@burdenoff/mcp-libs 2026.511.1

package/dist/transports/index.cjs

@@ -0,0 +1,183 @@
+'use strict';
+
+var stdio_js = require('@modelcontextprotocol/sdk/server/stdio.js');
+var crypto = require('crypto');
+var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+var types_js = require('@modelcontextprotocol/sdk/types.js');
+
+// src/transports/stdio.ts
+async function startStdioServer(server, ctx, _opts = {}) {
+  ctx.logger.info("Starting MCP server with stdio transport", {
+    name: ctx.serverName,
+    version: ctx.serverVersion
+  });
+  const transport = new stdio_js.StdioServerTransport();
+  await server.connect(transport);
+  ctx.logger.info("MCP stdio server started");
+}
+
+// src/transports/security.ts
+var SESSION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function parseCorsOrigins(origins) {
+  if (Array.isArray(origins)) return origins;
+  const value = origins?.trim();
+  if (!value || value === "*") {
+    return ["http://127.0.0.1", "http://localhost"];
+  }
+  return value.split(",").map((origin) => origin.trim()).filter(Boolean);
+}
+function isAuthorizedRequest(req, apiKey) {
+  return req.headers.authorization === `Bearer ${apiKey}` || req.headers["x-api-key"] === apiKey;
+}
+function requireAuthorizedRequest(req, res, apiKey) {
+  if (!apiKey) {
+    res.status(503).json({ error: "Transport authentication is not configured" });
+    return false;
+  }
+  if (!isAuthorizedRequest(req, apiKey)) {
+    res.status(401).json({ error: "Unauthorized" });
+    return false;
+  }
+  return true;
+}
+function assertTransportAuthConfigured(transport, apiKey) {
+  if ((transport === "sse" || transport === "http") && !apiKey) {
+    throw new Error("MCP_API_KEY must be configured for HTTP/SSE transports");
+  }
+}
+function isValidSessionId(sessionId) {
+  return SESSION_ID_PATTERN.test(sessionId);
+}
+
+// src/transports/http.ts
+async function createHttpApp(ctx, createServerFn, options = {}) {
+  const expressMod = await import('express');
+  const corsMod = await import('cors');
+  const express = expressMod.default ?? expressMod;
+  const cors = corsMod.default ?? corsMod;
+  const cfg = ctx.config.read();
+  const app = express();
+  app.use(express.json());
+  if (options.enableCors !== false) {
+    const corsOrigins = options.corsOrigins ?? cfg.corsOrigins;
+    app.use(
+      cors({
+        origin: parseCorsOrigins(corsOrigins),
+        exposedHeaders: ["Mcp-Session-Id"],
+        allowedHeaders: ["Content-Type", "Authorization", "X-API-Key", "mcp-session-id"]
+      })
+    );
+  }
+  const transports = {};
+  const apiKey = options.apiKey ?? cfg.apiKey;
+  app.post("/mcp", async (req, res) => {
+    if (!requireAuthorizedRequest(req, res, apiKey)) return;
+    try {
+      const sessionId = req.headers["mcp-session-id"];
+      let transport;
+      if (sessionId && !isValidSessionId(sessionId)) {
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Bad Request: Invalid session ID provided" },
+          id: null
+        });
+        return;
+      }
+      if (sessionId && transports[sessionId]) {
+        transport = transports[sessionId];
+      } else if (!sessionId && types_js.isInitializeRequest(req.body)) {
+        transport = new streamableHttp_js.StreamableHTTPServerTransport({
+          sessionIdGenerator: () => crypto.randomUUID(),
+          onsessioninitialized: (sid) => {
+            transports[sid] = transport;
+            ctx.logger.info("New MCP session initialized", { sessionId: sid });
+          },
