@frontmcp/adapters 1.9.1 → 1.9.3

package/esm/index.mjs

@@ -10,7 +10,10 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-import { normalizeSsrfOptions as normalizeSsrfOptions2, OpenAPIToolGenerator } from "mcp-from-openapi";
+import {
+  normalizeSsrfOptions as normalizeSsrfOptions2,
+  OpenAPIToolGenerator
+} from "mcp-from-openapi";
 import { Adapter, DynamicAdapter } from "@frontmcp/sdk";
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
@@ -605,7 +608,7 @@ async function resolveInputSecurity(tool2, input, options, securityResolver) {
 
 // libs/adapters/src/openapi/openapi.tool.ts
 import { z as z2 } from "@frontmcp/lazy-zod";
-import { tool } from "@frontmcp/sdk";
+import { InvalidInputError, tool } from "@frontmcp/sdk";
 import { isRedirectResponse } from "@frontmcp/utils";
 
 // libs/adapters/src/openapi/openapi.frontmcp-schema.ts
@@ -651,7 +654,9 @@ var KNOWN_EXTENSION_FIELDS = /* @__PURE__ */ new Set([
   "codecall",
   "tags",
   "hideFromDiscovery",
-  "examples"
+  "examples",
+  "meta",
+  "icons"
 ]);
 var KNOWN_ANNOTATION_FIELDS = /* @__PURE__ */ new Set([
   "title",
@@ -875,6 +880,10 @@ function appendCookie(headers, name, value) {
   const combined = existing ? `${existing}; ${cookiePair}` : cookiePair;
   headers.set("Cookie", combined);
 }
+function specDefault(tool2, inputKey) {
+  const property = tool2.inputSchema.properties?.[inputKey];
+  return typeof property === "object" ? property.default : void 0;
+}
 function buildRequest(tool2, input, security, baseUrl) {
   const rawBaseUrl = tool2.metadata.servers?.[0]?.url || baseUrl;
   validateBaseUrl(rawBaseUrl);
@@ -888,7 +897,7 @@ function buildRequest(tool2, input, security, baseUrl) {
   let body;
   for (const mapper of tool2.mapper) {
     if (mapper.security) continue;
-    const value = input[mapper.inputKey];
+    const value = input[mapper.inputKey] ?? (mapper.required ? specDefault(tool2, mapper.inputKey) : void 0);
     if (value === void 0 || value === null) {
       if (mapper.required) {
         throw new Error(
@@ -1002,9 +1011,11 @@ function createOpenApiTool(openapiTool, options, logger) {
   const inputTransforms = metadata.adapter?.inputTransforms ?? [];
   const toolTransform = metadata.adapter?.toolTransform ?? {};
   const postToolTransform = metadata.adapter?.postToolTransform;
+  const serverFilledKeys = new Set(inputTransforms.map((transform) => transform.inputKey));
   const frontmcpValidation = validateFrontMcpExtension(metadata.frontmcp, openapiTool.name, logger);
   const frontmcpExt = frontmcpValidation.data;
   const schemaResult = getZodSchemaFromJsonSchema(openapiTool.inputSchema, openapiTool.name, logger);
+  const argumentCheck = schemaResult.conversionFailed ? void 0 : getZodSchemaFromJsonSchema(toArgumentJsonSchema(openapiTool), openapiTool.name, logger);
   let wrappedOutputSchema;
   if (openapiTool.outputSchema !== void 0) {
     const baseOutputSchema = openapiTool.outputSchema ?? { type: "string" };
@@ -1022,11 +1033,15 @@ function createOpenApiTool(openapiTool, options, logger) {
   const toolMetadata = {
     id: openapiTool.name,
     name: openapiTool.name,
+    ...openapiTool.title && { title: openapiTool.title },
     description: openapiTool.description,
     inputSchema: schemaResult.schema.shape || {},
     rawInputSchema: openapiTool.inputSchema,
     // Add output schema for tool/list to expose (only if not moved to description)
-    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema }
+    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema },
+    ...openapiTool.annotations && { annotations: { ...openapiTool.annotations } },
+    ...openapiTool.icons?.length && { icons: openapiTool.icons.map((icon) => ({ ...icon })) },
+    ...openapiTool._meta && { _meta: { ...openapiTool._meta } }
   };
   if (schemaResult.conversionFailed) {
     toolMetadata["_schemaConversionFailed"] = true;
@@ -1034,7 +1049,10 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   if (frontmcpExt) {
     if (frontmcpExt.annotations) {
-      toolMetadata["annotations"] = { ...frontmcpExt.annotations };
+      toolMetadata["annotations"] = {
+        ...toolMetadata["annotations"] || {},
+        ...frontmcpExt.annotations
+      };
     }
     if (frontmcpExt.tags) {
