@cyanheads/mcp-ts-core 0.8.18 → 0.8.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CLAUDE.md +47 -46
- package/README.md +35 -37
- package/changelog/0.8.x/0.8.19.md +33 -0
- package/changelog/template.md +71 -44
- package/dist/cli/init.js +12 -5
- package/dist/cli/init.js.map +1 -1
- package/dist/logs/combined.log +6 -12
- package/dist/logs/error.log +4 -8
- package/package.json +13 -11
- package/scripts/build-changelog.ts +27 -18
- package/skills/api-telemetry/SKILL.md +222 -0
- package/skills/api-utils/SKILL.md +3 -1
- package/skills/maintenance/SKILL.md +16 -6
- package/skills/polish-docs-meta/references/package-meta.md +1 -1
- package/skills/report-issue-framework/SKILL.md +5 -3
- package/skills/report-issue-local/SKILL.md +5 -3
- package/skills/setup/SKILL.md +10 -9
- package/templates/AGENTS.md +20 -10
- package/templates/CLAUDE.md +20 -10
- package/templates/Dockerfile +2 -2
- package/templates/changelog/template.md +71 -44
- package/templates/package.json +2 -2
package/dist/logs/combined.log
CHANGED
|
@@ -1,12 +1,6 @@
|
|
|
1
|
-
{"level":40,"time":
|
|
2
|
-
{"level":40,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
5
|
-
{"level":50,"time":
|
|
6
|
-
{"level":50,"time":
|
|
7
|
-
{"level":40,"time":1778113122106,"env":"testing","version":"0.8.18","pid":96558,"transport":"http","requestId":"KB0L9-45SRE","timestamp":"2026-05-07T00:18:42.105Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
|
|
8
|
-
{"level":40,"time":1778113123806,"env":"testing","version":"0.8.18","pid":96558,"transport":"http","requestId":"KB0L9-45SRE","timestamp":"2026-05-07T00:18:42.105Z","operation":"TransportManager.start","component":"HttpTransportSetup","sessionId":"not-a-real-session-1778113123806","msg":"Session validation failed - invalid or hijacked session"}
|
|
9
|
-
{"level":50,"time":1778113128896,"env":"testing","version":"0.0.0-test","pid":96713,"requestId":"IQ3DB-WN22W","timestamp":"2026-05-07T00:18:48.895Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"8625152c71df39d8debaade079806ddddf7a2f1ea2e76b680a38b2d5a2aba453","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"8625152c71df39d8debaade079806ddddf7a2f1ea2e76b680a38b2d5a2aba453","toolName":"scoped_echo","requestId":"IQ3DB-WN22W","timestamp":"2026-05-07T00:18:48.895Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:61:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:182:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
10
|
-
{"level":50,"time":1778113129210,"env":"testing","version":"0.8.18","pid":96715,"requestId":"UC5FE-IJ8R6","timestamp":"2026-05-07T00:18:49.209Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"UC5FE-IJ8R6","timestamp":"2026-05-07T00:18:49.209Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
11
|
-
{"level":50,"time":1778113129226,"env":"testing","version":"0.8.18","pid":96715,"requestId":"QX28D-H2XVM","timestamp":"2026-05-07T00:18:49.226Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"QX28D-H2XVM","timestamp":"2026-05-07T00:18:49.226Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:56:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
12
|
-
{"level":50,"time":1778113129229,"env":"testing","version":"0.8.18","pid":96715,"requestId":"JMEBO-ZCM7S","timestamp":"2026-05-07T00:18:49.229Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"JMEBO-ZCM7S","timestamp":"2026-05-07T00:18:49.229Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
1
|
+
{"level":40,"time":1778235929533,"env":"testing","version":"0.8.19","pid":78428,"transport":"http","requestId":"Q8627-MFEM4","timestamp":"2026-05-08T10:25:29.532Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
|
|
2
|
+
{"level":40,"time":1778235931406,"env":"testing","version":"0.8.19","pid":78428,"transport":"http","requestId":"Q8627-MFEM4","timestamp":"2026-05-08T10:25:29.532Z","operation":"TransportManager.start","component":"HttpTransportSetup","sessionId":"not-a-real-session-1778235931406","msg":"Session validation failed - invalid or hijacked session"}
|
|
3
|
+
{"level":50,"time":1778235936218,"env":"testing","version":"0.0.0-test","pid":78583,"requestId":"IF69M-6JUK9","timestamp":"2026-05-08T10:25:36.217Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"4b3d45f04700813199bd658614b7755a161937d0cc1af8148285dc3ab3570631","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"4b3d45f04700813199bd658614b7755a161937d0cc1af8148285dc3ab3570631","toolName":"scoped_echo","requestId":"IF69M-6JUK9","timestamp":"2026-05-08T10:25:36.217Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:61:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:182:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
4
|
+
{"level":50,"time":1778235937205,"env":"testing","version":"0.8.19","pid":78590,"requestId":"5EPAW-MLFXN","timestamp":"2026-05-08T10:25:37.204Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"5EPAW-MLFXN","timestamp":"2026-05-08T10:25:37.204Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
5
|
+
