@crossgen-ai/praxis-connectors 0.1.2

package/lib/oauth.js

@@ -0,0 +1,139 @@
+// The store-backed OAuthClientProvider: PKCE verifier, client
+// registration, and tokens all live in the box's auth/<id>.json (0600) and
+// never leave it. The human leg is split exactly the way the MCP SDK
+// sanctions — redirectToAuthorization() captures the URL for whichever face
+// (app, CLI) can show it to a human; the code comes back through
+// engine.authFinish(), however it traveled (serve callback or paste-back).
+'use strict';
+
+const crypto = require('node:crypto');
+
+class StoreOAuthProvider {
+  /**
+   * @param {import('./store').ConnectorsStore} store
+   * @param {string} id           connector id
+   * @param {object} [opts]
+   * @param {string} [opts.redirectUrl]  where the AS should send the code —
+   *        serve's callback route; falls back to the one recorded when the
+   *        flow started (refresh flows never use it).
+   */
+  constructor(store, id, { redirectUrl } = {}) {
+    this.store = store;
+    this.id = id;
+    // Fall back to the flow-in-progress redirect, then the one the last
+    // completed sign-in used — the SDK's refresh branch only runs for
+    // providers that look interactive (redirectUrl present).
+    const persisted = this.store.readAuth(id);
+    this._redirectUrl = redirectUrl
+      || persisted.pendingAuth?.redirectUrl
+      || persisted.redirectUrl;
+    this.capturedAuthorizationUrl = null;
+  }
+
+  get redirectUrl() {
+    return this._redirectUrl;
+  }
+
+  get clientMetadata() {
+    return {
+      client_name: 'Praxis Connectors',
+      ...(this._redirectUrl ? { redirect_uris: [String(this._redirectUrl)] } : {}),
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+    };
+  }
+
+  /**
+   * The OAuth state parameter doubles as the callback's router: serve's
+   * single callback route finds the connector by matching it (engine
+   * findPendingByState). Prefix is cosmetic; the entropy is the guard.
+   */
+  state() {
+    const auth = this.store.readAuth(this.id);
+    if (auth.pendingAuth?.state) return auth.pendingAuth.state;
+    const state = `${this.id}-${crypto.randomBytes(16).toString('hex')}`;
+    this.store.patchAuth(this.id, {
+      pendingAuth: { ...(auth.pendingAuth || {}), state, redirectUrl: this._redirectUrl },
+    });
+    return state;
+  }
+
+  clientInformation() {
+    return this.store.readAuth(this.id).clientInfo || undefined;
+  }
+
+  saveClientInformation(clientInformation) {
+    this.store.patchAuth(this.id, { clientInfo: clientInformation });
+  }
+
+  tokens() {
+    return this.store.readAuth(this.id).tokens || undefined;
+  }
+
+  saveTokens(tokens) {
+    // tokensSavedAt rides beside (not inside) the SDK's shape — the refresh
+    // engine computes expiry as savedAt + expires_in. The redirect URL
+    // outlives the flow so later refreshes count as interactive.
+    this.store.patchAuth(this.id, {
+      tokens,
+      tokensSavedAt: new Date().toISOString(),
+      pendingAuth: undefined,
+      ...(this._redirectUrl ? { redirectUrl: String(this._redirectUrl) } : {}),
+    });
+  }
+
+  redirectToAuthorization(authorizationUrl) {
+    // No browser on the box: capture the URL for the relay.
+    this.capturedAuthorizationUrl = String(authorizationUrl);
+    const auth = this.store.readAuth(this.id);
+    this.store.patchAuth(this.id, {
+      pendingAuth: {
+        ...(auth.pendingAuth || {}),
+        url: this.capturedAuthorizationUrl,
+        redirectUrl: this._redirectUrl,
+        startedAt: new Date().toISOString(),
+      },
+    });
+  }
+
+  saveCodeVerifier(codeVerifier) {
+    this.store.patchAuth(this.id, { codeVerifier });
+  }
+
+  /**
+   * SEP-2352: discovery state persists alongside the verifier so the
+   * callback leg can prove the code came from the same authorization
+   * server the flow started with (mix-up defense).
