@christopher_dondici/mcp-gen 2.1.2

package/dist/templates/go/ci.yml.hbs

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+          cache: true
+
+      - name: Download dependencies
+        run: go mod download
+
+      - name: Build
+        run: go build -v .
+
+      - name: Test
+        run: go test -v ./...

package/dist/templates/go/client.go.hbs

@@ -0,0 +1,86 @@
+// Auto-generated client SDK for {{info.title}} v{{info.version}}
+// Generated: {{generatedAt}}
+
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+type APIClient struct {
+	BaseURL string
+	Token   string
+	HTTP    *http.Client
+}
+
+func NewAPIClient(baseURL, token string) *APIClient {
+	if token == "" {
+		token = apiToken
+	}
+	return &APIClient{BaseURL: strings.TrimRight(baseURL, "/"), Token: token, HTTP: &http.Client{Timeout: 30 * time.Second}}
+}
+
+type APIError struct {
+	Status int
+	Body   string
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("HTTP %d: %s", e.Status, e.Body)
+}
+
+func (c *APIClient) do(method, path string, params map[string]any) (any, error) {
+	path = c.expand(path, params)
+	var body io.Reader
+	if v, ok := params["body"]; ok {
+		b, err := json.Marshal(v)
+		if err != nil {
+			return nil, err
+		}
+		body = bytes.NewReader(b)
+	}
+	req, err := http.NewRequest(method, c.BaseURL+path, body)
+	if err != nil {
+		return nil, err
+	}
+	if c.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.Token)
+	}
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	{{#each (allHeaderParams tools)}}
+	if v, ok := params["{{name}}"]; ok {
+		req.Header.Set("{{name}}", fmt.Sprintf("%v", v))
+	}
+	{{/each}}
+	resp, err := c.HTTP.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	raw, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 400 {
+		return nil, &APIError{Status: resp.StatusCode, Body: string(raw)}
+	}
+	var out any
+	if len(raw) > 0 {
+		if err := json.Unmarshal(raw, &out); err != nil {
+			return string(raw), nil
+		}
+	}
+	return out, nil
+}
+
+func (c *APIClient) expand(path string, params map[string]any) string {
+	for k, v := range params {
+		path = strings.ReplaceAll(path, "{"+k+"}", fmt.Sprintf("%v", v))
+	}
+	return path
+}

package/dist/templates/go/go.mod.hbs

@@ -0,0 +1,5 @@
+module {{serverName}}
+
+go 1.22
+
+require github.com/mark3labs/mcp-go v0.20.0

package/dist/templates/go/models.go.hbs

@@ -0,0 +1,28 @@
+// Auto-generated by mcp-gen v{{generatorVersion}} — do not edit.
+// Spec: {{info.title}} v{{info.version}}
+
+package main
+
+{{#each models}}
+{{#if isEnum}}
+// {{escapeText description}}
+type {{name}} = {{#each enumValues}}{{#if (eq (typeof this) "string")}}"{{escapeLiteral this}}"{{else}}{{this}}{{/if}}{{#unless @last}} | {{/unless}}{{/each}}
+
+{{else if oneOf}}
+// {{escapeText description}}
+type {{name}} = {{#each oneOf}}{{this}}{{#unless @last}} | {{/unless}}{{/each}}
+
+{{else if anyOf}}
+// {{escapeText description}}
+type {{name}} = {{#each anyOf}}{{this}}{{#unless @last}} | {{/unless}}{{/each}}
+
+{{else}}
+// {{escapeText description}}
+type {{name}} struct {
+{{#each properties}}
+	{{pascal name}} {{#if ref}}{{ref}}{{#if isArray}}[]{{/if}}{{else if isArray}}[]any{{else}}{{goType type}}{{/if}} `json:"{{name}}{{#unless (includes ../required name)}},omitempty{{/unless}}"`{{#if description}} // {{escapeText description}}{{/if}}
+{{/each}}
+}
+
+{{/if}}
+{{/each}}

