@casys/mcp-erpnext 2.5.0 → 2.6.0

package/README.md

@@ -1,3 +1,5 @@
+English | [繁體中文](README.zh-TW.md)
+
 # @casys/mcp-erpnext
 
 [![JSR](https://jsr.io/badges/@casys/mcp-erpnext)](https://jsr.io/@casys/mcp-erpnext)
@@ -6,7 +8,7 @@
 [![MCP](https://img.shields.io/badge/MCP-server-1f6feb?logo=modelcontextprotocol&logoColor=white)](https://modelcontextprotocol.io)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-MCP server for [ERPNext](https://erpnext.com) / Frappe ERP — **123 tools**
+MCP server for [ERPNext](https://erpnext.com) / Frappe ERP — **124 tools**
 across **14 categories**, with **7 interactive UI viewers**.
 
 Connect any MCP-compatible AI agent (Claude Desktop, Claude Code, VS Code
@@ -239,9 +241,9 @@ npm install
 node build-all.mjs
 ```
 
-## Tools (123)
+## Tools (124)
 
-123 tools across 14 categories. Each `_list` tool returns interactive results
+124 tools across 14 categories. Each `_list` tool returns interactive results
 via the doclist-viewer with row click, inline detail, and cross-viewer
 navigation.
 
@@ -258,8 +260,8 @@ navigation.
 - **Manufacturing** (7) — BOMs, Work Orders, and Job Cards.
 - **CRM** (8) — Leads, Opportunities, Contacts, and Campaigns.
 - **Assets** (8) — Assets, Movements, Maintenance records, and Categories.
-- **Operations** (9) — Generic CRUD and native assignment for any DocType
-  (`erpnext_doc_*`).
+- **Operations** (10) — Generic CRUD, native assignment, and file upload for any
+  DocType (`erpnext_doc_*`, `erpnext_file_upload`).
 - **Kanban** (2) — Read-write boards for Task, Opportunity, and Issue with
   drag-and-drop.
 - **Analytics** (17) — 11 analytics charts (bar, area, treemap, radar, scatter,
@@ -270,11 +272,12 @@ Full per-tool reference with parameters: [`docs/tools.md`](docs/tools.md).
 
 ## Environment Variables
 
-| Variable             | Required | Description                                                                                                   |
-| -------------------- | -------- | ------------------------------------------------------------------------------------------------------------- |
-| `ERPNEXT_URL`        | Yes      | ERPNext base URL — self-hosted (e.g. `http://localhost:8000`) or cloud (e.g. `https://mycompany.erpnext.com`) |
-| `ERPNEXT_API_KEY`    | Yes      | API Key from User Settings                                                                                    |
-| `ERPNEXT_API_SECRET` | Yes      | API Secret from User Settings                                                                                 |
+| Variable                   | Required | Description                                                                                                   |
+| -------------------------- | -------- | ------------------------------------------------------------------------------------------------------------- |
+| `ERPNEXT_URL`              | Yes      | ERPNext base URL — self-hosted (e.g. `http://localhost:8000`) or cloud (e.g. `https://mycompany.erpnext.com`) |
+| `ERPNEXT_API_KEY`          | Yes      | API Key from User Settings                                                                                    |
+| `ERPNEXT_API_SECRET`       | Yes      | API Secret from User Settings                                                                                 |
+| `ERPNEXT_MAX_UPLOAD_BYTES` | No       | Maximum decoded file-upload size in bytes (positive integer; default: 10 MiB)                                 |
 
 ## Architecture
 
@@ -301,7 +304,7 @@ src/
     manufacturing.ts  # 7 manufacturing tools
     crm.ts            # 8 CRM tools
     assets.ts         # 8 asset tools
-    operations.ts     # 9 generic CRUD tools
+    operations.ts     # 10 generic operations tools
     setup.ts          # 3 company/setup tools
     kanban.ts         # 2 read-write kanban tools
     analytics.ts      # 17 analytics tools (charts, KPIs, funnel)

package/mcp-erpnext.mjs

@@ -34542,7 +34542,7 @@ function isCloudflareWorkers() {
 var USER_AGENT;
 if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
   const NAME = "jose";
-  const VERSION2 = "v6.2.3";
+  const VERSION2 = "v6.2.4";
   USER_AGENT = `${NAME}/${VERSION2}`;
 }
 var customFetch = Symbol();