+   */
+  discoveryState() {
+    return this.store.readAuth(this.id).discoveryState || undefined;
+  }
+
+  saveDiscoveryState(state) {
+    this.store.patchAuth(this.id, { discoveryState: state });
+  }
+
+  codeVerifier() {
+    const v = this.store.readAuth(this.id).codeVerifier;
+    if (!v) throw new Error(`no sign-in in progress for connector ${this.id}`);
+    return v;
+  }
+
+  invalidateCredentials(scope) {
+    if (scope === 'all') {
+      this.store.patchAuth(this.id, {
+        tokens: undefined, tokensSavedAt: undefined,
+        clientInfo: undefined, codeVerifier: undefined,
+      });
+    } else if (scope === 'client') {
+      this.store.patchAuth(this.id, { clientInfo: undefined });
+    } else if (scope === 'tokens') {
+      this.store.patchAuth(this.id, { tokens: undefined, tokensSavedAt: undefined });
+    } else if (scope === 'verifier') {
+      this.store.patchAuth(this.id, { codeVerifier: undefined });
+    }
+  }
+}
+
+module.exports = { StoreOAuthProvider };

package/lib/store.js

@@ -0,0 +1,193 @@
+// The box-local connector store: one directory per box is the whole sharing
+// contract. Whoever writes, everyone sees — every operation re-reads from
+// disk, so a long-lived host process, an interactive harness session, and a
+// scheduled run never hold stale copies.
+//
+//   $PRAXIS_CONNECTORS_HOME (default ~/.praxis-connectors)/
+//     connectors.json     the registry (no secrets, ever)
+//     auth/<id>.json      tokens + OAuth client state, 0600
+//     cache/<id>.json     cached tool lists (deferred loading)
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+// Lowercase/underscore only: the harness's tools.json surface schema pins
+// tool names to ^[a-z][a-z0-9_]*$, and connector ids become tool-name
+// segments (mcp__<id>__<tool>).
+const ID_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+
+const TRANSPORTS = ['stdio', 'http'];
+
+function resolveHome(explicit) {
+  return explicit
+    || process.env.PRAXIS_CONNECTORS_HOME
+    || path.join(os.homedir(), '.praxis-connectors');
+}
+
+function validateId(id) {
+  if (!ID_PATTERN.test(String(id || ''))) {
+    throw new Error(
+      `connector id must be lowercase letters, digits, or underscores (got ${JSON.stringify(id)})`,
+    );
+  }
+  return String(id);
+}
+
+class ConnectorsStore {
+  constructor(home) {
+    this.home = resolveHome(home);
+    this.registryFile = path.join(this.home, 'connectors.json');
+    this.authDir = path.join(this.home, 'auth');
+    this.cacheDir = path.join(this.home, 'cache');
+  }
+
+  _ensureDirs() {
+    fs.mkdirSync(this.home, { recursive: true });
+    fs.mkdirSync(this.authDir, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(this.cacheDir, { recursive: true });
+  }
+
+  _readJson(file, fallback) {
+    try {
+      return JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch {
+      return fallback;
+    }
+  }
+
+  _writeJson(file, data, { mode } = {}) {
+    this._ensureDirs();
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 1), mode ? { mode } : {});
+    fs.renameSync(tmp, file);
+  }
+
+  /* ---- registry ---- */
+
+  readRegistry() {
+    const reg = this._readJson(this.registryFile, { version: 1, connectors: [] });
+    if (!Array.isArray(reg.connectors)) reg.connectors = [];
+    return reg;
+  }
+
+  list() {
+    return this.readRegistry().connectors;
+  }
+
+  get(id) {
+    return this.list().find((c) => c.id === id) || null;
+  }
+
+  /**
+   * Add or replace a registry entry. `entry`: { id, name, transport,
+   * command?, args?, url?, catalog?, addedBy? }. Secrets never enter the
+   * registry — tokens live in auth/, and command/url are configuration.
