@christopher_dondici/mcp-gen 2.1.2

package/dist/templates/python/server.py.hbs

@@ -0,0 +1,195 @@
+"""
+Auto-generated by mcp-gen v{{generatorVersion}}
+Spec: {{info.title}} v{{info.version}}
+Generated: {{generatedAt}}
+{{#if incremental}}
+Incremental mode: edit code between @@mcp-gen markers — it will be preserved on re-generation.
+{{/if}}
+Base URL: {{baseUrl}}
+"""
+
+from mcp.server.fastmcp import FastMCP
+from models import {{#each models}}{{name}}{{#unless @last}}, {{/unless}}{{/each}}
+from typing import Optional, Any, Dict
+import httpx
+from datetime import datetime, timezone
+
+mcp = FastMCP("{{serverName}}")
+
+BASE_URL = "{{baseUrl}}"
+
+_http_headers: Dict[str, str] = {}
+{{#if requiresAuth}}
+import os
+_token = os.environ.get("TOKEN")
+if _token:
+    _http_headers["Authorization"] = f"Bearer {_token}"
+{{/if}}
+
+RAW_CREDENTIAL_KEYS = {
+    "authorization",
+    "token",
+    "access_token",
+    "api_key",
+    "apikey",
+    "x_api_key",
+    "client_secret",
+    "refresh_token",
+    "password",
+    "secret",
+}
+
+TOOL_POLICIES = {
+{{#each tools}}
+    "{{name}}": {
+        "endpoint": "{{method}} {{path}}",
+        "requires_ttl": True,
+        "requires_spend_limit": True,
+        "requires_request_log": True,
+        "requires_revocation_check": True,
+    },
+{{/each}}
+}
+
+
+def _normalize_key(key: str) -> str:
+    return "".join(ch for ch in key.lower() if ch.isalnum() or ch == "_")
+
+
+def _contains_raw_credentials(value: Any) -> bool:
+    if isinstance(value, dict):
+        for key, nested in value.items():
+            normalized = _normalize_key(str(key)).replace("-", "_")
+            for candidate in RAW_CREDENTIAL_KEYS:
+                if normalized == _normalize_key(candidate):
+                    return True
+            if _contains_raw_credentials(nested):
+                return True
+    elif isinstance(value, list):
+        return any(_contains_raw_credentials(item) for item in value)
+    return False
+
+
+def ensure_no_raw_credentials(payload: Optional[dict]) -> None:
+    if payload and _contains_raw_credentials(payload):
+        raise ValueError(
+            "Raw provider credentials are not allowed in tool arguments. "
+            "Use scoped auth_context metadata only."
+        )
+
+
+def _is_expired(expires_at: Optional[str]) -> bool:
+    if not expires_at:
+        return True
+    try:
+        parsed = datetime.fromisoformat(expires_at.replace("Z", "+00:00"))
+    except ValueError:
+        return True
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=timezone.utc)
+    return parsed <= datetime.now(timezone.utc)
+
+
+def require_security(tool_name: str, security: Any, auth_context: Optional[dict], request_args: Optional[dict]) -> None:
+    ensure_no_raw_credentials(request_args)
+    if auth_context is not None:
+        ensure_no_raw_credentials(auth_context)
+
+    policy = TOOL_POLICIES.get(tool_name)
+    if not policy:
+        raise ValueError(f"Missing security policy for tool: {tool_name}")
+
+    if not isinstance(auth_context, dict):
+        raise ValueError(
+            "Missing auth_context. Provide scoped metadata "
+            "(token_id, expires_at, limits, request_id) from your gateway."
+        )
+
+    if policy["requires_revocation_check"] and auth_context.get("revoked") is True:
+        raise PermissionError("Access revoked")
+
+    if policy["requires_ttl"] and _is_expired(auth_context.get("expires_at")):
+        raise PermissionError("Token expired or missing TTL")
+
+    if policy["requires_request_log"] and not auth_context.get("request_id"):
+        raise ValueError("request_id is required for audit logging")
+
+    if policy["requires_spend_limit"]:
+        limit = auth_context.get("spend_limit_usd")
+        used = auth_context.get("spend_used_usd")
+        if not isinstance(limit, (int, float)) or not isinstance(used, (int, float)):
+            raise ValueError("Spend limit metadata is required")
+        if used > limit:
+            raise PermissionError("Spend limit exceeded")
+
+    allowed_tools = auth_context.get("allowed_tools")
+    if isinstance(allowed_tools, list) and tool_name not in allowed_tools:
+        raise PermissionError(f"Tool not allowed by scope: {tool_name}")
+
+    endpoint_allowlist = auth_context.get("endpoint_allowlist")
+    endpoint = policy["endpoint"]
+    if isinstance(endpoint_allowlist, list) and endpoint not in endpoint_allowlist:
+        raise PermissionError(f"Endpoint not allowed: {endpoint}")
+
+    if security:
+        if not auth_context.get("token_id"):
+            raise PermissionError("Missing token_id for secured operation")
+
+
+async def _call_api(method: str, path: str, params: dict, headers: Optional[dict] = None) -> Any:
+    """Real HTTP call to the underlying API (used in --http mode)."""
+    url = BASE_URL.rstrip("/") + _expand_path(path, params)
+    merged_headers = dict(_http_headers)
+    if headers:
+        merged_headers.update(headers)
+    body = params.get("body")
+    async with httpx.AsyncClient() as client:
+        r = await client.request(method, url, json=body, headers=merged_headers)
+        if r.status_code >= 400:
+            raise RuntimeError(f"HTTP {r.status_code}: {r.text}")
+        try:
+            return r.json()
+        except ValueError:
+            return r.text
+
+
+def _expand_path(path: str, params: dict) -> str:
+    out = path
+    for k, v in params.items():
+        out = out.replace("{" + k + "}", str(v))
+    return out
+
+
+# ─── Tools ───────────────────────────────────────────────────────────────────
+
+{{#each tools}}
+@mcp.tool()
+async def {{name}}({{#each params}}{{name}}: {{#if required}}{{#eq type "string"}}str{{/eq}}{{#eq type "number"}}float{{/eq}}{{#eq type "boolean"}}bool{{/eq}}{{#eq type "object"}}dict{{/eq}}{{#eq type "array"}}list{{/eq}}{{else}}Optional[{{#eq type "string"}}str{{/eq}}{{#eq type "number"}}float{{/eq}}{{#eq type "boolean"}}bool{{/eq}}{{#eq type "object"}}dict{{/eq}}{{#eq type "array"}}list{{/eq}}] = None{{/if}}{{#unless @last}}, {{/unless}}{{/each}}{{#if params}}, {{/if}}auth_context: Optional[dict] = None) -> Any:
+    """{{escapeText description}}
+
+    {{method}} {{path}}
+    """
+    # @@mcp-gen:start:{{name}}
+    request_args = {
+        key: value
+        for key, value in locals().items()
+        if key not in {"auth_context", "request_args"}
+    }
+    require_security("{{name}}", {{#if security}}{{json security}}{{else}}None{{/if}}, auth_context, request_args)
+    {{#if ../http}}
+    return {{#if ../requiresAuth}}await _call_api("{{method}}", "{{path}}", request_args){{else}}await _call_api("{{method}}", "{{path}}", request_args){{/if}}
+    {{else}}
+    {{#if exampleResponse}}
+    return {{json exampleResponse}}
+    {{else}}
+    raise NotImplementedError("Handler not implemented: {{name}}")
+    {{/if}}
+    {{/if}}
+    # @@mcp-gen:end:{{name}}
+
+
+{{/each}}
+# ─── Start ───────────────────────────────────────────────────────────────────
+
+if __name__ == "__main__":
+    mcp.run()