@@ -37314,6 +37314,65 @@ function defaultHumanName(name) {
   return name.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
 }
 
+// node_modules/@casys/mcp-server/src/auth/static-token-provider.ts
+var StaticTokenAuthProvider = class extends AuthProvider {
+  tokens;
+  authInfo;
+  resource;
+  resourceMetadataUrl;
+  scopesSupported;
+  constructor(tokens, options) {
+    super();
+    if (tokens.length === 0) {
+      throw new Error(
+        "[StaticTokenAuthProvider] `tokens` must contain at least one token"
+      );
+    }
+    if (tokens.some((t) => t.trim().length === 0)) {
+      throw new Error(
+        "[StaticTokenAuthProvider] `tokens` must not contain empty entries"
+      );
+    }
+    if (!options.resource?.trim()) {
+      throw new Error("[StaticTokenAuthProvider] `resource` is required");
+    }
+    const resourceUrl = httpsUrl(options.resource);
+    this.tokens = new Set(tokens.map((t) => t.trim()));
+    const scopes = Object.freeze([...options.scopes ?? []]);
+    this.authInfo = Object.freeze({
+      subject: options.subject ?? "static-token-user",
+      scopes
+    });
+    this.resource = options.resource;
+    this.scopesSupported = options.scopesSupported ? Object.freeze([...options.scopesSupported]) : scopes.length > 0 ? scopes : void 0;
+    if (options.resourceMetadataUrl?.trim()) {
+      this.resourceMetadataUrl = httpsUrl(options.resourceMetadataUrl);
+    } else {
+      const parsed = new URL(resourceUrl);
+      const pathPart = parsed.pathname === "/" ? "" : parsed.pathname;
+      this.resourceMetadataUrl = httpsUrl(
+        `${parsed.origin}/.well-known/oauth-protected-resource${pathPart}${parsed.search}`
+      );
+    }
+  }
+  async verifyToken(token) {
+    return this.tokens.has(token.trim()) ? this.authInfo : null;
+  }
+  getResourceMetadata() {
+    return {
+      resource: this.resource,
+      resource_metadata_url: this.resourceMetadataUrl,
+      // No authorization server: static tokens are provisioned out of band.
+      authorization_servers: [],
+      scopes_supported: this.scopesSupported,
+      bearer_methods_supported: ["header"]
+    };
+  }
+};
+function createStaticTokenAuthProvider(tokens, options) {
+  return new StaticTokenAuthProvider(tokens, options);
+}
+
 // node_modules/@casys/mcp-server/src/inspector/launcher.ts
 async function launchInspector(serverCommand, serverArgs, options) {
   const { spawn } = await import("node:child_process");
@@ -37480,6 +37539,34 @@ function stableStringify(value) {
 }
 var DEFAULT_RETRY_STATUSES = [408, 429, 502, 503, 504];
 var DEFAULT_RETRY_METHODS = ["GET"];
+var DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+function decodeBase64File(contentBase64, maxBytes) {
+  if (contentBase64.length === 0) {
+    throw new Error("[FrappeClient] File content must not be empty");
+  }
+  const unpadded = contentBase64.replace(/=+$/, "");
+  const padding = contentBase64.slice(unpadded.length);
+  if (!/^[A-Za-z0-9+/]+$/.test(unpadded) || !/^={0,2}$/.test(padding) || unpadded.length % 4 === 1) {
+    throw new Error("[FrappeClient] File content must be valid base64");
+  }
+  const decodedSize = Math.floor(unpadded.length * 6 / 8);
+  if (decodedSize > maxBytes) {
+    throw new Error(
+      `[FrappeClient] Decoded file size ${decodedSize} bytes exceeds the ${maxBytes}-byte upload limit`
+    );
+  }
+  const normalized = unpadded + "=".repeat((4 - unpadded.length % 4) % 4);
+  let binary;
+  try {
+    binary = atob(normalized);
+  } catch {
+    throw new Error("[FrappeClient] File content must be valid base64");
+  }
+  if (binary.length === 0) {
+    throw new Error("[FrappeClient] File content must not be empty");
+  }
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
 var FrappeAPIError = class extends Error {
   /**
    * @param message - Human-readable error description
@@ -37537,6 +37624,7 @@ var FrappeClient = class {
   baseUrl;
   authHeader;
   timeoutMs;
+  maxUploadBytes;
   retries;
   retryStatuses;
   retryBackoffMs;
@@ -37546,6 +37634,12 @@ var FrappeClient = class {
     this.baseUrl = config2.baseUrl.replace(/\/$/, "");
     this.authHeader = `token ${config2.apiKey}:${config2.apiSecret}`;
     this.timeoutMs = config2.timeoutMs ?? 3e4;
