@cyanheads/mcp-ts-core 0.11.0 → 0.11.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/mcp-ts-core",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "mcpName": "io.github.cyanheads/mcp-ts-core",
   "description": "Agent-native TypeScript framework for building MCP servers. Declarative definitions with auth, multi-backend storage, OpenTelemetry, and first-class support for Bun/Node/Cloudflare Workers.",
   "files": [
@@ -172,10 +172,12 @@
     "tree": "bun run scripts/tree.ts",
     "fetch-spec": "bun run scripts/fetch-openapi-spec.ts",
     "test": "bunx vitest run",
-    "test:all": "bun run test:coverage && bun run test:node && bun run test:worker && bun run test:integration",
+    "test:all": "bun run rebuild && bun run test:coverage && bun run test:node && bun run test:worker && bun run test:integration",
     "test:integration": "bunx vitest run --config vitest.integration.ts",
     "test:leaks": "bunx vitest run --detect-async-leaks",
     "test:node": "sh -c 'NODE_BIN=$(which -a node | grep -v /bun-node- | head -n 1); \"$NODE_BIN\" ./node_modules/vitest/vitest.mjs run && \"$NODE_BIN\" ./node_modules/vitest/vitest.mjs run --config vitest.integration.ts'",
+    "test:order": "sh -c 'NODE_BIN=$(which -a node | grep -v /bun-node- | head -n 1); \"$NODE_BIN\" ./node_modules/vitest/vitest.mjs run --sequence.shuffle --sequence.seed=20260809 --expect.requireAssertions'",
+    "test:package": "bun run rebuild && bunx vitest run --config vitest.package.ts",
     "test:unit": "bunx vitest run --project unit",
     "test:smoke": "bunx vitest run --project smoke",
     "test:fuzz": "bunx vitest run --project fuzz",
@@ -193,57 +195,57 @@
     "publish-mcp": "mcp-publisher login github -token \"$(security find-generic-password -a \"$USER\" -s mcp-publisher-github-pat -w)\" && mcp-publisher publish"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.5",
-    "@cloudflare/vitest-pool-workers": "^0.18.6",
-    "@cloudflare/workers-types": "5.20260706.1",
-    "@duckdb/node-api": "^1.5.5-r.1",
+    "@biomejs/biome": "2.5.6",
+    "@cloudflare/vitest-pool-workers": "^0.19.1",
+    "@cloudflare/workers-types": "5.20260730.1",
+    "@duckdb/node-api": "^1.5.5-r.3",
     "@hono/otel": "^1.1.2",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.221.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
     "@opentelemetry/instrumentation-http": "^0.221.0",
-    "@opentelemetry/instrumentation-pino": "^0.66.0",
+    "@opentelemetry/instrumentation-pino": "^0.67.0",
     "@opentelemetry/resources": "^2.10.0",
     "@opentelemetry/sdk-metrics": "^2.10.0",
     "@opentelemetry/sdk-node": "^0.221.0",
     "@opentelemetry/sdk-trace-node": "^2.10.0",
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "@socketsecurity/bun-security-scanner": "^1.1.2",
-    "@supabase/supabase-js": "^2.110.8",
+    "@supabase/supabase-js": "^2.112.2",
     "@types/bun": "^1.3.14",
-    "@types/node": "26.1.1",
+    "@types/node": "26.1.2",
     "@types/papaparse": "^5.5.2",
     "@types/sanitize-html": "^2.16.1",
     "@types/validator": "^13.15.10",
     "@vitest/coverage-istanbul": "4.1.10",
     "@vitest/ui": "4.1.10",
-    "better-sqlite3": "^13.0.1",
+    "better-sqlite3": "^13.0.3",
     "bun-types": "^1.3.14",
     "chrono-node": "^2.10.1",
-    "clipboardy": "^5.3.1",
+    "clipboardy": "^5.3.2",
     "defuddle": "^0.19.2",
     "depcheck": "^1.4.7",
     "diff": "^9.0.0",
-    "execa": "^10.0.0",
+    "execa": "^10.0.1",
     "fast-check": "^4.9.0",
     "fast-xml-parser": "^5.10.1",
     "ignore": "^7.0.6",
-    "js-yaml": "^5.2.1",
+    "js-yaml": "^5.2.3",
     "linkedom": "^0.18.13",
     "node-cron": "^4.6.0",
-    "openai": "^6.48.0",
+    "openai": "^6.49.0",
     "papaparse": "^5.5.4",
     "partial-json": "^0.1.7",
     "pdf-lib": "^1.17.1",
     "pino-pretty": "^13.1.3",
-    "repomix": "^1.17.0",
+    "repomix": "^1.18.0",
     "sanitize-html": "^2.17.6",
     "tsc-alias": "^1.9.1",
     "typedoc": "^0.28.20",
     "typescript": "^7.0.2",
     "typescript-v6": "npm:typescript@^6.0.3",
-    "unpdf": "^1.6.2",
+    "unpdf": "^1.8.0",
     "validator": "^13.15.35",
-    "vite": "8.1.5",
+    "vite": "8.2.0",
     "vitest": "^4.1.10"
   },
   "keywords": [
@@ -297,13 +299,13 @@
   },
   "dependencies": {
     "@hono/mcp": "^0.3.1",
-    "@hono/node-server": "^2.0.11",
-    "@modelcontextprotocol/ext-apps": "^1.7.4",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@hono/node-server": "^2.1.0",
+    "@modelcontextprotocol/ext-apps": "^1.7.5",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@opentelemetry/api": "^1.9.1",
     "dotenv": "^17.4.2",
-    "hono": "^4.12.31",
-    "jose": "^6.2.4",
+    "hono": "^4.13.1",
+    "jose": "^6.2.8",
     "pino": "^10.3.1",
     "zod": "^4.4.3"
   },
@@ -429,11 +431,11 @@
     }
   },
   "overrides": {
-    "brace-expansion": "^2.1.2",
-    "postcss": "^8.5.22",
+    "brace-expansion": "^2.1.3",
+    "postcss": "^8.5.23",
     "protobufjs": "^7.6.5",
     "sharp": "^0.35.3",
-    "fast-uri": "^3.1.4",
-    "@hono/node-server": "^2.0.11"
+    "fast-uri": "^3.1.5",
+    "ip-address": "^10.3.1"
   }
 }

