@cyanheads/mcp-ts-core 0.7.4 → 0.7.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CLAUDE.md +1 -1
- package/README.md +1 -1
- package/changelog/0.7.x/0.7.5.md +18 -0
- package/changelog/0.7.x/0.7.6.md +23 -0
- package/changelog/template.md +2 -0
- package/dist/cli/init.js +12 -15
- package/dist/cli/init.js.map +1 -1
- package/dist/logs/combined.log +4 -4
- package/dist/logs/error.log +4 -4
- package/package.json +6 -6
- package/skills/design-mcp-server/SKILL.md +4 -1
- package/skills/field-test/SKILL.md +11 -3
- package/skills/maintenance/SKILL.md +13 -11
- package/skills/release-and-publish/SKILL.md +9 -16
- package/skills/setup/SKILL.md +2 -2
- package/templates/changelog/template.md +2 -0
- package/templates/package.json +2 -0
package/CLAUDE.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Agent Protocol
|
|
2
2
|
|
|
3
|
-
**Package:** `@cyanheads/mcp-ts-core` · **Version:** 0.7.
|
|
3
|
+
**Package:** `@cyanheads/mcp-ts-core` · **Version:** 0.7.6
|
|
4
4
|
**npm:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) · **Docker:** [ghcr.io/cyanheads/mcp-ts-core](https://ghcr.io/cyanheads/mcp-ts-core)
|
|
5
5
|
|
|
6
6
|
> **Developer note:** Never assume. Read related files and docs before making changes. Read full file content for context. Never edit a file before reading it.
|
package/README.md
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
|
|
6
6
|
<div align="center">
|
|
7
7
|
|
|
8
|
-
[](./CHANGELOG.md) [](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx) [](https://modelcontextprotocol.io/) [](./LICENSE)
|
|
9
9
|
|
|
10
10
|
[](https://www.typescriptlang.org/) [](https://bun.sh/)
|
|
11
11
|
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
---
|
|
2
|
+
summary: "init scaffold derives script list from package.json files: (closes #73); field-test and design-mcp-server skills audit descriptions for implementation leaks, meta-coaching, and consumer-aware phrasing (closes #74)"
|
|
3
|
+
breaking: false
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# 0.7.5 — 2026-04-25
|
|
7
|
+
|
|
8
|
+
Two small fixes queued from issues [#73](https://github.com/cyanheads/mcp-ts-core/issues/73) and [#74](https://github.com/cyanheads/mcp-ts-core/issues/74). The init CLI now derives the scaffold script list from `package.json` `files:` so newly-shipped framework scripts can no longer be missed by a stale hardcoded mirror; the `field-test` and `design-mcp-server` skills name three explicit categories of description leak so a review pass catches them at catalog time.
|
|
9
|
+
|
|
10
|
+
## Fixed
|
|
11
|
+
|
|
12
|
+
- **`init` scaffolds every shipped framework script ([#73](https://github.com/cyanheads/mcp-ts-core/issues/73))** — `src/cli/init.ts` previously kept a hardcoded `SCAFFOLD_SCRIPTS` array (8 entries) that drifted from `package.json` `files:` (9 shipped scripts). When 0.7.2 added `scripts/check-framework-antipatterns.ts` to `files:`, the static list missed it; fresh `npx @cyanheads/mcp-ts-core init` projects therefore produced `scripts/devcheck.ts` invoking a file that didn't exist, and `bun run devcheck` failed immediately on the new project. Replaced the static list with a derivation from `PACKAGE_JSON.files` filtered to `scripts/*.ts` — `package.json` `files:` is now the single source of truth, and any future script added there automatically scaffolds. Unit test extended to cover the regression. Same drift class as [#69](https://github.com/cyanheads/mcp-ts-core/issues/69) (maintenance skill Phase C); the symmetric fix for #69 is still pending. As an incidental simplification this commit also consolidates three duplicate `JSON.parse(readFileSync(package.json))` reads in `init.ts` to a single module-level `PACKAGE_JSON` const.
|
|
13
|
+
|
|
14
|
+
## Changed
|
|
15
|
+
|
|
16
|
+
- **`field-test` skill audits descriptions for leaks ([#74](https://github.com/cyanheads/mcp-ts-core/issues/74))** — Step 3 catalog pass now requires an explicit audit of every tool/parameter/output `.describe()` against three leak categories: *implementation details* (endpoint paths, API call counts, internal parameter mappings, routing logic), *meta-coaching* (directives like "treat X as the canonical Y", "callers should…", "the LLM should…"), and *consumer-aware phrasing* (references to "LLM", "agent", "Claude", or any specific reader). The `tools/list` jq projection now includes `outputSchema` so field-level describes are visible. Severity table `ux` row extended to mention leaky descriptions; checklist updated to require the audit. Resolves the gap where the design-time authoring rule did not reach the review-time workflow.
|
|
17
|
+
- **`design-mcp-server` skill restates the leak rule with the same three categories** — the *Don't leak implementation details* bullet under *Tool descriptions* is now *Don't leak.* with the same three sub-categories as the field-test audit. Out-of-scope per [#74](https://github.com/cyanheads/mcp-ts-core/issues/74) but trivially valuable: keeps authoring rule and review rule on identical taxonomy so guidance doesn't fork.
|
|
18
|
+
- **`CLAUDE.md` / `AGENTS.md` Version:** bumped to 0.7.5 — caught up from 0.7.3 (the v0.7.4 release missed this sync).
