@automattic/mcp-wordpress-remote 0.2.19 → 0.2.21

package/README.md

@@ -50,6 +50,7 @@ Add to your MCP client configuration (e.g., Claude Desktop's `claude_desktop_con
 You can add custom headers to all API requests using the `CUSTOM_HEADERS` environment variable. This is useful for API keys, custom authentication, or other header requirements.
 
 #### JSON Format (Recommended):
+
 ```json
 {
   "mcpServers": {
@@ -66,6 +67,7 @@ You can add custom headers to all API requests using the `CUSTOM_HEADERS` enviro
 ```
 
 #### Comma-Separated Format:
+
 ```json
 {
   "mcpServers": {
@@ -82,6 +84,7 @@ You can add custom headers to all API requests using the `CUSTOM_HEADERS` enviro
 ```
 
 #### Command Line Usage:
+
 ```bash
 CUSTOM_HEADERS='{"X-MCP-API-Key": "wc_mcp_FaQduhQcW0mfVaZgP3yaaqDuXaZ3mw7j"}' \
 WP_API_URL="https://your-site.com" \
@@ -89,6 +92,7 @@ npx @automattic/mcp-wordpress-remote
 ```
 
 Custom headers are included in:
+
 - All WordPress API requests
 - OAuth discovery requests
 - OAuth token exchange requests
@@ -130,8 +134,6 @@ OAuth 2.1 provides the most secure and user-friendly experience with full MCP Au
 }
 ```
 
-
-
 **MCP Authorization Specification Features:**
 
 - **OAuth 2.1 authorization code flow** with PKCE (RFC 7636)
@@ -240,34 +242,32 @@ For WooCommerce-specific tools and reports:
 
 ### Environment Variables
 
-| Variable                     | Description                        | Default              | Required |
-| ---------------------------- | ---------------------------------- | -------------------- | -------- |
-| `WP_API_URL`                 | WordPress site URL                 | -                    | ✅       |
-| `OAUTH_ENABLED`              | Enable OAuth authentication        | `true`               | -        |
-| `OAUTH_CALLBACK_PORT`        | OAuth callback port                | `7665`               | -        |
-| `OAUTH_HOST`                 | OAuth callback hostname            | `127.0.0.1`          | -        |
-| `WP_OAUTH_CLIENT_ID`         | Custom OAuth client ID             | -                    | -        |
-| **OAuth Endpoints**          |                                    |                      |          |
-| `OAUTH_AUTHORIZE_ENDPOINT`   | OAuth authorization endpoint       | -                    | ✅ (for custom OAuth) |
-| `OAUTH_TOKEN_ENDPOINT`       | OAuth token endpoint               | -                    | ✅ (for custom OAuth) |
-| `OAUTH_AUTHENTICATE_ENDPOINT`| OAuth authenticate endpoint       | -                    | -        |
-| **MCP OAuth 2.1 Settings**   |                                    |                      |          |
-| `OAUTH_FLOW_TYPE`            | OAuth flow type (authorization_code or implicit) | `authorization_code` | -        |
-| `OAUTH_USE_PKCE`             | Use PKCE (required for OAuth 2.1)  | `true`               | -        |
-| `OAUTH_DYNAMIC_REGISTRATION` | Enable dynamic client registration | `true`               | -        |
-| `OAUTH_RESOURCE_INDICATOR`   | Use resource indicators (RFC 8707) | `true`               | -        |
-| **Configuration**            |                                    |                      |          |
-| `WP_MCP_CONFIG_DIR`          | Config directory override          | `~/.mcp-auth`        | -        |
-| `LOG_FILE`                   | Log file path                      | -                    | -        |
-| `LOG_LEVEL`                  | Log level (0-3)                    | `2`                  | -        |
-| **Legacy Authentication**    |                                    |                      |          |
-| `JWT_TOKEN`                  | JWT token for authentication       | -                    | -        |
-| `WP_API_USERNAME`            | WordPress username (legacy)        | -                    | -        |
-| `WP_API_PASSWORD`            | WordPress app password (legacy)    | -                    | -        |