package/skills/api-testing/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Testing patterns for MCP tool/resource handlers using `createMockContext` and Vitest. Covers mock context options, handler testing, McpError assertions, format testing, Vitest config setup, and test isolation conventions.
 metadata:
   author: cyanheads
-  version: "1.5"
+  version: "1.6"
   audience: external
   type: reference
 ---
@@ -13,7 +13,7 @@ metadata:
 
 Tests target handler behavior directly — call `handler(input, ctx)`, assert on the return value or thrown error. The framework's handler factory (try/catch, formatting, telemetry) is not involved. Use `createMockContext` from `@cyanheads/mcp-ts-core/testing` to construct the `ctx` argument.
 
-**Additional exports from `/testing`:** `createMockLogger()` returns a standalone `MockContextLogger` for unit-testing code that accepts a `ContextLogger` directly (services, utilities). `createInMemoryStorage(options?)` provides a real `StorageService` backed by `InMemoryProvider` for testing services that take a `StorageService` dependency.
+**Additional exports from `/testing`:** `createMockSession()` binds a mock handler context to an HTTP session; `createFetchMock()` provides a strict upstream HTTP fake; `runToolContract()` executes a definition through schema, handler, formatting, enrichment/content, and production-shaped error-envelope checks. `createMockLogger()` returns a standalone `MockContextLogger`, and `createInMemoryStorage(options?)` provides a real `StorageService` backed by `InMemoryProvider`.
 
 **Philosophy:** Test behavior, not implementation. Refactors should not break tests. Match the repo's existing test layout: fresh scaffolds use `tests/`, while colocated `src/**/*.test.ts` files are also supported. Integration tests at I/O boundaries over unit tests of internals.
 
@@ -21,7 +21,7 @@ Tests target handler behavior directly — call `handler(input, ctx)`, assert on
 