       toolMetadata["tags"] = [...frontmcpExt.tags];
@@ -1074,16 +1092,20 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   return tool(toolMetadata)(async (input, toolCtx) => {
     const ctx = toolCtx.context;
+    const modelInput = omitKeys(input, serverFilledKeys);
+    if (argumentCheck && !argumentCheck.conversionFailed) {
+      const validation = argumentCheck.schema.safeParse(modelInput);
+      if (!validation.success) {
+        const problems = validation.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+        throw new InvalidInputError(`Invalid arguments for tool '${openapiTool.name}': ${problems.join("; ")}`);
+      }
+    }
     const transformContext = {
       ctx,
       env: process.env,
       tool: openapiTool
     };
-    const injectedInput = await injectTransformedValues(
-      input,
-      inputTransforms,
-      transformContext
-    );
+    const injectedInput = await injectTransformedValues(modelInput, inputTransforms, transformContext);
     const security = await resolveToolSecurity(openapiTool, ctx, options, {
       input: injectedInput,
       deferCredentialCheck: true
@@ -1268,6 +1290,10 @@ async function safeInject(transform, ctx, timeoutMs = DEFAULT_TRANSFORM_TIMEOUT_
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function omitKeys(input, keys) {
+  if (keys.size === 0 || !isPlainObject(input)) return input;
+  return Object.fromEntries(Object.entries(input).filter(([key]) => !keys.has(key)));
+}
 async function injectTransformedValues(input, transforms, ctx) {
   if (!isPlainObject(input)) {
     throw new Error(`Invalid input type: expected object, got ${input === null ? "null" : typeof input}`);
@@ -1287,6 +1313,64 @@ async function injectTransformedValues(input, transforms, ctx) {
   }
   return result;
 }
+var SUBSCHEMA_KEYWORDS = [
+  "items",
+  "additionalProperties",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contains",
+  "propertyNames",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SUBSCHEMA_LIST_KEYWORDS = ["allOf", "anyOf", "prefixItems"];
+var SUBSCHEMA_MAP_KEYWORDS = ["properties", "patternProperties", "dependentSchemas", "$defs", "definitions"];
+function toArgumentJsonSchema(openapiTool) {
+  const argumentSchema = relaxSchema(openapiTool.inputSchema);
+  const credentialKeys = new Set(
+    openapiTool.mapper.filter((mapper) => mapper.security).map((mapper) => mapper.inputKey)
+  );
+  const required = argumentSchema["required"];
+  if (Array.isArray(required)) {
+    argumentSchema["required"] = required.filter((key) => !credentialKeys.has(key));
+  }
+  return argumentSchema;
+}
+function relaxSchema(schema) {
+  if (Array.isArray(schema)) return schema.map(relaxSchema);
+  if (typeof schema !== "object" || schema === null) return schema;
+  const relaxed = { ...schema };
+  delete relaxed["format"];
+  for (const keyword of SUBSCHEMA_KEYWORDS) {
+    if (keyword in relaxed) relaxed[keyword] = relaxSchema(relaxed[keyword]);
+  }
+  for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+    const subschemas = relaxed[keyword];
+    if (Array.isArray(subschemas)) relaxed[keyword] = subschemas.map(relaxSchema);
+  }
+  for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+    const subschemasByName = relaxed[keyword];
+    if (typeof subschemasByName === "object" && subschemasByName !== null) {
+      relaxed[keyword] = Object.fromEntries(
+        Object.entries(subschemasByName).map(([name, subschema]) => [name, relaxSchema(subschema)])
+      );
+    }
+  }
+  const exclusiveBranches = relaxed["oneOf"];
+  if (Array.isArray(exclusiveBranches)) {
+    delete relaxed["oneOf"];
+    const branches = exclusiveBranches.map(relaxSchema);
+    if (Array.isArray(relaxed["anyOf"])) {
+      const allOf = Array.isArray(relaxed["allOf"]) ? relaxed["allOf"] : [];
+      relaxed["allOf"] = [...allOf, { anyOf: branches }];
+    } else {
+      relaxed["anyOf"] = branches;
+    }
+  }
+  return relaxed;
+}
 function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   if (typeof jsonSchema !== "object" || jsonSchema === null) {
     logger.warn(`[${toolName}] No valid JSON schema provided, using permissive schema`);
@@ -1314,6 +1398,18 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
 