+    this.maxUploadBytes = config2.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+    if (!Number.isInteger(this.maxUploadBytes) || this.maxUploadBytes <= 0) {
+      throw new Error(
+        "[FrappeClient] maxUploadBytes must be a positive integer"
+      );
+    }
     this.retries = config2.retries ?? 3;
     this.retryStatuses = config2.retryStatuses ?? DEFAULT_RETRY_STATUSES;
     this.retryBackoffMs = config2.retryBackoffMs ?? 200;
@@ -37553,12 +37647,15 @@ var FrappeClient = class {
     this.cache = config2.cache ?? new MemoryCache();
   }
   // ── Private HTTP helpers ────────────────────────────────────────────────────
-  buildHeaders() {
-    return {
+  buildHeaders(includeJsonContentType = true) {
+    const headers = {
       "Authorization": this.authHeader,
-      "Accept": "application/json",
-      "Content-Type": "application/json"
+      "Accept": "application/json"
     };
+    if (includeJsonContentType) {
+      headers["Content-Type"] = "application/json";
+    }
+    return headers;
   }
   /**
    * Decide whether an error is worth retrying.
@@ -37578,11 +37675,11 @@ var FrappeClient = class {
     }
     return this.retryBackoffMs * 2 ** attempt;
   }
-  async request(method, path, body) {
+  async request(method, path, body, multipart = false) {
     let lastError;
     for (let attempt = 0; attempt <= this.retries; attempt++) {
       try {
-        return await this.requestOnce(method, path, body);
+        return await this.requestOnce(method, path, body, multipart);
       } catch (err) {
         lastError = err;
         if (attempt === this.retries || !this.isRetryable(err, method)) {
@@ -37596,7 +37693,7 @@ var FrappeClient = class {
     }
     throw lastError;
   }
-  async requestOnce(method, path, body) {
+  async requestOnce(method, path, body, multipart = false) {
     const url = `${this.baseUrl}${path}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
@@ -37604,8 +37701,8 @@ var FrappeClient = class {
     try {
       response = await fetch(url, {
         method,
-        headers: this.buildHeaders(),
-        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        headers: this.buildHeaders(!multipart),
+        body: body === void 0 ? void 0 : multipart ? body : JSON.stringify(body),
         signal: controller.signal
       });
     } catch (err) {
@@ -37778,6 +37875,56 @@ var FrappeClient = class {
     );
     this.invalidate(doctype, name);
   }
+  /**
+   * Upload file bytes and attach the native File document to another document.
+   * POST /api/method/upload_file
+   */
+  async uploadFile(input) {
+    const fileName = input.fileName.trim();
+    const attachedToDoctype = input.attachedToDoctype.trim();
+    const attachedToName = input.attachedToName.trim();
+    const attachedToField = input.attachedToField?.trim();
+    if (!fileName || /[\\/\0]/.test(fileName)) {
+      throw new Error(
+        "[FrappeClient] fileName must be a filename without path separators"
+      );
+    }
+    if (!attachedToDoctype) {
+      throw new Error("[FrappeClient] attachedToDoctype must not be empty");
+    }
+    if (!attachedToName) {
+      throw new Error("[FrappeClient] attachedToName must not be empty");
+    }
+    const bytes = decodeBase64File(
+      input.contentBase64,
+      this.maxUploadBytes
+    );
+    const fileBuffer = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(fileBuffer).set(bytes);
+    const form = new FormData();
+    form.append("file", new Blob([fileBuffer]), fileName);
+    form.append("doctype", attachedToDoctype);
+    form.append("docname", attachedToName);
+    if (attachedToField) {
+      form.append("fieldname", attachedToField);
+    }
+    form.append("is_private", input.isPrivate === false ? "0" : "1");
+    const res = await this.request(
+      "POST",
+      "/api/method/upload_file",
+      form,
+      true
+    );
+    const file = res.message;
+    this.invalidate("File", file.name);
+    this.invalidate(attachedToDoctype, attachedToName);
+    if (attachedToField) {
+      await this.update(attachedToDoctype, attachedToName, {
+        [attachedToField]: file.file_url
+      });
+    }
+    return file;
+  }
   /**
    * Call a whitelisted Frappe method.