-| `WOO_CUSTOMER_KEY`           | WooCommerce consumer key           | -                    | -        |
-| `WOO_CUSTOMER_SECRET`        | WooCommerce consumer secret        | -                    | -        |
-
-
+| Variable                      | Description                                      | Default              | Required              |
+| ----------------------------- | ------------------------------------------------ | -------------------- | --------------------- |
+| `WP_API_URL`                  | WordPress site URL                               | -                    | ✅                    |
+| `OAUTH_ENABLED`               | Enable OAuth authentication                      | `true`               | -                     |
+| `OAUTH_CALLBACK_PORT`         | OAuth callback port                              | `7665`               | -                     |
+| `OAUTH_HOST`                  | OAuth callback hostname                          | `127.0.0.1`          | -                     |
+| `WP_OAUTH_CLIENT_ID`          | Custom OAuth client ID                           | -                    | -                     |
+| **OAuth Endpoints**           |                                                  |                      |                       |
+| `OAUTH_AUTHORIZE_ENDPOINT`    | OAuth authorization endpoint                     | -                    | ✅ (for custom OAuth) |
+| `OAUTH_TOKEN_ENDPOINT`        | OAuth token endpoint                             | -                    | ✅ (for custom OAuth) |
+| `OAUTH_AUTHENTICATE_ENDPOINT` | OAuth authenticate endpoint                      | -                    | -                     |
+| **MCP OAuth 2.1 Settings**    |                                                  |                      |                       |
+| `OAUTH_FLOW_TYPE`             | OAuth flow type (authorization_code or implicit) | `authorization_code` | -                     |
+| `OAUTH_USE_PKCE`              | Use PKCE (required for OAuth 2.1)                | `true`               | -                     |
+| `OAUTH_DYNAMIC_REGISTRATION`  | Enable dynamic client registration               | `true`               | -                     |
+| `OAUTH_RESOURCE_INDICATOR`    | Use resource indicators (RFC 8707)               | `true`               | -                     |
+| **Configuration**             |                                                  |                      |                       |
+| `WP_MCP_CONFIG_DIR`           | Config directory override                        | `~/.mcp-auth`        | -                     |
+| `LOG_FILE`                    | Log file path                                    | -                    | -                     |
+| `LOG_LEVEL`                   | Log level (0-3)                                  | `2`                  | -                     |
+| **Legacy Authentication**     |                                                  |                      |                       |
+| `JWT_TOKEN`                   | JWT token for authentication                     | -                    | -                     |
+| `WP_API_USERNAME`             | WordPress username (legacy)                      | -                    | -                     |
+| `WP_API_PASSWORD`             | WordPress app password (legacy)                  | -                    | -                     |
+| `WOO_CUSTOMER_KEY`            | WooCommerce consumer key                         | -                    | -                     |
+| `WOO_CUSTOMER_SECRET`         | WooCommerce consumer secret                      | -                    | -                     |
 
 ### Disable OAuth
 

package/dist/lib.d.ts

@@ -280,6 +280,7 @@ declare function getFetchInfo(): {
  *
  * Supports:
  * - macOS: Automatic PAC file detection from system proxy settings
+ * - macOS: System SOCKS proxy detection (AutoProxxy Tunnel All Traffic)
  * - All platforms: Environment variables (SOCKS_PROXY, HTTPS_PROXY, etc.)
