@automattic/mcp-wordpress-remote 0.2.16 → 0.2.17

package/dist/proxy.js

@@ -36036,7 +36036,7 @@ async function selectCallbackPort(serverUrl, specifiedPort, _unused) {
 }
 
 // src/lib/config.ts
-var MCP_WORDPRESS_REMOTE_VERSION = "0.2.16";
+var MCP_WORDPRESS_REMOTE_VERSION = "0.2.17";
 var CONFIG = {
   // API Configuration
   WP_API_URL: process.env.WP_API_URL || "https://example.com",
@@ -36082,6 +36082,9 @@ var CONFIG = {
   JWT_TOKEN: process.env.JWT_TOKEN,
   WOO_CUSTOMER_KEY: process.env.WOO_CUSTOMER_KEY,
   WOO_CUSTOMER_SECRET: process.env.WOO_CUSTOMER_SECRET,
+  // Custom Headers Configuration
+  CUSTOM_HEADERS: process.env.CUSTOM_HEADERS || "",
+  // JSON string or comma-separated header:value pairs
   // Environment
   NODE_ENV: process.env.NODE_ENV || "development"
 };
@@ -36095,17 +36098,54 @@ function getDefaultOAuthScopes() {
   const defaultScopes = ["read", "write"];
   return parseOAuthScopes(CONFIG.OAUTH_SCOPES, defaultScopes);
 }
+function parseCustomHeaders(customHeadersString) {
+  if (!customHeadersString || customHeadersString.trim() === "") {
+    return {};
+  }
+  try {
+    if (customHeadersString.trim().startsWith("{")) {
+      return JSON.parse(customHeadersString);
+    }
+    const headers = {};
+    const pairs = customHeadersString.split(",");
+    for (const pair of pairs) {
+      const colonIndex = pair.indexOf(":");
+      if (colonIndex > 0) {
+        const key = pair.substring(0, colonIndex).trim();
+        const value = pair.substring(colonIndex + 1).trim();
+        if (key && value) {
+          headers[key] = value;
+        }
+      }
+    }
+    return headers;
+  } catch (error) {
+    logger.error("Error parsing custom headers", "CONFIG", error);
+    return {};
+  }
+}
+function getCustomHeaders() {
+  const customHeadersEnv = process.env.CUSTOM_HEADERS || "";
+  return parseCustomHeaders(customHeadersEnv);
+}
 function validateConfig() {
   const errors = [];
-  const hasJWT = !!CONFIG.JWT_TOKEN;
-  const hasBasicAuth = !!(CONFIG.WP_API_USERNAME && CONFIG.WP_API_PASSWORD);
-  const hasOAuth = CONFIG.OAUTH_ENABLED;
-  if (!hasJWT && !hasBasicAuth && !hasOAuth) {
+  const currentApiUrl = process.env.WP_API_URL || CONFIG.WP_API_URL;
+  const currentCustomHeaders = process.env.CUSTOM_HEADERS || CONFIG.CUSTOM_HEADERS;
+  const currentJwtToken = process.env.JWT_TOKEN || CONFIG.JWT_TOKEN;
+  const currentUsername = process.env.WP_API_USERNAME || CONFIG.WP_API_USERNAME;
+  const currentPassword = process.env.WP_API_PASSWORD || CONFIG.WP_API_PASSWORD;
+  const currentOAuthEnabled = process.env.OAUTH_ENABLED === "true" || CONFIG.OAUTH_ENABLED;
+  const hasJWT = !!currentJwtToken;
+  const hasBasicAuth = !!(currentUsername && currentPassword);
+  const hasOAuth = currentOAuthEnabled;
+  const hasCustomHeaders = !!currentCustomHeaders && currentCustomHeaders.trim() !== "";
+  if (!hasJWT && !hasBasicAuth && !hasOAuth && !hasCustomHeaders) {
     errors.push(
-      "No authentication method configured. Please set one of: JWT_TOKEN, WP_API_USERNAME+WP_API_PASSWORD, or enable OAuth"
+      "No authentication method configured. Please set one of: JWT_TOKEN, WP_API_USERNAME+WP_API_PASSWORD, enable OAuth, or set CUSTOM_HEADERS"
     );
   }
-  if (!CONFIG.WP_API_URL || CONFIG.WP_API_URL === "https://example.com") {
+  if (!currentApiUrl || currentApiUrl === "https://example.com") {
     errors.push("WP_API_URL must be set to your WordPress site URL");
   }
   if (CONFIG.OAUTH_ENABLED) {
@@ -36139,7 +36179,8 @@ function formatConfigError(error) {
     return `${error}. Configure one of these options:
     \u2022 JWT_TOKEN=your_jwt_token (preferred for APIs)
     \u2022 WP_API_USERNAME=username and WP_API_PASSWORD=app_password (for application passwords)
-    \u2022 Set OAUTH_ENABLED=true and WP_OAUTH_CLIENT_ID=your_client_id (for OAuth 2.1)`;
+    \u2022 Set OAUTH_ENABLED=true and WP_OAUTH_CLIENT_ID=your_client_id (for OAuth 2.1)
+    \u2022 CUSTOM_HEADERS='{"X-API-Key": "your_api_key"}' (for custom header authentication)`;
   }
   if (error.includes("OAUTH_CALLBACK_PORT")) {
     return `${error}. The port must be available for the OAuth callback server. Try a different port like 7777, 7890, or other ports in the safe 7000-7999 range.`;
@@ -36739,7 +36780,13 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl) {
   try {
     const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationServerUrl);
     logger.oauth(`Discovering authorization server metadata: ${metadataUrl}`);
-    const response = await fetch(metadataUrl.toString());
+    const customHeaders = getCustomHeaders();
+    const response = await fetch(metadataUrl.toString(), {
+      headers: {
+        "Accept": "application/json",
+        ...customHeaders
+      }
+    });
     if (!response.ok) {
       throw new OAuthError(
         `Failed to fetch authorization server metadata: ${response.status}`,
@@ -36770,7 +36817,13 @@ async function discoverProtectedResourceMetadata(resourceUrl) {
     const url = new URL(resourceUrl);
