@cyanheads/mcp-ts-core 0.11.0 → 0.11.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +9 -5
- package/CLAUDE.md +9 -5
- package/README.md +4 -2
- package/biome.json +1 -1
- package/changelog/0.11.x/0.11.0.md +0 -2
- package/changelog/0.11.x/0.11.1.md +74 -0
- package/dist/logs/combined.log +8 -8
- package/dist/logs/error.log +4 -4
- package/dist/testing/fuzz.d.ts +5 -1
- package/dist/testing/fuzz.d.ts.map +1 -1
- package/dist/testing/fuzz.js +118 -27
- package/dist/testing/fuzz.js.map +1 -1
- package/dist/testing/index.d.ts +111 -1
- package/dist/testing/index.d.ts.map +1 -1
- package/dist/testing/index.js +139 -0
- package/dist/testing/index.js.map +1 -1
- package/dist/testing/vitest.d.ts +77 -12
- package/dist/testing/vitest.d.ts.map +1 -1
- package/dist/testing/vitest.js +88 -11
- package/dist/testing/vitest.js.map +1 -1
- package/package.json +21 -21
- package/skills/api-testing/SKILL.md +65 -4
- package/skills/security-pass/SKILL.md +2 -2
- package/templates/devcheck.config.json +1 -1
- package/templates/package.json +2 -0
- package/templates/tests/fuzz/echo-tool.fuzz.test.ts +20 -0
- package/templates/tests/integration/echo-contract.int.test.ts +25 -0
- package/templates/tests/smoke/definitions.smoke.test.ts +46 -0
- package/templates/vitest.config.ts +24 -27
- package/vitest.config.base.mjs +6 -0
package/AGENTS.md
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
# Developer Protocol
|
|
2
2
|
|
|
3
3
|
**Package:** `@cyanheads/mcp-ts-core`
|
|
4
|
-
**Version:** 0.11.
|
|
4
|
+
**Version:** 0.11.1
|
|
5
5
|
**Engines:** Bun ≥1.3.0, Node ≥24.0.0
|
|
6
|
-
**MCP SDK:** `@modelcontextprotocol/sdk` ^1.
|
|
6
|
+
**MCP SDK:** `@modelcontextprotocol/sdk` ^1.30.0
|
|
7
7
|
**Zod:** ^4.4.3
|
|
8
8
|
**GitHub:** [cyanheads/mcp-ts-core](https://github.com/cyanheads/mcp-ts-core)
|
|
9
9
|
**npm:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
|
|
@@ -60,9 +60,9 @@ Both paths share the same public API. Init copies starter `package.json`, config
|
|
|
60
60
|
| `/utils` | formatting, encoding, network, pagination, overflow (`outlineOnOverflow`, `OUTLINE_VARIANT`, `selectSections`, `formatOutline`), logging, runtime, telemetry, token counting, parsers†, sanitization†, scheduling† | All utilities (†optional peer deps) |
|
|
61
61
|
| `/services` | `OpenRouterProvider`, `SpeechService`, `createSpeechProvider`, `ElevenLabsProvider`, `WhisperProvider`, `GraphService`, provider interfaces and types | LLM, Speech (TTS/STT), Graph services |
|
|
62
62
|
| `/linter` | `validateDefinitions`, `LintReport`, `LintDiagnostic`, `LintInput`, `LintSeverity` | Definition validation |
|
|
63
|
-
| `/testing` | `createMockContext`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage` | Test
|
|
63
|
+
| `/testing` | `createMockContext`, `createMockSession`, `createFetchMock`, `runToolContract`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage` | Test kit for handlers and upstream HTTP boundaries |
|
|
64
64
|
| `/testing/fuzz` | `fuzzTool`, `fuzzResource`, `fuzzPrompt`, `zodToArbitrary`, `adversarialArbitrary`, `ADVERSARIAL_STRINGS` | Fuzz testing |
|
|
65
|
-
| `/testing/vitest` | `mcpTest`, `McpTestFixtures` (+ re-exported `
|
|
65
|
+
| `/testing/vitest` | `mcpTest`, `toolContractSuite`, `McpTestFixtures` (+ re-exported `/testing` helpers) | Vitest fixtures and tool conformance suites (optional peer `vitest`) |
|
|
66
66
|
|
|
67
67
|
All subpaths prefixed with `@cyanheads/mcp-ts-core`. **†Tier 3 modules** require optional peer dependencies — see `package.json` `peerDependencies`. Tier 3 methods that lazy-load deps are **async**.