 // libs/adapters/src/openapi/openapi.adapter.ts
 var RESERVED_KEYS2 = ["__proto__", "constructor", "prototype"];
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+function normalizeMethods(adapterName, optionName, methods) {
+  return methods?.map((method) => {
+    const lowerMethod = method.toLowerCase();
+    if (!HTTP_METHODS.includes(lowerMethod)) {
+      throw new Error(
+        `[OpenAPI Adapter: ${adapterName}] generateOptions.${optionName} lists "${method}", which is not an HTTP method; use one of ${HTTP_METHODS.join(", ")}.`
+      );
+    }
+    return lowerMethod;
+  });
+}
 function createConsoleLogger(prefix) {
   const formatMessage = (level, msg) => `[${prefix}] ${level}: ${msg}`;
   return {
@@ -1332,9 +1428,14 @@ var OpenapiAdapter = class extends DynamicAdapter {
   poller = null;
   updateCallbacks = /* @__PURE__ */ new Set();
   rebuildChain = Promise.resolve();
+  methodFilters;
   constructor(options) {
     super();
     this.options = options;
+    this.methodFilters = {
+      includeMethods: normalizeMethods(options.name, "includeMethods", options.generateOptions?.includeMethods),
+      excludeMethods: normalizeMethods(options.name, "excludeMethods", options.generateOptions?.excludeMethods)
+    };
     this.logger = options.logger ?? createConsoleLogger(`openapi:${options.name}`);
     if (options.polling?.enabled && !("url" in options)) {
       throw new Error(
@@ -1358,6 +1459,8 @@ var OpenapiAdapter = class extends DynamicAdapter {
     const generateOptions = this.options.generateOptions;
     let openapiTools = await this.generator.generateTools({
       ...generateOptions,
+      ...this.methodFilters,
+      filterFn: this.operationFilter(),
       preferredStatusCodes: generateOptions?.preferredStatusCodes ?? [200, 201, 202, 204],
       includeDeprecated: generateOptions?.includeDeprecated ?? false,
       includeAllResponses: generateOptions?.includeAllResponses ?? true,
@@ -1443,28 +1546,31 @@ var OpenapiAdapter = class extends DynamicAdapter {
   resolveRefResolution() {
     return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
   }
+  /**
+   * `generateOptions.filterFn`, and with `includeOperations` set, only the operations it names: the
+   * generator lets an operation with no `operationId` through that list.
+   */
+  operationFilter() {
+    const { includeOperations, filterFn } = this.options.generateOptions ?? {};
+    if (!includeOperations) return filterFn;
+    return (operation) => operation.operationId !== void 0 && includeOperations.includes(operation.operationId) && (filterFn?.(operation) ?? true);
+  }
   async initializeGenerator() {
-    const refResolution = this.resolveRefResolution();
+    const loadOptions = {
+      ...this.options.loadOptions,
+      baseUrl: this.options.baseUrl,
+      validate: this.options.loadOptions?.validate ?? true,
+      dereference: this.options.loadOptions?.dereference ?? true,
+      // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+      // internal target would otherwise be fetched. With mcp-from-openapi
+      // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+      followRedirects: this.options.loadOptions?.followRedirects ?? false,
+      refResolution: this.resolveRefResolution()
+    };
     if ("url" in this.options) {
-      return await OpenAPIToolGenerator.fromURL(this.options.url, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        headers: this.options.loadOptions?.headers,
-        timeout: this.options.loadOptions?.timeout,
-        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
-        // internal target would otherwise be fetched. With mcp-from-openapi
-        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
-        followRedirects: this.options.loadOptions?.followRedirects ?? false,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromURL(this.options.url, loadOptions);
     } else if ("spec" in this.options) {
-      return await OpenAPIToolGenerator.fromJSON(this.options.spec, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromJSON(this.options.spec, loadOptions);
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");
     }

package/esm/openapi/index.mjs

@@ -10,7 +10,10 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-import { normalizeSsrfOptions as normalizeSsrfOptions2, OpenAPIToolGenerator } from "mcp-from-openapi";
+import {
+  normalizeSsrfOptions as normalizeSsrfOptions2,
+  OpenAPIToolGenerator
+} from "mcp-from-openapi";
 import { Adapter, DynamicAdapter } from "@frontmcp/sdk";
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
@@ -605,7 +608,7 @@ async function resolveInputSecurity(tool2, input, options, securityResolver) {
 