    * POST /api/method/{method}
@@ -37797,6 +37944,7 @@ function getFrappeClient() {
   const url = env6("ERPNEXT_URL");
   const apiKey = env6("ERPNEXT_API_KEY");
   const apiSecret = env6("ERPNEXT_API_SECRET");
+  const maxUploadBytesRaw = env6("ERPNEXT_MAX_UPLOAD_BYTES");
   if (!url) {
     throw new Error(
       "[lib/erpnext] ERPNEXT_URL is required. Set it to your ERPNext instance URL, e.g. http://localhost:8000"
@@ -37811,7 +37959,8 @@ function getFrappeClient() {
     baseUrl: url,
     apiKey,
     apiSecret,
-    cache: getCache()
+    cache: getCache(),
+    maxUploadBytes: maxUploadBytesRaw?.trim() ? Number(maxUploadBytesRaw) : void 0
   });
   return _client;
 }
@@ -37899,6 +38048,23 @@ async function resolveDynamicLink(client, targetDoctype, identifier, options = {
   return resolveLink(client, targetDoctype, identifier, searchField, options);
 }
 
+// src/tools/submit-helpers.ts
+function withRoundedTotalFallback(doc) {
+  const hasNullRoundedTotal = "base_rounded_total" in doc && doc.base_rounded_total == null || "rounded_total" in doc && doc.rounded_total == null;
+  if (!hasNullRoundedTotal || doc.disable_rounded_total) {
+    return doc;
+  }
+  return { ...doc, disable_rounded_total: 1 };
+}
+function roundedTotalFallbackWarning(original, patched) {
+  if (patched.disable_rounded_total === 1 && original.disable_rounded_total !== 1) {
+    return [
+      "disable_rounded_total auto-set \u2014 rounded totals were null (rounding not configured on this instance)"
+    ];
+  }
+  return [];
+}
+
 // src/tools/sales.ts
 function mapLineItems(items, options) {
   if (!Array.isArray(items) || items.length === 0) {
@@ -38339,13 +38505,20 @@ var salesTools = [
       if (!input.name) {
         throw new Error("[erpnext_sales_order_submit] 'name' is required");
       }
-      const doc = await ctx.client.get("Sales Order", input.name);
+      const doc = await ctx.client.get("Sales Order", input.name, {
+        skipCache: true
+      });
+      const docWithDoctype = { ...doc, doctype: "Sales Order" };
+      const patchedDoc = withRoundedTotalFallback(docWithDoctype);
       const result = await ctx.client.callMethod("frappe.client.submit", {
-        doc: { ...doc, doctype: "Sales Order" }
+        doc: patchedDoc
       });
+      ctx.client.invalidate("Sales Order", input.name);
+      const warnings = roundedTotalFallbackWarning(docWithDoctype, patchedDoc);
       return {
         data: result,
-        message: `Sales Order ${input.name} submitted successfully`
+        message: `Sales Order ${input.name} submitted successfully`,
+        ...warnings.length > 0 ? { warnings } : {}
       };
     }
   },
@@ -38372,6 +38545,7 @@ var salesTools = [
         doctype: "Sales Order",
         name: input.name
       });
+      ctx.client.invalidate("Sales Order", input.name);
       return {
         data: result,
         message: `Sales Order ${input.name} cancelled successfully`
@@ -38578,14 +38752,21 @@ var salesTools = [
       if (!input.name) {
         throw new Error("[erpnext_sales_invoice_submit] 'name' is required");
       }
-      const doc = await ctx.client.get("Sales Invoice", input.name);
+      const doc = await ctx.client.get("Sales Invoice", input.name, {
+        skipCache: true
+      });
+      const docWithDoctype = { ...doc, doctype: "Sales Invoice" };
+      const patchedDoc = withRoundedTotalFallback(docWithDoctype);
       const result = await ctx.client.callMethod("frappe.client.submit", {
-        doc: { ...doc, doctype: "Sales Invoice" }
+        doc: patchedDoc
       });
+      ctx.client.invalidate("Sales Invoice", input.name);
+      const warnings = roundedTotalFallbackWarning(docWithDoctype, patchedDoc);
       return {
         data: result,
         message: `Sales Invoice ${input.name} submitted successfully`,
-        _meta: INVOICE_META
+        _meta: INVOICE_META,
+        ...warnings.length > 0 ? { warnings } : {}
