@cyanheads/mcp-ts-core 0.9.4 → 0.9.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CLAUDE.md +19 -107
- package/README.md +1 -1
- package/biome.json +1 -1
- package/changelog/0.9.x/0.9.5.md +17 -0
- package/dist/logs/combined.log +7 -7
- package/dist/logs/error.log +5 -5
- package/package.json +4 -4
- package/skills/maintenance/SKILL.md +2 -1
- package/skills/polish-docs-meta/SKILL.md +33 -5
- package/templates/CLAUDE.md +1 -1
- package/templates/_.mcpbignore +0 -3
package/CLAUDE.md
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# Developer Protocol
|
|
2
2
|
|
|
3
3
|
**Package:** `@cyanheads/mcp-ts-core`
|
|
4
|
-
**Version:** 0.9.
|
|
4
|
+
**Version:** 0.9.5
|
|
5
5
|
**Engines:** Bun ≥1.3.0, Node ≥24.0.0
|
|
6
6
|
**MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
|
|
7
7
|
**Zod:** ^4.4.3
|
|
@@ -32,8 +32,8 @@ Both paths share the same public API. Init copies starter `package.json`, config
|
|
|
32
32
|
- **Full-stack observability.** The framework automatically instruments every tool/resource call — OTel span, duration/payload/memory metrics, structured completion log. Use `ctx.log` for additional domain-specific logging within handlers (external API calls, multi-step operations, business events). `requestId`, `traceId`, `tenantId` auto-correlated. No `console` calls.
|
|
33
33
|
- **Unified Context.** Handlers receive `ctx` with logging (`ctx.log`), tenant-scoped storage (`ctx.state`), optional protocol capabilities (`ctx.elicit`, `ctx.sample`), and cancellation (`ctx.signal`).
|
|
34
34
|
- **Decoupled storage.** `ctx.state` for tenant-scoped KV. Never access persistence backends directly.
|
|
35
|
-
- **Canvas tokens are capabilities, not tenant-scoped state.** A `canvasId` is a 10-char URL-safe token; possession grants full read/write/drop
|
|
36
|
-
- **Runtime parity.** All features work
|
|
35
|
+
- **Canvas tokens are capabilities, not tenant-scoped state.** A `canvasId` is a 10-char URL-safe token; possession grants full read/write/drop. Shareable between agents and across users in single-tenant deployments. Tools accept token in `input` (omit to create fresh) and return in `output`; collaboration is opt-in via token exchange.
|
|
36
|
+
- **Runtime parity.** All features work across `stdio`/`http`/Worker. Guard non-portable deps via `runtimeCaps` from `/utils` (`isNode`, `isBun`, `isWorkerLike`, `hasBuffer`, `hasProcess`, etc.). Prefer runtime-agnostic abstractions (Hono, Fetch APIs).
|
|
37
37
|
- **Definition linting is build-time only.** Run `bun run lint:mcp` (standalone) or `bun run devcheck` (gate). Not invoked at server startup — new lint rules are additive and never break deployed servers. Every diagnostic links to the rule reference in `api-linter` skill; see that skill for the full rule catalog.
|
|
38
38
|
- **Elicitation for missing input.** Use `ctx.elicit` when the client supports it.
|
|
39
39
|
|
|
@@ -106,7 +106,7 @@ await createApp({
|
|
|
106
106
|
});
|
|
107
107
|
```
|
|
108
108
|
|
|
109
|
-
**`instructions`** — Optional server-level orientation
|
|
109
|
+
**`instructions`** — Optional server-level orientation, surfaced on every `initialize` response as session-level system context. Use for deployment-specific guidance (connection aliases, regional notes, scope hints) instead of repeating in tool descriptions. Client adoption uneven but no downside when set.
|
|
110
110
|
|
|
111
111
|
### Cloudflare Workers — `createWorkerHandler(options)`
|
|
112
112
|
|
|
@@ -125,8 +125,6 @@ export default createWorkerHandler({
|
|
|
125
125
|
});
|
|
126
126
|
```
|
|
127
127
|
|
|
128
|
-
`instructions` on the Worker handler accepts either a plain string or a `(env) => string` resolver so deployment env (injected at request time) can shape the text.
|
|
129
|
-
|
|
130
128
|
Per-request `McpServer` factory (security: SDK GHSA-345p-7cg4-v4c7). Requires `compatibility_flags = ["nodejs_compat"]` and `compatibility_date >= "2025-09-01"` in `wrangler.toml`. Only `in-memory`, `cloudflare-r2`, `cloudflare-kv`, `cloudflare-d1` storage in Workers. See `api-workers` skill for full details.