{"level":50,"time":1778235937222,"env":"testing","version":"0.8.19","pid":78590,"requestId":"GJ6K8-V54G5","timestamp":"2026-05-08T10:25:37.222Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"GJ6K8-V54G5","timestamp":"2026-05-08T10:25:37.222Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:56:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
6
|
+
{"level":50,"time":1778235937225,"env":"testing","version":"0.8.19","pid":78590,"requestId":"8DTH5-7ODPW","timestamp":"2026-05-08T10:25:37.225Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"8DTH5-7ODPW","timestamp":"2026-05-08T10:25:37.225Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
package/dist/logs/error.log
CHANGED
|
@@ -1,8 +1,4 @@
|
|
|
1
|
-
{"level":50,"time":
|
|
2
|
-
{"level":50,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
5
|
-
{"level":50,"time":1778113128896,"env":"testing","version":"0.0.0-test","pid":96713,"requestId":"IQ3DB-WN22W","timestamp":"2026-05-07T00:18:48.895Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"8625152c71df39d8debaade079806ddddf7a2f1ea2e76b680a38b2d5a2aba453","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"8625152c71df39d8debaade079806ddddf7a2f1ea2e76b680a38b2d5a2aba453","toolName":"scoped_echo","requestId":"IQ3DB-WN22W","timestamp":"2026-05-07T00:18:48.895Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:61:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:182:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
6
|
-
{"level":50,"time":1778113129210,"env":"testing","version":"0.8.18","pid":96715,"requestId":"UC5FE-IJ8R6","timestamp":"2026-05-07T00:18:49.209Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"UC5FE-IJ8R6","timestamp":"2026-05-07T00:18:49.209Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
7
|
-
{"level":50,"time":1778113129226,"env":"testing","version":"0.8.18","pid":96715,"requestId":"QX28D-H2XVM","timestamp":"2026-05-07T00:18:49.226Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"QX28D-H2XVM","timestamp":"2026-05-07T00:18:49.226Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:56:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
8
|
-
{"level":50,"time":1778113129229,"env":"testing","version":"0.8.18","pid":96715,"requestId":"JMEBO-ZCM7S","timestamp":"2026-05-07T00:18:49.229Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"JMEBO-ZCM7S","timestamp":"2026-05-07T00:18:49.229Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
1
|
+
{"level":50,"time":1778235936218,"env":"testing","version":"0.0.0-test","pid":78583,"requestId":"IF69M-6JUK9","timestamp":"2026-05-08T10:25:36.217Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"4b3d45f04700813199bd658614b7755a161937d0cc1af8148285dc3ab3570631","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"4b3d45f04700813199bd658614b7755a161937d0cc1af8148285dc3ab3570631","toolName":"scoped_echo","requestId":"IF69M-6JUK9","timestamp":"2026-05-08T10:25:36.217Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:61:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:182:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
2
|
+
{"level":50,"time":1778235937205,"env":"testing","version":"0.8.19","pid":78590,"requestId":"5EPAW-MLFXN","timestamp":"2026-05-08T10:25:37.204Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"5EPAW-MLFXN","timestamp":"2026-05-08T10:25:37.204Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
3
|
+
{"level":50,"time":1778235937222,"env":"testing","version":"0.8.19","pid":78590,"requestId":"GJ6K8-V54G5","timestamp":"2026-05-08T10:25:37.222Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"GJ6K8-V54G5","timestamp":"2026-05-08T10:25:37.222Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:56:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
4
|
+
{"level":50,"time":1778235937225,"env":"testing","version":"0.8.19","pid":78590,"requestId":"8DTH5-7ODPW","timestamp":"2026-05-08T10:25:37.225Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"8DTH5-7ODPW","timestamp":"2026-05-08T10:25:37.225Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cyanheads/mcp-ts-core",
|
|
3
|
-
"version": "0.8.
|
|
3
|
+
"version": "0.8.19",
|
|
4
4
|
"mcpName": "io.github.cyanheads/mcp-ts-core",
|
|
5
5
|
"description": "Agent-native TypeScript framework for building MCP servers. Declarative definitions with auth, multi-backend storage, OpenTelemetry, and first-class support for Bun/Node/Cloudflare Workers.",
|
|
6
6
|
"main": "dist/core/index.js",
|
|
@@ -165,10 +165,10 @@
|
|
|
165
165
|
},
|
|
166
166
|
"devDependencies": {
|
|
167
167
|
"@biomejs/biome": "2.4.14",
|
|
168
|
-
"@cloudflare/vitest-pool-workers": "^0.16.
|
|
169
|
-
"@cloudflare/workers-types": "^4.
|
|
168
|
+
"@cloudflare/vitest-pool-workers": "^0.16.3",
|
|
169
|
+
"@cloudflare/workers-types": "^4.20260508.1",
|
|
170
170
|
"@duckdb/node-api": "^1.5.2-r.1",
|
|
171
|
-
"@hono/otel": "^1.1.
|
|
171
|
+
"@hono/otel": "^1.1.2",
|
|
172
172
|
"@opentelemetry/exporter-metrics-otlp-http": "^0.217.0",
|
|
173
173
|
"@opentelemetry/exporter-trace-otlp-http": "^0.217.0",
|
|
174
174
|
"@opentelemetry/instrumentation-http": "^0.217.0",
|
|
@@ -181,7 +181,7 @@
|
|
|
181
181
|
"@supabase/supabase-js": "^2.105.3",
|
|
182
182
|
"@types/bun": "^1.3.13",
|
|
183
183
|
"@types/js-yaml": "^4.0.9",
|
|
184
|
-
"@types/node": "^25.6.