|
|
68
68
|
|
|
@@ -458,9 +458,13 @@ describe('myTool', () => {
|
|
|
458
458
|
|
|
459
459
|
**`createMockContext` options:** `createMockContext()` (minimal), `{ tenantId: 'test-tenant' }` (enables state), `{ elicit: vi.fn() }`, `{ progress: true }` (task progress).
|
|
460
460
|
|
|
461
|
+
**HTTP/session fixtures:** `createFetchMock(routes)` provides a strict fetch-compatible fake with ordered routes, captured `Request` objects, one-shot responses, and optional global install/restore. `createMockSession(options)` returns `{ sessionId, tenantId?, ctx }` for handlers that branch on durable HTTP session identity.
|
|
462
|
+
|
|
461
463
|
**Schema assertions:** `expect(result).toEqual(expect.schemaMatching(myTool.output))` — Vitest 4's Standard Schema asymmetric matcher validates handler output against the definition's own Zod schema. Use when output is dynamic (timestamps, generated IDs); exact `toEqual` still wins when the full value is known.
|
|
462
464
|
|
|
463
|
-
**Fixture-based tests:** `mcpTest` from `/testing/vitest` (optional peer `vitest`) extends Vitest's `test` with per-test fixtures: `ctx` (fresh mock context) and `storage` (fresh in-memory `StorageService`). Override fixtures via `.extend` with the function form only — a bare value would share one mutable context across every test in the file.
|
|
465
|
+
**Fixture-based tests:** `mcpTest` from `/testing/vitest` (optional peer `vitest`) extends Vitest's `test` with per-test fixtures: `ctx` (fresh mock context), `session` (session-bound context), `fetchMock` (strict fetch fake, installed/restored around the test), and `storage` (fresh in-memory `StorageService`). Override fixtures via `.extend` with the function form only — a bare value would share one mutable context across every test in the file.
|
|
466
|
+
|
|
467
|
+
**Tool contracts:** `runToolContract(definition, input)` from `/testing` validates input/output, invokes the handler, formats content, and returns production-shaped success/error surfaces without transport auth or telemetry. `toolContractSuite(definition, { success, errors })` from `/testing/vitest` registers reusable schema/handler/error-envelope conformance cases for a server's own tool definitions.
|
|
464
468
|
|
|
465
469
|
**Fuzz testing:** `fuzzTool`/`fuzzResource`/`fuzzPrompt` from `/testing/fuzz` generate valid and adversarial inputs from Zod schemas via `fast-check`, then assert handler invariants (no crashes, no prototype pollution, no stack trace leaks). Returns a `FuzzReport` for custom assertions.