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
---
|
|
2
|
+
summary: "maintenance skill Phase C enumerates package scripts/ instead of a hardcoded list (closes #69); skill git references made tool-agnostic; templates ship runner-friendly start script + bun engine"
|
|
3
|
+
breaking: false
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# 0.7.6 — 2026-04-27
|
|
7
|
+
|
|
8
|
+
Patch release closing the symmetric drift fix from [#69](https://github.com/cyanheads/mcp-ts-core/issues/69) and tightening agent-facing skill prose. The `maintenance` skill's Phase C now enumerates the package's installed `scripts/` directory directly, mirroring how Phase A handles skills. Skill prose around git operations is reworded so agents pick whichever git tooling they have available rather than being pointed at literal `git <cmd>` invocations. Consumer templates pick up a runner-friendly `start` script and declare `bun` in `engines` alongside `node`.
|
|
9
|
+
|
|
10
|
+
## Fixed
|
|
11
|
+
|
|
12
|
+
- **`skills/maintenance/` Phase C enumerates the installed `scripts/` directory ([#69](https://github.com/cyanheads/mcp-ts-core/issues/69))** — replaced the hardcoded 8-name script list (`build-changelog.ts build.ts check-docs-sync.ts check-skills-sync.ts clean.ts devcheck.ts lint-mcp.ts tree.ts`) with a `for src in node_modules/@cyanheads/mcp-ts-core/scripts/*.ts` loop. The package's `files:` field gates what lands in `node_modules/.../scripts/`, so enumerating that directory IS the canonical "shipped scripts" set — newly-added scripts (like `check-framework-antipatterns.ts`, added in 0.7.2) are now picked up automatically. Loop also reports `added:` vs `updated:` for clearer signal during sync. Same drift class as [#73](https://github.com/cyanheads/mcp-ts-core/issues/73) — paired symmetric fix on the maintenance side. Deletion case (loop is one-way) was assessed and intentionally not pursued: framework script removals are rare, the `Removed` section of `CHANGELOG.md` is the existing human-in-the-loop signal, and the proposed mitigations (manifest file or `@framework-managed` marker) add permanent surface area for a problem that hasn't occurred.
|
|
13
|
+
- **YAML frontmatter quoting in `changelog/0.7.x/0.7.5.md`** — `summary:` value contained an unquoted `:` (colon-space) inside the string, which GitHub's strict YAML parser rejected with `mapping values are not allowed in this context`. Wrapped value in double quotes. Both `changelog/template.md` and `templates/changelog/template.md` gained a comment line warning future authors to keep the quotes.
|
|
14
|
+
|
|
15
|
+
## Changed
|
|
16
|
+
|
|
17
|
+
- **`skills/release-and-publish/`, `skills/setup/`, `skills/maintenance/` reworded git references to be tool-agnostic** — replaced literal `git <cmd>` invocations and `bash` fences with action-verb prose ("Use your git tools to push commits and tags to origin", "diff `bun.lock` to surface version deltas", "revert that file using your git tools"). Lets agents pick whichever git tooling they have — `mcp__git-mcp-server__*`, raw `git` via Bash, or other wrappers — instead of being pointed at a single CLI invocation. `release-and-publish` v2.1 → v2.2; `setup` v1.5 → v1.6; `maintenance` v1.6 → v1.7. Also covers `OWNER/REPO` derivation, working-tree verification, and post-sync diff/restore guidance.
|
|
18
|
+
- **Dependency updates** — patch and minor bumps with no API impact: `jose` 6.2.2 → 6.2.3, `@modelcontextprotocol/ext-apps` 1.7.0 → 1.7.1, `@supabase/supabase-js` 2.104.1 → 2.105.0 (peer + dev), `@cloudflare/workers-types` 4.20260424.1 → 4.20260426.1 (dev), `repomix` 1.13.1 → 1.14.0 (dev). Devcheck and full test suite (2558 passing) clean across all updates.
|
|
19
|
+
|
|
20
|
+
## Added
|
|
21
|
+
|
|
22
|
+
- **`templates/package.json` `start` script** — bare `"start": "node dist/index.js"` alongside the existing explicit `start:stdio` / `start:http` variants. External MCP runners and hosted environments that assume the npm-canonical `start` script now work out of the box. The new script is `.env`-respecting (no inline `MCP_TRANSPORT_TYPE` override) so user-configured transport selection still takes effect.
|
|
23
|
+
- **`templates/package.json` declares `bun` in `engines`** — `bun: >=1.2.0` added alongside the existing `node: >=22.0.0`. Documents that the scaffold works on Bun (it already did — Bun runs the template's `tsx` and `node` invocations transparently). Matches the framework's own `package.json` engines field.