+          enableDnsRebindingProtection: options.enableDnsRebindingProtection ?? true,
+          allowedHosts: options.allowedHosts ?? cfg.allowedHosts.split(",")
+        });
+        transport.onclose = () => {
+          if (transport.sessionId) {
+            delete transports[transport.sessionId];
+            ctx.logger.info("MCP session closed", { sessionId: transport.sessionId });
+          }
+        };
+        const server = createServerFn();
+        await server.connect(transport);
+      } else {
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Bad Request: No valid session ID provided" },
+          id: null
+        });
+        return;
+      }
+      await transport.handleRequest(req, res, req.body);
+    } catch (error) {
+      ctx.logger.error("Error handling MCP request", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: "2.0",
+          error: { code: -32603, message: "Internal server error" },
+          id: null
+        });
+      }
+    }
+  });
+  const handleSessionRequest = async (req, res) => {
+    if (!requireAuthorizedRequest(req, res, apiKey)) return;
+    const sessionId = req.headers["mcp-session-id"];
+    if (!sessionId || !isValidSessionId(sessionId) || !transports[sessionId]) {
+      res.status(400).send("Invalid or missing session ID");
+      return;
+    }
+    await transports[sessionId].handleRequest(req, res);
+  };
+  app.get("/mcp", handleSessionRequest);
+  app.delete("/mcp", handleSessionRequest);
+  app.get("/health", (_req, res) => {
+    res.json({
+      status: "healthy",
+      server: ctx.serverName,
+      version: ctx.serverVersion,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      uptime: process.uptime(),
+      activeSessions: Object.keys(transports).length
+    });
+  });
+  return app;
+}
+async function startHttpServer(ctx, createServerFn, options = {}) {
+  const cfg = ctx.config.read();
+  const port = options.port ?? cfg.httpPort;
+  const host = options.host ?? cfg.host;
+  ctx.logger.info("Starting MCP server with HTTP transport", {
+    port,
+    host,
+    name: ctx.serverName,
+    version: ctx.serverVersion
+  });
+  const app = await createHttpApp(ctx, createServerFn, options);
+  await new Promise((resolve, reject) => {
+    const server = app.listen(port, host, (err) => {
+      if (err) reject(err);
+      else {
+        ctx.logger.info("MCP HTTP server started", { port, host });
+        resolve();
+      }
+    });
+    server.on("error", reject);
+  });
+}
+
+exports.assertTransportAuthConfigured = assertTransportAuthConfigured;
+exports.createHttpApp = createHttpApp;
+exports.isAuthorizedRequest = isAuthorizedRequest;
+exports.isValidSessionId = isValidSessionId;
+exports.parseCorsOrigins = parseCorsOrigins;
+exports.requireAuthorizedRequest = requireAuthorizedRequest;
+exports.startHttpServer = startHttpServer;
+exports.startStdioServer = startStdioServer;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/transports/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/transports/stdio.ts","../../src/transports/security.ts","../../src/transports/http.ts"],"names":["StdioServerTransport","isInitializeRequest","StreamableHTTPServerTransport","randomUUID"],"mappings":";;;;;;;;AAgBA,eAAsB,gBAAA,CACpB,MAAA,EACA,GAAA,EACA,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0CAAA,EAA4C;AAAA,IAC1D,MAAM,GAAA,CAAI,UAAA;AAAA,IACV,SAAS,GAAA,CAAI;AAAA,GACd,CAAA;AAED,EAAA,MAAM,SAAA,GAAY,IAAIA,6BAAA,EAAqB;AAC3C,EAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAE9B,EAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0BAA0B,CAAA;AAC5C;;;AClBA,IAAM,kBAAA,GACJ,4EAAA;AAEK,SAAS,iBAAiB,OAAA,EAAkD;AACjF,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,OAAO,OAAA;AAEnC,EAAA,MAAM,KAAA,GAAQ,SAAS,IAAA,EAAK;AAC5B,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,KAAU,GAAA,EAAK;AAC3B,IAAA,OAAO,CAAC,oBAAoB,kBAAkB,CAAA;AAAA,EAChD;AAEA,EAAA,OAAO,KAAA,CACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,MAAA,KAAW,MAAA,CAAO,IAAA,EAAM,CAAA,CAC7B,MAAA,CAAO,OAAO,CAAA;AACnB;AAEO,SAAS,mBAAA,CAAoB,KAAc,MAAA,EAAyB;AACzE,EAAA,OAAO,GAAA,CAAI,QAAQ,aAAA,KAAkB,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,IAAM,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA,KAAM,MAAA;AAC1F;AAEO,SAAS,wBAAA,CACd,GAAA,EACA,GAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8CAA8C,CAAA;AAC5E,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,mBAAA,CAAoB,GAAA,EAAK,MAAM,CAAA,EAAG;AACrC,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,CAAA;AAC9C,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,6BAAA,CACd,WACA,MAAA,EACM;AACN,EAAA,IAAA,CAAK,SAAA,KAAc,KAAA,IAAS,SAAA,KAAc,MAAA,KAAW,CAAC,MAAA,EAAQ;AAC5D,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACF;AAEO,SAAS,iBAAiB,SAAA,EAA4B;AAC3D,EAAA,OAAO,kBAAA,CAAmB,KAAK,SAAS,CAAA;AAC1C;;;ACvBA,eAAsB,aAAA,CACpB,GAAA,EACA,cAAA,EACA,OAAA,GAA6B,EAAC,EACc;AAG5C,EAAA,MAAM,UAAA,GAAc,MAAM,OAAO,SAAgB,CAAA;AAEjD,EAAA,MAAM,OAAA,GAAW,MAAM,OAAO,MAAa,CAAA;AAE3C,EAAA,MAAM,OAAA,GAAU,WAAW,OAAA,IAAW,UAAA;AACtC,EAAA,MAAM,IAAA,GAAO,QAAQ,OAAA,IAAW,OAAA;AAEhC,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,EAAA,MAAM,MAAM,OAAA,EAAQ;AAEpB,EAAA,GAAA,CAAI,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,CAAA;AAEtB,EAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AAChC,IAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,GAAA,CAAI,WAAA;AAC/C,IAAA,GAAA,CAAI,GAAA;AAAA,MACF,IAAA,CAAK;AAAA,QACH,MAAA,EAAQ,iBAAiB,WAAW,CAAA;AAAA,QACpC,cAAA,EAAgB,CAAC,gBAAgB,CAAA;AAAA,QACjC,cAAA,EAAgB,CAAC,cAAA,EAAgB,eAAA,EAAiB,aAAa,gBAAgB;AAAA,OAChF;AAAA,KACH;AAAA,EACF;AAEA,EAAA,MAAM,aAA4D,EAAC;AACnE,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,GAAA,CAAI,MAAA;AAGrC,EAAA,GAAA,CAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,GAAA,EAAU,GAAA,KAAa;AAC7C,IAAA,IAAI,CAAC,wBAAA,CAAyB,GAAA,EAAK,GAAA,EAAK,MAAM,CAAA,EAAG;AAEjD,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,MAAA,IAAI,SAAA;AAEJ,MAAA,IAAI,SAAA,IAAa,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAC7C,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,UACnB,OAAA,EAAS,KAAA;AAAA,UACT,KAAA,EAAO,EAAE,IAAA,EAAM,CAAA,IAAA,EAAQ,SAAS,0CAAA,EAA2C;AAAA,UAC3E,EAAA,EAAI;AAAA,SACL,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,SAAA,IAAa,UAAA,CAAW,SAAS,CAAA,EAAG;AACtC,QAAA,SAAA,GAAY,WAAW,SAAS,CAAA;AAAA,MAClC,WAAW,CAAC,SAAA,IAAaC,4BAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,EAAG;AACtD,QAAA,SAAA,GAAY,IAAIC,+CAAA,CAA8B;AAAA,UAC5C,kBAAA,EAAoB,MAAMC,iBAAA,EAAW;AAAA,UACrC,oBAAA,EAAsB,CAAC,GAAA,KAAQ;AAC7B,YAAA,UAAA,CAAW,GAAG,CAAA,GAAI,SAAA;AAClB,YAAA,GAAA,CAAI,OAAO,IAAA,CAAK,6BAAA,EAA+B,EAAE,SAAA,EAAW,KAAK,CAAA;AAAA,UACnE,CAAA;AAAA,UACA,4BAAA,EAA8B,QAAQ,4BAAA,IAAgC,IAAA;AAAA,UACtE,cAAc,OAAA,CAAQ,YAAA,IAAgB,GAAA,CAAI,YAAA,CAAa,MAAM,GAAG;AAAA,SACjE,CAAA;AAED,QAAA,SAAA,CAAU,UAAU,MAAY;AAC9B,UAAA,IAAI,UAAU,SAAA,EAAW;AACvB,YAAA,OAAO,UAAA,CAAW,UAAU,SAAS,CAAA;AACrC,YAAA,GAAA,CAAI,OAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,SAAA,EAAW,SAAA,CAAU,WAAW,CAAA;AAAA,UAC1E;AAAA,QACF,CAAA;AAEA,QAAA,MAAM,SAAS,cAAA,EAAe;AAC9B,QAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,MAChC,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,UACnB,OAAA,EAAS,KAAA;AAAA,UACT,KAAA,EAAO,EAAE,IAAA,EAAM,CAAA,IAAA,EAAQ,SAAS,2CAAA,EAA4C;AAAA,UAC5E,EAAA,EAAI;AAAA,SACL,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,SAAA,CAAU,aAAA,CAAc,GAAA,EAAK,GAAA,EAAK,IAAI,IAAI,CAAA;AAAA,IAClD,SAAS,KAAA,EAAO;AACd,MAAA,GAAA,CAAI,MAAA,CAAO,MAAM,4BAAA,EAA8B;AAAA,QAC7C,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,OAC7D,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,UACnB,OAAA,EAAS,KAAA;AAAA,UACT,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,uBAAA,EAAwB;AAAA,UACxD,EAAA,EAAI;AAAA,SACL,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAGD,EAAA,MAAM,oBAAA,GAAuB,OAAO,GAAA,EAAU,GAAA,KAA4B;AACxE,IAAA,IAAI,CAAC,wBAAA,CAAyB,GAAA,EAAK,GAAA,EAAK,MAAM,CAAA,EAAG;AACjD,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,IAAA,IAAI,CAAC,aAAa,CAAC,gBAAA,CAAiB,SAAS,CAAA,IAAK,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG;AACxE,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,+BAA+B,CAAA;AACpD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,CAAW,SAAS,CAAA,CAAE,aAAA,CAAc,KAAK,GAAG,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,GAAA,CAAI,GAAA,CAAI,QAAQ,oBAAoB,CAAA;AACpC,EAAA,GAAA,CAAI,MAAA,CAAO,QAAQ,oBAAoB,CAAA;AAGvC,EAAA,GAAA,CAAI,GAAA,CAAI,SAAA,EAAW,CAAC,IAAA,EAAW,GAAA,KAAa;AAC1C,IAAA,GAAA,CAAI,IAAA,CAAK;AAAA,MACP,MAAA,EAAQ,SAAA;AAAA,MACR,QAAQ,GAAA,CAAI,UAAA;AAAA,MACZ,SAAS,GAAA,CAAI,aAAA;AAAA,MACb,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MAClC,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,MACvB,cAAA,EAAgB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE;AAAA,KACzC,CAAA;AAAA,EACH,CAAC,CAAA;AAED,EAAA,OAAO,GAAA;AACT;AAMA,eAAsB,eAAA,CACpB,GAAA,EACA,cAAA,EACA,OAAA,GAA6B,EAAC,EACf;AACf,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,IAAQ,GAAA,CAAI,QAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,IAAA,IAAQ,GAAA,CAAI,IAAA;AAEjC,EAAA,GAAA,CAAI,MAAA,CAAO,KAAK,yCAAA,EAA2C;AAAA,IACzD,IAAA;AAAA,IACA,IAAA;AAAA,IACA,MAAM,GAAA,CAAI,UAAA;AAAA,IACV,SAAS,GAAA,CAAI;AAAA,GACd,CAAA;AAGD,EAAA,MAAM,GAAA,GAAO,MAAM,aAAA,CAAc,GAAA,EAAK,gBAAgB,OAAO,CAAA;AAE7D,EAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,IAAA,MAAM,SAAS,GAAA,CAAI,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,CAAC,GAAA,KAAgB;AACrD,MAAA,IAAI,GAAA,SAAY,GAAG,CAAA;AAAA,WACd;AACH,QAAA,GAAA,CAAI,OAAO,IAAA,CAAK,yBAAA,EAA2B,EAAE,IAAA,EAAM,MAAM,CAAA;AACzD,QAAA,OAAA,EAAQ;AAAA,MACV;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAA,CAAO,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC3B,CAAC,CAAA;AACH","file":"index.cjs","sourcesContent":["/**\n * Stdio transport — connects an existing McpServer over process.stdin/stdout.\n *\n * Stdio reserves stdout for JSON-RPC; ALL diagnostic output must go to stderr.\n * Modules that use ctx.logger are safe; raw console.log is not.\n */\n\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext } from '../core/context.js';\n\nexport interface StdioOptions {\n  /** No-op hook for symmetry with HTTP options. */\n  signal?: AbortSignal;\n}\n\nexport async function startStdioServer(\n  server: McpServer,\n  ctx: McpContext,\n  _opts: StdioOptions = {},\n): Promise<void> {\n  ctx.logger.info('Starting MCP server with stdio transport', {\n    name: ctx.serverName,\n    version: ctx.serverVersion,\n  });\n\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n\n  ctx.logger.info('MCP stdio server started');\n}\n","/**\n * HTTP transport security helpers — ported verbatim from\n * vibecontrols-mcp/src/transports/security.ts.