|
|
131
129
|
|
|
132
130
|
### Interfaces
|
|
@@ -260,56 +258,6 @@ Handler receives `(params, ctx)` — URI on `ctx.uri` if needed. Optional `size`
|
|
|
260
258
|
|
|
261
259
|
---
|
|
262
260
|
|
|
263
|
-
## Adding a Prompt
|
|
264
|
-
|
|
265
|
-
```ts
|
|
266
|
-
import { prompt, z } from '@cyanheads/mcp-ts-core';
|
|
267
|
-
|
|
268
|
-
export const codeReview = prompt('code_review', {
|
|
269
|
-
description: 'Review code for security and best practices.',
|
|
270
|
-
args: z.object({
|
|
271
|
-
code: z.string().describe('Code to review'),
|
|
272
|
-
language: z.string().optional().describe('Programming language'),
|
|
273
|
-
}),
|
|
274
|
-
generate: (args) => [
|
|
275
|
-
{ role: 'user', content: { type: 'text', text: `Review this ${args.language ?? ''} code:\n${args.code}` } },
|
|
276
|
-
],
|
|
277
|
-
});
|
|
278
|
-
```
|
|
279
|
-
|
|
280
|
-
Prompts are pure message templates — no `Context`, no auth, no side effects.
|
|
281
|
-
|
|
282
|
-
---
|
|
283
|
-
|
|
284
|
-
## Adding a Service
|
|
285
|
-
|
|
286
|
-
Init/accessor pattern — initialized in `setup()`, accessed at request time.
|
|
287
|
-
|
|
288
|
-
```ts
|
|
289
|
-
export class MyService {
|
|
290
|
-
constructor(private readonly config: AppConfig, private readonly storage: StorageService) {}
|
|
291
|
-
async doWork(input: string, ctx: Context): Promise<string> {
|
|
292
|
-
ctx.log.debug('Working', { input });
|
|
293
|
-
return `done: ${input}`;
|
|
294
|
-
}
|
|
295
|
-
}
|
|
296
|
-
|
|
297
|
-
let _service: MyService | undefined;
|
|
298
|
-
export function initMyService(config: AppConfig, storage: StorageService): void {
|
|
299
|
-
_service = new MyService(config, storage);
|
|
300
|
-
}
|
|
301
|
-
export function getMyService(): MyService {
|
|
302
|
-
if (!_service) throw new Error('MyService not initialized — call initMyService() in setup()');
|
|
303
|
-
return _service;
|
|
304
|
-
}
|
|
305
|
-
```
|
|
306
|
-
|
|
307
|
-
Usage: `getMyService().doWork(input.query, ctx)`. Convention: `ctx.elicit`/`ctx.sample` only from tool handlers, not services.
|
|
308
|
-
|
|
309
|
-
**API efficiency:** Prefer batch endpoints over N+1 individual requests. Use field selection to minimize payload. Cross-reference batch responses against requested IDs to detect missing items. See `add-service` skill for patterns.
|
|
310
|
-
|
|
311
|
-
---
|
|
312
|
-
|
|
313
261
|
## Context
|
|
314
262
|
|
|
315
263
|
```ts
|
|
@@ -404,11 +352,9 @@ async handler(input, ctx) {
|
|
|
404
352
|
}
|
|
405
353
|
```
|
|
406
354
|
|
|
407
|
-
**`ctx.recoveryFor(reason)`**
|
|
355
|
+
**`ctx.recoveryFor(reason)`** returns `{}` when no contract exists (spread-safe). Typed against the declared reason union on `HandlerContext<R>`. Works in services: `throw validationError(msg, { reason: 'X', ...ctx.recoveryFor('X') })`. Opt-in — author spreads explicitly.
|
|
408
356
|
|
|
409
|
-
**
|
|
410
|
-
|
|
411
|
-
The contract describes the **public failure surface** — declare domain-specific failures only. **Baseline codes** (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) bubble from anywhere and are auto-allowed by the conformance lint, so you don't need to enumerate them per-tool. The conformance lint scans handler source text only — failures thrown from called services aren't visible to it (still reach the client correctly via the auto-classifier, just without lint enforcement).
|
|
357
|
+
**Contracts are inline, per-tool.** Don't extract shared `errors[]` constants — locality is the point, and dynamic `recovery` hints need tool-specific context. Declare domain-specific failures only; **baseline codes** (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) are auto-allowed by conformance lint. The lint scans handler source only — service-layer throws still reach clients via auto-classification.
|
|
412
358
|
|
|
413
359
|
**Fallback for ad-hoc throws** (no contract entry fits, prototype tools, service-layer code): use error factories.
|
|
414
360
|
|
|
@@ -424,9 +370,9 @@ For HTTP responses from upstream APIs, use `httpErrorFromResponse(response, { se
|
|
|
424
370
|
|
|
425
371
|
**Auto-classification.** Plain `Error`, `ZodError`, and any other thrown value are caught and classified automatically. Resolution order: `McpError` code (preserved as-is) → JS constructor name (`TypeError` → `ValidationError`) → provider patterns (HTTP status codes, AWS errors, DB errors) → common message patterns → `AbortError` name → `InternalError` fallback.
|
|
426
372
|
|
|
427
|
-
**Error-path parity.** Tool errors
|
|
373
|
+
**Error-path parity.** Tool errors: `content[]` carries markdown with `data.recovery.hint`; `structuredContent.error` carries `{ code, message, data? }`. No `_meta.error`. Resources re-throw via JSON-RPC error envelope.