 ## `mcpTest` — fixture-based Vitest test
 
-`mcpTest` is a `test.extend`-based Vitest test that provides `ctx` and `storage` as **per-test fixtures** — fresh instances for every test, eliminating the `createMockContext()` boilerplate and enforcing the fresh-context-per-test convention automatically.
+`mcpTest` is a `test.extend`-based Vitest test that provides `ctx`, `session`, `fetchMock`, and `storage` as **per-test fixtures** — fresh instances for every test, eliminating boilerplate and enforcing isolation automatically. `fetchMock` is installed as `globalThis.fetch` only when requested by a test and restored afterward.
 
 ```ts
 import { mcpTest } from '@cyanheads/mcp-ts-core/testing/vitest';
@@ -36,6 +36,14 @@ mcpTest('uses storage fixture', async ({ ctx, storage }) => {
   const result = await svc.doWork(ctx);
   expect(result).toBeDefined();
 });
+
+mcpTest('stubs an upstream HTTP boundary', async ({ fetchMock }) => {
+  fetchMock.route({
+    match: 'https://api.example.test/items/42',
+    respond: Response.json({ id: '42' }),
+  });
+  await expect(loadItem('42')).resolves.toMatchObject({ id: '42' });
+});
 ```
 
 ### Fixtures
@@ -43,6 +51,8 @@ mcpTest('uses storage fixture', async ({ ctx, storage }) => {
 | Fixture | Type | Per-test? | Notes |
 |:--------|:-----|:----------|:------|
 | `ctx` | `Context` | Yes | Fresh `createMockContext()` each test |
+| `session` | `MockSession` | Yes | Fresh `{ sessionId, tenantId?, ctx }` from `createMockSession()` |
+| `fetchMock` | `FetchMockHarness` | Yes | Strict fetch fake installed/restored around the requesting test |
 | `storage` | `StorageService` | Yes | Fresh `createInMemoryStorage()` each test |
 
 ### Extending with the function form
@@ -61,7 +71,58 @@ const tenantTest = mcpTest.extend({
 // const tenantTest = mcpTest.extend({ ctx: createMockContext({ tenantId: 'test-tenant' }) });
 ```
 
-`createMockContext` and `createInMemoryStorage` are re-exported from `@cyanheads/mcp-ts-core/testing/vitest` so overrides don't need a second import.
+The portable `/testing` helpers are re-exported from `@cyanheads/mcp-ts-core/testing/vitest` so fixture overrides don't need a second import.
+
+---
+
+## Upstream HTTP testing with `createFetchMock`
+
+Use the fetch harness at real outbound I/O boundaries. Stub the external service, not server-owned services or handlers.
+
+```ts
+import { createFetchMock } from '@cyanheads/mcp-ts-core/testing';
+
+const http = createFetchMock([
+  {
+    method: 'GET',
+    match: 'https://api.example.test/items/42',
+    respond: Response.json({ id: '42', name: 'Example' }),
+  },
+]);
+
+http.install();
+try {
+  await expect(loadItem('42')).resolves.toEqual({ id: '42', name: 'Example' });
+  expect(http.calls[0]?.request.url).toBe('https://api.example.test/items/42');
+} finally {
+  http.restore();
+}
+```
+
+Routes match in registration order. `match` accepts an exact URL, `RegExp`, or request predicate; `respond` accepts a clonable `Response` or response factory. Set `once: true` for one-shot behavior. Unmatched requests throw unless `onUnhandled` is provided.
+
+---
+
+## Tool conformance with `toolContractSuite`
+
+Point the reusable suite at a definition plus representative success and failure inputs. It checks input/output schemas, invokes the real handler, applies formatting/enrichment/content, and validates both public error surfaces.
+
+```ts
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+import { toolContractSuite } from '@cyanheads/mcp-ts-core/testing/vitest';
+
+toolContractSuite(searchTool, {
+  success: [{ name: 'returns matches', input: { query: 'mcp' } }],
+  errors: [{
+    name: 'reports an empty query',
+    input: { query: '' },
+    code: JsonRpcErrorCode.InvalidParams,
+    reason: 'empty_query',
+  }],
+});
+```
+
+Use `runToolContract(definition, input, { context })` from `/testing` when a custom test runner or an imperative assertion is a better fit. It intentionally skips transport auth and telemetry; those belong in transport/integration tests.
 
 ---
 

package/skills/git-wrapup/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts) and an annotated tag. Verify, commit, tag. Stops at "committed and tagged locally" — no push, no publish. The release-and-publish skill picks up from here. Distilled from the git_wrapup_instructions protocol.
 metadata:
   author: cyanheads
-  version: "1.8"
+  version: "1.9"
   audience: external
   type: workflow
 ---
@@ -95,6 +95,8 @@ security: false    # true ONLY for a security fix in this server's own source
 ---
 ```
 