  */
 

package/dist/lib.js

@@ -35641,15 +35641,19 @@ import { SocksProxyAgent } from "socks-proxy-agent";
 import { HttpsProxyAgent } from "https-proxy-agent";
 var proxyConfig = { type: "none" };
 var initializationPromise = null;
-function detectMacOsPac() {
+function detectMacOsProxy() {
   if (process.platform !== "darwin") return null;
   try {
     const output = execSync("scutil --proxy", { encoding: "utf-8", timeout: 3e3 });
     const pacEnabled = output.match(/ProxyAutoConfigEnable\s*:\s*(\d)/)?.[1] === "1";
     const pacUrl = output.match(/ProxyAutoConfigURLString\s*:\s*(\S+)/)?.[1];
-    if (pacEnabled && pacUrl) {
-      return pacUrl;
-    }
+    const socksEnabled = output.match(/SOCKSEnable\s*:\s*(\d)/)?.[1] === "1";
+    const socksHost = output.match(/SOCKSProxy\s*:\s*(\S+)/)?.[1];
+    const socksPort = output.match(/SOCKSPort\s*:\s*(\d+)/)?.[1];
+    return {
+      pacUrl: pacEnabled && pacUrl ? pacUrl : null,
+      socks: socksEnabled && socksHost && socksPort ? { host: socksHost, port: socksPort } : null
+    };
   } catch {
   }
   return null;
@@ -35715,10 +35719,10 @@ async function initializeProxy() {
   return initializationPromise;
 }
 async function doInitializeProxy() {
-  const pacUrl = detectMacOsPac();
-  if (pacUrl) {
+  const macProxy = detectMacOsProxy();
+  if (macProxy?.pacUrl) {
     try {
-      const response = await fetch(pacUrl);
+      const response = await fetch(macProxy.pacUrl);
       const pacScript = await response.text();
       const { getQuickJS } = await import("@tootallnate/quickjs-emscripten");
       const { createPacResolver } = await import("pac-resolver");
@@ -35728,12 +35732,20 @@ async function doInitializeProxy() {
         type: "pac",
         pacResolver: resolver
       };
-      logger.info(`PAC proxy initialized from ${sanitizeProxyUrl(pacUrl)}`, "PROXY");
+      logger.info(`PAC proxy initialized from ${sanitizeProxyUrl(macProxy.pacUrl)}`, "PROXY");
       return;
     } catch (error) {
       logger.error(`Failed to initialize PAC proxy: ${error}`, "PROXY");
     }
   }
+  if (macProxy?.socks) {
+    const { host, port } = macProxy.socks;
+    const bracketedHost = host.includes(":") ? `[${host}]` : host;
+    const socksUrl = `socks5://${bracketedHost}:${port}`;
+    proxyConfig = { type: "env", envProxy: { url: socksUrl, type: "socks" } };
+    logger.info(`System SOCKS proxy configured: ${sanitizeProxyUrl(socksUrl)}`, "PROXY");
+    return;
+  }
   const envProxy = detectEnvProxy();
   if (envProxy) {
     proxyConfig = { type: "env", envProxy };

package/dist/proxy.js

@@ -36305,15 +36305,19 @@ import { SocksProxyAgent } from "socks-proxy-agent";
 import { HttpsProxyAgent } from "https-proxy-agent";
 var proxyConfig = { type: "none" };
 var initializationPromise = null;
-function detectMacOsPac() {
+function detectMacOsProxy() {
   if (process.platform !== "darwin") return null;
   try {
     const output = execSync("scutil --proxy", { encoding: "utf-8", timeout: 3e3 });
     const pacEnabled = output.match(/ProxyAutoConfigEnable\s*:\s*(\d)/)?.[1] === "1";
     const pacUrl = output.match(/ProxyAutoConfigURLString\s*:\s*(\S+)/)?.[1];
-    if (pacEnabled && pacUrl) {
-      return pacUrl;
-    }
+    const socksEnabled = output.match(/SOCKSEnable\s*:\s*(\d)/)?.[1] === "1";
+    const socksHost = output.match(/SOCKSProxy\s*:\s*(\S+)/)?.[1];
+    const socksPort = output.match(/SOCKSPort\s*:\s*(\d+)/)?.[1];
+    return {
+      pacUrl: pacEnabled && pacUrl ? pacUrl : null,
+      socks: socksEnabled && socksHost && socksPort ? { host: socksHost, port: socksPort } : null
+    };
   } catch {
   }
   return null;
@@ -36379,10 +36383,10 @@ async function initializeProxy() {
   return initializationPromise;
 }
 async function doInitializeProxy() {
-  const pacUrl = detectMacOsPac();
-  if (pacUrl) {
+  const macProxy = detectMacOsProxy();
+  if (macProxy?.pacUrl) {
     try {
-      const response = await fetch(pacUrl);
+      const response = await fetch(macProxy.pacUrl);
       const pacScript = await response.text();
       const { getQuickJS } = await import("@tootallnate/quickjs-emscripten");