|
|
466
470
|
|
package/CLAUDE.md
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
# Developer Protocol
|
|
2
2
|
|
|
3
3
|
**Package:** `@cyanheads/mcp-ts-core`
|
|
4
|
-
**Version:** 0.11.
|
|
4
|
+
**Version:** 0.11.1
|
|
5
5
|
**Engines:** Bun ≥1.3.0, Node ≥24.0.0
|
|
6
|
-
**MCP SDK:** `@modelcontextprotocol/sdk` ^1.
|
|
6
|
+
**MCP SDK:** `@modelcontextprotocol/sdk` ^1.30.0
|
|
7
7
|
**Zod:** ^4.4.3
|
|
8
8
|
**GitHub:** [cyanheads/mcp-ts-core](https://github.com/cyanheads/mcp-ts-core)
|
|
9
9
|
**npm:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
|
|
@@ -60,9 +60,9 @@ Both paths share the same public API. Init copies starter `package.json`, config
|
|
|
60
60
|
| `/utils` | formatting, encoding, network, pagination, overflow (`outlineOnOverflow`, `OUTLINE_VARIANT`, `selectSections`, `formatOutline`), logging, runtime, telemetry, token counting, parsers†, sanitization†, scheduling† | All utilities (†optional peer deps) |
|
|
61
61
|
| `/services` | `OpenRouterProvider`, `SpeechService`, `createSpeechProvider`, `ElevenLabsProvider`, `WhisperProvider`, `GraphService`, provider interfaces and types | LLM, Speech (TTS/STT), Graph services |
|
|
62
62
|
| `/linter` | `validateDefinitions`, `LintReport`, `LintDiagnostic`, `LintInput`, `LintSeverity` | Definition validation |
|
|
63
|
-
| `/testing` | `createMockContext`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage` | Test
|
|
63
|
+
| `/testing` | `createMockContext`, `createMockSession`, `createFetchMock`, `runToolContract`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage` | Test kit for handlers and upstream HTTP boundaries |
|
|
64
64
|
| `/testing/fuzz` | `fuzzTool`, `fuzzResource`, `fuzzPrompt`, `zodToArbitrary`, `adversarialArbitrary`, `ADVERSARIAL_STRINGS` | Fuzz testing |
|
|
65
|
-
| `/testing/vitest` | `mcpTest`, `McpTestFixtures` (+ re-exported `
|
|
65
|
+
| `/testing/vitest` | `mcpTest`, `toolContractSuite`, `McpTestFixtures` (+ re-exported `/testing` helpers) | Vitest fixtures and tool conformance suites (optional peer `vitest`) |
|
|
66
66
|
|
|
67
67
|
All subpaths prefixed with `@cyanheads/mcp-ts-core`. **†Tier 3 modules** require optional peer dependencies — see `package.json` `peerDependencies`. Tier 3 methods that lazy-load deps are **async**.
|
|
68
68
|
|
|
@@ -458,9 +458,13 @@ describe('myTool', () => {
|
|
|
458
458
|
|
|
459
459
|
**`createMockContext` options:** `createMockContext()` (minimal), `{ tenantId: 'test-tenant' }` (enables state), `{ elicit: vi.fn() }`, `{ progress: true }` (task progress).
|
|
460
460
|
|
|
461
|
+
**HTTP/session fixtures:** `createFetchMock(routes)` provides a strict fetch-compatible fake with ordered routes, captured `Request` objects, one-shot responses, and optional global install/restore. `createMockSession(options)` returns `{ sessionId, tenantId?, ctx }` for handlers that branch on durable HTTP session identity.
|
|
462
|
+
|
|
461
463
|
**Schema assertions:** `expect(result).toEqual(expect.schemaMatching(myTool.output))` — Vitest 4's Standard Schema asymmetric matcher validates handler output against the definition's own Zod schema. Use when output is dynamic (timestamps, generated IDs); exact `toEqual` still wins when the full value is known.
|
|
462
464
|
|
|
463
|
-
**Fixture-based tests:** `mcpTest` from `/testing/vitest` (optional peer `vitest`) extends Vitest's `test` with per-test fixtures: `ctx` (fresh mock context) and `storage` (fresh in-memory `StorageService`). Override fixtures via `.extend` with the function form only — a bare value would share one mutable context across every test in the file.
|
|
465
|
+
**Fixture-based tests:** `mcpTest` from `/testing/vitest` (optional peer `vitest`) extends Vitest's `test` with per-test fixtures: `ctx` (fresh mock context), `session` (session-bound context), `fetchMock` (strict fetch fake, installed/restored around the test), and `storage` (fresh in-memory `StorageService`). Override fixtures via `.extend` with the function form only — a bare value would share one mutable context across every test in the file.