+**Write `summary:` LAST, derived from the body you just wrote — never independently.** It is the line most readers see, and it propagates unedited to three further surfaces: the `CHANGELOG.md` rollup, the GitHub Release body, and the annotated tag (which cannot be edited once pushed). Written from recollection rather than from the body, it reliably names a mechanism that was never built or a target that was never fixed, while the body beside it stays correct. After writing it, re-read the body and confirm every claim in the summary appears there.
+
 **`security:` is a source-code signal — not a dependency-CVE signal.** Set `security: true` only when this release fixes a vulnerability or adds hardening in code *this server ships*. A dependency or transitive CVE bump — even one that clears an advisory (`bun audit` going 1 → 0) — is routine maintenance: record it under `## Dependencies` with the advisory ID and leave the flag `false`. The `🛡️ Security` badge answers "does the server itself have a vuln"; a dep bump must not trip it.
 
 **Body:** Section order follows Keep a Changelog — Added / Changed / Deprecated / Removed / Fixed / Security. Include only sections with entries. Delete empty sections.
@@ -142,6 +144,24 @@ git commit -m "<subject>"
 - Work commits (no version): `feat: hosted server endpoint`, `fix: handle empty SPARQL result sets`, `feat(linter): enrichment contract rules`, `docs: document the enrichment block`
 - Release commit (subject leads with the version): `chore(release): 0.2.1 — empty SPARQL result handling`
 
+**Body: every commit has one, and it is one or two lines.** Uniform across the stack — no commit ships subject-only, none ships a paragraph. One sentence stating the *why* or the load-bearing constraint, a second only if the first genuinely cannot carry it. Two lines is the hard ceiling.
+
+```
+fix: handle empty SPARQL result sets
+
+Upstream returns 200 with an empty bindings array rather than 404.
+```
+
+**Never put a closing keyword in a commit body.** `Fixes #N`, `Closes #N`, `Resolves #N` and friends close the issue the moment the commit is pushed — before the close-out comment recording what shipped, so the issue closes with no account of the fix. Reference issues as bare `(#N)` backlinks in the subject or body; closing is a deliberate later step.
+
+A body is too long the moment it:
+- enumerates the files, subsystems, or symbols touched — that is `git show --stat`
+- walks through how the implementation works — that is the code
+- narrates a fix's mechanism across multiple sentences — that is the changelog entry
+- runs to a second paragraph, ever
+
+The changelog carries the depth, the tag carries the headline, the commit carries one line of why. When the body wants to grow, that pressure is telling you the content belongs in the changelog entry.
+
 **Rules:**
 - Plain `-m` flag only — no heredoc, no command substitution
 - No `Co-authored-by` or `Generated with` trailers
@@ -218,6 +238,7 @@ If the working tree isn't clean or the tag doesn't point at HEAD, something went
 - [ ] `bun run devcheck` passes
 - [ ] `bun run test:all` (or `test`) passes
 - [ ] Work grouped into logical commits (large features split by layer); release artifacts (version + changelog + tree) committed separately on top, subject leading with the version
+- [ ] Every commit carries a body, and every body is one or two lines — none subject-only, none a paragraph
 - [ ] Annotated tag `v<version>` with structured markdown message, final line linking this version's changelog file
 - [ ] Working tree clean
 - [ ] Nothing pushed — local only

package/skills/security-pass/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Review an MCP server for common security gaps: LLM-facing surfaces as injection vector (tools, resources, prompts, descriptions), scope blast radius, destructive ops without consent, upstream auth shape, input sinks (URL / path / roots / shell / schema strictness / ReDoS), tenant isolation, leakage through errors and telemetry, unbounded resources, and HTTP-mode deployment surface. Use before a release, after a batch of handler changes, or when the user asks for a security review, audit, or hardening pass. Produces grouped findings and a numbered options list.
 metadata:
   author: cyanheads
-  version: "1.5"
+  version: "1.6"
   audience: external
   type: audit
 ---
@@ -122,7 +122,7 @@ grep -rn "ctx.elicit" src/mcp-server/tools/definitions/
 **Check:**
 
 - Each destructive handler calls `ctx.elicit` before the side effect?
-- Fallback when client doesn't support elicit — refuses, not silently proceeds?
+- Fallback when elicit is unavailable — **proceeds on the tool annotations, and says so in the tool description?** Do NOT require a refusal here: `ctx.elicit` is `undefined` on *every* Streamable HTTP request (the transport builds a fresh `McpServer` per request, so the SDK never records the client's capabilities — mcp-ts-core#312), so a refusing fallback makes the gated tools permanently unusable on the hosted transport. That is an outage, not a hardening. What IS in scope: a **declined or unparseable** elicit response must never proceed, and any doc claiming the gate protects "clients that support elicitation" must name the HTTP limitation or it overstates the control.
 - Elicit **response** validated against a Zod schema before use? The returned payload is LLM-mediated, not user-direct — "user confirmed" does not mean "user authored these exact fields."
 - Consent is scoped to the specific target (e.g., record ID rendered in the prompt), not a generic "proceed?"
 