|
|
184
|
+
"@types/node": "^25.6.2",
|
|
185
185
|
"@types/papaparse": "^5.5.2",
|
|
186
186
|
"@types/sanitize-html": "^2.16.1",
|
|
187
187
|
"@types/validator": "^13.15.10",
|
|
@@ -195,11 +195,12 @@
|
|
|
195
195
|
"diff": "^9.0.0",
|
|
196
196
|
"execa": "^9.6.1",
|
|
197
197
|
"fast-check": "^4.7.0",
|
|
198
|
+
"fast-xml-parser": "^5.7.3",
|
|
198
199
|
"ignore": "^7.0.5",
|
|
199
200
|
"js-yaml": "^4.1.1",
|
|
200
201
|
"linkedom": "^0.18.12",
|
|
201
202
|
"node-cron": "^4.2.1",
|
|
202
|
-
"openai": "^6.
|
|
203
|
+
"openai": "^6.37.0",
|
|
203
204
|
"papaparse": "^5.5.3",
|
|
204
205
|
"partial-json": "^0.1.7",
|
|
205
206
|
"pdf-lib": "^1.17.1",
|
|
@@ -211,7 +212,7 @@
|
|
|
211
212
|
"typescript": "^6.0.3",
|
|
212
213
|
"unpdf": "^1.6.2",
|
|
213
214
|
"validator": "^13.15.35",
|
|
214
|
-
"vite": "8.0.
|
|
215
|
+
"vite": "8.0.11",
|
|
215
216
|
"vitest": "^4.1.5"
|
|
216
217
|
},
|
|
217
218
|
"keywords": [
|
|
@@ -219,13 +220,14 @@
|
|
|
219
220
|
"agent-native",
|
|
220
221
|
"ai",
|
|
221
222
|
"ai-agent",
|
|
223
|
+
"bun",
|
|
222
224
|
"cloudflare-workers",
|
|
223
225
|
"declarative",
|
|
224
|
-
"edge",
|
|
225
226
|
"framework",
|
|
226
227
|
"llm",
|
|
227
228
|
"mcp",
|
|
228
229
|
"mcp-server",
|
|
230
|
+
"mcp-framework",
|
|
229
231
|
"model-context-protocol",
|
|
230
232
|
"observability",
|
|
231
233
|
"opentelemetry",
|
|
@@ -246,8 +248,8 @@
|
|
|
246
248
|
],
|
|
247
249
|
"packageManager": "bun@1.3.2",
|
|
248
250
|
"engines": {
|
|
249
|
-
"bun": ">=1.
|
|
250
|
-
"node": ">=
|
|
251
|
+
"bun": ">=1.3.0",
|
|
252
|
+
"node": ">=24.0.0"
|
|
251
253
|
},
|
|
252
254
|
"depcheck": {
|
|
253
255
|
"ignores": [
|
|
@@ -264,7 +266,7 @@
|
|
|
264
266
|
},
|
|
265
267
|
"dependencies": {
|
|
266
268
|
"@hono/mcp": "^0.2.5",
|
|
267
|
-
"@hono/node-server": "^2.0.
|
|
269
|
+
"@hono/node-server": "^2.0.2",
|
|
268
270
|
"@modelcontextprotocol/ext-apps": "^1.7.1",
|
|
269
271
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
270
272
|
"@opentelemetry/api": "^1.9.1",
|
|
@@ -6,23 +6,25 @@
|
|
|
6
6
|
* YAML frontmatter declaring:
|
|
7
7
|
* • summary (required) — ≤250-char headline, no markdown, one line
|
|
8
8
|
* • breaking (optional) — `true` flags releases with breaking changes
|
|
9
|
+
* • security (optional) — `true` flags releases with security fixes
|
|
9
10
|
*
|
|
10
11
|
* The rollup is a thin **index**, not a copy of bodies — each entry is just a
|
|
11
12
|
* clickable header + one-line summary. Full content stays in the per-version files.
|
|
12
13
|
*
|
|
13
14
|
* Rendered rollup entry:
|
|
14
|
-
* ## [X.Y.Z](changelog/N.N.x/X.Y.Z.md) — YYYY-MM-DD · ⚠️ Breaking
|
|
15
|
+
* ## [X.Y.Z](changelog/N.N.x/X.Y.Z.md) — YYYY-MM-DD · ⚠️ Breaking · 🛡️ Security
|
|
15
16
|
*
|
|
16
17
|
* <summary>
|
|
17
18
|
*
|
|
18
|
-
*
|
|
19
|
+
* Badges only render when their flag is `true`. Order is fixed: Breaking before
|
|
20
|
+
* Security when both are set.
|
|
19
21
|
*
|
|
20
22
|
* Modes:
|
|
21
23
|
* • default → regenerate CHANGELOG.md
|
|
22
24
|
* • --check → exit 1 if CHANGELOG.md differs from what would be generated
|
|
23
25
|
*
|
|
24
26
|
* Missing `summary`: warning (not failure) — the entry renders header-only.
|
|
25
|
-
* Summary > 250 chars, or malformed `breaking`: hard error.
|
|
27
|
+
* Summary > 250 chars, or malformed `breaking` / `security`: hard error.
|
|
26
28
|
*
|
|
27
29
|
* @module scripts/build-changelog
|
|
28
30
|
*/
|
|
@@ -50,6 +52,7 @@ interface VersionEntry {
|
|
|
50
52
|
|
|
51
53
|
interface Frontmatter {
|
|
52
54
|
breaking: boolean;
|
|
55
|
+
security: boolean;
|
|
53
56
|
summary: string | null;
|
|
54
57
|
}
|
|
55
58
|
|
|
@@ -75,13 +78,13 @@ function compareSemverDesc(a: string, b: string): number {
|
|
|
75
78
|
}
|
|
76
79
|
|
|
77
80
|
/**
|
|
78
|
-
* Parse minimal YAML frontmatter. Only recognizes `summary
|
|
79
|
-
* other keys are ignored, so the format stays extensible without
|
|
80
|
-
* parser. Throws on malformed values we actually care about.