\n *\n * - parseCorsOrigins: comma-separated string → array (defaults to localhost-only)\n * - isAuthorizedRequest: Bearer or X-API-Key header check\n * - requireAuthorizedRequest: 401/503 short-circuit middleware\n * - isValidSessionId: UUID v1-8 pattern guard\n */\n\nimport type { Request, Response } from 'express';\n\nconst SESSION_ID_PATTERN =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nexport function parseCorsOrigins(origins: string | string[] | undefined): string[] {\n  if (Array.isArray(origins)) return origins;\n\n  const value = origins?.trim();\n  if (!value || value === '*') {\n    return ['http://127.0.0.1', 'http://localhost'];\n  }\n\n  return value\n    .split(',')\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n}\n\nexport function isAuthorizedRequest(req: Request, apiKey: string): boolean {\n  return req.headers.authorization === `Bearer ${apiKey}` || req.headers['x-api-key'] === apiKey;\n}\n\nexport function requireAuthorizedRequest(\n  req: Request,\n  res: Response,\n  apiKey: string | undefined,\n): boolean {\n  if (!apiKey) {\n    res.status(503).json({ error: 'Transport authentication is not configured' });\n    return false;\n  }\n\n  if (!isAuthorizedRequest(req, apiKey)) {\n    res.status(401).json({ error: 'Unauthorized' });\n    return false;\n  }\n\n  return true;\n}\n\nexport function assertTransportAuthConfigured(\n  transport: 'stdio' | 'sse' | 'http',\n  apiKey: string | undefined,\n): void {\n  if ((transport === 'sse' || transport === 'http') && !apiKey) {\n    throw new Error('MCP_API_KEY must be configured for HTTP/SSE transports');\n  }\n}\n\nexport function isValidSessionId(sessionId: string): boolean {\n  return SESSION_ID_PATTERN.test(sessionId);\n}\n","/**\n * HTTP transport — Streamable HTTP via Express + CORS.\n *\n * express + cors are OPTIONAL peer deps; we dynamic-import them so stdio-only\n * consumers don't pay the install cost.\n *\n * Ported from vibecontrols-mcp/src/transports/http-simple.ts. Notable:\n *  - DNS-rebinding protection ON by default (don't relax!)\n *  - Per-session UUID transport instances (multi-client multiplex)\n *  - Optional API-key auth (Bearer or X-API-Key)\n *\n * NOTE: each new MCP session re-runs the createServerFn to mint a fresh\n * server instance. The shell passes a factory so each session gets its own\n * registered tools/resources/prompts (current vibecontrols-mcp pattern).\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext } from '../core/context.js';\nimport { isValidSessionId, parseCorsOrigins, requireAuthorizedRequest } from './security.js';\n\nexport interface HttpServerOptions {\n  port?: number;\n  host?: string;\n  apiKey?: string;\n  enableCors?: boolean;\n  corsOrigins?: string | string[];\n  enableDnsRebindingProtection?: boolean;\n  allowedHosts?: string[];\n}\n\nexport type CreateServerFn = () => McpServer;\n\n/**\n * Build an Express app exposing /mcp + /health endpoints. The createServerFn\n * is invoked once per new MCP session.\n */\nexport async function createHttpApp(\n  ctx: McpContext,\n  createServerFn: CreateServerFn,\n  options: HttpServerOptions = {},\n): Promise<unknown /* express.Application */> {\n  // Dynamic-import express + cors so stdio-only consumers don't pay the cost.