package/templates/devcheck.config.json

@@ -12,7 +12,7 @@
     "ignorePatterns": []
   },
   "outdated": {
-    "allowlist": ["typescript"]
+    "allowlist": []
   },
   "packaging": {
     "pluginManifests": true

package/templates/package.json

@@ -36,6 +36,7 @@
     "changelog:check": "bun run scripts/build-changelog.ts --check",
     "release:github": "bun run scripts/release-github.ts",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "start": "node dist/index.js",
     "start:stdio": "MCP_TRANSPORT_TYPE=stdio node dist/index.js",
     "start:http": "MCP_TRANSPORT_TYPE=http node dist/index.js"
@@ -67,6 +68,7 @@
     "@biomejs/biome": "2.5.5",
     "@socketsecurity/bun-security-scanner": "^1.1.2",
     "@types/node": "26.1.1",
+    "@vitest/coverage-istanbul": "4.1.10",
     "depcheck": "^1.4.7",
     "ignore": "^7.0.6",
     "tsc-alias": "^1.9.1",

package/templates/tests/fuzz/echo-tool.fuzz.test.ts

@@ -0,0 +1,20 @@
+/**
+ * @fileoverview Property-based fuzz coverage for the scaffolded echo tool.
+ * @module tests/fuzz/echo-tool.fuzz.test
+ */
+
+import { expect, it } from 'vitest';
+import { fuzzTool } from '@cyanheads/mcp-ts-core/testing/fuzz';
+import { echoTool } from '@/mcp-server/tools/definitions/echo.tool.js';
+
+it('keeps the echo tool safe across generated and adversarial inputs', async () => {
+  const report = await fuzzTool(echoTool, {
+    numRuns: 50,
+    numAdversarial: 30,
+    seed: 20_260_802,
+  });
+
+  expect(report.crashes).toHaveLength(0);
+  expect(report.leaks).toHaveLength(0);
+  expect(report.prototypePollution).toBe(false);
+});

package/templates/tests/integration/echo-contract.int.test.ts

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview Tool-contract integration coverage for the scaffolded echo tool.
+ * @module tests/integration/echo-contract.int.test
+ */
+
+import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
+import { toolContractSuite } from '@cyanheads/mcp-ts-core/testing/vitest';
+import { echoTool } from '@/mcp-server/tools/definitions/echo.tool.js';
+
+toolContractSuite(echoTool, {
+  success: [
+    {
+      name: 'validates, invokes, and formats a successful call',
+      input: { message: 'integration' },
+    },
+  ],
+  errors: [
+    {
+      name: 'returns the declared dual-surface error envelope',
+      input: { message: '   ' },
+      code: JsonRpcErrorCode.InvalidParams,
+      reason: 'empty_message',
+    },
+  ],
+});