|
|
81
|
+
* Parse minimal YAML frontmatter. Only recognizes `summary`, `breaking`, and
|
|
82
|
+
* `security` — other keys are ignored, so the format stays extensible without
|
|
83
|
+
* touching the parser. Throws on malformed values we actually care about.
|
|
81
84
|
*/
|
|
82
85
|
function parseFrontmatter(content: string, fileLabel: string): Frontmatter {
|
|
83
86
|
const match = content.match(/^---\n([\s\S]*?)\n---\n?/);
|
|
84
|
-
if (!match) return { summary: null, breaking: false };
|
|
87
|
+
if (!match) return { summary: null, breaking: false, security: false };
|
|
85
88
|
|
|
86
89
|
const block = match[1] as string;
|
|
87
90
|
|
|
@@ -101,18 +104,21 @@ function parseFrontmatter(content: string, fileLabel: string): Frontmatter {
|
|
|
101
104
|
);
|
|
102
105
|
}
|
|
103
106
|
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
const val = breakingMatch[1];
|
|
107
|
+
const parseBool = (key: string): boolean => {
|
|
108
|
+
const m = block.match(new RegExp(`^${key}:\\s*(\\S+)\\s*$`, 'm'));
|
|
109
|
+
if (!m) return false;
|
|
110
|
+
const val = m[1];
|
|
109
111
|
if (val !== 'true' && val !== 'false') {
|
|
110
|
-
throw new Error(`${fileLabel}:
|
|
112
|
+
throw new Error(`${fileLabel}: ${key} must be 'true' or 'false', got '${val}'.`);
|
|
111
113
|
}
|
|
112
|
-
|
|
113
|
-
}
|
|
114
|
+
return val === 'true';
|
|
115
|
+
};
|
|
114
116
|
|
|
115
|
-
return {
|
|
117
|
+
return {
|
|
118
|
+
summary,
|
|
119
|
+
breaking: parseBool('breaking'),
|
|
120
|
+
security: parseBool('security'),
|
|
121
|
+
};
|
|
116
122
|
}
|
|
117
123
|
|
|
118
124
|
/** Extract the release date from the H1 heading. */
|
|
@@ -128,8 +134,11 @@ function extractDate(body: string, fileLabel: string): string {
|
|
|
128
134
|
|
|
129
135
|
function renderEntry(entry: VersionEntry, fm: Frontmatter, date: string): string {
|
|
130
136
|
const link = `changelog/${entry.series}/${entry.version}.md`;
|
|
131
|
-
const
|
|
132
|
-
|
|
137
|
+
const badges = [fm.breaking ? '⚠️ Breaking' : null, fm.security ? '🛡️ Security' : null].filter(
|
|
138
|
+
(b): b is string => b !== null,
|
|
139
|
+
);
|
|
140
|
+
const badgeSuffix = badges.length > 0 ? ` · ${badges.join(' · ')}` : '';
|
|
141
|
+
const header = `## [${entry.version}](${link}) — ${date}${badgeSuffix}`;
|
|
133
142
|
if (fm.summary) {
|
|
134
143
|
return `${header}\n\n${fm.summary}\n`;
|
|
135
144
|
}
|
|
@@ -0,0 +1,222 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: api-telemetry
|
|
3
|
+
description: >
|
|
4
|
+
Catalog of OpenTelemetry instrumentation built into framework `@cyanheads/mcp-ts-core` — spans, metrics, completion logs, env config, runtime caveats, custom instrumentation patterns, and cardinality rules. Use when enabling OTel export, adding custom spans or metrics in services, debugging missing telemetry, looking up attribute names, or deciding what's safe to put on a metric attribute vs. a span.
|
|
5
|
+
metadata:
|
|
6
|
+
author: cyanheads
|
|
7
|
+
version: "1.0"
|
|
8
|
+
audience: external
|
|
9
|
+
type: reference
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## Overview
|
|
13
|
+
|
|
14
|
+
The framework auto-instruments every tool, resource, prompt, storage, LLM, speech, and graph call — each gets its own span and the standard counters/histograms. HTTP server requests pick up spans from `HttpInstrumentation` (or `@hono/otel` on the HTTP transport). Auth checks, session lifecycle, and task lifecycle are tracked as **metrics only** — auth decorates the active HTTP span with attributes, sessions and tasks emit counters.
|
|
15
|
+
|
|
16
|
+
`requestId`, `traceId`, and `tenantId` correlate automatically across spans, metrics, and logs. Pino logs get `trace_id`/`span_id` injected when a span is active.
|
|
17
|
+
|
|
18
|
+
For the helper API surface (`withSpan`, `createCounter`, `createHistogram`, `buildTraceparent`, etc.) — see the `api-utils` skill, `Telemetry` section. This skill is the catalog of **what** is emitted; that one is the reference for **how** to emit your own.
|
|
19
|
+
|
|
20
|
+
---
|
|
21
|
+
|
|
22
|
+
## Enabling export
|
|
23
|
+
|
|
24
|
+
OTel is **off by default**. `OTEL_ENABLED=true` alone does nothing — you also need an OTLP endpoint. Without an endpoint the SDK is configured but nothing leaves the process.