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const expressMod = (await import('express' as any)) as any;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const corsMod = (await import('cors' as any)) as any;\n\n  const express = expressMod.default ?? expressMod;\n  const cors = corsMod.default ?? corsMod;\n\n  const cfg = ctx.config.read();\n  const app = express();\n\n  app.use(express.json());\n\n  if (options.enableCors !== false) {\n    const corsOrigins = options.corsOrigins ?? cfg.corsOrigins;\n    app.use(\n      cors({\n        origin: parseCorsOrigins(corsOrigins),\n        exposedHeaders: ['Mcp-Session-Id'],\n        allowedHeaders: ['Content-Type', 'Authorization', 'X-API-Key', 'mcp-session-id'],\n      }),\n    );\n  }\n\n  const transports: Record<string, StreamableHTTPServerTransport> = {};\n  const apiKey = options.apiKey ?? cfg.apiKey;\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  app.post('/mcp', async (req: any, res: any) => {\n    if (!requireAuthorizedRequest(req, res, apiKey)) return;\n\n    try {\n      const sessionId = req.headers['mcp-session-id'] as string | undefined;\n      let transport: StreamableHTTPServerTransport;\n\n      if (sessionId && !isValidSessionId(sessionId)) {\n        res.status(400).json({\n          jsonrpc: '2.0',\n          error: { code: -32000, message: 'Bad Request: Invalid session ID provided' },\n          id: null,\n        });\n        return;\n      }\n\n      if (sessionId && transports[sessionId]) {\n        transport = transports[sessionId];\n      } else if (!sessionId && isInitializeRequest(req.body)) {\n        transport = new StreamableHTTPServerTransport({\n          sessionIdGenerator: () => randomUUID(),\n          onsessioninitialized: (sid) => {\n            transports[sid] = transport;\n            ctx.logger.info('New MCP session initialized', { sessionId: sid });\n          },\n          enableDnsRebindingProtection: options.enableDnsRebindingProtection ?? true,\n          allowedHosts: options.allowedHosts ?? cfg.allowedHosts.split(','),\n        });\n\n        transport.onclose = (): void => {\n          if (transport.sessionId) {\n            delete transports[transport.sessionId];\n            ctx.logger.info('MCP session closed', { sessionId: transport.sessionId });\n          }\n        };\n\n        const server = createServerFn();\n        await server.connect(transport);\n      } else {\n        res.status(400).json({\n          jsonrpc: '2.0',\n          error: { code: -32000, message: 'Bad Request: No valid session ID provided' },\n          id: null,\n        });\n        return;\n      }\n\n      await transport.handleRequest(req, res, req.body);\n    } catch (error) {\n      ctx.logger.error('Error handling MCP request', {\n        error: error instanceof Error ? error.message : String(error),\n      });\n      if (!res.headersSent) {\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'Internal server error' },\n          id: null,\n        });\n      }\n    }\n  });\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const handleSessionRequest = async (req: any, res: any): Promise<void> => {\n    if (!requireAuthorizedRequest(req, res, apiKey)) return;\n    const sessionId = req.headers['mcp-session-id'] as string | undefined;\n    if (!sessionId || !isValidSessionId(sessionId) || !transports[sessionId]) {\n      res.status(400).send('Invalid or missing session ID');\n      return;\n    }\n    await transports[sessionId].handleRequest(req, res);\n  };\n\n  app.get('/mcp', handleSessionRequest);\n  app.delete('/mcp', handleSessionRequest);\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  app.get('/health', (_req: any, res: any) => {\n    res.json({\n      status: 'healthy',\n      server: ctx.serverName,\n      version: ctx.serverVersion,\n      timestamp: new Date().toISOString(),\n      uptime: process.uptime(),\n      activeSessions: Object.keys(transports).length,\n    });\n  });\n\n  return app;\n}\n\n/**\n * Start the HTTP transport. The shell passes a factory because each new MCP\n * session needs a fresh server instance with its own per-session state.