 // libs/adapters/src/openapi/openapi.tool.ts
 import { z as z2 } from "@frontmcp/lazy-zod";
-import { tool } from "@frontmcp/sdk";
+import { InvalidInputError, tool } from "@frontmcp/sdk";
 import { isRedirectResponse } from "@frontmcp/utils";
 
 // libs/adapters/src/openapi/openapi.frontmcp-schema.ts
@@ -651,7 +654,9 @@ var KNOWN_EXTENSION_FIELDS = /* @__PURE__ */ new Set([
   "codecall",
   "tags",
   "hideFromDiscovery",
-  "examples"
+  "examples",
+  "meta",
+  "icons"
 ]);
 var KNOWN_ANNOTATION_FIELDS = /* @__PURE__ */ new Set([
   "title",
@@ -875,6 +880,10 @@ function appendCookie(headers, name, value) {
   const combined = existing ? `${existing}; ${cookiePair}` : cookiePair;
   headers.set("Cookie", combined);
 }
+function specDefault(tool2, inputKey) {
+  const property = tool2.inputSchema.properties?.[inputKey];
+  return typeof property === "object" ? property.default : void 0;
+}
 function buildRequest(tool2, input, security, baseUrl) {
   const rawBaseUrl = tool2.metadata.servers?.[0]?.url || baseUrl;
   validateBaseUrl(rawBaseUrl);
@@ -888,7 +897,7 @@ function buildRequest(tool2, input, security, baseUrl) {
   let body;
   for (const mapper of tool2.mapper) {
     if (mapper.security) continue;
-    const value = input[mapper.inputKey];
+    const value = input[mapper.inputKey] ?? (mapper.required ? specDefault(tool2, mapper.inputKey) : void 0);
     if (value === void 0 || value === null) {
       if (mapper.required) {
         throw new Error(
@@ -1002,9 +1011,11 @@ function createOpenApiTool(openapiTool, options, logger) {
   const inputTransforms = metadata.adapter?.inputTransforms ?? [];
   const toolTransform = metadata.adapter?.toolTransform ?? {};
   const postToolTransform = metadata.adapter?.postToolTransform;
+  const serverFilledKeys = new Set(inputTransforms.map((transform) => transform.inputKey));
   const frontmcpValidation = validateFrontMcpExtension(metadata.frontmcp, openapiTool.name, logger);
   const frontmcpExt = frontmcpValidation.data;
   const schemaResult = getZodSchemaFromJsonSchema(openapiTool.inputSchema, openapiTool.name, logger);
+  const argumentCheck = schemaResult.conversionFailed ? void 0 : getZodSchemaFromJsonSchema(toArgumentJsonSchema(openapiTool), openapiTool.name, logger);
   let wrappedOutputSchema;
   if (openapiTool.outputSchema !== void 0) {
     const baseOutputSchema = openapiTool.outputSchema ?? { type: "string" };
@@ -1022,11 +1033,15 @@ function createOpenApiTool(openapiTool, options, logger) {
   const toolMetadata = {
     id: openapiTool.name,
     name: openapiTool.name,
+    ...openapiTool.title && { title: openapiTool.title },
     description: openapiTool.description,
     inputSchema: schemaResult.schema.shape || {},
     rawInputSchema: openapiTool.inputSchema,
     // Add output schema for tool/list to expose (only if not moved to description)
-    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema }
+    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema },
+    ...openapiTool.annotations && { annotations: { ...openapiTool.annotations } },
+    ...openapiTool.icons?.length && { icons: openapiTool.icons.map((icon) => ({ ...icon })) },
+    ...openapiTool._meta && { _meta: { ...openapiTool._meta } }
   };
   if (schemaResult.conversionFailed) {
     toolMetadata["_schemaConversionFailed"] = true;
@@ -1034,7 +1049,10 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   if (frontmcpExt) {
     if (frontmcpExt.annotations) {
-      toolMetadata["annotations"] = { ...frontmcpExt.annotations };
+      toolMetadata["annotations"] = {
+        ...toolMetadata["annotations"] || {},
+        ...frontmcpExt.annotations
+      };
     }
     if (frontmcpExt.tags) {
       toolMetadata["tags"] = [...frontmcpExt.tags];
@@ -1074,16 +1092,20 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   return tool(toolMetadata)(async (input, toolCtx) => {
     const ctx = toolCtx.context;
+    const modelInput = omitKeys(input, serverFilledKeys);
+    if (argumentCheck && !argumentCheck.conversionFailed) {
+      const validation = argumentCheck.schema.safeParse(modelInput);
+      if (!validation.success) {