|
|
466
|
+
|
|
467
|
+
**Tool contracts:** `runToolContract(definition, input)` from `/testing` validates input/output, invokes the handler, formats content, and returns production-shaped success/error surfaces without transport auth or telemetry. `toolContractSuite(definition, { success, errors })` from `/testing/vitest` registers reusable schema/handler/error-envelope conformance cases for a server's own tool definitions.
|
|
464
468
|
|
|
465
469
|
**Fuzz testing:** `fuzzTool`/`fuzzResource`/`fuzzPrompt` from `/testing/fuzz` generate valid and adversarial inputs from Zod schemas via `fast-check`, then assert handler invariants (no crashes, no prototype pollution, no stack trace leaks). Returns a `FuzzReport` for custom assertions.
|
|
466
470
|
|
package/README.md
CHANGED
|
@@ -5,9 +5,9 @@
|
|
|
5
5
|
|
|
6
6
|
<div align="center">
|
|
7
7
|
|
|
8
|
-
[](./CHANGELOG.md) [](./LICENSE) [](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx)
|
|
9
9
|
|
|
10
|
-
[](https://modelcontextprotocol.io/) [](https://www.typescriptlang.org/) [](https://bun.sh/)
|
|
11
11
|
|
|
12
12
|
[](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
|
|
13
13
|
|
|
@@ -275,6 +275,8 @@ const result = await myTool.handler(input, ctx);
|
|
|
275
275
|
|
|
276
276
|
`createMockContext()` provides stubbed `log`, `state`, and `signal`. Pass `{ tenantId }` for state operations, `{ elicit }` for elicitation mocking, `{ progress: true }` for task tools.
|
|
277
277
|
|
|
278
|
+
`/testing` also exports `createMockSession()` for session-bound contexts, `createFetchMock()` for upstream HTTP boundaries, and `runToolContract()` to drive a definition through schema, handler, formatting, and error-envelope checks. `/testing/vitest` adds the `mcpTest` fixtures (`ctx`, `session`, `fetchMock`, `storage`) and `toolContractSuite()`.
|
|
279
|
+
|
|
278
280
|
### Fuzz testing
|
|
279
281
|
|
|
280
282
|
Schema-aware fuzz testing via `fast-check`. Generates valid inputs from Zod schemas and adversarial payloads (prototype pollution, injection strings, type confusion) to verify handler invariants.
|
package/biome.json
CHANGED
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
---
|
|
2
|
+
summary: "Test kit gains session, upstream-HTTP, and tool-contract helpers; the fuzz generator expands finite nesting in full and honors array length constraints; scaffolds ship smoke, integration, and fuzz suites."
|
|
3
|
+
breaking: false
|
|
4
|
+
security: false
|
|
5
|
+
agent-notes: |
|
|
6
|
+
New scaffolds get `tests/smoke/`, `tests/integration/`, and `tests/fuzz/` plus
|
|
7
|
+
the matching `vitest.config.ts` projects and a `test:coverage` script. Existing
|
|
8
|
+
servers get none of this from an upgrade — copy the suites from
|
|
9
|
+
`templates/tests/` and uncomment the projects if the server wants them.
|
|
10
|
+
|
|
11
|
+
Servers whose tools declare an `errors[]` contract should re-read their
|
|
12
|
+
`fuzzTool` assertions: a thrown `McpError` is now a handled outcome rather than
|
|
13
|
+
a crash, so a suite that asserted on `report.crashes` to prove a contract fires
|
|
14
|
+
needs a different assertion.