|
|
428
374
|
|
|
429
|
-
|
|
375
|
+
**Lint rules** (all warnings, surfaced in `devcheck`): `prefer-mcp-error-in-handler`, `prefer-error-factory`, `preserve-cause-on-rethrow`, `no-stringify-upstream-error`, `error-contract-conformance`, `error-contract-prefer-fail`. See `api-linter` skill.
|
|
430
376
|
|
|
431
377
|
See `api-errors` skill for the full pattern-matching table, error code reference, and detailed examples.
|
|
432
378
|
|
|
@@ -447,7 +393,7 @@ Pick one convention per server and stay consistent. Verbs are typically `read`,
|
|
|
447
393
|
|
|
448
394
|
**Modes** (`MCP_AUTH_MODE`): `none` (default) | `jwt` (local secret via `MCP_AUTH_SECRET_KEY`) | `oauth` (JWKS via `OAUTH_ISSUER_URL`, `OAUTH_AUDIENCE`). See `api-auth` skill for claims, CORS, and detailed config.
|
|
449
395
|
|
|
450
|
-
**Granted scopes** union `scp`, `scope`, and `mcp_tool_scopes` JWT claims. `mcp_tool_scopes` is the escape hatch
|
|
396
|
+
**Granted scopes** union `scp`, `scope`, and `mcp_tool_scopes` JWT claims. `mcp_tool_scopes` is the OIDC escape hatch (Authentik, Keycloak < 26.5, Zitadel). `MCP_AUTH_DISABLE_SCOPE_CHECKS=true` bypasses scope checks while preserving auth-context verification (signature/audience/issuer/expiry). Logs `WARNING` at startup.
|
|
451
397
|
|
|
452
398
|
---
|
|
453
399
|
|
|
@@ -514,41 +460,11 @@ Detailed method signatures, options, and examples live in skill files. Read the
|
|
|
514
460
|
|
|
515
461
|
### Skill versioning
|
|
516
462
|
|
|
517
|
-
Each `skills/<name>/SKILL.md` carries
|
|
518
|
-
|
|
519
|
-
**Policy:**
|
|
520
|
-
|
|
521
|
-
|
|
522
|
-
|:------|:-----|:-------|
|
|
523
|
-
| `api-utils` | `skills/api-utils/SKILL.md` | formatting, parsing, security, network, pagination, runtime, scheduling, types, logger, requestContext, errorHandler, telemetry helpers (`withSpan`, `createCounter`, …) |
|
|
524
|
-
| `api-telemetry` | `skills/api-telemetry/SKILL.md` | OTel catalog: span names, metric names + attributes, completion log fields, env config, runtime support, cardinality rules |
|
|
525
|
-
| `api-services` | `skills/api-services/SKILL.md` | LLM (OpenRouter), Speech (ElevenLabs TTS, Whisper STT), Graph (CRUD, traversal, pathfinding) |
|
|
526
|
-
| `api-context` | `skills/api-context/SKILL.md` | Context interface, createContext, ContextLogger/State/Progress |
|
|
527
|
-
| `api-errors` | `skills/api-errors/SKILL.md` | McpError, JsonRpcErrorCode, error handling patterns |
|
|
528
|
-
| `api-auth` | `skills/api-auth/SKILL.md` | Auth modes, scopes, JWT/OAuth strategies |
|
|
529
|
-
| `api-config` | `skills/api-config/SKILL.md` | AppConfig, parseConfig, env vars |
|
|
530
|
-
| `api-testing` | `skills/api-testing/SKILL.md` | createMockContext, test patterns, MockContextOptions |
|
|
531
|
-
| `api-workers` | `skills/api-workers/SKILL.md` | createWorkerHandler, CloudflareBindings, Worker runtime |
|
|
532
|
-
| `api-canvas` | `skills/api-canvas/SKILL.md` | DataCanvas primitive: acquire/register/query/export, token-sharing model, SQL gate, lifecycle, spillover pattern |
|
|
533
|
-
| `api-linter` | `skills/api-linter/SKILL.md` | Definition lint rules (`format-parity`, `schema-*`, `name-*`, `server-json-*`, …) — look here when devcheck reports a lint diagnostic |
|
|
534
|
-
| `add-tool` | `skills/add-tool/SKILL.md` | Scaffold a new MCP tool definition |
|
|
535
|
-
| `add-app-tool` | `skills/add-app-tool/SKILL.md` | Scaffold an MCP App tool + UI resource pair |
|
|
536
|
-
| `add-resource` | `skills/add-resource/SKILL.md` | Scaffold a new MCP resource definition |
|
|
537
|
-
| `add-prompt` | `skills/add-prompt/SKILL.md` | Scaffold a new MCP prompt definition |
|
|
538
|
-
| `add-service` | `skills/add-service/SKILL.md` | Scaffold a new domain service |
|
|
539
|
-
| `add-test` | `skills/add-test/SKILL.md` | Scaffold test file for a tool, resource, or service |
|
|
540
|
-
| `field-test` | `skills/field-test/SKILL.md` | Exercise tools/resources/prompts with real inputs, verify behavior, report issues |
|
|
541
|
-
| `security-pass` | `skills/security-pass/SKILL.md` | Review server for MCP-flavored security gaps: output injection, scope blast radius, elicit gaps, upstream auth, input sinks, tenant isolation, leakage, resource bounds |