+   */
+  upsert(entry) {
+    const id = validateId(entry.id);
+    if (!TRANSPORTS.includes(entry.transport)) {
+      throw new Error(`transport must be one of ${TRANSPORTS.join(', ')}`);
+    }
+    if (entry.transport === 'stdio' && !entry.command) {
+      throw new Error('a stdio connector needs a command');
+    }
+    if (entry.transport === 'http') {
+      let url;
+      try {
+        url = new URL(String(entry.url || ''));
+      } catch {
+        throw new Error('an http connector needs a valid URL');
+      }
+      if (!/^https?:$/.test(url.protocol)) {
+        throw new Error('an http connector URL must be http:// or https://');
+      }
+    }
+    const clean = {
+      id,
+      name: String(entry.name || id),
+      transport: entry.transport,
+      ...(entry.transport === 'stdio'
+        ? { command: String(entry.command), args: (entry.args || []).map(String) }
+        : { url: String(entry.url) }),
+      ...(entry.catalog ? { catalog: String(entry.catalog) } : {}),
+      addedBy: String(entry.addedBy || 'unknown'),
+      addedAt: entry.addedAt || new Date().toISOString(),
+    };
+    const reg = this.readRegistry();
+    const idx = reg.connectors.findIndex((c) => c.id === id);
+    if (idx === -1) reg.connectors.push(clean);
+    else reg.connectors[idx] = { ...reg.connectors[idx], ...clean };
+    this._writeJson(this.registryFile, reg);
+    return clean;
+  }
+
+  remove(id) {
+    const reg = this.readRegistry();
+    const idx = reg.connectors.findIndex((c) => c.id === id);
+    if (idx === -1) return false;
+    reg.connectors.splice(idx, 1);
+    this._writeJson(this.registryFile, reg);
+    for (const file of [this._authFile(id), this._cacheFile(id)]) {
+      try { fs.rmSync(file); } catch { /* already gone */ }
+    }
+    return true;
+  }
+
+  /* ---- auth (0600: tokens are born, live, and die here) ---- */
+
+  _authFile(id) {
+    return path.join(this.authDir, `${validateId(id)}.json`);
+  }
+
+  readAuth(id) {
+    return this._readJson(this._authFile(id), {});
+  }
+
+  writeAuth(id, data) {
+    this._writeJson(this._authFile(id), data, { mode: 0o600 });
+    // rename preserves the tmp file's mode; belt-and-braces on reused paths.
+    try { fs.chmodSync(this._authFile(id), 0o600); } catch { /* best effort */ }
+  }
+
+  patchAuth(id, patch) {
+    const next = { ...this.readAuth(id), ...patch };
+    for (const [k, v] of Object.entries(patch)) {
+      if (v === undefined) delete next[k];
+    }
+    this.writeAuth(id, next);
+    return next;
+  }
+
+  /* ---- tool cache (roster-style: listing never blocks a spawn) ---- */
+
+  _cacheFile(id) {
+    return path.join(this.cacheDir, `${validateId(id)}.json`);
+  }
+
+  readCache(id) {
+    return this._readJson(this._cacheFile(id), null);
+  }
+
+  writeCache(id, { tools, status }) {
+    this._writeJson(this._cacheFile(id), {
+      tools: tools || [],
+      status: status || 'connected',
+      listedAt: new Date().toISOString(),
+    });
+  }
+
+  /** Status bookkeeping rides the cache file so list() stays disk-only. */
+  writeStatus(id, status, detail) {
+    const prev = this.readCache(id) || { tools: [] };
+    this._writeJson(this._cacheFile(id), {
+      ...prev,
+      status,
+      ...(detail ? { statusDetail: String(detail) } : { statusDetail: undefined }),
+      statusAt: new Date().toISOString(),
+    });
+  }
+}
+
+module.exports = { ConnectorsStore, resolveHome, validateId, ID_PATTERN };

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@crossgen-ai/praxis-connectors",
+  "version": "0.1.2",
+  "description": "An MCP connector engine for the Praxis platform.",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./extension": "./extension/index.js",
+    "./test-helpers": "./test/helpers/index.js",
+    "./package.json": "./package.json"
+  },
+  "pi": {
+    "extensions": ["./extension/index.js"]
+  },
+  "files": [
+    "lib",
+    "extension",
+    "test/helpers",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "praxis",
+    "mcp",
+    "connectors",
+    "pi-package"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/client": "^2.0.0"
+  }
+}

package/test/helpers/fake-as.js

@@ -0,0 +1,168 @@
+// Hermetic OAuth 2.1 authorization server for connector tests: metadata
+// discovery (RFC 8414), dynamic client registration (RFC 7591), PKCE S256
+// authorization-code flow, and refresh with rotation. Loopback http is
+// sanctioned by the SDK (SEP-2207), so no TLS theater is needed.