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
# 0.11.1 — 2026-08-02
|
|
18
|
+
|
|
19
|
+
## Added
|
|
20
|
+
|
|
21
|
+
- **`createMockSession(options)`** (`/testing`) — returns `{ ctx, sessionId, tenantId? }` for handlers that branch on durable HTTP session identity. Session ID defaults to `test-session-id` so assertions don't depend on generated values.
|
|
22
|
+
- **`createFetchMock(routes, options)`** (`/testing`) — strict fetch fake for upstream HTTP boundaries. Routes match in registration order by exact URL, `RegExp`, or request predicate, with optional `method` and `once` constraints; requests are captured as clones on `harness.calls`. Unmatched requests reject unless `onUnhandled` is supplied. `install()`/`restore()` swap `globalThis.fetch`.
|
|
23
|
+
- **`runToolContract(definition, input, options?)`** (`/testing`) — drives a tool definition through input parsing, the real handler, output parsing, `format()`, enrichment, and collected content, returning the production `CallToolResult` for both the success and error envelopes. Transport auth and telemetry are skipped.
|
|
24
|
+
- **`toolContractSuite(definition, { success, errors })`** (`/testing/vitest`) — registers a Vitest conformance suite over `runToolContract`. Error cases assert the JSON-RPC code and, optionally, `structuredContent.error.data.reason`.
|
|
25
|
+
- **`mcpTest` fixtures `session` and `fetchMock`** — `session` supplies a fresh `MockSession`; `fetchMock` installs the harness as `globalThis.fetch` only for tests that request it and restores it afterward.
|
|
26
|
+
- **Scaffolded test suites** — `bunx @cyanheads/mcp-ts-core init` now writes `tests/smoke/definitions.smoke.test.ts`, `tests/integration/echo-contract.int.test.ts`, and `tests/fuzz/echo-tool.fuzz.test.ts`, with the matching `smoke`/`integration`/`fuzz` projects active in `vitest.config.ts` and a `test:coverage` script backed by `@vitest/coverage-istanbul`.
|
|
27
|
+
|
|
28
|
+
## Changed
|
|
29
|
+
|
|
30
|
+
- **`fuzzTool`/`fuzzResource` treat a thrown `McpError` as a handled outcome**, not a crash. The error message is still leak-checked, so a stack trace or internal path in a domain error still lands in `report.leaks`. `fuzzTool` also passes a tool's `errors[]` contract into the mock context, so a handler calling `ctx.fail(...)` runs under fuzz instead of throwing on an unattached contract.
|
|
31
|
+
- **Coverage thresholds** raised to lines 94, functions 94, branches 87, statements 94, and the same block added to `vitest.config.base.mjs` so consumers extending the base config inherit it.
|
|
32
|
+
- **`typescript` dropped from the `outdated` allowlist** in `devcheck.config.json` and `templates/devcheck.config.json`.
|
|
33
|
+
- **`api-testing` skill 1.6** — documents `createMockSession`, `createFetchMock`, `runToolContract`, `toolContractSuite`, and the two new fixtures.
|
|
34
|
+
- **`security-pass` skill 1.6** — the elicitation-gate check no longer expects a refusing fallback. `ctx.elicit` is `undefined` on every Streamable HTTP request ([#312](https://github.com/cyanheads/mcp-ts-core/issues/312)), so refusing makes gated tools unusable on the hosted transport; the check now asks that the fallback proceed on annotations and say so in the tool description, and that a declined or unparseable response never proceeds.
|
|
35
|
+
- **Package description** aligned with the README across `package.json` and `CITATION.cff`.
|
|
36
|
+
|
|
37
|
+
## Fixed
|
|
38
|
+
|
|
39
|
+
- **`zodToArbitrary` expands finite nesting in full** ([#319](https://github.com/cyanheads/mcp-ts-core/issues/319)). The fixed depth-six cutoff replaced deeper nodes with `null`, so an ordinary seven-level object schema generated values its own schema rejects and `fuzzTool` skipped them as invalid Phase 1 samples. Recursion is now detected by node identity along the current path, with a depth-32 backstop for getters that mint a fresh node per access; a node that cannot terminate collapses to an absence the schema accepts — `[]` for an array element, an omitted optional, `null` for a nullable — instead of an inline `null`.