|
|
542
|
-
| `add-provider` | `skills/add-provider/SKILL.md` | Add a new provider implementation |
|
|
543
|
-
| `add-export` | `skills/add-export/SKILL.md` | Add a new subpath export |
|
|
544
|
-
| `design-mcp-server` | `skills/design-mcp-server/SKILL.md` | Design tool surface, resources, and service layer for a new server |
|
|
545
|
-
| `setup` | `skills/setup/SKILL.md` | Initialize a new consumer server from the template |
|
|
546
|
-
| `polish-docs-meta` | `skills/polish-docs-meta/SKILL.md` | Finalize docs, README, metadata, and agent protocol for shipping |
|
|
547
|
-
| `report-issue-framework` | `skills/report-issue-framework/SKILL.md` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
|
|
548
|
-
| `report-issue-local` | `skills/report-issue-local/SKILL.md` | File a bug or feature request against this server's own repo via `gh` CLI |
|
|
549
|
-
| `release-and-publish` | `skills/release-and-publish/SKILL.md` | Post-wrapup ship workflow: verification gate, push, publish to npm/MCP Registry/GHCR |
|
|
550
|
-
| `maintenance` | `skills/maintenance/SKILL.md` | Dependency updates, housekeeping tasks |
|
|
551
|
-
| `migrate-mcp-ts-template` | `skills/migrate-mcp-ts-template/SKILL.md` | Migrate legacy template fork to package dependency |
|
|
463
|
+
Each `skills/<name>/SKILL.md` carries `metadata.version` in frontmatter. The `maintenance` skill's Phase A uses this to sync consumer copies — replaces the **entire skill directory** as one unit. Without a version bump, Phase A skips the skill (content-hash backstop catches drift, but noisier).
|
|
464
|
+
|
|
465
|
+
**Policy:** Bump `metadata.version` when changing any file under `skills/<name>/` — SKILL.md is the single version knob for the directory. Typo/whitespace fixes exempt. One bump per release cycle suffices.
|
|
466
|
+
|
|
467
|
+
Skills live in `skills/<name>/SKILL.md`. Read the relevant skill before starting a task it covers. The full list is discoverable via the agent's skill registry at session start.
|
|
552
468
|
|
|
553
469
|
---
|
|
554
470
|
|
|
@@ -581,7 +497,7 @@ Each `skills/<name>/SKILL.md` carries a `metadata.version` string in its frontma
|
|
|
581
497
|
| `bun run build` | Build library output (`scripts/build.ts`) |
|
|
582
498
|
| `bun run rebuild` | Clean and rebuild (`scripts/clean.ts` + `build`) |
|
|
583
499
|
| `bun run devcheck` | **Use often.** Lint, format, typecheck, MCP definition linting, `bun audit`, `bun outdated` |
|
|
584
|
-
| `bun run audit:refresh` | Delete `bun.lock`, reinstall,
|
|
500
|
+
| `bun run audit:refresh` | Delete `bun.lock`, reinstall, re-audit. Use when `devcheck` flags a transitive advisory — stale lockfile can mask already-patched deps. If advisory survives, it's real. |
|
|
585
501
|
| `bun run lint:mcp` | Validate MCP definitions against spec |
|
|
586
502
|
| `bun run format` | Auto-fix Biome lint/format issues |
|
|
587
503
|
| `bun run test` | Unit/integration tests |
|
|
@@ -596,11 +512,9 @@ After `bun update --latest`, run the `maintenance` skill to investigate changelo
|
|
|
596
512
|
|
|
597
513
|
## Changelog
|
|
598
514
|
|
|
599
|
-
Directory-based
|
|
600
|
-
|
|
601
|
-
At release time, author the per-version file with a concrete version and date, then run `bun run changelog:build` to regenerate the rollup. `changelog/template.md` is a format reference — never edited; consult it for frontmatter and section layout when scaffolding a new file. Be concise and accurate.
|
|
515
|
+
Directory-based. Source of truth: `changelog/<major.minor>.x/<version>.md` — one file per release (e.g. `changelog/0.5.x/0.5.4.md`), shipped in the npm package for direct agent access. `changelog/template.md` is the format reference (never edited).
|
|
602
516
|
|
|
603
|
-
`CHANGELOG.md` is a **navigation index
|
|
517
|
+
`CHANGELOG.md` is a **navigation index** — clickable headers + one-line summaries from frontmatter. Regenerated by `bun run changelog:build`; `changelog:check` hard-fails on drift in devcheck. Never hand-edit — edit the per-version file and rerun the build.