|
package/changelog/template.md
CHANGED
|
@@ -8,6 +8,8 @@
|
|
|
8
8
|
|
|
9
9
|
# Required. One-line headline describing the release. Max 250 chars. No markdown.
|
|
10
10
|
# This line is what the CHANGELOG.md rollup shows — write it like a GitHub Release title.
|
|
11
|
+
# Keep the double quotes around the value — unquoted YAML treats `:` (colon-space)
|
|
12
|
+
# inside the string as a key separator, which fails GitHub's strict YAML parser.
|
|
11
13
|
summary: ""
|
|
12
14
|
|
|
13
15
|
# Set to `true` only if this release has breaking changes (API removals, signature
|
package/dist/cli/init.js
CHANGED
|
@@ -11,17 +11,16 @@ const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
|
|
|
11
11
|
const TEMPLATES_DIR = join(PACKAGE_ROOT, 'templates');
|
|
12
12
|
const SKILLS_DIR = join(PACKAGE_ROOT, 'skills');
|
|
13
13
|
const SCRIPTS_DIR = join(PACKAGE_ROOT, 'scripts');
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
'
|
|
22
|
-
'
|
|
23
|
-
|
|
24
|
-
];
|
|
14
|
+
const PACKAGE_JSON = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf-8'));
|
|
15
|
+
/**
|
|
16
|
+
* Scaffold scripts derived from `package.json` `files:` — the canonical
|
|
17
|
+
* declaration of what ships to consumers. Avoids a static list that
|
|
18
|
+
* silently drifts when new framework scripts are added (issues #69, #73).
|
|
19
|
+
*/
|
|
20
|
+
const SCAFFOLD_SCRIPTS = (PACKAGE_JSON.files ?? [])
|
|
21
|
+
.filter((entry) => entry.startsWith('scripts/') && entry.endsWith('.ts'))
|
|
22
|
+
.map((entry) => entry.slice('scripts/'.length))
|
|
23
|
+
.sort();
|
|
25
24
|
const TEXT_EXTENSIONS = new Set([
|
|
26
25
|
'.md',
|
|
27
26
|
'.ts',
|
|
@@ -43,9 +42,8 @@ else {
|
|
|
43
42
|
process.exit(subcommand === undefined || subcommand === '--help' ? 0 : 1);
|
|
44
43
|
}
|
|
45
44
|
function printUsage() {
|
|
46
|
-
const pkg = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf-8'));
|
|
47
45
|
console.log(`
|
|
48
|
-
@cyanheads/mcp-ts-core v${
|
|
46
|
+
@cyanheads/mcp-ts-core v${PACKAGE_JSON.version}
|
|
49
47
|
|
|
50
48
|
Usage:
|
|
51
49
|
mcp-ts-core init [name] Scaffold a new MCP server project
|
|
@@ -67,12 +65,11 @@ function init() {
|
|
|
67
65
|
}
|
|
68
66
|
mkdirSync(dest, { recursive: true });
|
|
69
67
|
}
|
|
70
|
-
const pkg = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf-8'));
|
|
71
68
|
console.log(`\n Scaffolding${name ? ` ${name}` : ''} in ${dest}\n`);
|
|
72
69
|
const created = [];
|
|
73
70
|
const skipped = [];
|
|
74
71
|
// Step 1: Copy templates
|
|
75
|
-
copyTemplates(dest, packageName,
|
|
72
|
+
copyTemplates(dest, packageName, PACKAGE_JSON.version, created, skipped);
|
|
76
73
|
// Step 2: Copy scripts
|
|
77
74
|
copyScripts(dest, created, skipped);
|
|
78
75
|
// Step 3: Copy external skills
|
package/dist/cli/init.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAClD,
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAClD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAGxF,CAAC;AACF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;KAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;KACxE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;KAC9C,IAAI,EAAE,CAAC;AACV,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,EAAE;CACH,CAAC,CAAC;AAEH,yEAAyE;AAEzE,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE3C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC;AACT,CAAC;KAAM,CAAC;IACN,UAAU,EAAE,CAAC;IACb,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC;4BACc,YAAY,CAAC,OAAO;;;;;;;;CAQ/C,CAAC,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,KAAK,CACX,kCAAkC,IAAI,kDAAkD,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAErE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,yBAAyB;IACzB,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEzE,uBAAuB;IACvB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEpC,+BAA+B;IAC/B,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAE3C,gBAAgB;IAChB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,yEAAyE;AAEzE,SAAS,aAAa,CACpB,IAAY,EACZ,IAAY,EACZ,gBAAwB,EACxB,OAAiB,EACjB,OAAiB;IAEjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,qCAAqC;QACrC,wCAAwC;QACxC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAErC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;iBAC3C,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC;iBACtC,OAAO,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC;YAC3D,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,WAAW,CAAC,IAAY,EAAE,OAAiB,EAAE,OAAiB;IACrE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAErC,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAErC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAiB,EAAE,OAAiB;IAC5E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEpC,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAElG,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAEvC,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ,KAAK,UAAU;YAAE,SAAS;QAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvD,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAErC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO;IAC9B,iFAAiF;IACjF,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjG,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CACnB,OAAe,EACf,QAAgB,EAChB,OAAe,EACf,OAAiB,EACjB,OAAiB;IAEjB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AAEzE,+EAA+E;AAC/E,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,OAAiB,EAAE,OAAiB,EAAE,IAAwB;IAClF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,sDAAsD,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;AACH,CAAC"}