|
|
40
|
+
- **`zodToArbitrary` honors Zod 4 array length constraints** ([#320](https://github.com/cyanheads/mcp-ts-core/issues/320)). `ZodArray` exposes no `.minLength`/`.maxLength` accessors — `.min()`, `.max()`, `.length()`, and `.nonempty()` all land in `_def.checks` — so the accessor read returned `undefined` and every constraint fell back to a fixed 0–5 length. Bounds are now resolved from the `min_length`, `max_length`, and `length_equals` checks.
|
|
41
|
+
|
|
42
|
+
## Dependencies
|
|
43
|
+
|
|
44
|
+
Runtime:
|
|
45
|
+
|
|
46
|
+
- `@hono/node-server` `^2.0.11` → `^2.0.12`
|
|
47
|
+
- `@modelcontextprotocol/ext-apps` `^1.7.4` → `^1.7.5`
|
|
48
|
+
- `@modelcontextprotocol/sdk` `^1.29.0` → `^1.30.0`
|
|
49
|
+
- `hono` `^4.12.31` → `^4.12.32`
|
|
50
|
+
- `jose` `^6.2.4` → `^6.2.5`
|
|
51
|
+
|
|
52
|
+
Dev:
|
|
53
|
+
|
|
54
|
+
- `@biomejs/biome` `2.5.5` → `2.5.6` (plus the `biome.json` `$schema` URL)
|
|
55
|
+
- `@cloudflare/vitest-pool-workers` `^0.18.6` → `^0.19.1`
|
|
56
|
+
- `@cloudflare/workers-types` `5.20260706.1` → `5.20260730.1`
|
|
57
|
+
- `@duckdb/node-api` `^1.5.5-r.1` → `^1.5.5-r.2`
|
|
58
|
+
- `@opentelemetry/instrumentation-pino` `^0.66.0` → `^0.67.0`
|
|
59
|
+
- `@supabase/supabase-js` `^2.110.8` → `^2.111.0`
|
|
60
|
+
- `@types/node` `26.1.1` → `26.1.2`
|
|
61
|
+
- `better-sqlite3` `^13.0.1` → `^13.0.2`
|
|
62
|
+
- `clipboardy` `^5.3.1` → `^5.3.2`
|
|
63
|
+
- `js-yaml` `^5.2.1` → `^5.2.2`
|
|
64
|
+
- `openai` `^6.48.0` → `^6.49.0`
|
|
65
|
+
- `unpdf` `^1.6.2` → `^1.8.0`
|
|
66
|
+
- `vite` `8.1.5` → `8.2.0`
|
|
67
|
+
|
|
68
|
+
Overrides:
|
|
69
|
+
|
|
70
|
+
- `brace-expansion` `^2.1.2` → `^2.1.3`
|
|
71
|
+
|
|
72
|
+
Templates:
|
|
73
|
+
|
|
74
|
+
- `@vitest/coverage-istanbul` `4.1.10` added
|
package/dist/logs/combined.log
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
|
-
{"level":40,"time":
|
|
2
|
-
{"level":40,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
5
|
-
{"level":40,"time":
|
|
6
|
-
{"level":40,"time":
|
|
7
|
-
{"level":50,"time":
|
|
8
|
-
{"level":50,"time":
|
|
1
|
+
{"level":40,"time":1785693822104,"env":"testing","version":"0.11.1","pid":36606,"transport":"http","requestId":"HFRXU-4BH7I","timestamp":"2026-08-02T18:03:42.104Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
|
|
2
|
+
{"level":40,"time":1785693823928,"env":"testing","version":"0.11.1","pid":36606,"component":"HttpTransport","requestId":"5OFOA-HME3I","timestamp":"2026-08-02T18:03:43.928Z","operation":"HttpRpcRequest","sessionId":"not-a-real-session-1785693823927","msg":"Session validation failed - invalid or hijacked session"}
|
|
3
|
+
{"level":50,"time":1785693826485,"env":"testing","version":"0.0.0-test","pid":36627,"requestId":"CADO7-L3PJZ","timestamp":"2026-08-02T18:03:46.485Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"ab280bd1fa662eedb59dd4ad976bc68ce2c055d82454d16a77158837e598a5a5","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"ab280bd1fa662eedb59dd4ad976bc68ce2c055d82454d16a77158837e598a5a5","toolName":"scoped_echo","requestId":"CADO7-L3PJZ","timestamp":"2026-08-02T18:03:46.485Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)"},"stack":"McpError: Insufficient permissions.\n at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
4
|
+
{"level":50,"time":1785693826497,"env":"testing","version":"0.0.0-test","pid":36627,"requestId":"VYAG2-FLU7B","timestamp":"2026-08-02T18:03:46.497Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"c5b31d840c44642587c0979a57a7c12e3bcce4fd18f16912a3f7ce55ced0c850","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"c5b31d840c44642587c0979a57a7c12e3bcce4fd18f16912a3f7ce55ced0c850","toolName":"scoped_echo","requestId":"VYAG2-FLU7B","timestamp":"2026-08-02T18:03:46.497Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)"},"stack":"McpError: Insufficient permissions.\n at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