package/templates/tests/smoke/definitions.smoke.test.ts

@@ -0,0 +1,46 @@
+/**
+ * @fileoverview Smoke coverage for every definition shipped by the scaffold.
+ * @module tests/smoke/definitions.smoke.test
+ */
+
+import { describe, expect, it } from 'vitest';
+import { createMockContext } from '@cyanheads/mcp-ts-core/testing';
+import { echoPrompt } from '@/mcp-server/prompts/definitions/echo.prompt.js';
+import { echoAppUiResource } from '@/mcp-server/resources/definitions/echo-app-ui.app-resource.js';
+import { echoResource } from '@/mcp-server/resources/definitions/echo.resource.js';
+import { echoAppTool } from '@/mcp-server/tools/definitions/echo-app.app-tool.js';
+import { echoTool } from '@/mcp-server/tools/definitions/echo.tool.js';
+
+describe('scaffold definition smoke test', () => {
+  it('executes the shipped tool, resource, and prompt definitions', async () => {
+    const ctx = createMockContext();
+    const toolResult = await echoTool.handler(
+      echoTool.input.parse({ message: 'smoke' }),
+      ctx,
+    );
+    const resourceResult = await echoResource.handler(
+      echoResource.params.parse({ message: 'smoke' }),
+      ctx,
+    );
+    const promptMessages = echoPrompt.generate(echoPrompt.args.parse({ message: 'smoke' }));
+    const appResult = await echoAppTool.handler(
+      echoAppTool.input.parse({ message: 'smoke app' }),
+      ctx,
+    );
+    const appContent = echoAppTool.format?.(appResult);
+    const appHtml = await echoAppUiResource.handler(
+      echoAppUiResource.params.parse({}),
+      createMockContext({ uri: new URL('ui://template-echo-app/app.html') }),
+    );
+
+    expect(toolResult).toEqual({ message: 'smoke' });
+    expect(resourceResult).toEqual({ message: 'smoke' });
+    expect(promptMessages).toEqual([
+      { role: 'user', content: { type: 'text', text: 'Echo: smoke' } },
+    ]);
+    expect(appResult).toEqual(expect.schemaMatching(echoAppTool.output));
+    expect(appContent?.[0]).toEqual({ type: 'text', text: JSON.stringify(appResult) });
+    expect(appHtml).toContain('<title>Echo App</title>');
+    expect(appHtml).toContain('app.callServerTool');
+  });
+});

package/templates/vitest.config.ts

@@ -25,33 +25,30 @@ export default mergeConfig(
             exclude: ['tests/smoke/**', 'tests/integration/**', 'tests/fuzz/**'],
           },
         },
-        // Add more projects as your suite grows. Each inherits the framework's
-        // base config (environment, pool, coverage) and can override freely.
-        //
-        // {
-        //   extends: true,
-        //   test: {
-        //     name: 'smoke',
-        //     include: ['tests/smoke/**/*.test.ts'],
-        //   },
-        // },
-        // {
-        //   extends: true,
-        //   test: {
-        //     name: 'fuzz',
-        //     include: ['tests/fuzz/**/*.test.ts'],
-        //     testTimeout: 15_000,
-        //   },
-        // },
-        // {
-        //   extends: true,
-        //   test: {
-        //     name: 'integration',
-        //     include: ['tests/integration/**/*.test.ts'],
-        //     maxWorkers: 1,
-        //     testTimeout: 30_000,
-        //   },
-        // },
+        {
+          extends: true,
+          test: {
+            name: 'smoke',
+            include: ['tests/smoke/**/*.test.ts'],
+          },
+        },
+        {
+          extends: true,
+          test: {
+            name: 'integration',
+            include: ['tests/integration/**/*.test.ts'],
+            maxWorkers: 1,
+            testTimeout: 30_000,
+          },
+        },
+        {
+          extends: true,
+          test: {
+            name: 'fuzz',
+            include: ['tests/fuzz/**/*.test.ts'],
+            testTimeout: 15_000,
+          },
+        },
       ],
     },
   }),

package/vitest.config.base.mjs

@@ -35,6 +35,12 @@ export default defineConfig({
       reporter: ['text', 'json', 'html'],
       include: ['src/**/*.ts'],
       exclude: ['src/**/*.d.ts'],
+      thresholds: {
+        lines: 94,
+        functions: 94,
+        branches: 87,
+        statements: 94,
+      },
     },
   },
 });