       };
     }
   },
@@ -42642,6 +42823,94 @@ var assetsTools = [
 
 // src/tools/operations.ts
 var operationsTools = [
+  // ── File Attachments ───────────────────────────────────────────────────────
+  {
+    name: "erpnext_file_upload",
+    annotations: { destructiveHint: true },
+    description: "Upload base64-encoded file content and attach it to any ERPNext document. Files are private by default.",
+    category: "operations",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file_name: {
+          type: "string",
+          description: "Filename only, without a path.",
+          minLength: 1
+        },
+        content_base64: {
+          type: "string",
+          description: "File content as standard base64 (not a data URL).",
+          minLength: 1
+        },
+        attached_to_doctype: {
+          type: "string",
+          description: "DocType of the document to attach the file to.",
+          minLength: 1
+        },
+        attached_to_name: {
+          type: "string",
+          description: "Name/ID of the document to attach the file to.",
+          minLength: 1
+        },
+        attached_to_field: {
+          type: "string",
+          description: "Optional Attach or Attach Image field to populate with the uploaded file."
+        },
+        is_private: {
+          type: "boolean",
+          description: "Whether the attachment is private. Defaults to true.",
+          default: true
+        }
+      },
+      required: [
+        "file_name",
+        "content_base64",
+        "attached_to_doctype",
+        "attached_to_name"
+      ]
+    },
+    handler: async (input, ctx) => {
+      const requiredStrings = [
+        "file_name",
+        "content_base64",
+        "attached_to_doctype",
+        "attached_to_name"
+      ];
+      for (const field of requiredStrings) {
+        if (typeof input[field] !== "string" || !input[field].trim()) {
+          throw new Error(
+            `[erpnext_file_upload] '${field}' must be a non-empty string`
+          );
+        }
+      }
+      const fileName = input.file_name;
+      if (/[\\/\0]/.test(fileName)) {
+        throw new Error(
+          "[erpnext_file_upload] 'file_name' must be a filename without a path"
+        );
+      }
+      if (input.is_private !== void 0 && typeof input.is_private !== "boolean") {
+        throw new Error("[erpnext_file_upload] 'is_private' must be a boolean");
+      }
+      if (input.attached_to_field !== void 0 && (typeof input.attached_to_field !== "string" || !input.attached_to_field.trim())) {
+        throw new Error(
+          "[erpnext_file_upload] 'attached_to_field' must be a non-empty string"
+        );
+      }
+      const file = await ctx.client.uploadFile({
+        fileName,
+        contentBase64: input.content_base64,
+        attachedToDoctype: input.attached_to_doctype,
+        attachedToName: input.attached_to_name,
+        ...input.attached_to_field !== void 0 ? { attachedToField: input.attached_to_field.trim() } : {},
+        isPrivate: input.is_private === void 0 ? true : input.is_private
+      });
+      return {
+        data: file,
+        message: `${fileName} attached to ${input.attached_to_doctype} ${input.attached_to_name}`
+      };
+    }
+  },
   // ── Generic Create ──────────────────────────────────────────────────────────
   {
     name: "erpnext_doc_create",
@@ -42796,15 +43065,19 @@ var operationsTools = [
         input.name,
         { skipCache: true }
       );
+      const docWithDoctype = { ...doc, doctype: input.doctype };
+      const patchedDoc = withRoundedTotalFallback(docWithDoctype);
       const result = await ctx.client.callMethod("frappe.client.submit", {
-        doc: { ...doc, doctype: input.doctype }
+        doc: patchedDoc
       });
       ctx.client.invalidate(input.doctype, input.name);
+      const warnings = roundedTotalFallbackWarning(docWithDoctype, patchedDoc);