\n */\nexport async function startHttpServer(\n  ctx: McpContext,\n  createServerFn: CreateServerFn,\n  options: HttpServerOptions = {},\n): Promise<void> {\n  const cfg = ctx.config.read();\n  const port = options.port ?? cfg.httpPort;\n  const host = options.host ?? cfg.host;\n\n  ctx.logger.info('Starting MCP server with HTTP transport', {\n    port,\n    host,\n    name: ctx.serverName,\n    version: ctx.serverVersion,\n  });\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const app = (await createHttpApp(ctx, createServerFn, options)) as any;\n\n  await new Promise<void>((resolve, reject) => {\n    const server = app.listen(port, host, (err?: Error) => {\n      if (err) reject(err);\n      else {\n        ctx.logger.info('MCP HTTP server started', { port, host });\n        resolve();\n      }\n    });\n    server.on('error', reject);\n  });\n}\n"]}

package/dist/transports/index.d.cts

@@ -0,0 +1,13 @@
+export { C as CreateServerFn, H as HttpServerOptions, S as StdioOptions, c as createHttpApp, s as startHttpServer, a as startStdioServer } from '../http-BP4c721D.cjs';
+import { Request, Response } from 'express';
+import '@modelcontextprotocol/sdk/server/mcp.js';
+import '../context-1jV4NsLv.cjs';
+import 'graphql-request';
+
+declare function parseCorsOrigins(origins: string | string[] | undefined): string[];
+declare function isAuthorizedRequest(req: Request, apiKey: string): boolean;
+declare function requireAuthorizedRequest(req: Request, res: Response, apiKey: string | undefined): boolean;
+declare function assertTransportAuthConfigured(transport: 'stdio' | 'sse' | 'http', apiKey: string | undefined): void;
+declare function isValidSessionId(sessionId: string): boolean;
+
+export { assertTransportAuthConfigured, isAuthorizedRequest, isValidSessionId, parseCorsOrigins, requireAuthorizedRequest };

package/dist/transports/index.d.ts

@@ -0,0 +1,13 @@
+export { C as CreateServerFn, H as HttpServerOptions, S as StdioOptions, c as createHttpApp, s as startHttpServer, a as startStdioServer } from '../http-DXTeCD5r.js';
+import { Request, Response } from 'express';
+import '@modelcontextprotocol/sdk/server/mcp.js';
+import '../context-1jV4NsLv.js';
+import 'graphql-request';
+
+declare function parseCorsOrigins(origins: string | string[] | undefined): string[];
+declare function isAuthorizedRequest(req: Request, apiKey: string): boolean;
+declare function requireAuthorizedRequest(req: Request, res: Response, apiKey: string | undefined): boolean;
+declare function assertTransportAuthConfigured(transport: 'stdio' | 'sse' | 'http', apiKey: string | undefined): void;
+declare function isValidSessionId(sessionId: string): boolean;
+
+export { assertTransportAuthConfigured, isAuthorizedRequest, isValidSessionId, parseCorsOrigins, requireAuthorizedRequest };

package/dist/transports/index.js

@@ -0,0 +1,3 @@
+export { assertTransportAuthConfigured, createHttpApp, isAuthorizedRequest, isValidSessionId, parseCorsOrigins, requireAuthorizedRequest, startHttpServer, startStdioServer } from '../chunk-JFEQYSWM.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/transports/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/package.json