|
|
604
518
|
|
|
605
519
|
### Per-version file format
|
|
606
520
|
|
|
@@ -626,11 +540,9 @@ security: false # optional, default fals
|
|
|
626
540
|
| `breaking` | no (default `false`) | Flags releases with breaking changes. Renders as `· ⚠️ Breaking` badge in the rollup. Agents running the `maintenance` skill read this to prioritize review. |
|
|
627
541
|
| `security` | no (default `false`) | Flags releases with security fixes. Renders as `· 🛡️ Security` badge in the rollup so users can triage upgrade urgency. Pairs with the `## Security` body section. |
|
|
628
542
|
|
|
629
|
-
|
|
630
|
-
|
|
631
|
-
**Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Include only sections with entries — don't ship empty headers.
|
|
543
|
+
Badge order when both set: `· ⚠️ Breaking · 🛡️ Security`. Summary > 350 chars or malformed boolean fails `changelog:check`.
|
|
632
544
|
|
|
633
|
-
|
|
545
|
+
**Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Omit empty sections. Pre-release versions consolidate as sub-headers inside the final version's file — no separate files per pre-release.
|
|
634
546
|
|
|
635
547
|
---
|
|
636
548
|
|
package/README.md
CHANGED
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
|
|
8
8
|
[](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
|
|
9
9
|
|
|
10
|
-
[](./CHANGELOG.md) [](./LICENSE) [](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx)
|
|
11
11
|
|
|
12
12
|
[](https://modelcontextprotocol.io/) [](https://www.typescriptlang.org/) [](https://bun.sh/)
|
|
13
13
|
|
package/biome.json
CHANGED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
---
|
|
2
|
+
summary: "mcpbignore recursive-match fix, zod promoted to dependencies, polish-docs-meta MCPB step, maintenance template-file adoption, CLAUDE.md condensed"
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# 0.9.5 — 2026-05-23
|
|
6
|
+
|
|
7
|
+
## Fixed
|
|
8
|
+
|
|
9
|
+
- `.mcpbignore` template: removed bare `src/`, `tests/`, `coverage/` entries that matched recursively and stripped `node_modules/**/build/src/`, breaking `@opentelemetry/api` CJS entry in MCPB bundles ([#146](https://github.com/cyanheads/mcp-ts-core/issues/146))
|
|
10
|
+
- `zod` added to `dependencies` (was peer-only); stale `node_modules` could leave zod unresolved since the framework imports it at runtime
|
|
11
|
+
|
|
12
|
+
## Changed
|
|
13
|
+
|
|
14
|
+
- `CLAUDE.md`/`AGENTS.md`: condensed prose across Error Handling, Auth, Changelog, Entry Points, Core Rules; removed Adding a Prompt, Adding a Service sections (covered by skills), removed 30-row skill table (redundant with session skill registry)
|
|
15
|
+
- `biome.json`: `noDuplicateDependencies` downgraded to `warn` — intentional `dependencies` + `peerDependencies` overlap for zod
|
|
16
|
+
- `skills/polish-docs-meta` v2.0 → v2.1: new Step 10 for MCPB bundling artifacts (`manifest.json`, `.mcpbignore`, `bundle`/`lint:packaging` scripts, README install badges)
|
|
17
|
+
- `skills/maintenance` v2.3 → v2.4: Step 4 scan table gains "New template-scaffolded files" row — flags missing files like `manifest.json` and `.mcpbignore` for adoption ([#147](https://github.com/cyanheads/mcp-ts-core/issues/147))
|
package/dist/logs/combined.log
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
{"level":40,"time":
|
|
2
|
-
{"level":40,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
5
|
-
{"level":50,"time":
|
|
6
|
-
{"level":50,"time":
|
|
7
|
-
{"level":50,"time":
|
|
1
|
+
{"level":40,"time":1779525180302,"env":"testing","version":"0.9.5","pid":19119,"transport":"http","requestId":"8I7DR-QK3Q5","timestamp":"2026-05-23T08:33:00.301Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
|
|
2
|
+
{"level":40,"time":1779525182035,"env":"testing","version":"0.9.5","pid":19119,"transport":"http","requestId":"8I7DR-QK3Q5","timestamp":"2026-05-23T08:33:00.301Z","operation":"TransportManager.start","component":"HttpTransportSetup","sessionId":"not-a-real-session-1779525182035","msg":"Session validation failed - invalid or hijacked session"}
|
|
3
|
+
{"level":50,"time":1779525186246,"env":"testing","version":"0.0.0-test","pid":19207,"requestId":"5BTFB-9TCTE","timestamp":"2026-05-23T08:33:06.245Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"5798bcd4468074f87ca9d8bce75ddd7d971b63fce0ae460a8a1c93ef422b742e","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"5798bcd4468074f87ca9d8bce75ddd7d971b63fce0ae460a8a1c93ef422b742e","toolName":"scoped_echo","requestId":"5BTFB-9TCTE","timestamp":"2026-05-23T08:33:06.245Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:184:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
4
|
+
{"level":50,"time":1779525186253,"env":"testing","version":"0.0.0-test","pid":19207,"requestId":"KLWMG-6WVT6","timestamp":"2026-05-23T08:33:06.253Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"00625ce1a231065e2a92c4423cf94c6f9dc139a6e16bfbba8888d34226fde894","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"00625ce1a231065e2a92c4423cf94c6f9dc139a6e16bfbba8888d34226fde894","toolName":"scoped_echo","requestId":"KLWMG-6WVT6","timestamp":"2026-05-23T08:33:06.253Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:184:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
