@chkp/documentation-mcp 1.4.3 → 1.4.5

package/README.md

@@ -196,6 +196,40 @@ Add the configuration as Claude Desktop App.
   
 ---
 
+## HTTP Transport
+
+By default, this server uses **stdio** transport, which is the standard mode for MCP clients like Claude Desktop and Cursor. For hosted or multi-user deployments, an **HTTP transport** (MCP Streamable HTTP) is also available.
+
+> **Security notice before you continue:** The HTTP server has no built-in authentication and no TLS. Any client that can reach the port can establish a session, and credentials travel in cleartext. Only use HTTP transport behind an authenticated reverse proxy (nginx, Caddy, a cloud load balancer) that terminates TLS and enforces authentication. If you are running the server on the same machine as your MCP client, use the default stdio transport — it has none of these concerns.
+
+### Starting the server in HTTP mode
+
+```bash
+MCP_TRANSPORT_TYPE=http MCP_TRANSPORT_PORT=3000 npx @chkp/documentation-mcp
+# or
+npx @chkp/documentation-mcp --transport http --transport-port 3000
+```
+
+The server exposes:
+- `POST/GET/DELETE /mcp` — MCP protocol endpoint
+- `GET /health` — server status (active session count, version)
+
+### Connecting an MCP client
+
+Point your MCP client at `http://<host>:3000/mcp`. Example for Claude Desktop (`claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "checkpoint-documentation-tool": {
+      "url": "http://localhost:3000/mcp"
+    }
+  }
+}
+```
+
+---
+
 ## Development
 
 ### Prerequisites

package/dist/index.js

@@ -1560,7 +1560,7 @@ var Settings = class _Settings {
       return "STG";
     return void 0;
   }
-  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, cloudConnected = process.env.CLOUD_CONNECTED === "true", clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
+  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, cloudConnected = process.env.CLOUD_CONNECTED === "true", sid, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
     this.region = "EU";
     this.devPort = "8006";
     this.gatewayUrl = "";
@@ -1588,6 +1588,7 @@ var Settings = class _Settings {
     this.managementPort = managementPort;
     this.cloudInfraToken = cloudInfraToken;
     this.cloudConnected = cloudConnected;
+    this.sid = sid;
     this.clientId = clientId;
     this.secretKey = secretKey;
     this.region = this.normalizeRegion(region) || "EU";
@@ -1661,6 +1662,7 @@ var Settings = class _Settings {
     const verbose = SettingsManager.globalDebugState;
     if (verbose) {
       console.error("[Settings] Verbose: Validating settings...");
+      console.error("[Settings] Verbose: sid:", this.sid ? "***" : "(empty)");
       console.error("[Settings] Verbose: s1cUrl:", this.s1cUrl || "(empty)");
       console.error("[Settings] Verbose: managementHost:", this.managementHost || "(empty)");
       console.error("[Settings] Verbose: apiKey:", this.apiKey ? "***" : "(empty)");
@@ -1668,17 +1670,35 @@ var Settings = class _Settings {
       console.error("[Settings] Verbose: username:", this.username ? "***" : "(empty)");
       console.error("[Settings] Verbose: password:", this.password ? "***" : "(empty)");
     }
-    if (!nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.apiKey) && nullOrEmpty(this.cloudInfraToken)) {
+    if (!nullOrEmpty(this.sid)) {
       if (verbose) {
-        console.error("[Settings] Verbose: Validation FAILED - S1C URL provided but no API key or CI token");
+        console.error("[Settings] Verbose: Pre-authenticated SID provided, skipping credential validation");
+      }
+      return;
+    }
+    if (!nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.apiKey) && nullOrEmpty(this.cloudInfraToken)) {
+      if (process.env.MCP_TRANSPORT_TYPE?.toLowerCase() === "http") {
+        if (verbose) {
+          console.error("[Settings] Verbose: S1C URL provided without credentials, but HTTP transport mode allows per-request auth via headers");
+        }
+      } else {
+        if (verbose) {
+          console.error("[Settings] Verbose: Validation FAILED - S1C URL provided but no API key or CI token");
+        }
+        throw new Error("API key or CI Token is required for S1C (via --api-key or API_KEY env var)");
       }
-      throw new Error("API key or CI Token is required for S1C (via --api-key or API_KEY env var)");
     }
     if (!nullOrEmpty(this.managementHost) && nullOrEmpty(this.apiKey) && (nullOrEmpty(this.username) || nullOrEmpty(this.password))) {
-      if (verbose) {
-        console.error("[Settings] Verbose: Validation FAILED - Management host provided but no API key or credentials");
+      if (process.env.MCP_TRANSPORT_TYPE?.toLowerCase() === "http") {
+        if (verbose) {
+          console.error("[Settings] Verbose: Management host provided without credentials, but HTTP transport mode allows per-request auth via headers");
+        }
+      } else {
+        if (verbose) {
+          console.error("[Settings] Verbose: Validation FAILED - Management host provided but no API key or credentials");
+        }
+        throw new Error("Either API key or username/password are required for on-prem management (via CLI args or env vars)");
       }
-      throw new Error("Either API key or username/password are required for on-prem management (via CLI args or env vars)");
     }
     if (nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.managementHost)) {
       if (verbose) {
@@ -1747,6 +1767,7 @@ var Settings = class _Settings {
       managementPort: getHeaderValue(headers, "MANAGEMENT-PORT"),
       cloudInfraToken: getHeaderValue(headers, "CLOUD-INFRA-TOKEN"),
       cloudConnected: getHeaderValue(headers, "CLOUD-CONNECTED"),
+      sid: getHeaderValue(headers, "X-chkp-sid"),
       clientId: getHeaderValue(headers, "CLIENT-ID"),
       secretKey: getHeaderValue(headers, "SECRET-KEY"),
       region: getHeaderValue(headers, "REGION"),
@@ -1780,6 +1801,7 @@ var Settings = class _Settings {
       managementPort: extractedValues.managementPort,
       cloudInfraToken: extractedValues.cloudInfraToken,
       cloudConnected: extractedValues.cloudConnected === "true",
+      sid: extractedValues.sid,
       clientId: extractedValues.clientId,
       secretKey: extractedValues.secretKey,
       region: extractedValues.region?.toUpperCase(),

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",

package/package.json.bak

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",