       return {
         data: result,
         message: `${input.doctype} ${input.name} submitted successfully`,
         doctype: input.doctype,
-        name: input.name
+        name: input.name,
+        ...warnings.length > 0 ? { warnings } : {}
       };
     }
   },
@@ -45832,6 +46105,121 @@ function resolveViewerDistPath2(moduleUrl, viewerName, exists) {
   return null;
 }
 
+// src/auth/composite-provider.ts
+var CompositeAuthProvider = class extends AuthProvider {
+  constructor(providers) {
+    super();
+    this.providers = providers;
+    if (providers.length === 0) {
+      throw new Error(
+        "[CompositeAuthProvider] at least one provider is required"
+      );
+    }
+  }
+  async verifyToken(token) {
+    for (const provider of this.providers) {
+      const info = await provider.verifyToken(token);
+      if (info) return info;
+    }
+    return null;
+  }
+  getResourceMetadata() {
+    const metadata = this.providers.map(
+      (provider) => provider.getResourceMetadata()
+    );
+    const primary = metadata[0];
+    const scopesSupported = [
+      ...new Set(metadata.flatMap((item) => item.scopes_supported ?? []))
+    ];
+    return {
+      ...primary,
+      authorization_servers: [
+        ...new Set(metadata.flatMap((item) => item.authorization_servers))
+      ],
+      ...scopesSupported.length > 0 ? { scopes_supported: scopesSupported } : {},
+      bearer_methods_supported: [
+        ...new Set(
+          metadata.flatMap((item) => item.bearer_methods_supported)
+        )
+      ]
+    };
+  }
+};
+
+// src/auth/config.ts
+function unquote(value) {
+  if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function optionalEnvValue(value) {
+  const trimmed = value?.trim();
+  return trimmed ? unquote(trimmed) : void 0;
+}
+function loadAuthConfig2() {
+  const single = optionalEnvValue(env6("MCP_AUTH_TOKEN"));
+  const multi = env6("MCP_AUTH_TOKENS");
+  const jwksUrl = optionalEnvValue(env6("MCP_OAUTH_JWKS_URL"));
+  const tokens = /* @__PURE__ */ new Set();
+  if (single) tokens.add(single);
+  if (multi) {
+    for (const t of multi.split(",")) {
+      const token = optionalEnvValue(t);
+      if (token) tokens.add(token);
+    }
+  }
+  if (tokens.size === 0 && !jwksUrl) return null;
+  return {
+    tokens,
+    resource: optionalEnvValue(env6("MCP_AUTH_RESOURCE")),
+    jwksUrl,
+    audience: optionalEnvValue(env6("MCP_OAUTH_AUDIENCE")),
+    issuer: optionalEnvValue(env6("MCP_OAUTH_ISSUER"))
+  };
+}
+function buildAuthProvider(config2) {
+  const providers = [];
+  if (config2.tokens.size > 0) {
+    if (!config2.resource) {
+      throw new Error(
+        "[mcp-erpnext] MCP_AUTH_RESOURCE is required alongside MCP_AUTH_TOKEN(S) \u2014 set it to this server's public URL, e.g. https://mcp.example.com"
+      );
+    }
+    providers.push(
+      createStaticTokenAuthProvider([...config2.tokens], {
+        resource: config2.resource
+      })
+    );
+  }
+  if (config2.jwksUrl) {
+    if (!config2.issuer) {
+      throw new Error(
+        "[mcp-erpnext] MCP_OAUTH_ISSUER is required alongside MCP_OAUTH_JWKS_URL"
+      );
+    }
+    if (!config2.audience) {
+      throw new Error(
+        "[mcp-erpnext] MCP_OAUTH_AUDIENCE is required alongside MCP_OAUTH_JWKS_URL"
+      );
+    }
+    if (!config2.resource) {
+      throw new Error(
+        "[mcp-erpnext] MCP_AUTH_RESOURCE is required alongside MCP_OAUTH_JWKS_URL"
+      );
+    }
+    providers.push(
+      createOIDCAuthProvider({
+        issuer: config2.issuer,
+        audience: config2.audience,
+        jwksUri: config2.jwksUrl,
+        resource: config2.resource
+      })
+    );
+  }
+  return providers.length === 1 ? providers[0] : new CompositeAuthProvider(providers);
+}
+
 // src/cache/warm.ts
 async function warmCache() {
   const configured = env6("MCP_CACHE_WARM_TOOLS");
@@ -45863,6 +46251,22 @@ async function warmCache() {