5
|
+
{"level":50,"time":1779525187678,"env":"testing","version":"0.9.5","pid":19245,"requestId":"ET1UM-D2PSZ","timestamp":"2026-05-23T08:33:07.678Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"ET1UM-D2PSZ","timestamp":"2026-05-23T08:33:07.678Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
6
|
+
{"level":50,"time":1779525187693,"env":"testing","version":"0.9.5","pid":19245,"requestId":"KHCYN-C8IAD","timestamp":"2026-05-23T08:33:07.693Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"KHCYN-C8IAD","timestamp":"2026-05-23T08:33:07.693Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:72:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
7
|
+
{"level":50,"time":1779525187697,"env":"testing","version":"0.9.5","pid":19245,"requestId":"GVI8J-0B2W0","timestamp":"2026-05-23T08:33:07.697Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"GVI8J-0B2W0","timestamp":"2026-05-23T08:33:07.697Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
package/dist/logs/error.log
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
{"level":50,"time":
|
|
2
|
-
{"level":50,"time":
|
|
3
|
-
{"level":50,"time":
|
|
4
|
-
{"level":50,"time":
|
|
5
|
-
{"level":50,"time":
|
|
1
|
+
{"level":50,"time":1779525186246,"env":"testing","version":"0.0.0-test","pid":19207,"requestId":"5BTFB-9TCTE","timestamp":"2026-05-23T08:33:06.245Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"5798bcd4468074f87ca9d8bce75ddd7d971b63fce0ae460a8a1c93ef422b742e","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"5798bcd4468074f87ca9d8bce75ddd7d971b63fce0ae460a8a1c93ef422b742e","toolName":"scoped_echo","requestId":"5BTFB-9TCTE","timestamp":"2026-05-23T08:33:06.245Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:184:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
2
|
+
{"level":50,"time":1779525186253,"env":"testing","version":"0.0.0-test","pid":19207,"requestId":"KLWMG-6WVT6","timestamp":"2026-05-23T08:33:06.253Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"00625ce1a231065e2a92c4423cf94c6f9dc139a6e16bfbba8888d34226fde894","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"00625ce1a231065e2a92c4423cf94c6f9dc139a6e16bfbba8888d34226fde894","toolName":"scoped_echo","requestId":"KLWMG-6WVT6","timestamp":"2026-05-23T08:33:06.253Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:146:17)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:184:26)\n at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
|
|
3
|
+
{"level":50,"time":1779525187678,"env":"testing","version":"0.9.5","pid":19245,"requestId":"ET1UM-D2PSZ","timestamp":"2026-05-23T08:33:07.678Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"ET1UM-D2PSZ","timestamp":"2026-05-23T08:33:07.678Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
|
4
|
+
{"level":50,"time":1779525187693,"env":"testing","version":"0.9.5","pid":19245,"requestId":"KHCYN-C8IAD","timestamp":"2026-05-23T08:33:07.693Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"POST","errorData":{"path":"/mcp","method":"POST","requestId":"KHCYN-C8IAD","timestamp":"2026-05-23T08:33:07.693Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Token has expired.","originalStack":"McpError: Token has expired.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at handleJoseVerifyError (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/claimParser.js:72:11)\n at verify (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/strategies/jwtStrategy.js:91:13)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Token has expired.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Token has expired."}
|
|
5
|
+
{"level":50,"time":1779525187697,"env":"testing","version":"0.9.5","pid":19245,"requestId":"GVI8J-0B2W0","timestamp":"2026-05-23T08:33:07.697Z","operation":"httpErrorHandler","critical":false,"errorCode":-32006,"originalErrorType":"McpError","finalErrorType":"McpError","path":"/mcp","method":"GET","errorData":{"path":"/mcp","method":"GET","requestId":"GVI8J-0B2W0","timestamp":"2026-05-23T08:33:07.697Z","operation":"httpErrorHandler","originalErrorName":"McpError","originalMessage":"Missing or invalid Authorization header. Bearer scheme required.","originalStack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at unauthorized (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:86:61)\n at authMiddleware (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/authMiddleware.js:64:19)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpTransport.js:232:22)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:22:23)\n at cors2 (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/middleware/cors/index.js:79:11)\n at processTicksAndRejections (native:7:39)"},"stack":"McpError: Missing or invalid Authorization header. Bearer scheme required.\n at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/http/httpErrorHandler.js:59:39)\n at dispatch (/Users/casey/Developer/github/mcp-ts-core/node_modules/hono/dist/compose.js:26:25)\n at processTicksAndRejections (native:7:39)","msg":"Error in httpTransport: Missing or invalid Authorization header. Bearer scheme required."}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cyanheads/mcp-ts-core",
|
|
3
|
-
"version": "0.9.