|
package/dist/logs/combined.log
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
{"level":50,"time":
|
|
2
|
-
{"level":50,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
1
|
+
{"level":50,"time":1777324706999,"env":"testing","version":"0.0.0-test","pid":89417,"requestId":"AOV5H-H08IQ","timestamp":"2026-04-27T21:18:26.998Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"14c2dcafd18a13812e43d4ce0cfc986d843e8c37dc13e1f9caf4fcadd5670b4e","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant"},"errorData":{"sessionId":"14c2dcafd18a13812e43d4ce0cfc986d843e8c37dc13e1f9caf4fcadd5670b4e","toolName":"scoped_echo","requestId":"AOV5H-H08IQ","timestamp":"2026-04-27T21:18:26.998Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:61:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:72:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:105:42)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
2
|
+
{"level":50,"time":1777324707659,"env":"testing","version":"0.7.6","pid":89421,"requestId":"RVDNZ-FA1DS","timestamp":"2026-04-27T21:18:27.658Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"RVDNZ-FA1DS","timestamp":"2026-04-27T21:18:27.658Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:82:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
3
|
+
{"level":50,"time":1777324707674,"env":"testing","version":"0.7.6","pid":89421,"requestId":"I3QVO-34K3C","timestamp":"2026-04-27T21:18:27.674Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"I3QVO-34K3C","timestamp":"2026-04-27T21:18:27.674Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:56:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
4
|
+
{"level":50,"time":1777324707677,"env":"testing","version":"0.7.6","pid":89421,"requestId":"2D53Y-ZJKO6","timestamp":"2026-04-27T21:18:27.677Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"2D53Y-ZJKO6","timestamp":"2026-04-27T21:18:27.677Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:82:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
package/dist/logs/error.log
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
{"level":50,"time":
|
|
2
|
-
{"level":50,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
1
|
+
{"level":50,"time":1777324706999,"env":"testing","version":"0.0.0-test","pid":89417,"requestId":"AOV5H-H08IQ","timestamp":"2026-04-27T21:18:26.998Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"14c2dcafd18a13812e43d4ce0cfc986d843e8c37dc13e1f9caf4fcadd5670b4e","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant"},"errorData":{"sessionId":"14c2dcafd18a13812e43d4ce0cfc986d843e8c37dc13e1f9caf4fcadd5670b4e","toolName":"scoped_echo","requestId":"AOV5H-H08IQ","timestamp":"2026-04-27T21:18:26.998Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:61:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:72:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:105:42)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
2
|
+
{"level":50,"time":1777324707659,"env":"testing","version":"0.7.6","pid":89421,"requestId":"RVDNZ-FA1DS","timestamp":"2026-04-27T21:18:27.658Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"RVDNZ-FA1DS","timestamp":"2026-04-27T21:18:27.658Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:82:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
3
|
+
{"level":50,"time":1777324707674,"env":"testing","version":"0.7.6","pid":89421,"requestId":"I3QVO-34K3C","timestamp":"2026-04-27T21:18:27.674Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"I3QVO-34K3C","timestamp":"2026-04-27T21:18:27.674Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:56:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
4
|
+
{"level":50,"time":1777324707677,"env":"testing","version":"0.7.6","pid":89421,"requestId":"2D53Y-ZJKO6","timestamp":"2026-04-27T21:18:27.677Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"2D53Y-ZJKO6","timestamp":"2026-04-27T21:18:27.677Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:82:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:169:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cyanheads/mcp-ts-core",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.6",
|
|
4
4
|
"mcpName": "io.github.cyanheads/mcp-ts-core",
|
|
5
5
|
"description": "Agent-native TypeScript framework for building MCP servers. Declarative definitions with auth, multi-backend storage, OpenTelemetry, and first-class support for Bun/Node/Cloudflare Workers.",
|
|
6
6
|
"main": "dist/core/index.js",
|
|
@@ -162,7 +162,7 @@
|
|
|
162
162
|
},
|
|
163
163
|
"devDependencies": {
|
|
164
164
|
"@biomejs/biome": "2.4.13",
|
|
165
|
-
"@cloudflare/workers-types": "^4.