package/dist/templates/go/server.go.hbs

@@ -0,0 +1,220 @@
+// Auto-generated by mcp-gen v{{generatorVersion}} — do not edit.
+// Spec: {{info.title}} v{{info.version}}
+// Generated: {{generatedAt}}
+{{#if incremental}}
+// Incremental mode: edit code between @@mcp-gen markers — it will be preserved on re-generation.
+{{/if}}
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/mark3labs/mcp-go/server"
+)
+
+var baseURL = "{{baseUrl}}"
+var apiToken = os.Getenv("TOKEN")
+
+// RAW_CREDENTIAL_KEYS defines credential keywords that are blocked by default
+var RAW_CREDENTIAL_KEYS = map[string]bool{
+	"authorization": true,
+	"token":         true,
+	"access_token":  true,
+	"api_key":       true,
+	"apikey":        true,
+	"x_api_key":     true,
+	"client_secret": true,
+	"refresh_token": true,
+	"password":      true,
+	"secret":        true,
+}
+
+// TOOL_POLICIES defines per-tool security policies
+var TOOL_POLICIES = map[string]struct {
+	Endpoint               string
+	RequiresTTL            bool
+	RequiresSpendLimit     bool
+	RequiresRequestLog     bool
+	RequiresRevocationCheck bool
+}{
+{{#each tools}}
+	"{{name}}": {
+		Endpoint:               "{{method}} {{path}}",
+		RequiresTTL:            true,
+		RequiresSpendLimit:     true,
+		RequiresRequestLog:     true,
+		RequiresRevocationCheck: true,
+	},
+{{/each}}
+}
+
+func jsonSerialize(v any) (*mcp.CallToolResult, error) {
+	b, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return mcp.NewToolResultText(string(b)), nil
+}
+
+func jsonExample(s string) any {
+	var v any
+	if err := json.Unmarshal([]byte(s), &v); err != nil {
+		return nil
+	}
+	return v
+}
+
+func hasRawCredentialKey(value any) bool {
+	if value == nil {
+		return false
+	}
+	switch v := value.(type) {
+	case map[string]any:
+		for key, nested := range v {
+			normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "-", ""), "_", ""))
+			for candidate := range RAW_CREDENTIAL_KEYS {
+				candNorm := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(candidate, "-", ""), "_", ""))
+				if normalized == candNorm {
+					return true
+				}
+			}
+			if hasRawCredentialKey(nested) {
+				return true
+			}
+		}
+	case []any:
+		for _, item := range v {
+			if hasRawCredentialKey(item) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func requireSecurity(toolName string, security any, authContext map[string]any, requestArgs map[string]any) error {
+	if requestArgs != nil && hasRawCredentialKey(requestArgs) {
+		return fmt.Errorf("raw provider credentials are not allowed in tool arguments. use scoped auth_context metadata only")
+	}
+	if authContext != nil && hasRawCredentialKey(authContext) {
+		return fmt.Errorf("raw provider credentials are not allowed in auth_context. use scoped metadata only")
+	}
+
+	policy, ok := TOOL_POLICIES[toolName]
+	if !ok {
+		return fmt.Errorf("missing security policy for tool: %s", toolName)
+	}
+
+	if authContext == nil {
+		return fmt.Errorf("missing auth_context. provide scoped metadata (token_id, expires_at, limits, request_id) from your gateway")
+	}
+
+	if policy.RequiresRevocationCheck {
+		if revoked, ok := authContext["revoked"].(bool); ok && revoked {
+			return fmt.Errorf("access revoked")
+		}
+	}
+
+	if policy.RequiresTTL {
+		if expiresAt, ok := authContext["expires_at"].(string); ok {
+			// Simple check - in production use proper parsing
+			if expiresAt == "" || expiresAt < "2025-01-01T00:00:00Z" {
+				return fmt.Errorf("token expired or missing TTL")
+			}
+		} else {
+			return fmt.Errorf("token expired or missing TTL")
+		}
+	}
+
+	if policy.RequiresRequestLog {
+		if _, ok := authContext["request_id"].(string); !ok {
+			return fmt.Errorf("request_id is required for audit logging")
+		}
+	}
+
+	if policy.RequiresSpendLimit {
+		limit, hasLimit := authContext["spend_limit_usd"].(float64)
+		used, hasUsed := authContext["spend_used_usd"].(float64)
+		if !hasLimit || !hasUsed {
+			return fmt.Errorf("spend limit metadata is required")
+		}
+		if used > limit {
+			return fmt.Errorf("spend limit exceeded")
+		}
+	}
+
+	if allowedTools, ok := authContext["allowed_tools"].([]any); ok {
+		found := false
+		for _, t := range allowedTools {
+			if ts, ok := t.(string); ok && ts == toolName {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return fmt.Errorf("tool not allowed by scope: %s", toolName)
+		}
+	}
+
+	if endpointAllowlist, ok := authContext["endpoint_allowlist"].([]any); ok {
+		found := false
+		for _, e := range endpointAllowlist {
+			if es, ok := e.(string); ok && es == policy.Endpoint {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return fmt.Errorf("endpoint not allowed: %s", policy.Endpoint)
+		}
+	}
+
+	if security != nil {
+		if _, ok := authContext["token_id"].(string); !ok {
+			return fmt.Errorf("missing token_id for secured operation")
+		}
+	}
+
+	return nil
+}
+
+func main() {
+	s := server.NewMCPServer("{{serverName}}", "{{serverVersion}}")
+
+{{#each tools}}
+	// {{method}} {{path}}
+	{{name}}Tool := mcp.NewTool("{{name}}",
+		mcp.WithDescription("{{escapeText description}}"),
+{{#each params}}
+		mcp.With{{pascalGoType type}}("{{name}}",
+			mcp.Description("{{escapeText description}}"),
+{{#if required}}
+			mcp.Required(),
+{{/if}}
+		),
+{{/each}}
+	)
+	s.AddTool({{name}}Tool, func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		_ = request.Params.Arguments
+		// @@mcp-gen:start:{{name}}
+		{{#if http}}
+		return nil, fmt.Errorf("impl via client not yet wired: {{name}} (edit inside @@mcp-gen markers to call {{method}} {{path}})")
+		{{else if exampleResponse}}
+		return jsonSerialize(jsonExample(`{{json exampleResponse}}`))
+		{{else}}
+		return nil, fmt.Errorf("handler not implemented: {{name}}")
+		{{/if}}
+		// @@mcp-gen:end:{{name}}
+	})
+
+{{/each}}
+	if err := server.ServeStdio(s); err != nil {
+		fmt.Fprintf(os.Stderr, "Fatal: %v\n", err)
+		os.Exit(1)
+	}
+}