|
|
3
|
+
"version": "0.9.5",
|
|
4
4
|
"mcpName": "io.github.cyanheads/mcp-ts-core",
|
|
5
5
|
"description": "Agent-native TypeScript framework for building MCP servers. Declarative definitions with auth, multi-backend storage, OpenTelemetry, and first-class support for Bun/Node/Cloudflare Workers.",
|
|
6
6
|
"main": "dist/core/index.js",
|
|
@@ -217,8 +217,7 @@
|
|
|
217
217
|
"unpdf": "^1.6.2",
|
|
218
218
|
"validator": "^13.15.35",
|
|
219
219
|
"vite": "8.0.14",
|
|
220
|
-
"vitest": "^4.1.7"
|
|
221
|
-
"zod": "^4.4.3"
|
|
220
|
+
"vitest": "^4.1.7"
|
|
222
221
|
},
|
|
223
222
|
"keywords": [
|
|
224
223
|
"agent",
|
|
@@ -278,7 +277,8 @@
|
|
|
278
277
|
"dotenv": "^17.4.2",
|
|
279
278
|
"hono": "^4.12.22",
|
|
280
279
|
"jose": "^6.2.3",
|
|
281
|
-
"pino": "^10.3.1"
|
|
280
|
+
"pino": "^10.3.1",
|
|
281
|
+
"zod": "^4.4.3"
|
|
282
282
|
},
|
|
283
283
|
"peerDependencies": {
|
|
284
284
|
"@duckdb/node-api": "^1.5.0",
|
|
@@ -4,7 +4,7 @@ description: >
|
|
|
4
4
|
Investigate, adopt, and verify dependency updates — with special handling for `@cyanheads/mcp-ts-core`. Captures what changed, understands why, cross-references against the codebase, adopts framework improvements, syncs project skills, and runs final checks. Supports two entry modes: run the full flow end-to-end, or review updates you already applied.
|
|
5
5
|
metadata:
|
|
6
6
|
author: cyanheads
|
|
7
|
-
version: "2.
|
|
7
|
+
version: "2.4"
|
|
8
8
|
audience: external
|
|
9
9
|
type: workflow
|
|
10
10
|
---
|
|
@@ -78,6 +78,7 @@ Scan specifically for:
|
|
|
78
78
|
| Config changes | New env vars, renamed keys, changed defaults |
|
|
79
79
|
| Linter rules | New definition-lint rules that may now flag existing tools/resources |
|
|
80
80
|
| New or materially-changed skills | Note new skills or workflow changes (renamed steps, new checklist items) worth surfacing at end-of-run. Don't auto-invoke — some skills (e.g. `security-pass`) are user-triggered. The per-version changelog entries (e.g. 0.6.14 calling out `skills/security-pass/ (v1.0)`) name what changed. |
|
|
81
|
+
| New template-scaffolded files | Compare `templates/` in the package against the project root. Files that `init` would create for a new project but don't exist in this project are adoption candidates — create them with project-specific values (version, name, description, env vars from `server.json`). Examples: `manifest.json`, `.mcpbignore`. Skip files the project has intentionally opted out of (documented in CLAUDE.md or a code comment). |
|
|
81
82
|
|
|
82
83
|
Cross-reference each finding against the server's code. Collect adoption opportunities for Step 6.
|
|
83
84
|
|
|
@@ -4,7 +4,7 @@ description: >
|
|
|
4
4
|
Finalize documentation and project metadata for a ship-ready MCP server. Use after implementation is complete, tests pass, and devcheck is clean. Safe to run at any stage — each step checks current state and only acts on what still needs work.
|
|
5
5
|
metadata:
|
|
6
6
|
author: cyanheads
|
|
7
|
-
version: "2.
|
|
7
|
+
version: "2.1"
|
|
8
8
|
audience: external
|
|
9
9
|
type: workflow
|
|
10
10
|
---
|
|
@@ -163,11 +163,38 @@ Never hand-edit `CHANGELOG.md` when using this pattern — it's a build artifact
|
|
|
163
163
|
|
|
164
164
|
**Monolithic** — maintain `CHANGELOG.md` directly in [Keep a Changelog](https://keepachangelog.com/) format. To collapse from the template default: delete the `changelog/` directory, remove `changelog:build` and `changelog:check` from `package.json` scripts (and from `devcheck.config.json` if referenced), and drop `"changelog/"` from the `files` array. The `release` skill's directory-specific steps then don't apply — just edit `CHANGELOG.md` and bump version at release time.
|
|
165
165
|
|
|
166
|
-
### 10.
|
|
166
|
+
### 10. MCPB Bundling Artifacts
|
|
167
|
+
|
|
168
|
+
If the project ships as an `.mcpb` bundle for Claude Desktop (check for `manifest.json` at the project root), verify the full artifact set is present and consistent. If the project doesn't ship `.mcpb` bundles, skip this step.