|
|
25
|
+
|
|
26
|
+
| Env var | Default | Purpose |
|
|
27
|
+
|:--------|:--------|:--------|
|
|
28
|
+
| `OTEL_ENABLED` | `false` | Master switch. Must be `true` to start the SDK. |
|
|
29
|
+
| `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` | — | OTLP/HTTP traces endpoint (e.g. `http://localhost:4318/v1/traces`). |
|
|
30
|
+
| `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` | — | OTLP/HTTP metrics endpoint (e.g. `http://localhost:4318/v1/metrics`). |
|
|
31
|
+
| `OTEL_SERVICE_NAME` | `package.json` `name` | `service.name` resource attribute. |
|
|
32
|
+
| `OTEL_SERVICE_VERSION` | `package.json` `version` | `service.version` resource attribute. |
|
|
33
|
+
| `OTEL_TRACES_SAMPLER_ARG` | `1.0` | Trace sampling ratio (0–1) for `TraceIdRatioBasedSampler`. |
|
|
34
|
+
| `OTEL_LOG_LEVEL` | `INFO` | OTel diagnostic logger level (`NONE`/`ERROR`/`WARN`/`INFO`/`DEBUG`/`VERBOSE`/`ALL`). |
|
|
35
|
+
|
|
36
|
+
Metrics push via `PeriodicExportingMetricReader` every **15 seconds**. Traces use `BatchSpanProcessor`.
|
|
37
|
+
|
|
38
|
+
---
|
|
39
|
+
|
|
40
|
+
## Runtime support
|
|
41
|
+
|
|
42
|
+
| Runtime | Behavior |
|
|
43
|
+
|:--------|:---------|
|
|
44
|
+
| **Node.js / Bun** | Full `NodeSDK`. Auto-instrumentations: HTTP server (Node http hooks; skips `/healthz`), Pino logs (`trace_id`/`span_id` injection). On the HTTP transport, when OTel is enabled and `@hono/otel` is installed, `httpInstrumentationMiddleware` is also wired onto the MCP endpoint — fills the gap on Bun, where the Node http auto-instrumentation silently no-ops. Manual spans, custom metrics, and OTLP export work on Bun regardless. |
|
|
45
|
+
| **Cloudflare Workers / V8 isolates** | `NodeSDK` is unavailable. SDK init no-ops silently. `createCounter`/`createHistogram`/`withSpan` calls still work via the global OTel API but produce no output unless you wire a Worker-compatible exporter and `ctx.waitUntil()` for flush. |
|
|
46
|
+
|
|
47
|
+
Cloud platform detection auto-populates resource attributes:
|
|
48
|
+
|
|
49
|
+
| Detected | Attributes set |
|
|
50
|
+
|:---------|:--------------|
|
|
51
|
+
| Cloudflare Workers | `cloud.provider=cloudflare`, `cloud.platform=cloudflare_workers` |
|
|
52
|
+
| AWS Lambda | `cloud.provider=aws`, `cloud.platform=aws_lambda`, `cloud.region` from `AWS_REGION` |
|
|
53
|
+
| GCP Cloud Run / Functions | `cloud.provider=gcp`, `cloud.platform=gcp_cloud_run` (or `gcp_cloud_functions`), `cloud.region` from `GCP_REGION` |
|
|
54
|
+
| All | `deployment.environment.name` from `config.environment` |
|
|
55
|
+
|
|
56
|
+
---
|
|
57
|
+
|
|
58
|
+
## Spans
|
|
59
|
+
|
|
60
|
+
Every handler call gets a span. Nested operations (storage, graph, LLM) become child spans on the same trace. All spans carry `code.function.name` and `code.namespace` for code-attribution. Errors are recorded via `span.recordException()` and `SpanStatusCode.ERROR`; `McpError` codes surface as the `*.error_code` attribute.
|
|
61
|
+
|
|
62
|
+
| Span name | Source | Key attributes |
|
|
63
|
+
|:----------|:-------|:---------------|
|
|
64
|
+
| `tool_execution:<tool>` | every tool call | `mcp.tool.input_bytes`, `mcp.tool.output_bytes`, `mcp.tool.duration_ms`, `mcp.tool.success`, `mcp.tool.error_code`, `mcp.tool.partial_success`, `mcp.tool.batch.{succeeded,failed}_count` |
|
|
65
|
+
| `resource_read:<resource>` | every resource handler | `mcp.resource.uri`, `mcp.resource.mime_type`, `mcp.resource.size_bytes`, `mcp.resource.duration_ms`, `mcp.resource.success`, `mcp.resource.error_code` |
|
|
66
|
+
| `prompt_generation:<prompt>` | every prompt handler | `mcp.prompt.input_bytes`, `mcp.prompt.output_bytes`, `mcp.prompt.message_count`, `mcp.prompt.duration_ms`, `mcp.prompt.success`, `mcp.prompt.error_code` |
|
|
67
|
+
| `storage:<op>` | `StorageService` (every call) | `mcp.storage.operation`, `mcp.storage.duration_ms`, `mcp.storage.success`, `mcp.storage.key_count` (batch ops) |
|
|
68
|
+
| `graph:<op>` | `GraphService` (every call) | `mcp.graph.operation`, `mcp.graph.duration_ms`, `mcp.graph.success` |
|
|
69
|
+
| `gen_ai.chat_completion` | OpenRouter LLM provider | `gen_ai.system=openrouter`, `gen_ai.request.model`, `gen_ai.request.{max_tokens,temperature,top_p,streaming}`, `gen_ai.response.model`, `gen_ai.usage.{input,output,total}_tokens` |
|
|
70
|
+
| `speech:tts` | ElevenLabs provider | `mcp.speech.provider`, `mcp.speech.operation`, `mcp.speech.input_bytes`, `mcp.speech.output_bytes`, `mcp.speech.duration_ms`, `mcp.speech.success` |
|
|
71
|
+
| `speech:stt` | Whisper provider | same as `speech:tts` |
|
|
72
|
+
|
|
73
|
+
Trace context propagates across boundaries via W3C `traceparent` headers. See `api-utils` → `telemetry/trace` for `withSpan`, `buildTraceparent`, `extractTraceparent`, `createContextWithParentTrace`, `injectCurrentContextInto`, `runInContext` signatures.