+'use strict';
+
+const crypto = require('node:crypto');
+const http = require('node:http');
+
+function s256(verifier) {
+  return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+
+/**
+ * @param {object} [opts]
+ * @param {Set<string>} [opts.issued]  shared with the fake resource server:
+ *        tokens this AS mints land here; refresh rotates old ones out.
+ * @param {number} [opts.expiresIn]    access-token lifetime (seconds)
+ * @param {boolean} [opts.issParameter]  declare RFC 9207
+ *        (`authorization_response_iss_parameter_supported`) in metadata, which
+ *        makes the SDK REQUIRE `iss` on the authorization response — the
+ *        Google shape. The redirect always carries `iss`
+ *        either way; only the declaration is gated, so non-declaring suites
+ *        keep their existing behavior.
+ * @returns {Promise<{url, issued, authRequests, approve, refreshCount, close}>}
+ */
+function startFakeAs({ issued = new Set(), expiresIn = 3600, issParameter = false } = {}) {
+  const clients = new Map();   // client_id → registration
+  const codes = new Map();     // code → { challenge, clientId, redirectUri, state }
+  const refreshTokens = new Map(); // refresh_token → { clientId, accessToken }
+  const authRequests = [];
+  const state = { refreshCount: 0 };
+
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url, `http://${req.headers.host}`);
+    const json = (status, body) => {
+      res.writeHead(status, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(body));
+    };
+
+    if (req.method === 'GET' && url.pathname.startsWith('/.well-known/oauth-authorization-server')) {
+      const issuer = `http://127.0.0.1:${server.address().port}`;
+      return json(200, {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/token`,
+        registration_endpoint: `${issuer}/register`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        ...(issParameter ? { authorization_response_iss_parameter_supported: true } : {}),
+      });
+    }
+
+    if (req.method === 'POST' && url.pathname === '/register') {
+      let body = '';
+      for await (const chunk of req) body += chunk;
+      const meta = JSON.parse(body || '{}');
+      const clientId = `fake-client-${clients.size + 1}`;
+      clients.set(clientId, meta);
+      return json(201, {
+        client_id: clientId,
+        redirect_uris: meta.redirect_uris || [],
+        token_endpoint_auth_method: 'none',
+        grant_types: meta.grant_types || ['authorization_code'],
+        response_types: ['code'],
+      });
+    }
+
+    if (req.method === 'GET' && url.pathname === '/authorize') {
+      // The "browser leg": record it; tests approve() to mint the redirect.
