@ferrlabs/mcp-core 6.1.0 → 6.2.0

package/dist/transports/http.d.ts

@@ -4,6 +4,13 @@ export interface HttpServerOptions {
     host?: string;
     stateless?: boolean;
     createServer: () => McpServer;
+    /**
+     * URL of the OAuth 2.0 Authorization Server users authenticate against.
+     * Surfaced to MCP clients via /.well-known/oauth-protected-resource so
+     * they can drive the standard PKCE flow when no Bearer is present.
+     * Defaults to `FERRLABS_AUTH_URL` env or `https://auth.ferrlabs.com`.
+     */
+    authorizationServer?: string;
 }
 export declare function startHttpServer(opts: HttpServerOptions): Promise<void>;
 //# sourceMappingURL=http.d.ts.map

package/dist/transports/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAUzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,SAAS,CAAC;CAC/B;AAoBD,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2E5E"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiBzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoBD,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuH5E"}

package/dist/transports/http.js

@@ -9,6 +9,11 @@ function extractBearer(req) {
     const match = /^Bearer\s+(.+)$/i.exec(header);
     return match?.[1];
 }
+function publicOrigin(req) {
+    const proto = req.headers['x-forwarded-proto']?.split(',')[0]?.trim() ?? 'https';
+    const host = req.headers['x-forwarded-host'] ?? req.headers.host ?? '';
+    return `${proto}://${host}`;
+}
 async function readJsonBody(req) {
     if (req.method !== 'POST')
         return undefined;
@@ -31,8 +36,40 @@ async function readJsonBody(req) {
 }
 export async function startHttpServer(opts) {
     const { port, host = '0.0.0.0', stateless = true } = opts;
+    const authServer = opts.authorizationServer ?? process.env.FERRLABS_AUTH_URL ?? 'https://auth.ferrlabs.com';
     const transports = new Map();
+    function sendUnauthorized(req, res) {
+        const origin = publicOrigin(req);
+        const metadataUrl = `${origin}/.well-known/oauth-protected-resource`;
+        res.writeHead(401, {
+            'Content-Type': 'application/json',
+            'WWW-Authenticate': `Bearer resource_metadata="${metadataUrl}"`,
+        });
+        res.end(JSON.stringify({
+            jsonrpc: '2.0',
+            error: {
+                code: -32001,
+                message: 'Missing or invalid bearer token. The MCP client should fetch the OAuth protected-resource metadata and run the authorization code + PKCE flow.',
+            },
+            id: null,
+        }));
+    }
+    function sendResourceMetadata(req, res) {
+        const origin = publicOrigin(req);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            resource: origin,
+            authorization_servers: [authServer],
+            bearer_methods_supported: ['header'],
+            resource_documentation: 'https://ferrlabs.com',
+        }));
+    }
     async function handleMcpRequest(req, res) {
+        const bearerToken = extractBearer(req);
+        if (!bearerToken) {
+            sendUnauthorized(req, res);
+            return;
+        }
         const sessionId = req.headers['mcp-session-id'] ?? undefined;
         let transport = sessionId ? transports.get(sessionId) : undefined;
         if (sessionId && !transport && !stateless) {
@@ -67,7 +104,6 @@ export async function startHttpServer(opts) {
             await server.connect(transport);
         }
         const body = await readJsonBody(req);
-        const bearerToken = extractBearer(req);
         await runWithAuthContext({ bearerToken }, () => transport.handleRequest(req, res, body));
     }
     const httpServer = createHttpServer((req, res) => {
@@ -77,6 +113,10 @@ export async function startHttpServer(opts) {
             res.end(JSON.stringify({ status: 'ok', service: 'ferrlabs-mcp' }));
             return;
         }
+        if (url === '/.well-known/oauth-protected-resource') {
+            sendResourceMetadata(req, res);
+            return;
+        }
         if (url === '/mcp' || url.startsWith('/mcp?')) {
             handleMcpRequest(req, res).catch((err) => {
                 if (!res.headersSent) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ferrlabs/mcp-core",
-  "version": "6.1.0",
-  "description": "Shared core for FerrLabs MCP servers — auth, transports (stdio + Streamable HTTP), api-client, runner",
+  "version": "6.2.0",
+  "description": "Shared core for FerrLabs MCP servers — auth, transports (stdio + Streamable HTTP), api-client, runner",
   "license": "MPL-2.0",
   "type": "module",
   "main": "./dist/index.js",