package/dist/templates/typescript/Dockerfile.hbs

@@ -0,0 +1,18 @@
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --production=false
+COPY . .
+RUN npm run build
+
+FROM node:20-alpine AS runtime
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --production
+COPY --from=builder /app/dist ./dist
+
+ENV NODE_ENV=production
+
+CMD ["node", "dist/server.js"]

package/dist/templates/typescript/README.md.hbs

@@ -0,0 +1,91 @@
+# {{info.title}} — MCP Server
+
+> Generated by [mcp-gen](https://github.com/your-org/mcp-generator)
+> OpenAPI version: {{info.version}}
+
+{{info.description}}
+
+## Setup
+
+```bash
+npm install
+npm run build
+```
+
+## Run
+
+```bash
+npm start
+```
+
+## Connect to Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "{{serverName}}": {
+      "command": "node",
+      "args": ["/absolute/path/to/dist/server.js"]
+    }
+  }
+}
+```
+
+## Available Tools ({{tools.length}})
+
+{{#each tools}}
+### `{{name}}`
+> {{description}}
+
+**`{{method}} {{path}}`**
+
+{{#if params}}
+| Name | Type | Required | Description |
+|------|------|----------|-------------|
+{{#each params}}
+| `{{name}}` | `{{type}}` | {{#if required}}✓{{else}}—{{/if}} | {{description}} |
+{{/each}}
+{{/if}}
+
+{{/each}}
+
+---
+
+## Security
+
+
+### Contrato padrão do `authContext`
+
+As tools geradas esperam **metadados de autorização com escopo** (e não credenciais brutas), por exemplo:
+
+```json
+{
+  "tokenId": "tok_abc123",
+  "principal": "user:42",
+  "expiresAt": "2026-05-11T14:00:00Z",
+  "allowedTools": ["get_orders"],
+  "endpointAllowlist": ["GET /orders"],
+  "spendLimitUsd": 5,
+  "spendUsedUsd": 1.2,
+  "revoked": false,
+  "requestId": "req_01J..."
+}
+```
+
+O scaffold bloqueia por padrão argumentos como `token`, `authorization`, `api_key`, `client_secret` e similares.
+
+*Quick example (env var):*
+
+```bash
+# Linux / macOS
+export PROVIDER_KEY=your_key_here
+
+# Windows (PowerShell)
+$env:PROVIDER_KEY='your_key_here'
+```
+
+For advanced integrations and management, consider Cohesivity.ai as a backend for auth, storage, and revocation policies.
+
+*Generated by mcp-gen — edit handlers, not the scaffold.*