@@ -0,0 +1,125 @@
+{
+  "name": "@burdenoff/mcp-libs",
+  "version": "2026.511.1",
+  "description": "Modular MCP SDK shared across all Burdenoff product MCPs (vibecontrols, botlit, fluidgrids, bigconsole, healthybowl, workspaces). Each module exports an McpModule contract; product MCPs become thin shells that pick which modules to mount.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js",
+      "require": "./dist/core/index.cjs"
+    },
+    "./transports": {
+      "types": "./dist/transports/index.d.ts",
+      "import": "./dist/transports/index.js",
+      "require": "./dist/transports/index.cjs"
+    },
+    "./modules/*": {
+      "types": "./dist/modules/*/index.d.ts",
+      "import": "./dist/modules/*/index.js",
+      "require": "./dist/modules/*/index.cjs"
+    }
+  },
+  "scripts": {
+    "dev": "tsup --watch",
+    "build": "tsup",
+    "type-check": "tsc --noEmit",
+    "lint": "eslint src --fix",
+    "lint:check": "eslint src",
+    "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint:check; else bun run lint:check -- --cache --cache-location .eslintcache; fi",
+    "format": "prettier --write \"src/**/*.{ts,js,json,md}\" \"tests/**/*.{ts,js}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,js,json,md}\" \"tests/**/*.{ts,js}\"",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "clean": "rimraf dist .eslintcache",
+    "sanity": "bun run format:check && bun run lint:sanity && bun run type-check && bun run build && bun run test",
+    "prepublishOnly": "bun run clean && bun run build",
+    "publish:verdaccio": "bun run build && bunx npm@latest publish --tag alpha --access restricted",
+    "publish:verdaccio:latest": "bun run build && bunx npm@latest publish --tag latest --access restricted"
+  },
+  "keywords": [
+    "burdenoff",
+    "mcp",
+    "model-context-protocol",
+    "mcp-sdk",
+    "modular",
+    "graphql"
+  ],
+  "author": {
+    "name": "Vignesh T.V",
+    "email": "vignesh@burdenoff.com",
+    "url": "https://github.com/tvvignesh"
+  },
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/algoshred/mcp-libs.git"
+  },
+  "bugs": {
+    "url": "https://github.com/algoshred/mcp-libs/issues"
+  },
+  "homepage": "https://github.com/algoshred/mcp-libs#readme",
+  "publishConfig": {
+    "access": "restricted",
+    "registry": "https://verdaccio.tooling.internal.burdenoff.com/"
+  },
+  "dependencies": {
+    "cross-fetch": "^4.1.0"
+  },
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "graphql": "^16.0.0",
+    "graphql-request": "^7.0.0",
+    "zod": "^3.25.0"
+  },
+  "peerDependenciesMeta": {
+    "express": {
+      "optional": true
+    },
+    "cors": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "@types/cors": "^2.8.17",
+    "@types/express": "^5.0.0",
+    "@types/node": "^24.12.2",
+    "@typescript-eslint/eslint-plugin": "^8.58.0",
+    "@typescript-eslint/parser": "^8.58.0",
+    "@vitest/coverage-v8": "^3.2.4",
+    "cors": "^2.8.6",
+    "eslint": "^9.39.4",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.5",
+    "express": "^5.2.1",
+    "globals": "^16.5.0",
+    "graphql": "^16.13.2",
+    "graphql-request": "^7.4.0",
+    "prettier": "^3.8.1",
+    "rimraf": "^6.1.3",
+    "tsup": "^8.5.1",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4",
+    "zod": "^3.25.76"
+  },
+  "engines": {
+    "node": ">=24.11.0",
+    "bun": ">=1.3.10"
+  }
+}