+      authRequests.push(Object.fromEntries(url.searchParams));
+      res.writeHead(200, { 'content-type': 'text/html' });
+      return res.end('<html><body>fake sign-in page</body></html>');
+    }
+
+    if (req.method === 'POST' && url.pathname === '/token') {
+      let body = '';
+      for await (const chunk of req) body += chunk;
+      const params = new URLSearchParams(body);
+      const grant = params.get('grant_type');
+
+      if (grant === 'authorization_code') {
+        const stored = codes.get(params.get('code'));
+        if (!stored) return json(400, { error: 'invalid_grant', error_description: 'unknown code' });
+        codes.delete(params.get('code'));
+        if (s256(params.get('code_verifier') || '') !== stored.challenge) {
+          return json(400, { error: 'invalid_grant', error_description: 'PKCE verification failed' });
+        }
+        const accessToken = `at-${crypto.randomBytes(12).toString('hex')}`;
+        const refreshToken = `rt-${crypto.randomBytes(12).toString('hex')}`;
+        issued.add(accessToken);
+        refreshTokens.set(refreshToken, { clientId: stored.clientId, accessToken });
+        return json(200, {
+          access_token: accessToken,
+          token_type: 'Bearer',
+          expires_in: expiresIn,
+          refresh_token: refreshToken,
+        });
+      }
+
+      if (grant === 'refresh_token') {
+        const stored = refreshTokens.get(params.get('refresh_token'));
+        if (!stored) return json(400, { error: 'invalid_grant', error_description: 'unknown refresh token' });
+        refreshTokens.delete(params.get('refresh_token'));
+        issued.delete(stored.accessToken);
+        state.refreshCount += 1;
+        const accessToken = `at-${crypto.randomBytes(12).toString('hex')}`;
+        const refreshToken = `rt-${crypto.randomBytes(12).toString('hex')}`;
+        issued.add(accessToken);
+        refreshTokens.set(refreshToken, { clientId: stored.clientId, accessToken });
+        return json(200, {
+          access_token: accessToken,
+          token_type: 'Bearer',
+          expires_in: expiresIn,
+          refresh_token: refreshToken,
+        });
+      }
+
+      return json(400, { error: 'unsupported_grant_type' });
+    }
+
+    json(404, { error: 'not found' });
+  });
+
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      resolve({
+        url: `http://127.0.0.1:${server.address().port}`,
+        issued,
+        authRequests,
+        get refreshCount() { return state.refreshCount; },
+        /**
+         * Simulate the human approving a sign-in. Pass the authorization
+         * URL the engine handed out (the SDK never fetches /authorize
+         * itself — that is the browser's job); with no argument, the last
+         * browser-fetched /authorize request is used instead.
+         */
+        approve(authorizationUrl) {
+          const reqParams = authorizationUrl
+            ? Object.fromEntries(new URL(authorizationUrl).searchParams)
+            : authRequests[authRequests.length - 1];
+          if (!reqParams) throw new Error('no authorization request to approve');
+          const code = `code-${crypto.randomBytes(8).toString('hex')}`;
+          codes.set(code, {
+            challenge: reqParams.code_challenge,
+            clientId: reqParams.client_id,
+            redirectUri: reqParams.redirect_uri,
+            state: reqParams.state,
+          });
+          const redirect = new URL(reqParams.redirect_uri);
+          redirect.searchParams.set('code', code);
+          if (reqParams.state) redirect.searchParams.set('state', reqParams.state);
+          // RFC 9207: a real declaring AS (Google) always stamps the response
+          // with its issuer; send it unconditionally — clients validate it
+          // only when the metadata declares support.
+          const issuer = `http://127.0.0.1:${server.address().port}`;
+          redirect.searchParams.set('iss', issuer);
+          return { redirectUrl: redirect.toString(), code, state: reqParams.state, iss: issuer };
+        },
+        close: () => new Promise((r) => server.close(r)),
+      });
+    });
+  });
+}
+
+module.exports = { startFakeAs };

package/test/helpers/fake-mcp-http.js

@@ -0,0 +1,137 @@
+// Hermetic streamable-HTTP MCP server: JSON-RPC over POST with plain JSON
+// responses (the spec's stateless mode). Optionally OAuth-protected — a
+// request without a valid bearer gets 401 + the RFC 9728 pointer at the
+// fake AS, which is exactly what drives the SDK's discovery.