|
|
74
|
+
|
|
75
|
+
---
|
|
76
|
+
|
|
77
|
+
## Metrics
|
|
78
|
+
|
|
79
|
+
All custom metrics are namespaced `mcp.*` (or `process.*` / `http.client.*` where standard semconv applies). Lazy-initialized on first emission; the universal ones are eagerly created at startup so series exist from the first export cycle.
|
|
80
|
+
|
|
81
|
+
### Tools, resources, prompts
|
|
82
|
+
|
|
83
|
+
| Metric | Type | Unit | Attributes |
|
|
84
|
+
|:-------|:-----|:-----|:-----------|
|
|
85
|
+
| `mcp.tool.calls` | counter | `{calls}` | `mcp.tool.name`, `mcp.tool.success` |
|
|
86
|
+
| `mcp.tool.duration` | histogram | `ms` | `mcp.tool.name`, `mcp.tool.success` |
|
|
87
|
+
| `mcp.tool.errors` | counter | `{errors}` | `mcp.tool.name`, `mcp.tool.error_category` (`upstream`/`server`/`client`) |
|
|
88
|
+
| `mcp.tool.input_bytes` | histogram | `bytes` | `mcp.tool.name` |
|
|
89
|
+
| `mcp.tool.output_bytes` | histogram | `bytes` | `mcp.tool.name` |
|
|
90
|
+
| `mcp.tool.param.usage` | counter | `{uses}` | `mcp.tool.name`, `mcp.tool.param` (top-level keys supplied by caller) |
|
|
91
|
+
| `mcp.resource.reads` | counter | `{reads}` | `mcp.resource.name`, `mcp.resource.success` |
|
|
92
|
+
| `mcp.resource.duration` | histogram | `ms` | `mcp.resource.name`, `mcp.resource.success` |
|
|
93
|
+
| `mcp.resource.errors` | counter | `{errors}` | `mcp.resource.name` |
|
|
94
|
+
| `mcp.resource.output_bytes` | histogram | `bytes` | `mcp.resource.name` |
|
|
95
|
+
| `mcp.prompt.generations` | counter | `{generations}` | `mcp.prompt.name`, `mcp.prompt.success` |
|
|
96
|
+
| `mcp.prompt.duration` | histogram | `ms` | `mcp.prompt.name`, `mcp.prompt.success` |
|
|
97
|
+
| `mcp.prompt.errors` | counter | `{errors}` | `mcp.prompt.name`, `mcp.prompt.error_category` |
|
|
98
|
+
| `mcp.prompt.input_bytes` | histogram | `bytes` | `mcp.prompt.name` |
|
|
99
|
+
| `mcp.prompt.output_bytes` | histogram | `bytes` | `mcp.prompt.name` |
|
|
100
|
+
| `mcp.prompt.message_count` | histogram | `{messages}` | `mcp.prompt.name` |
|
|
101
|
+
| `mcp.requests.active` | up/down counter | `{requests}` | — (in-flight handler executions, all three types) |
|
|
102
|
+
|
|
103
|
+
### Storage, LLM, speech, graph
|
|
104
|
+
|
|
105
|
+
| Metric | Type | Unit | Attributes |
|
|
106
|
+
|:-------|:-----|:-----|:-----------|
|
|
107
|
+
| `mcp.storage.operations` | counter | `{ops}` | `mcp.storage.operation`, `mcp.storage.success` |
|
|
108
|
+
| `mcp.storage.duration` | histogram | `ms` | `mcp.storage.operation`, `mcp.storage.success` |
|
|
109
|
+
| `mcp.storage.errors` | counter | `{errors}` | `mcp.storage.operation` |
|
|
110
|
+
| `mcp.llm.requests` | counter | `{requests}` | `gen_ai.system`, `gen_ai.request.model` |
|
|
111
|
+
| `mcp.llm.duration` | histogram | `ms` | `gen_ai.system`, `gen_ai.request.model` |
|
|
112
|
+
| `mcp.llm.errors` | counter | `{errors}` | `gen_ai.system`, `gen_ai.request.model` |
|
|
113
|
+
| `mcp.llm.tokens` | counter | `{tokens}` | `gen_ai.request.model`, `gen_ai.token.type` (`input`/`output`) |
|
|
114
|
+
| `mcp.speech.operations` | counter | `{ops}` | `mcp.speech.operation` (`tts`/`stt`), `mcp.speech.provider`, `mcp.speech.success` |
|
|
115
|
+
| `mcp.speech.duration` | histogram | `ms` | `mcp.speech.operation`, `mcp.speech.provider` |
|
|
116
|
+
| `mcp.speech.errors` | counter | `{errors}` | `mcp.speech.operation`, `mcp.speech.provider` |
|
|
117
|
+
| `mcp.graph.operations` | counter | `{ops}` | `mcp.graph.operation`, `mcp.graph.success` |
|
|
118
|
+
| `mcp.graph.duration` | histogram | `ms` | `mcp.graph.operation`, `mcp.graph.success` |
|
|
119
|
+