       const { createPacResolver } = await import("pac-resolver");
@@ -36392,12 +36396,20 @@ async function doInitializeProxy() {
         type: "pac",
         pacResolver: resolver
       };
-      logger.info(`PAC proxy initialized from ${sanitizeProxyUrl(pacUrl)}`, "PROXY");
+      logger.info(`PAC proxy initialized from ${sanitizeProxyUrl(macProxy.pacUrl)}`, "PROXY");
       return;
     } catch (error) {
       logger.error(`Failed to initialize PAC proxy: ${error}`, "PROXY");
     }
   }
+  if (macProxy?.socks) {
+    const { host, port } = macProxy.socks;
+    const bracketedHost = host.includes(":") ? `[${host}]` : host;
+    const socksUrl = `socks5://${bracketedHost}:${port}`;
+    proxyConfig = { type: "env", envProxy: { url: socksUrl, type: "socks" } };
+    logger.info(`System SOCKS proxy configured: ${sanitizeProxyUrl(socksUrl)}`, "PROXY");
+    return;
+  }
   const envProxy = detectEnvProxy();
   if (envProxy) {
     proxyConfig = { type: "env", envProxy };
@@ -38796,12 +38808,45 @@ function prepareRequest(wpRequestParams, mcpRequest, context) {
   }
 }
 function createSessionContext() {
+  let resolve;
+  const ready = new Promise((r2) => {
+    resolve = r2;
+  });
   return {
     sessionId: null,
     requestIdCounter: 0,
-    transportType: null
+    transportType: null,
+    _init: {
+      ready,
+      resolve,
+      settled: false,
+      failed: false
+    }
   };
 }
+function resolveInit(context, failed) {
+  if (context._init.settled) return;
+  context._init.failed = failed;
+  context._init.settled = true;
+  context._init.resolve();
+}
+var INIT_TIMEOUT_MS = 3e4;
+async function waitForInit(context, timeoutMs = INIT_TIMEOUT_MS) {
+  if (context._init.settled) {
+    return context._init.failed ? { ready: false, reason: "failed" } : { ready: true };
+  }
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), timeoutMs);
+  });
+  const result = await Promise.race([context._init.ready.then(() => "ready"), timeout]);
+  clearTimeout(timer);
+  if (result === "timeout") {
+    logger.error("Timed out waiting for initialization to complete", "INIT");
+    return { ready: false, reason: "timeout" };
+  }
+  return context._init.failed ? { ready: false, reason: "failed" } : { ready: true };
+}
 
 // src/lib/transport-detection.ts
 async function detectTransportType(context, initParams) {
@@ -38970,6 +39015,11 @@ function convertAPIErrorToMcpError(error) {
 function createRequestHandler(config, context) {
   return async (request) => {
     logger.debug(`Processing ${config.name}Request`, "MCP");
+    const init = await waitForInit(context);
+    if (!init.ready) {
+      const cause = init.reason === "timeout" ? "timed out waiting for" : "failed during";
+      throw new Error(`Cannot process ${config.method}: WordPress connection ${cause} initialization`);
+    }
     const wpParams = config.paramMapper(request);
     const requestData = prepareRequest(wpParams, request, context);
     const response = await wpRequest(requestData, context.transportType === "jsonrpc");
@@ -39156,6 +39206,7 @@ async function WordPressProxy() {
     try {
       logger.info("\u{1F504} Initializing WordPress connection with client parameters", "INIT");
       const { initResult } = await detectTransportType(sessionContext, request.params);
+      resolveInit(sessionContext, false);
       const wordpressInitResponse = {
         protocolVersion: initResult.protocolVersion || "2025-06-18",
         serverInfo: initResult.serverInfo,
@@ -39166,9 +39217,15 @@ async function WordPressProxy() {
       logger.debug("Initialize response:", "INIT", wordpressInitResponse);
       return wordpressInitResponse;
     } catch (error) {
-      logger.error("\u274C Failed to initialize WordPress connection with client parameters", "INIT", error);
+      logger.error(
+        "\u274C Failed to initialize WordPress connection with client parameters",
+        "INIT",
+        error
+      );
+      resolveInit(sessionContext, true);
+      const clientProtocolVersion = request?.params?.protocolVersion || "2025-06-18";
       const fallbackResponse = {