|
|
165
|
+
"@cloudflare/workers-types": "^4.20260426.1",
|
|
166
166
|
"@hono/otel": "^1.1.1",
|
|
167
167
|
"@opentelemetry/exporter-metrics-otlp-http": "^0.215.0",
|
|
168
168
|
"@opentelemetry/exporter-trace-otlp-http": "^0.215.0",
|
|
@@ -173,7 +173,7 @@
|
|
|
173
173
|
"@opentelemetry/sdk-node": "^0.215.0",
|
|
174
174
|
"@opentelemetry/sdk-trace-node": "^2.7.0",
|
|
175
175
|
"@opentelemetry/semantic-conventions": "^1.40.0",
|
|
176
|
-
"@supabase/supabase-js": "^2.
|
|
176
|
+
"@supabase/supabase-js": "^2.105.0",
|
|
177
177
|
"@types/bun": "^1.3.13",
|
|
178
178
|
"@types/js-yaml": "^4.0.9",
|
|
179
179
|
"@types/node": "^25.6.0",
|
|
@@ -199,7 +199,7 @@
|
|
|
199
199
|
"partial-json": "^0.1.7",
|
|
200
200
|
"pdf-lib": "^1.17.1",
|
|
201
201
|
"pino-pretty": "^13.1.3",
|
|
202
|
-
"repomix": "^1.
|
|
202
|
+
"repomix": "^1.14.0",
|
|
203
203
|
"sanitize-html": "^2.17.3",
|
|
204
204
|
"tsc-alias": "^1.8.16",
|
|
205
205
|
"typedoc": "^0.28.19",
|
|
@@ -260,12 +260,12 @@
|
|
|
260
260
|
"dependencies": {
|
|
261
261
|
"@hono/mcp": "^0.2.5",
|
|
262
262
|
"@hono/node-server": "^2.0.0",
|
|
263
|
-
"@modelcontextprotocol/ext-apps": "^1.7.
|
|
263
|
+
"@modelcontextprotocol/ext-apps": "^1.7.1",
|
|
264
264
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
265
265
|
"@opentelemetry/api": "^1.9.1",
|
|
266
266
|
"dotenv": "^17.4.2",
|
|
267
267
|
"hono": "^4.12.15",
|
|
268
|
-
"jose": "^6.2.
|
|
268
|
+
"jose": "^6.2.3",
|
|
269
269
|
"pino": "^10.3.1",
|
|
270
270
|
"zod": "^4.3.6"
|
|
271
271
|
},
|
|
@@ -207,7 +207,10 @@ The description is the LLM's primary signal for tool selection. It must answer:
|
|
|
207
207
|
- **Be concrete about capability.** "Search for clinical trial studies using queries and filters" beats "Interact with studies."
|
|
208
208
|
- **Include operational guidance when it matters.** If the tool has prerequisites, constraints, or gotchas the LLM needs to know, say so in the description. Don't add boilerplate workflow hints when the tool is self-explanatory.
|
|
209
209
|
- **Prefer a single cohesive paragraph.** Pack operational guidance into prose sentences (separated by periods or em-dashes) rather than bullet lists or blank-line-separated sections. Descriptions render inline in most clients, and bullet structure reads as visual noise rather than signal. Operation-by-operation bullets also duplicate info that already lives in the `operation` enum's `.describe()`.
|
|
210
|
-
- **Don't leak
|
|
210
|
+
- **Don't leak.** Descriptions are for the consumer, not the author. Three categories to audit against:
|
|
211
|
+
- *Implementation details* — endpoint paths, API call counts, internal parameter mappings, routing logic. Describe what the tool does and when to use it, not how it's wired up.
|
|
212
|
+
- *Meta-coaching* — directives about how to use the output. "Treat X as the canonical Y", "callers should…", "the LLM should…". The description sells the tool; it doesn't coach the reader.
|
|
213
|
+
- *Consumer-aware phrasing* — references to "LLM", "agent", "Claude", or any specific reader. The description shouldn't name who's reading it.
|
|
211
214
|
|
|
212
215
|
```ts
|
|
213
216
|
// Good — describes a prerequisite the LLM must know
|
|
@@ -132,13 +132,21 @@ Runs `initialize`, captures the session id, sends `notifications/initialized`.
|
|
|
132
132
|
|
|
133
133
|
```bash
|
|
134
134
|
. /tmp/mcp-field-test.sh
|
|
135
|
-
mcp_call tools/list | jq '.result.tools[] | {name, description, inputSchema}'
|
|
135
|
+
mcp_call tools/list | jq '.result.tools[] | {name, description, inputSchema, outputSchema}'
|
|
136
136
|
mcp_call resources/list | jq '.result.resources[] | {uri, name, mimeType}'
|
|
137
137
|
mcp_call prompts/list | jq '.result.prompts[] | {name, description, arguments}'
|
|
138
138
|
```
|
|
139
139
|
|
|
140
140
|
Present a compact catalog to the user: each definition's name + 1-line description. Flag vague or missing descriptions as you go — those feed into the report. Use this to build the test plan.
|
|
141
141
|
|
|
142
|
+
**Audit every description for leaks** — tool description, every parameter `.describe()` in `inputSchema`, and every field `.describe()` in `outputSchema` (the `outputSchema` projection above is what surfaces these; don't skim past it). Three categories:
|
|
143
|
+
|
|
144
|
+
- **Implementation details** — endpoint paths, API call counts, internal parameter mappings, routing logic. Describe *what the tool does*, not *how it's wired up*.