+'use strict';
+
+const http = require('node:http');
+
+const DEFAULT_TOOLS = [
+  {
+    name: 'echo',
+    description: 'Echo the message back',
+    inputSchema: {
+      type: 'object',
+      properties: { message: { type: 'string', description: 'What to echo' } },
+      required: ['message'],
+    },
+  },
+];
+
+/**
+ * @param {object} [opts]
+ * @param {boolean} [opts.requireAuth]
+ * @param {string} [opts.asUrl]          the fake AS (required with requireAuth)
+ * @param {Set<string>} [opts.issued]    tokens the AS minted (shared set)
+ * @param {Array} [opts.tools]
+ * @param {(name, args) => object} [opts.onCall]  → { text, isError? }
+ * @param {boolean} [opts.failCalls]     every tools/call errors (tool-error path)
+ */
+function startFakeMcpHttp({
+  requireAuth = false, asUrl, issued = new Set(), tools = DEFAULT_TOOLS,
+  onCall, failCalls = false,
+} = {}) {
+  const seen = { calls: [], initializes: 0 };
+
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url, `http://${req.headers.host}`);
+    const base = `http://127.0.0.1:${server.address().port}`;
+    const json = (status, body, headers = {}) => {
+      res.writeHead(status, { 'content-type': 'application/json', ...headers });
+      res.end(JSON.stringify(body));
+    };
+
+    if (req.method === 'GET' && url.pathname.startsWith('/.well-known/oauth-protected-resource')) {
+      return json(200, {
+        resource: base,
+        authorization_servers: [asUrl],
+      });
+    }
+
+    if (req.method === 'GET') {
+      // No standing SSE stream in the fake — the spec allows 405.
+      res.writeHead(405, { allow: 'POST' });
+      return res.end();
+    }
+
+    if (req.method !== 'POST') {
+      res.writeHead(405);
+      return res.end();
+    }
+
+    if (requireAuth) {
+      const m = /^Bearer (.+)$/.exec(req.headers.authorization || '');
+      if (!m || !issued.has(m[1])) {
+        return json(401, { error: 'unauthorized' }, {
+          'www-authenticate': `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`,
+        });
+      }
+    }
+
+    let body = '';
+    for await (const chunk of req) body += chunk;
+    let msg;
+    try {
+      msg = JSON.parse(body);
+    } catch {
+      return json(400, { error: 'bad json' });
+    }
+
+    // Notifications get a bare 202 (spec: no body).
+    if (msg.id === undefined) {
+      res.writeHead(202);
+      return res.end();
+    }
+
+    const reply = (result) => json(200, { jsonrpc: '2.0', id: msg.id, result });
+    const rpcError = (code, message) => json(200, {
+      jsonrpc: '2.0', id: msg.id, error: { code, message },
+    });
+
+    switch (msg.method) {
+      case 'initialize':
+        seen.initializes += 1;
+        return reply({
+          protocolVersion: msg.params?.protocolVersion || '2025-06-18',
+          capabilities: { tools: {} },
+          serverInfo: { name: 'fake-mcp-http', version: '1.0.0' },
+        });
+      case 'ping':
+        return reply({});
+      case 'tools/list':
+        return reply({ tools });
+      case 'tools/call': {
+        seen.calls.push({ name: msg.params?.name, args: msg.params?.arguments });
+        if (failCalls) {
+          return reply({
+            content: [{ type: 'text', text: 'the service rejected this request' }],
+            isError: true,
+          });
+        }
+        const out = onCall
+          ? onCall(msg.params?.name, msg.params?.arguments || {})
+          : { text: `echo: ${msg.params?.arguments?.message ?? ''}` };
+        return reply({
+          content: [{ type: 'text', text: out.text }],
+          isError: Boolean(out.isError),
+        });
+      }
+      default:
+        // Unknown methods (incl. the 2026 discover probe) → legacy signal.
+        return rpcError(-32601, `method not found: ${msg.method}`);
+    }
+  });
+
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      resolve({
+        url: `http://127.0.0.1:${server.address().port}`,
+        seen,
+        issued,
+        close: () => new Promise((r) => server.close(r)),
+      });
+    });
+  });
+}
+
+module.exports = { startFakeMcpHttp, DEFAULT_TOOLS };