| `mcp.graph.errors` | counter | `{errors}` | `mcp.graph.operation` |
|
|
120
|
+
|
|
121
|
+
### Transport, auth, sessions, tasks
|
|
122
|
+
|
|
123
|
+
| Metric | Type | Unit | Attributes |
|
|
124
|
+
|:-------|:-----|:-----|:-----------|
|
|
125
|
+
| `mcp.auth.attempts` | counter | `{attempts}` | `mcp.auth.outcome` (`success`/`failure`/`missing`), `mcp.auth.failure_reason` |
|
|
126
|
+
| `mcp.auth.duration` | histogram | `ms` | `mcp.auth.outcome`, `mcp.auth.failure_reason` |
|
|
127
|
+
| `mcp.sessions.events` | counter | `{events}` | `mcp.session.event` (`created`/`terminated`/`rejected`/`stale_cleanup`) |
|
|
128
|
+
| `mcp.session.duration` | histogram | `s` | — |
|
|
129
|
+
| `mcp.sessions.active` | observable gauge | `{sessions}` | — |
|
|
130
|
+
| `mcp.heartbeat.failures` | counter | `{failures}` | `mcp.connection.transport` (`stdio`/`http`) |
|
|
131
|
+
| `mcp.http.close_failures` | counter | `{failures}` | `surface` (`transport`/`server`), `trigger` (`success`/`error`/`sse-abort`) — per-request close threw or timed out |
|
|
132
|
+
| `mcp.http.per_request.created` | counter | `{instances}` | `kind` (`server`/`transport`) — per-request `McpServer` and `McpSessionTransport` instances created |
|
|
133
|
+
| `mcp.http.per_request.finalized` | counter | `{instances}` | `kind` (`server`/`transport`) — per-request instances reclaimed by GC; persistent gap vs `created` indicates a leak |
|
|
134
|
+
| `mcp.tasks.created` | counter | `{tasks}` | `mcp.task.store_type` (`in-memory`/`storage`) |
|
|
135
|
+
| `mcp.tasks.status_changes` | counter | `{transitions}` | `mcp.task.status`, `mcp.task.store_type` |
|
|
136
|
+
| `mcp.tasks.active` | observable gauge | `{tasks}` | — (in-memory store only) |
|
|
137
|
+
|
|
138
|
+
### Errors, rate limits, HTTP client
|
|
139
|
+
|
|
140
|
+
| Metric | Type | Unit | Attributes |
|
|
141
|
+
|:-------|:-----|:-----|:-----------|
|
|
142
|
+
| `mcp.errors.classified` | counter | `{errors}` | `mcp.error.classified_code` (JSON-RPC code), `operation` |
|
|
143
|
+
| `mcp.ratelimit.rejections` | counter | `{rejections}` | `mcp.rate_limit.key` |
|
|
144
|
+
| `http.client.request.duration` | histogram | `s` | `http.request.method`, `server.address`, `http.response.status_code` (when > 0; absent on network errors before a response is received) |
|
|
145
|
+
|
|
146
|
+
### Process
|
|
147
|
+
|
|
148
|
+
Auto-registered when `process.memoryUsage` / `process.uptime` / `perf_hooks` are available (Node/Bun, not Workers). The three memory gauges share a single `process.memoryUsage()` snapshot per collection cycle, refreshed at most every 100 ms.
|
|
149
|
+
|
|
150
|
+
| Metric | Type | Unit | Notes |
|
|
151
|
+
|:-------|:-----|:-----|:------|
|
|
152
|
+
| `process.memory.rss` | observable gauge | `bytes` | Resident set size |
|
|
153
|
+
| `process.memory.heap_used` | observable gauge | `bytes` | V8 heap used |
|
|
154
|
+
| `process.memory.heap_total` | observable gauge | `bytes` | V8 total heap |
|
|
155
|
+
| `process.uptime` | observable gauge | `s` | Process uptime |
|
|
156
|
+
| `process.event_loop.delay` | observable gauge | `ms` | p99 delay (`monitorEventLoopDelay` resolution=20) |
|
|
157
|
+
| `process.event_loop.utilization` | observable gauge | `1` | 0 = idle, 1 = saturated |
|
|
158
|
+
|
|
159
|
+
---
|
|
160
|
+
|
|
161
|
+
## Logs
|
|
162
|
+
|
|
163
|
+
Pino logs are auto-instrumented by `@opentelemetry/instrumentation-pino`. When a span is active, `trace_id` and `span_id` are injected into the record. Combined with the framework logger's automatic `requestId`/`tenantId` correlation, every log line is searchable by trace.
