplete="current-password">
+      </label>
+      <label>Permission
+        <select name="mode">
+          <option value="read" selected>Read only &mdash; analytics and reports</option>
+          <option value="write">Read and write &mdash; also create and update websites</option>
+          <option value="admin">Admin &mdash; also manage users</option>
+        </select>
+      </label>
+      <button type="submit">Connect</button>
+  </form>
+
+  <div class="note">
+    <strong>What happens to your password:</strong> it is verified against the Umami URL you
+    entered, then encrypted into the access token itself. This server keeps no database and
+    stores no credentials. Irreversible operations &mdash; deleting a website, wiping its data,
+    removing a user &mdash; are never available through this connection, whichever permission
+    you pick.
+  </div>
+</main></body></html>`;
+}
+export function errorPage(title, detail) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(title)}</title>
+<style>:root{color-scheme:light dark}body{margin:0;padding:3rem 1rem;font:15px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;text-align:center}
+h1{font-size:1.15rem;margin:0 0 .5rem}p{color:#666;max-width:30rem;margin:0 auto}</style></head>
+<body><h1>${escapeHtml(title)}</h1><p>${escapeHtml(detail)}</p></body></html>`;
+}
+//# sourceMappingURL=consent.js.map

package/dist/oauth/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/oauth/consent.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAC9E,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,WAAW,CAAC,CAAqB;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;SACzF,IAAI,CAAC,UAAU,CAAC,CAAC;IAEpB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAEzE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,gDAAgD,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;kDAC1B,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;QACrF,CAAC,CAAC;;;gBAGU,CAAC;IAEf,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkCU,MAAM;;IAErB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;;;;;;;;;QAS1D,MAAM;QACN,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;sBAwBM,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,OAAO;4EACmE,UAAU,CAAC,KAAK,CAAC;;;YAGjF,UAAU,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,oBAAoB,CAAC;AAC/E,CAAC"}

package/dist/oauth/router.d.ts

@@ -0,0 +1,27 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Config } from '../config.js';
+import { MemoryStore } from './store.js';
+import { type SealedIdentity } from './seal.js';
+export interface OAuthOptions {
+    /** Public base URL of this server, e.g. https://umami-mcp.example.com */
+    issuer: string;
+    key: Buffer;
+    /** Pin every connection to one Umami instance; omit for multi-tenant. */
+    fixedUrl?: string;
+    tokenTtlSeconds: number;
+    baseConfig: Config;
+}
+export declare class OAuthProvider {
+    private readonly o;
+    readonly store: MemoryStore;
+    constructor(o: OAuthOptions);
+    /** Validate an Authorization header and return the caller's identity. */
+    authenticate(req: IncomingMessage): SealedIdentity;
+    /** Returns true when the request was an OAuth endpoint and has been handled. */
+    handle(req: IncomingMessage, res: ServerResponse, url: URL): Promise<boolean>;
+    private register;
+    private showConsent;
+    /** Consent submitted: verify the credentials for real, then mint a code. */
+    private grant;
+    private token;
+}