package/dist/templates/python/Dockerfile.hbs

@@ -0,0 +1,12 @@
+FROM python:3.12-slim AS runtime
+
+WORKDIR /app
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+ENV PYTHONUNBUFFERED=1
+
+CMD ["python", "server.py"]

package/dist/templates/python/README.md.hbs

@@ -0,0 +1,115 @@
+# {{info.title}} — MCP Server (Python)
+
+> Generated by [mcp-gen](https://github.com/your-org/openapi-to-mcp)
+> OpenAPI version: {{info.version}}
+
+{{info.description}}
+
+## Setup
+
+```bash
+pip install -r requirements.txt
+```
+
+## Run
+
+```bash
+python server.py
+```
+
+## Connect to Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "{{serverName}}": {
+      "command": "python",
+      "args": ["/absolute/path/to/server.py"]
+    }
+  }
+}
+```
+
+## Available Tools ({{tools.length}})
+
+{{#each tools}}
+### `{{name}}`
+
+> {{description}}
+
+**`{{method}} {{path}}`**
+
+{{#if params}}
+| Name | Type | Required | Description |
+|------|------|----------|-------------|
+{{#each params}}
+| `{{name}}` | `{{type}}` | {{#if required}}✓{{else}}—{{/if}} | {{description}} |
+{{/each}}
+{{else}}
+No parameters.
+{{/if}}
+
+{{/each}}
+
+## Implement Handlers
+
+Find each function in `server.py` and replace the stub:
+
+```python
+@mcp.tool()
+async def your_tool_name(param: str) -> Any:
+    """Your tool description"""
+    # @@mcp-gen:start:your_tool_name
+    result = await your_api_call(param)
+    return result
+    # @@mcp-gen:end:your_tool_name
+```
+
+## Base URL
+
+`{{baseUrl}}`
+
+---
+
+## Security
+
+- **Don't embed credentials**: don't include provider keys or secrets directly in generated projects. Use environment variables or a secret manager (e.g., Vault, AWS Secrets Manager) or credential management service (e.g., Cohesivity.ai) for storage and secret revocation.
+- **Scoped and TTL tokens**: prefer short-lived tokens with minimal scope, usage limits, and revocation capability.
+- **Logs and audit**: log sensitive requests and enable audit for critical operations.
+- **Never put secrets in model context**: avoid passing keys, tokens, or secrets in prompts or model context.
+
+### Default `auth_context` contract
+
+Generated tools expect **scoped authorization metadata** (not raw provider credentials), for example:
+
+```json
+{
+  "token_id": "tok_abc123",
+  "principal": "user:42",
+  "expires_at": "2026-05-11T14:00:00Z",
+  "allowed_tools": ["get_orders"],
+  "endpoint_allowlist": ["GET /orders"],
+  "spend_limit_usd": 5,
+  "spend_used_usd": 1.2,
+  "revoked": false,
+  "request_id": "req_01J..."
+}
+```
+
+The scaffold blocks raw credential-style arguments such as `token`, `authorization`, `api_key`, `client_secret`, and similar keys by default.
+
+*Quick example (env var):*
+
+```bash
+# Linux / macOS
+export PROVIDER_KEY=your_key_here
+
+# Windows (PowerShell)
+$env:PROVIDER_KEY='your_key_here'
+```
+
+For advanced integrations and management, consider Cohesivity.ai as a backend for auth, storage, and revocation policies.
+
+*Generated by mcp-gen — edit handlers, not the scaffold.*

package/dist/templates/python/ci.yml.hbs

@@ -0,0 +1,24 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt pytest pytest-asyncio
+
+      - name: Run tests
+        run: pytest --tb=short

package/dist/templates/python/models.py.hbs

@@ -0,0 +1,20 @@
+# Auto-generated by mcp-gen v{{generatorVersion}} — do not edit.
+# Spec: {{info.title}} v{{info.version}}
+
+from pydantic import BaseModel, Field
+from typing import Optional, List, Any, Literal
+
+
+{{#each models}}
+{{#if isEnum}}
+{{name}} = {{#each enumValues}}{{literal this}}{{#unless @last}} | {{/unless}}{{/each}}
+{{else}}
+class {{name}}(BaseModel):
+    """{{escapeText description}}"""
+    {{#each properties}}
+    {{name}}: {{pyType this}} {{#unless (includes ../required name)}} = None{{/unless}}
+    {{#if description}}  # {{escapeText description}}{{/if}}
+    {{/each}}
+
+{{/if}}
+{{/each}}

package/dist/templates/python/requirements.txt.hbs

@@ -0,0 +1,3 @@
+mcp[cli]>=1.0.0
+pydantic>=2.0.0
+httpx>=0.27.0