-        protocolVersion: "2025-06-18",
+        protocolVersion: clientProtocolVersion,
         serverInfo: {
           name: "WordPress MCP Remote Proxy",
           version: MCP_WORDPRESS_REMOTE_VERSION
@@ -39186,24 +39243,62 @@ async function WordPressProxy() {
       return fallbackResponse;
     }
   });
-  server.setRequestHandler(ListToolsRequestSchema, createWrappedHandler(HANDLER_CONFIGS.listTools, sessionContext));
-  server.setRequestHandler(CallToolRequestSchema, createWrappedHandler(HANDLER_CONFIGS.callTool, sessionContext));
-  server.setRequestHandler(ListResourcesRequestSchema, createWrappedHandler(HANDLER_CONFIGS.listResources, sessionContext));
-  server.setRequestHandler(ListResourceTemplatesRequestSchema, createWrappedHandler(HANDLER_CONFIGS.listResourceTemplates, sessionContext));
-  server.setRequestHandler(ReadResourceRequestSchema, createWrappedHandler(HANDLER_CONFIGS.readResource, sessionContext));
-  server.setRequestHandler(SubscribeRequestSchema, createWrappedHandler(HANDLER_CONFIGS.subscribe, sessionContext));
-  server.setRequestHandler(UnsubscribeRequestSchema, createWrappedHandler(HANDLER_CONFIGS.unsubscribe, sessionContext));
-  server.setRequestHandler(ListPromptsRequestSchema, createWrappedHandler(HANDLER_CONFIGS.listPrompts, sessionContext));
-  server.setRequestHandler(GetPromptRequestSchema, createWrappedHandler(HANDLER_CONFIGS.getPrompt, sessionContext));
-  server.setRequestHandler(SetLevelRequestSchema, createWrappedHandler(HANDLER_CONFIGS.setLevel, sessionContext));
-  server.setRequestHandler(CompleteRequestSchema, createWrappedHandler(HANDLER_CONFIGS.complete, sessionContext));
-  server.setRequestHandler(ListRootsRequestSchema, createWrappedHandler(HANDLER_CONFIGS.listRoots, sessionContext));
+  server.setRequestHandler(
+    ListToolsRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.listTools, sessionContext)
+  );
+  server.setRequestHandler(
+    CallToolRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.callTool, sessionContext)
+  );
+  server.setRequestHandler(
+    ListResourcesRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.listResources, sessionContext)
+  );
+  server.setRequestHandler(
+    ListResourceTemplatesRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.listResourceTemplates, sessionContext)
+  );
+  server.setRequestHandler(
+    ReadResourceRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.readResource, sessionContext)
+  );
+  server.setRequestHandler(
+    SubscribeRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.subscribe, sessionContext)
+  );
+  server.setRequestHandler(
+    UnsubscribeRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.unsubscribe, sessionContext)
+  );
+  server.setRequestHandler(
+    ListPromptsRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.listPrompts, sessionContext)
+  );
+  server.setRequestHandler(
+    GetPromptRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.getPrompt, sessionContext)
+  );
+  server.setRequestHandler(
+    SetLevelRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.setLevel, sessionContext)
+  );
+  server.setRequestHandler(
+    CompleteRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.complete, sessionContext)
+  );
+  server.setRequestHandler(
+    ListRootsRequestSchema,
+    createWrappedHandler(HANDLER_CONFIGS.listRoots, sessionContext)
+  );
   const transport = new StdioServerTransport();
   transport.onmessage = (message) => {
     const msg = message;
     const method = typeof msg?.method === "string" ? msg.method : "unknown";
     const id = msg?.id ?? "none";
-    const hasParams = Boolean(msg?.params && typeof msg.params === "object" && Object.keys(msg.params).length);
+    const hasParams = Boolean(
+      msg?.params && typeof msg.params === "object" && Object.keys(msg.params).length
+    );
     logger.info("\u{1F4E5} Raw client message received", "TRANSPORT", {
       method,
       id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/mcp-wordpress-remote",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "MCP WordPress Remote proxy server",
   "engines": {
     "node": ">=18.0.0"