|
|
145
|
+
- **Meta-coaching** — directives about how to use the output. "Treat X as the canonical Y", "callers should…", "the LLM should…". The description sells the tool; it doesn't coach the reader.
|
|
146
|
+
- **Consumer-aware phrasing** — references to "LLM", "agent", "Claude", or any specific reader. The description shouldn't name who's reading it.
|
|
147
|
+
|
|
148
|
+
Treat any hit as a `ux` finding in the report. The authoring rule lives under *Tool descriptions* in `design-mcp-server/SKILL.md` — same categories, applied at review time.
|
|
149
|
+
|
|
142
150
|
### 4. Plan the test pass
|
|
143
151
|
|
|
144
152
|
**Budget.** Don't run every category against every definition — the cross-product is infeasible. Apply the **universal battery** to everything; apply **situational categories** only when the definition triggers them.
|
|
@@ -210,7 +218,7 @@ Only include definitions with issues. Group by severity. Each finding is 2–4 l
|
|
|
210
218
|
| Severity | Meaning |
|
|
211
219
|
|:---------|:--------|
|
|
212
220
|
| **bug** | Broken: crash, wrong output, `isError: true` on valid input, data loss, schema violation |
|
|
213
|
-
| **ux** | Works but degrades the user/LLM experience: vague description, unhelpful error text, missing `format()`, parity drift, annotation mismatches behavior |
|
|
221
|
+
| **ux** | Works but degrades the user/LLM experience: vague description, leaky description (implementation details, meta-coaching, consumer-aware phrasing), unhelpful error text, missing `format()`, parity drift, annotation mismatches behavior |
|
|
214
222
|
| **nit** | Polish: phrasing, inconsistent tone, minor doc gaps |
|
|
215
223
|
|
|
216
224
|
Format:
|
|
@@ -242,7 +250,7 @@ End with:
|
|
|
242
250
|
|
|
243
251
|
- [ ] Server built and started; real port parsed from log
|
|
244
252
|
- [ ] Session initialized; `notifications/initialized` sent
|
|
245
|
-
- [ ] Catalog surfaced and presented
|
|
253
|
+
- [ ] Catalog surfaced and presented; descriptions audited for leaks (implementation details, meta-coaching, consumer-aware phrasing)
|
|
246
254
|
- [ ] Universal battery run on every definition
|
|
247
255
|
- [ ] Situational categories applied only when triggered
|
|
248
256
|
- [ ] External-state / auth-gated tools handled explicitly (run, skip, or confirm)
|
|
@@ -4,7 +4,7 @@ description: >
|
|
|
4
4
|
Investigate, adopt, and verify dependency updates — with special handling for `@cyanheads/mcp-ts-core`. Captures what changed, understands why, cross-references against the codebase, adopts framework improvements, syncs project skills, and runs final checks. Supports two entry modes: run the full flow end-to-end, or review updates you already applied.
|
|
5
5
|
metadata:
|
|
6
6
|
author: cyanheads
|
|
7
|
-
version: "1.
|
|
7
|
+
version: "1.7"
|
|
8
8
|
audience: external
|
|
9
9
|
type: workflow
|
|
10
10
|
---
|
|
@@ -20,7 +20,7 @@ metadata:
|
|
|
20
20
|
| Mode | Starting Point | First Step |
|
|
21
21
|
|:-----|:---------------|:-----------|
|
|
22
22
|
| **A — Full flow** | Lockfile is current; want to update | Step 1 |
|
|
23
|
-
| **B — Post-update review** | User already ran `bun update --latest` + `bun run rebuild` + `bun run test` | Skip to Step 3 with the update output or `
|
|
23
|
+
| **B — Post-update review** | User already ran `bun update --latest` + `bun run rebuild` + `bun run test` | Skip to Step 3 with the update output or a `bun.lock` diff |
|
|
24
24
|
|
|
25
25
|
Both modes converge at Step 3 and end at Step 8.
|
|
26
26
|
|
|
@@ -40,7 +40,7 @@ Note: `bun update --latest` crosses semver majors; `bun update` alone respects r
|
|
|
40
40
|
bun update --latest
|
|
41
41
|
```
|
|
42
42
|
|
|
43
|
-
Capture the `↑ package old → new` lines from stdout — these feed Step 3. Alternatively,
|
|
43
|
+
Capture the `↑ package old → new` lines from stdout — these feed Step 3. Alternatively, diff `bun.lock` to surface version deltas after the fact.