5
|
+
{"level":40,"time":1785693839069,"env":"testing","version":"0.11.1","pid":36761,"transport":"http","requestId":"6LLX6-XECCU","timestamp":"2026-08-02T18:03:59.068Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
|
|
6
|
+
{"level":40,"time":1785693840805,"env":"testing","version":"0.11.1","pid":36761,"component":"HttpTransport","requestId":"2RZIN-4Q2EI","timestamp":"2026-08-02T18:04:00.805Z","operation":"HttpRpcRequest","sessionId":"not-a-real-session-1785693840805","msg":"Session validation failed - invalid or hijacked session"}
|
|
7
|
+
{"level":50,"time":1785693843290,"env":"testing","version":"0.0.0-test","pid":36786,"requestId":"YPH96-FD95R","timestamp":"2026-08-02T18:04:03.289Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"8a2ffcfdf1e644a7e2130ed3b832d6f47b4f56d5dabf7fa0eb6b7a0a6f65387c","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"8a2ffcfdf1e644a7e2130ed3b832d6f47b4f56d5dabf7fa0eb6b7a0a6f65387c","toolName":"scoped_echo","requestId":"YPH96-FD95R","timestamp":"2026-08-02T18:04:03.289Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
8
|
+
{"level":50,"time":1785693843300,"env":"testing","version":"0.0.0-test","pid":36786,"requestId":"TPS8Q-Y0DA9","timestamp":"2026-08-02T18:04:03.300Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"cac532ca1c52fe40248f43323d7b5f473bfb6d61722b4f0f7371d38b228fd200","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"cac532ca1c52fe40248f43323d7b5f473bfb6d61722b4f0f7371d38b228fd200","toolName":"scoped_echo","requestId":"TPS8Q-Y0DA9","timestamp":"2026-08-02T18:04:03.300Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
package/dist/logs/error.log
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
{"level":50,"time":
|
|
2
|
-
{"level":50,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
1
|
+
{"level":50,"time":1785693826485,"env":"testing","version":"0.0.0-test","pid":36627,"requestId":"CADO7-L3PJZ","timestamp":"2026-08-02T18:03:46.485Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"ab280bd1fa662eedb59dd4ad976bc68ce2c055d82454d16a77158837e598a5a5","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"ab280bd1fa662eedb59dd4ad976bc68ce2c055d82454d16a77158837e598a5a5","toolName":"scoped_echo","requestId":"CADO7-L3PJZ","timestamp":"2026-08-02T18:03:46.485Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)"},"stack":"McpError: Insufficient permissions.\n at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
2
|
+
{"level":50,"time":1785693826497,"env":"testing","version":"0.0.0-test","pid":36627,"requestId":"VYAG2-FLU7B","timestamp":"2026-08-02T18:03:46.497Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"c5b31d840c44642587c0979a57a7c12e3bcce4fd18f16912a3f7ce55ced0c850","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"c5b31d840c44642587c0979a57a7c12e3bcce4fd18f16912a3f7ce55ced0c850","toolName":"scoped_echo","requestId":"VYAG2-FLU7B","timestamp":"2026-08-02T18:03:46.497Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)"},"stack":"McpError: Insufficient permissions.\n at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:114:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
3
|
+