     const metadataUrl = new URL("/.well-known/oauth-protected-resource", url.origin);
     logger.oauth(`Discovering protected resource metadata: ${metadataUrl}`);
-    const response = await fetch(metadataUrl.toString());
+    const customHeaders = getCustomHeaders();
+    const response = await fetch(metadataUrl.toString(), {
+      headers: {
+        "Accept": "application/json",
+        ...customHeaders
+      }
+    });
     if (!response.ok) {
       throw new OAuthError(
         `Failed to fetch protected resource metadata: ${response.status}`,
@@ -36830,10 +36883,12 @@ function parseWWWAuthenticateHeader(headerValue) {
 async function registerDynamicClient(registrationEndpoint, registrationRequest) {
   try {
     logger.oauth(`Attempting dynamic client registration: ${registrationEndpoint}`);
+    const customHeaders = getCustomHeaders();
     const response = await fetch(registrationEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        ...customHeaders
       },
       body: JSON.stringify(registrationRequest)
     });
@@ -36880,10 +36935,12 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
     if (resource) {
       params.set("resource", resource);
     }
+    const customHeaders = getCustomHeaders();
     const response = await fetch(tokenEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
+        "Content-Type": "application/x-www-form-urlencoded",
+        ...customHeaders
       },
       body: params.toString()
     });
@@ -37346,9 +37403,11 @@ var MCPOAuthProvider = class {
   async discoverVia401Response() {
     try {
       logger.oauth("Attempting discovery via 401 response method");
+      const customHeaders = getCustomHeaders();
       const response = await fetch(this.config.serverUrl, {
         headers: {
-          Accept: "application/json"
+          Accept: "application/json",
+          ...customHeaders
         }
       });
       if (response.status === 401) {
@@ -37357,7 +37416,12 @@ var MCPOAuthProvider = class {
           const authInfo = parseWWWAuthenticateHeader(wwwAuthHeader);
           logger.oauth("WWW-Authenticate header parsed successfully");
           if (authInfo.resource_metadata_url) {
-            const metadataResponse = await fetch(authInfo.resource_metadata_url);
+            const metadataResponse = await fetch(authInfo.resource_metadata_url, {
+              headers: {
+                "Accept": "application/json",
+                ...customHeaders
+              }
+            });
             if (metadataResponse.ok) {
               this.resourceMetadata = await metadataResponse.json();
               logger.oauth("Protected resource metadata obtained via 401 response");
@@ -38381,25 +38445,43 @@ async function wpRequest(requestData, useJsonRpc = true) {
     authHeader = `Basic ${auth2}`;
     logger.debug(`Auth header length: ${auth2.length}`, "AUTH");
   }
-  if (!authHeader) {
+  const customHeaders = getCustomHeaders();
+  const hasCustomHeaders = Object.keys(customHeaders).length > 0;
+  if (!authHeader && !hasCustomHeaders) {
     throw new AuthError(
-      "No authentication method available. Please configure JWT_TOKEN, OAuth, or Basic Auth (WP_API_USERNAME+WP_API_PASSWORD).",
+      "No authentication method available. Please configure JWT_TOKEN, OAuth, Basic Auth (WP_API_USERNAME+WP_API_PASSWORD), or CUSTOM_HEADERS.",
       "NO_AUTH_METHOD"
     );
   }
+  const currentApiUrl = process.env.WP_API_URL || CONFIG.WP_API_URL;
   logger.debug(`Environment: ${CONFIG.NODE_ENV}`, "API");
-  logger.debug(`Base API URL: ${CONFIG.WP_API_URL}`, "API");
-  const url = constructApiUrl(CONFIG.WP_API_URL, endpoint);
+  logger.debug(`Base API URL: ${currentApiUrl}`, "API");
+  const url = constructApiUrl(currentApiUrl, endpoint);
   logger.debug(`Final requesting URL: ${url}`, "API");
   const headers = {
-    Authorization: authHeader,
     "Content-Type": "application/json",
-    "MCP-Protocol-Version": "2025-06-18"
+    "MCP-Protocol-Version": "2025-06-18",
     // MCP protocol version
+    ...customHeaders
+    // Merge custom headers
   };
+  if (authHeader) {
+    headers.Authorization = authHeader;
+  }
   if (globalSessionId) {
     headers["Mcp-Session-Id"] = globalSessionId;
   }
+  if (authHeader) {
+    logger.debug("Using Authorization header for authentication", "API");
+  } else if (hasCustomHeaders) {
+    logger.auth("Using custom headers for authentication (no Authorization header)");
+  }
+  if (hasCustomHeaders) {
+    logger.debug(`Custom headers added: ${Object.keys(customHeaders).join(", ")}`, "API");
+    for (const [key, value] of Object.entries(customHeaders)) {
+      logger.debug(`Header ${key}: ${value.length} characters`, "API");
+    }
+  }
   const fetchOptions = {
     method,
     headers,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/mcp-wordpress-remote",
-  "version": "0.2.16",
+  "version": "0.2.17",
   "description": "MCP WordPress Remote proxy server",
   "engines": {
     "node": ">=18.0.0"