package/dist/templates/typescript/ci.yml.hbs

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test

package/dist/templates/typescript/client.hbs

@@ -0,0 +1,49 @@
+// Auto-generated client SDK for {{info.title}} v{{info.version}}
+// Generated: {{generatedAt}}
+
+export class ApiClient {
+  constructor(public baseUrl: string = "{{baseUrl}}", public token?: string) {}
+
+  private buildUrl(path: string, params: Record<string, unknown> | undefined): string {
+    let url = path;
+    if (params) {
+      for (const [k, v] of Object.entries(params)) {
+        url = url.replace(`{${k}}`, encodeURIComponent(String(v ?? "")));
+      }
+    }
+    return this.baseUrl.replace(/\/$/, "") + url;
+  }
+
+  private buildHeaders(params: Record<string, unknown>): Record<string, string> {
+    const headers: Record<string, string> = {};
+    {{#each (allHeaderParams tools)}}
+    const v{{@index}} = params["{{name}}"];
+    if (v{{@index}} !== undefined) headers["{{name}}"] = String(v{{@index}});
+    {{/each}}
+    return headers;
+  }
+
+  private async request(method: string, url: string, body?: unknown, headers: Record<string,string> = {}) {
+    if (this.token) headers["Authorization"] = `Bearer ${this.token}`;
+    const opts: RequestInit = { method, headers };
+    if (body !== undefined) {
+      opts.body = JSON.stringify(body);
+      headers["Content-Type"] = "application/json";
+    }
+    const res = await fetch(url, opts);
+    if (!res.ok) throw new Error(`HTTP ${res.status}: ${await res.text()}`);
+    const text = await res.text();
+    try { return JSON.parse(text); } catch { return text; }
+  }
+
+  {{#each tools}}
+  /** {{escapeText description}} */
+  async {{name}}(params: Record<string, unknown> = {}): Promise<unknown> {
+    const url = this.buildUrl("{{path}}", params);
+    const method = "{{method}}";
+    const hasBody = {{#if (includes (requiredParams params) "body")}}true{{else}}false{{/if}};
+    const body = hasBody ? (params["body"] as unknown) : undefined;
+    return this.request(method, url, body, this.buildHeaders(params));
+  }
+  {{/each}}
+}

package/dist/templates/typescript/models.hbs

@@ -0,0 +1,23 @@
+// Auto-generated by mcp-gen — do not edit.
+// Source: {{info.title}} v{{info.version}}
+
+{{#each models}}
+{{#if isEnum}}
+/** {{description}} */
+export type {{name}} = {{#each enumValues}}{{literal this}}{{#unless @last}} | {{/unless}}{{/each}};
+{{else if oneOf}}
+/** {{description}} */
+export type {{name}} = {{#each oneOf}}{{this}}{{#unless @last}} | {{/unless}}{{/each}};
+{{else if anyOf}}
+/** {{description}} */
+export type {{name}} = {{#each anyOf}}{{this}}{{#unless @last}} | {{/unless}}{{/each}};
+{{else}}
+/** {{description}} */
+export interface {{name}} {
+  {{#each properties}}
+  {{name}}{{#unless (includes ../required name)}}?{{/unless}}: {{#if ref}}{{ref}}{{#if isArray}}[]{{/if}}{{else}}{{type}}{{/if}};{{#if description}} // {{escapeText description}}{{/if}}
+  {{/each}}
+}
+
+{{/if}}
+{{/each}}

package/dist/templates/typescript/package.json.hbs

@@ -0,0 +1,26 @@
+{
+  "name": "{{serverName}}",
+  "version": "{{serverVersion}}",
+  "description": "{{info.description}}",
+  "type": "module",
+  "main": "dist/server.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/server.js",
+    "dev": "ts-node --esm src/server.ts",
+    "test": "jest --passWithNoTests",
+    "inspector": "npx @modelcontextprotocol/inspector node dist/server.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.5.0",
+    "@types/node": "^20.0.0",
+    "jest": "^29.5.0",
+    "ts-jest": "^29.1.0",
+    "ts-node": "^10.9.0",
+    "typescript": "^5.4.0"
+  },
+  "license": "MIT"
+}