|
|
164
|
+
|
|
165
|
+
For domain logging inside handlers, use `ctx.log` (`debug`/`info`/`notice`/`warning`/`error`) — auto-includes `requestId`, `traceId`, `tenantId`, `spanId`. The completion log emitted at the end of every handler carries a `metrics` payload, with fields tuned to each surface:
|
|
166
|
+
|
|
167
|
+
| Handler | Log message | `metrics` fields |
|
|
168
|
+
|:--------|:------------|:-----------------|
|
|
169
|
+
| Tool | `Tool execution finished.` | `durationMs`, `isSuccess`, `errorCode`, `inputBytes`, `outputBytes`, plus `partialSuccess` / `batchSucceeded` / `batchFailed` when the result is a partial-success batch |
|
|
170
|
+
| Resource | `Resource read finished.` | `durationMs`, `isSuccess`, `errorCode`, `outputBytes`, `uri`, `mimeType` |
|
|
171
|
+
| Prompt | `Prompt generation finished.` (or `failed.`) | `durationMs`, `isSuccess`, `errorCode`, `inputBytes`, `outputBytes`, `messageCount` |
|
|
172
|
+
|
|
173
|
+
---
|
|
174
|
+
|
|
175
|
+
## Custom instrumentation
|
|
176
|
+
|
|
177
|
+
Need a span or metric for your own service? Use the helpers from `@cyanheads/mcp-ts-core/utils` (full signatures in `api-utils` → `Telemetry`):
|
|
178
|
+
|
|
179
|
+
```ts
|
|
180
|
+
import { withSpan, createCounter, createHistogram } from '@cyanheads/mcp-ts-core/utils';
|
|
181
|
+
|
|
182
|
+
const myOps = createCounter('myservice.operations', 'My service ops', '{ops}');
|
|
183
|
+
const myDuration = createHistogram('myservice.duration', 'My service duration', 'ms');
|
|
184
|
+
|
|
185
|
+
export async function doWork() {
|
|
186
|
+
return withSpan('myservice.do_work', async (span) => {
|
|
187
|
+
const t0 = performance.now();
|
|
188
|
+
try {
|
|
189
|
+
const result = await reallyDoWork();
|
|
190
|
+
span.setAttribute('myservice.items', result.length);
|
|
191
|
+
return result;
|
|
192
|
+
} finally {
|
|
193
|
+
myDuration.record(performance.now() - t0);
|
|
194
|
+
myOps.add(1);
|
|
195
|
+
}
|
|
196
|
+
}, { 'myservice.region': 'us-west' });
|
|
197
|
+
}
|
|
198
|
+
```
|
|
199
|
+
|
|
200
|
+
Span context propagates automatically — `withSpan` calls inside a `tool_execution:*` span appear as children. `runInContext(ctx, fn)` carries the active OTel context across async boundaries (`setTimeout`, `queueMicrotask`).
|
|
201
|
+
|
|
202
|
+
For attribute keys, prefer the `ATTR_*` constants exported from `@cyanheads/mcp-ts-core/utils` (telemetry/attributes) over hand-typed strings — keeps you in step with framework conventions and avoids typos. Standard OTel semantic conventions (HTTP, cloud, service, network, etc.) are NOT re-exported — import those directly from `@opentelemetry/semantic-conventions`.
|
|
203
|
+
|
|
204
|
+
---
|
|
205
|
+
|
|
206
|
+
## Visualization
|
|
207
|
+
|
|
208
|
+
An example Grafana dashboard JSON and vendor-agnostic query recipes (Prometheus, Datadog, New Relic, Honeycomb) live at [`docs/telemetry/`](https://github.com/cyanheads/mcp-ts-core/tree/main/docs/telemetry) in the framework source — not bundled in the npm package, so consult the GitHub repo.
|
|
209
|
+
|
|
210
|
+
---
|
|
211
|
+
|
|
212
|
+
## Cardinality discipline
|
|
213
|
+
|
|
214
|
+
Series are cheap to emit but expensive to store and query. The framework deliberately keeps high-cardinality identifiers off metric attributes and on spans only. Follow the same rule when adding your own metrics.
|
|
215
|
+
|
|
216
|
+
| On metrics | On spans / logs only |
|
|
217
|
+
|:-----------|:---------------------|
|
|
218
|
+
| `mcp.resource.name` (URI template) | `mcp.resource.uri` (full URI with IDs) |
|
|
219
|
+
| `gen_ai.request.model` (bounded enum) | `mcp.tenant.id`, `mcp.client.id`, `mcp.auth.subject` |
|
|
220
|
+
| Bounded enum / template strings | Per-request unique IDs, free-form user input, opaque tokens |
|
|
221
|
+
|
|
222
|
+
When in doubt: if the attribute can take more than ~100 distinct values across a fleet's runtime, it belongs on the span, not the metric.
|
|
@@ -4,7 +4,7 @@ description: >
|
|
|
4
4
|
API reference for all utilities exported from `@cyanheads/mcp-ts-core/utils`. Use when looking up utility method signatures, options, peer dependencies, or usage patterns.
|
|
5
5
|
metadata:
|
|
6
6
|
author: cyanheads
|
|
7
|
-
version: "2.
|
|
7
|
+
version: "2.2"
|
|
8
8
|
audience: external
|
|
9
9
|
type: reference
|
|
10
10
|
---
|
|
@@ -136,6 +136,8 @@ Both functions throw `McpError(InternalError)` only on unexpected heuristic fail
|
|
|
136
136
|
|
|
137
137
|
## `@cyanheads/mcp-ts-core/utils` — Telemetry
|
|
138
138
|
|
|
139
|
+
Helper API only. For the catalog of what the framework auto-emits (span names, metric names, attributes, completion log fields, env config, runtime support, cardinality rules), see the `api-telemetry` skill.
|
|
140
|
+
|
|
139
141
|
### `telemetry/instrumentation`
|
|
140
142
|
|
|
141
143
|
| Export | Signature | Notes |
|