package/dist/logs/combined.log

@@ -1,8 +0,0 @@
-{"level":40,"time":1785063807938,"env":"testing","version":"0.11.0","pid":56700,"transport":"http","requestId":"4S3UM-DS2A2","timestamp":"2026-07-26T11:03:27.937Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
-{"level":40,"time":1785063809897,"env":"testing","version":"0.11.0","pid":56700,"component":"HttpTransport","requestId":"SRPG5-UDGEF","timestamp":"2026-07-26T11:03:29.897Z","operation":"HttpRpcRequest","sessionId":"not-a-real-session-1785063809896","msg":"Session validation failed - invalid or hijacked session"}
-{"level":50,"time":1785063813548,"env":"testing","version":"0.0.0-test","pid":56900,"requestId":"BZXOG-60V18","timestamp":"2026-07-26T11:03:33.548Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"5c775ae579ccf2a72f4baa13d44903c5f5d4bdbed02f19e8936d4f440e2b50c6","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"5c775ae579ccf2a72f4baa13d44903c5f5d4bdbed02f19e8936d4f440e2b50c6","toolName":"scoped_echo","requestId":"BZXOG-60V18","timestamp":"2026-07-26T11:03:33.548Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1785063813562,"env":"testing","version":"0.0.0-test","pid":56900,"requestId":"0UAVG-3BJIC","timestamp":"2026-07-26T11:03:33.562Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"675ebae9a36f615bca0e44bc994e3b156d20f51156b91678bc2dd72c36ca2935","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"675ebae9a36f615bca0e44bc994e3b156d20f51156b91678bc2dd72c36ca2935","toolName":"scoped_echo","requestId":"0UAVG-3BJIC","timestamp":"2026-07-26T11:03:33.562Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":40,"time":1785063825944,"env":"testing","version":"0.11.0","pid":57179,"transport":"http","requestId":"9P2HG-AOY8N","timestamp":"2026-07-26T11:03:45.943Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
-{"level":40,"time":1785063827752,"env":"testing","version":"0.11.0","pid":57179,"component":"HttpTransport","requestId":"L3KZL-ZPBLK","timestamp":"2026-07-26T11:03:47.752Z","operation":"HttpRpcRequest","sessionId":"not-a-real-session-1785063827752","msg":"Session validation failed - invalid or hijacked session"}
-{"level":50,"time":1785063830224,"env":"testing","version":"0.0.0-test","pid":57273,"requestId":"REJHT-C3VBN","timestamp":"2026-07-26T11:03:50.223Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"7871d98a58be8d5777097cf18cde920771863c2d9652ddc4853fc9b86bb3b015","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"7871d98a58be8d5777097cf18cde920771863c2d9652ddc4853fc9b86bb3b015","toolName":"scoped_echo","requestId":"REJHT-C3VBN","timestamp":"2026-07-26T11:03:50.223Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1785063830234,"env":"testing","version":"0.0.0-test","pid":57273,"requestId":"ROVXJ-AU9NR","timestamp":"2026-07-26T11:03:50.234Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"37ca626d705d9bc28c28dbf904beb81ca5683454f810b6556b11c29b7ad78707","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"37ca626d705d9bc28c28dbf904beb81ca5683454f810b6556b11c29b7ad78707","toolName":"scoped_echo","requestId":"ROVXJ-AU9NR","timestamp":"2026-07-26T11:03:50.234Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}

package/dist/logs/error.log

@@ -1,4 +0,0 @@
-{"level":50,"time":1785063813548,"env":"testing","version":"0.0.0-test","pid":56900,"requestId":"BZXOG-60V18","timestamp":"2026-07-26T11:03:33.548Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"5c775ae579ccf2a72f4baa13d44903c5f5d4bdbed02f19e8936d4f440e2b50c6","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"5c775ae579ccf2a72f4baa13d44903c5f5d4bdbed02f19e8936d4f440e2b50c6","toolName":"scoped_echo","requestId":"BZXOG-60V18","timestamp":"2026-07-26T11:03:33.548Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1785063813562,"env":"testing","version":"0.0.0-test","pid":56900,"requestId":"0UAVG-3BJIC","timestamp":"2026-07-26T11:03:33.562Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"675ebae9a36f615bca0e44bc994e3b156d20f51156b91678bc2dd72c36ca2935","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"675ebae9a36f615bca0e44bc994e3b156d20f51156b91678bc2dd72c36ca2935","toolName":"scoped_echo","requestId":"0UAVG-3BJIC","timestamp":"2026-07-26T11:03:33.562Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1785063830224,"env":"testing","version":"0.0.0-test","pid":57273,"requestId":"REJHT-C3VBN","timestamp":"2026-07-26T11:03:50.223Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"7871d98a58be8d5777097cf18cde920771863c2d9652ddc4853fc9b86bb3b015","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"7871d98a58be8d5777097cf18cde920771863c2d9652ddc4853fc9b86bb3b015","toolName":"scoped_echo","requestId":"REJHT-C3VBN","timestamp":"2026-07-26T11:03:50.223Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1785063830234,"env":"testing","version":"0.0.0-test","pid":57273,"requestId":"ROVXJ-AU9NR","timestamp":"2026-07-26T11:03:50.234Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"37ca626d705d9bc28c28dbf904beb81ca5683454f810b6556b11c29b7ad78707","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"37ca626d705d9bc28c28dbf904beb81ca5683454f810b6556b11c29b7ad78707","toolName":"scoped_echo","requestId":"ROVXJ-AU9NR","timestamp":"2026-07-26T11:03:50.234Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:287:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:336:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}