|
|
44
44
|
|
|
45
45
|
### 3. Investigate changelogs
|
|
46
46
|
|
|
@@ -122,20 +122,22 @@ If no agent directory exists, skip Phase B — the project hasn't opted in to pe
|
|
|
122
122
|
The `init` CLI scaffolds a fixed set of framework scripts into consumer projects — these underpin `bun run build`, `bun run devcheck`, `bun run lint:mcp`, `bun run tree`, and the changelog build. They drift silently when the framework updates them. Compare by content hash and overwrite on mismatch:
|
|
123
123
|
|
|
124
124
|
```bash
|
|
125
|
-
for
|
|
126
|
-
src
|
|
125
|
+
for src in node_modules/@cyanheads/mcp-ts-core/scripts/*.ts; do
|
|
126
|
+
s=$(basename "$src")
|
|
127
127
|
dst="scripts/$s"
|
|
128
|
-
[ -f "$
|
|
129
|
-
if [ ! -f "$dst" ] || ! cmp -s "$src" "$dst"; then
|
|
128
|
+
if [ ! -f "$dst" ]; then
|
|
130
129
|
cp "$src" "$dst"
|
|
131
|
-
echo "
|
|
130
|
+
echo "added: $s"
|
|
131
|
+
elif ! cmp -s "$src" "$dst"; then
|
|
132
|
+
cp "$src" "$dst"
|
|
133
|
+
echo "updated: $s"
|
|
132
134
|
fi
|
|
133
135
|
done
|
|
134
136
|
```
|
|
135
137
|
|
|
136
|
-
|
|
138
|
+
Scripts in `scripts/` that aren't present in the package directory are project-specific (custom deploy, codegen, etc.) — leave them alone. The package's `files:` field gates what ships into `node_modules/.../scripts/`, so enumerating that directory is the canonical "shipped scripts" set.
|
|
137
139
|
|
|
138
|
-
If the consumer customized a framework script, the overwrite discards those changes.
|
|
140
|
+
If the consumer customized a framework script, the overwrite discards those changes. After the sync runs, diff `scripts/` to surface replacements — review before committing. If a specific local customization needs to be preserved, revert that file using your git tools.
|
|
139
141
|
|
|
140
142
|
**Report** which skills were added/updated in Phase A (with version deltas), which agent directories were refreshed in Phase B, and which scripts were resynced in Phase C. The user needs to know what new guidance and tooling is now in play.
|
|
141
143
|
|
|
@@ -195,7 +197,7 @@ Present a concise numbered summary to the user:
|
|
|
195
197
|
- [ ] Adoption opportunities identified and applied
|
|
196
198
|
- [ ] Project `skills/` synced from package (Phase A), with a change report
|
|
197
199
|
- [ ] Agent skill directories (`.claude/skills/`, `.agents/skills/`, etc.) refreshed from project `skills/` (Phase B)
|
|
198
|
-
- [ ] Framework `scripts/` resynced from package via content-hash compare (Phase C), with a change report; `
|
|
200
|
+
- [ ] Framework `scripts/` resynced from package via content-hash compare (Phase C), with a change report; `scripts/` diff reviewed before committing
|
|
199
201
|
- [ ] `bun run rebuild` succeeds
|
|
200
202
|
- [ ] `bun run devcheck` passes (includes audit + outdated)
|
|
201
203
|
- [ ] `bun run test` passes
|
|
@@ -4,7 +4,7 @@ description: >
|
|
|
4
4
|
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GHCR). Runs the final verification gate, pushes commits and tags, then publishes to each applicable destination. Assumes git wrapup (version bumps, changelog, commit, annotated tag) is already complete — this skill is the post-wrapup publish workflow. Retries transient network failures on publish steps; halts with a partial-state report when retries are exhausted or the failure is terminal.
|
|
5
5
|
metadata:
|
|
6
6
|
author: cyanheads
|
|
7
|
-
version: "2.
|
|
7
|
+
version: "2.2"
|
|
8
8
|
audience: external
|
|
9
9
|
type: workflow
|
|
10
10
|
---
|
|
@@ -62,13 +62,11 @@ The user fixes locally and re-invokes. On re-invocation, already-published desti
|
|
|
62
62
|
|
|
63
63
|
### 1. Sanity-check wrapup outputs
|
|
64
64
|
|
|
65
|
-
Read `package.json` → capture `version`. Then verify:
|
|
65
|
+
Read `package.json` → capture `version`. Then use your git tools to verify:
|
|
66
66
|
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
git rev-parse --abbrev-ref HEAD # note the branch name for step 3
|
|
71
|
-
```
|
|
67
|
+
- **Working tree is clean** — no uncommitted changes
|
|
68
|
+
- **HEAD is tagged `v<version>`** — matches the `package.json` version
|
|
69
|
+
- **Current branch name** — note it for step 3
|
|
72
70
|
|
|
73
71
|
If working tree is dirty or HEAD isn't on `v<version>`, halt.
|
|
74
72
|
|
|
@@ -86,12 +84,7 @@ Any non-zero exit → halt with the failing command's output.
|
|
|
86
84
|
|
|
87
85
|
### 3. Push to origin
|
|
88
86
|
|
|
89
|
-
|
|
90
|
-
git push
|
|
91
|
-
git push --tags
|
|
92
|
-
```
|
|
93
|
-
|
|
94
|
-
If the remote rejects either push, halt.