   }
 }
 
+// src/auth/resource-metadata-route.ts
+var ROOT_METADATA_PATH = "/.well-known/oauth-protected-resource";
+function resourceMetadataRoute(provider) {
+  const metadata = provider.getResourceMetadata();
+  const path = new URL(metadata.resource_metadata_url).pathname;
+  if (path === ROOT_METADATA_PATH) return void 0;
+  return {
+    method: "get",
+    path,
+    handler: () => jsonMetadata(metadata)
+  };
+}
+function jsonMetadata(metadata) {
+  return Response.json(metadata);
+}
+
 // server.ts
 var DEFAULT_HTTP_PORT = 3012;
 async function main() {
@@ -45882,15 +46286,19 @@ async function main() {
   const httpPort = portArg ? parseInt(portArg.split("=")[1], 10) : DEFAULT_HTTP_PORT;
   const hostnameArg = args.find((arg) => arg.startsWith("--hostname="));
   const hostname = hostnameArg ? hostnameArg.split("=")[1] : "127.0.0.1";
+  const authConfig = httpFlag ? loadAuthConfig2() : null;
+  const authProvider = authConfig ? buildAuthProvider(authConfig) : void 0;
+  const authMetadataRoute = authProvider ? resourceMetadataRoute(authProvider) : void 0;
   const toolsClient = new ErpNextToolsClient(
     categories ? { categories } : void 0
   );
   const server = new McpApp({
     name: "mcp-erpnext",
-    version: "2.5.0",
+    version: "2.6.0",
     maxConcurrent: 10,
     backpressureStrategy: "queue",
     validateSchema: true,
+    auth: authProvider ? { provider: authProvider } : void 0,
     logger: (msg) => console.error(`[mcp-erpnext] ${msg}`),
     toolErrorMapper: (error2) => {
       if (error2 instanceof FrappeAPIError) return error2.message;
@@ -45939,23 +46347,39 @@ async function main() {
     const isLoopback = hostname === "127.0.0.1" || hostname === "::1" || hostname === "localhost";
     if (!isLoopback) {
       console.error(
-        `[mcp-erpnext] WARNING: binding to ${hostname} exposes the HTTP server to the network. Every tool acts with the server's ERPNext API key, so restrict access (firewall, private network, or an authenticating reverse proxy).`
+        `[mcp-erpnext] WARNING: binding to ${hostname} exposes the HTTP server to the network. Every tool acts with the server's ERPNext API key, so restrict access (firewall, private network) or configure auth via MCP_AUTH_TOKEN(S)/MCP_OAUTH_JWKS_URL.`
+      );
+    }
+    onSignal3("SIGINT", () => {
+      console.error("[mcp-erpnext] Shutting down...");
+      exit3(0);
+    });
+    if (!authConfig) {
+      console.error(
+        "[mcp-erpnext] WARNING: No auth configured for HTTP mode. Set MCP_AUTH_TOKEN, MCP_AUTH_TOKENS, or MCP_OAUTH_JWKS_URL to restrict access."
       );
     }
     await server.startHttp({
       port: httpPort,
       hostname,
       cors: true,
+      customRoutes: authMetadataRoute ? [authMetadataRoute] : void 0,
       onListen: (info) => {
         console.error(
-          `[mcp-erpnext] HTTP server listening on http://${info.hostname}:${info.port}`
+          `[mcp-erpnext] HTTP server listening${authConfig ? "" : " (unauthenticated)"} on http://${info.hostname}:${info.port}`
         );
+        if (authConfig) {
+          const authMethods = [];
+          if (authConfig.tokens.size > 0) {
+            authMethods.push(`static tokens (${authConfig.tokens.size})`);
+          }
+          if (authConfig.jwksUrl) {
+            authMethods.push(`OAuth JWT JWKS (${authConfig.jwksUrl})`);
+          }
+          console.error(`[mcp-erpnext] Auth: ${authMethods.join(", ")}`);
+        }
       }
     });
-    onSignal3("SIGINT", () => {
-      console.error("[mcp-erpnext] Shutting down...");
-      exit3(0);
-    });
   } else {
     await server.start();
     console.error("[mcp-erpnext] stdio mode ready");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casys/mcp-erpnext",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "MCP server for ERPNext with interactive UI viewers",
   "type": "module",
   "bin": {