|
|
169
|
+
|
|
170
|
+
**Files that must exist:**
|
|
171
|
+
|
|
172
|
+
- `manifest.json` — MCPB manifest with `mcp_config.env`, `user_config`, and metadata
|
|
173
|
+
- `.mcpbignore` — controls what's excluded from the bundle
|
|
174
|
+
|
|
175
|
+
**`package.json` scripts:**
|
|
176
|
+
|
|
177
|
+
- `bundle` — builds the `.mcpb` (e.g., `mcpb pack --output dist/`)
|
|
178
|
+
- `lint:packaging` — validates `manifest.json` ↔ `server.json` env var consistency (run by `devcheck`)
|
|
179
|
+
|
|
180
|
+
**Cross-file consistency:**
|
|
181
|
+
|
|
182
|
+
- `manifest.json` version matches `package.json` version
|
|
183
|
+
- Env var names in `manifest.json` (`mcp_config.env` + `user_config`) match `server.json` `environmentVariables` — `lint:packaging` enforces this, but verify the set is complete
|
|
184
|
+
- `manifest.json` `name` and `description` match `package.json`
|
|
185
|
+
|
|
186
|
+
**README install badges:**
|
|
187
|
+
|
|
188
|
+
- If `manifest.json` exists, the README should include the Claude Desktop install badge linking to `releases/latest/download/<name>.mcpb`
|
|
189
|
+
- If the package is published to npm, include Cursor and VS Code install badges
|
|
190
|
+
- See `references/readme.md` for badge format and config generation commands
|
|
191
|
+
- See the **Bundling** section of `templates/CLAUDE.md` for `base64` / `encodeURIComponent` generation
|
|
192
|
+
|
|
193
|
+
### 11. `LICENSE`
|
|
167
194
|
|
|
168
195
|
Confirm a license file exists. If not, ask the user which license to use (default: Apache-2.0, matching the scaffolded `package.json`). Create the file.
|
|
169
196
|
|
|
170
|
-
###
|
|
197
|
+
### 12. `Dockerfile`
|
|
171
198
|
|
|
172
199
|
If a `Dockerfile` exists, verify the OCI labels and runtime config match the actual server:
|
|
173
200
|
|
|
@@ -178,7 +205,7 @@ If a `Dockerfile` exists, verify the OCI labels and runtime config match the act
|
|
|
178
205
|
|
|
179
206
|
If no `Dockerfile` exists and the server is deployed via HTTP transport, consider scaffolding one — the template is available via `npx @cyanheads/mcp-ts-core init`.
|
|
180
207
|
|
|
181
|
-
###
|
|
208
|
+
### 13. `docs/tree.md`
|
|
182
209
|
|
|
183
210
|
Regenerate the directory structure:
|
|
184
211
|
|
|
@@ -188,7 +215,7 @@ bun run tree
|
|
|
188
215
|
|
|
189
216
|
Review the output for anything unexpected (leftover files, missing directories).
|
|
190
217
|
|
|
191
|
-
###
|
|
218
|
+
### 14. Final Verification
|
|
192
219
|
|
|
193
220
|
Run the full check suite one last time:
|
|
194
221
|
|
|
@@ -210,6 +237,7 @@ Both must pass clean.
|
|
|
210
237
|
- [ ] GitHub repo description matches `package.json` description; topics ↔ keywords in sync
|
|
211
238
|
- [ ] `bunfig.toml` present
|
|
212
239
|
- [ ] Changelog current — either monolithic `CHANGELOG.md` (hand-edited, Keep a Changelog) or directory-based (`changelog/<minor>.x/<version>.md` + rollup regenerated and in sync)
|
|
240
|
+
- [ ] MCPB artifacts consistent (if `manifest.json` present) — version synced, env vars match `server.json`, `bundle` + `lint:packaging` scripts exist, README install badges present
|
|
213
241
|
- [ ] `LICENSE` file present
|
|
214
242
|
- [ ] `Dockerfile` OCI labels and runtime config accurate (if present)
|
|
215
243
|
- [ ] `docs/tree.md` regenerated
|
package/templates/CLAUDE.md
CHANGED
|
@@ -295,7 +295,7 @@ When you complete a skill's checklist, check the boxes and add a completion time
|
|
|
295
295
|
| `npm run rebuild` | Clean + build |
|
|
296
296
|
| `npm run clean` | Remove build artifacts |
|
|
297
297
|
| `npm run devcheck` | Lint + format + typecheck + security + changelog sync |
|
|
298
|
-
| `bun run audit:refresh` | Delete `bun.lock`, reinstall,
|
|
298
|
+
| `bun run audit:refresh` | Delete `bun.lock`, reinstall, re-audit. Use when `devcheck` flags a transitive advisory — stale lockfile can mask already-patched deps. If advisory survives, it's real. |
|
|
299
299
|
| `npm run tree` | Generate directory structure doc |
|
|
300
300
|
| `npm run format` | Auto-fix formatting |
|
|
301
301
|
| `npm test` | Run tests |
|