|
|
87
|
+
Use your git tools to push commits and tags to origin. If the remote rejects either push, halt.
|
|
95
88
|
|
|
96
89
|
### 4. Publish to npm
|
|
97
90
|
|
|
@@ -139,7 +132,7 @@ Only if `Dockerfile` exists at the repo root (otherwise skip).
|
|
|
139
132
|
|
|
140
133
|
Derive:
|
|
141
134
|
|
|
142
|
-
- `OWNER/REPO` from
|
|
135
|
+
- `OWNER/REPO` from the origin remote URL — use your git tools to read it; strip `.git`, handle both `https://github.com/<owner>/<repo>` and `git@github.com:<owner>/<repo>` forms
|
|
143
136
|
- `VERSION` from `package.json` (step 1)
|
|
144
137
|
|
|
145
138
|
```bash
|
|
@@ -167,8 +160,8 @@ Skip any destination that was skipped in its step.
|
|
|
167
160
|
- [ ] `bun run devcheck` passes
|
|
168
161
|
- [ ] `bun run rebuild` succeeds
|
|
169
162
|
- [ ] `bun run test:all` (or `test`) passes
|
|
170
|
-
- [ ]
|
|
171
|
-
- [ ]
|
|
163
|
+
- [ ] Commits pushed to origin
|
|
164
|
+
- [ ] Tags pushed to origin
|
|
172
165
|
- [ ] `bun publish --access public` succeeds
|
|
173
166
|
- [ ] `bun run publish-mcp` succeeds (if `server.json` present)
|
|
174
167
|
- [ ] Docker buildx multi-arch push succeeds (if `Dockerfile` present)
|
package/skills/setup/SKILL.md
CHANGED
|
@@ -4,7 +4,7 @@ description: >
|
|
|
4
4
|
Post-init orientation for an MCP server built on @cyanheads/mcp-ts-core. Use after running `@cyanheads/mcp-ts-core init` to understand the project structure, conventions, and skill sync model. Also use when onboarding to an existing project for the first time.
|
|
5
5
|
metadata:
|
|
6
6
|
author: cyanheads
|
|
7
|
-
version: "1.
|
|
7
|
+
version: "1.6"
|
|
8
8
|
audience: external
|
|
9
9
|
type: workflow
|
|
10
10
|
---
|
|
@@ -129,7 +129,7 @@ This step is the **bootstrap** — it creates the agent directory. From then on,
|
|
|
129
129
|
After `bun install`, complete these one-time setup tasks:
|
|
130
130
|
|
|
131
131
|
1. **Update dependencies to latest** — `bun update --latest`. The scaffolded `package.json` pins minimum versions from when the framework was published; updating ensures you start with the latest compatible releases.
|
|
132
|
-
2. **Initialize git** —
|
|
132
|
+
2. **Initialize git** — use your git tools: init the repo, stage all files, and commit with message `chore: scaffold from @cyanheads/mcp-ts-core`
|
|
133
133
|
3. **Verify agent protocol placeholders** — if the `init` CLI was run without a `[name]` argument, `{{PACKAGE_NAME}}` may remain as a literal in `CLAUDE.md`/`AGENTS.md` and `package.json`. Replace it with the actual server name.
|
|
134
134
|
|
|
135
135
|
## Changelog Convention
|
|
@@ -8,6 +8,8 @@
|
|
|
8
8
|
|
|
9
9
|
# Required. One-line headline describing the release. Max 250 chars. No markdown.
|
|
10
10
|
# This line is what the CHANGELOG.md rollup shows — write it like a GitHub Release title.
|
|
11
|
+
# Keep the double quotes around the value — unquoted YAML treats `:` (colon-space)
|
|
12
|
+
# inside the string as a key separator, which fails GitHub's strict YAML parser.
|
|
11
13
|
summary: ""
|
|
12
14
|
|
|
13
15
|
# Set to `true` only if this release has breaking changes (API removals, signature
|
package/templates/package.json
CHANGED
|
@@ -31,6 +31,7 @@
|
|
|
31
31
|
"test": "vitest run",
|
|
32
32
|
"dev:stdio": "MCP_TRANSPORT_TYPE=stdio tsx --watch src/index.ts",
|
|
33
33
|
"dev:http": "MCP_TRANSPORT_TYPE=http tsx --watch src/index.ts",
|
|
34
|
+
"start": "node dist/index.js",
|
|
34
35
|
"start:stdio": "MCP_TRANSPORT_TYPE=stdio node dist/index.js",
|
|
35
36
|
"start:http": "MCP_TRANSPORT_TYPE=http node dist/index.js"
|
|
36
37
|
},
|
|
@@ -45,6 +46,7 @@
|
|
|
45
46
|
},
|
|
46
47
|
"license": "Apache-2.0",
|
|
47
48
|
"engines": {
|
|
49
|
+
"bun": ">=1.2.0",
|
|
48
50
|
"node": ">=22.0.0"
|
|
49
51
|
},
|
|
50
52
|
"publishConfig": {
|