{"level":50,"time":1785693843290,"env":"testing","version":"0.0.0-test","pid":36786,"requestId":"YPH96-FD95R","timestamp":"2026-08-02T18:04:03.289Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"8a2ffcfdf1e644a7e2130ed3b832d6f47b4f56d5dabf7fa0eb6b7a0a6f65387c","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"8a2ffcfdf1e644a7e2130ed3b832d6f47b4f56d5dabf7fa0eb6b7a0a6f65387c","toolName":"scoped_echo","requestId":"YPH96-FD95R","timestamp":"2026-08-02T18:04:03.289Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
4
|
+
{"level":50,"time":1785693843300,"env":"testing","version":"0.0.0-test","pid":36786,"requestId":"TPS8Q-Y0DA9","timestamp":"2026-08-02T18:04:03.300Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"cac532ca1c52fe40248f43323d7b5f473bfb6d61722b4f0f7371d38b228fd200","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"cac532ca1c52fe40248f43323d7b5f473bfb6d61722b4f0f7371d38b228fd200","toolName":"scoped_echo","requestId":"TPS8Q-Y0DA9","timestamp":"2026-08-02T18:04:03.300Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
package/dist/testing/fuzz.d.ts
CHANGED
|
@@ -33,6 +33,10 @@ export interface FuzzOptions {
|
|
|
33
33
|
* Converts a Zod schema to a fast-check `Arbitrary` that produces valid values.
|
|
34
34
|
* Supports the JSON-Schema-serializable subset used by MCP tool/resource schemas.
|
|
35
35
|
*
|
|
36
|
+
* Finite nesting is expanded in full, however deep. A self-referential schema —
|
|
37
|
+
* Zod 4's getter pattern, where reading `.shape` re-enters the same node —
|
|
38
|
+
* terminates at the point of recursion with an absence the schema accepts.
|
|
39
|
+
*
|
|
36
40
|
* Requires `fast-check` to be loaded first — call from within a `fuzzTool()`/
|
|
37
41
|
* `fuzzResource()`/`fuzzPrompt()` run, or call `loadFc()` before standalone use.
|
|
38
42
|
*/
|
|
@@ -68,7 +72,7 @@ export interface FuzzReport {
|
|
|
68
72
|
* Designed to be called inside a `describe()` / `it()` block.
|
|
69
73
|
*
|
|
70
74
|
* Checks:
|
|
71
|
-
* 1. Valid inputs -> handler
|
|
75
|
+
* 1. Valid inputs -> handler returns schema-valid output or a well-formed MCP error
|
|
72
76
|
* 2. Adversarial inputs -> Zod rejects or handler errors gracefully
|
|
73
77
|
* 3. No prototype pollution on Object.prototype
|
|
74
78
|
* 4. No stack trace / path leaks in error messages
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fuzz.d.ts","sourceRoot":"","sources":["../../src/testing/fuzz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAalD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;
|
|
1
|
+
{"version":3,"file":"fuzz.d.ts","sourceRoot":"","sources":["../../src/testing/fuzz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAalD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAEpF,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQxE,wMAAwM;AACxM,wBAAsB,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAGjD;AAiBD,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,GAAG,CAAC,EAAE,kBAAkB,CAAC;IACzB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmCD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAErE;AA6LD,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAwDvC,CAAC;AAEX,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CA6B5D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,GAC7B,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAUvC;AAmFD,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD,4DAA4D;IAC5D,KAAK,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,sDAAsD;IACtD,kBAAkB,EAAE,OAAO,CAAC;IAC5B,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,iBAAiB,EACtB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAkGrB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,qBAAqB,EAC1B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA+ErB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,mBAAmB,EACxB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAsErB"}
|