+        const problems = validation.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+        throw new InvalidInputError(`Invalid arguments for tool '${openapiTool.name}': ${problems.join("; ")}`);
+      }
+    }
     const transformContext = {
       ctx,
       env: process.env,
       tool: openapiTool
     };
-    const injectedInput = await injectTransformedValues(
-      input,
-      inputTransforms,
-      transformContext
-    );
+    const injectedInput = await injectTransformedValues(modelInput, inputTransforms, transformContext);
     const security = await resolveToolSecurity(openapiTool, ctx, options, {
       input: injectedInput,
       deferCredentialCheck: true
@@ -1268,6 +1290,10 @@ async function safeInject(transform, ctx, timeoutMs = DEFAULT_TRANSFORM_TIMEOUT_
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function omitKeys(input, keys) {
+  if (keys.size === 0 || !isPlainObject(input)) return input;
+  return Object.fromEntries(Object.entries(input).filter(([key]) => !keys.has(key)));
+}
 async function injectTransformedValues(input, transforms, ctx) {
   if (!isPlainObject(input)) {
     throw new Error(`Invalid input type: expected object, got ${input === null ? "null" : typeof input}`);
@@ -1287,6 +1313,64 @@ async function injectTransformedValues(input, transforms, ctx) {
   }
   return result;
 }
+var SUBSCHEMA_KEYWORDS = [
+  "items",
+  "additionalProperties",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contains",
+  "propertyNames",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SUBSCHEMA_LIST_KEYWORDS = ["allOf", "anyOf", "prefixItems"];
+var SUBSCHEMA_MAP_KEYWORDS = ["properties", "patternProperties", "dependentSchemas", "$defs", "definitions"];
+function toArgumentJsonSchema(openapiTool) {
+  const argumentSchema = relaxSchema(openapiTool.inputSchema);
+  const credentialKeys = new Set(
+    openapiTool.mapper.filter((mapper) => mapper.security).map((mapper) => mapper.inputKey)
+  );
+  const required = argumentSchema["required"];
+  if (Array.isArray(required)) {
+    argumentSchema["required"] = required.filter((key) => !credentialKeys.has(key));
+  }
+  return argumentSchema;
+}
+function relaxSchema(schema) {
+  if (Array.isArray(schema)) return schema.map(relaxSchema);
+  if (typeof schema !== "object" || schema === null) return schema;
+  const relaxed = { ...schema };
+  delete relaxed["format"];
+  for (const keyword of SUBSCHEMA_KEYWORDS) {
+    if (keyword in relaxed) relaxed[keyword] = relaxSchema(relaxed[keyword]);
+  }
+  for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+    const subschemas = relaxed[keyword];
+    if (Array.isArray(subschemas)) relaxed[keyword] = subschemas.map(relaxSchema);
+  }
+  for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+    const subschemasByName = relaxed[keyword];
+    if (typeof subschemasByName === "object" && subschemasByName !== null) {
+      relaxed[keyword] = Object.fromEntries(
+        Object.entries(subschemasByName).map(([name, subschema]) => [name, relaxSchema(subschema)])
+      );
+    }
+  }
+  const exclusiveBranches = relaxed["oneOf"];
+  if (Array.isArray(exclusiveBranches)) {
+    delete relaxed["oneOf"];
+    const branches = exclusiveBranches.map(relaxSchema);
+    if (Array.isArray(relaxed["anyOf"])) {
+      const allOf = Array.isArray(relaxed["allOf"]) ? relaxed["allOf"] : [];
+      relaxed["allOf"] = [...allOf, { anyOf: branches }];
+    } else {
+      relaxed["anyOf"] = branches;
+    }
+  }
+  return relaxed;
+}
 function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   if (typeof jsonSchema !== "object" || jsonSchema === null) {
     logger.warn(`[${toolName}] No valid JSON schema provided, using permissive schema`);
@@ -1314,6 +1398,18 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
 
 // libs/adapters/src/openapi/openapi.adapter.ts
 var RESERVED_KEYS2 = ["__proto__", "constructor", "prototype"];
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+function normalizeMethods(adapterName, optionName, methods) {
+  return methods?.map((method) => {
+    const lowerMethod = method.toLowerCase();
+    if (!HTTP_METHODS.includes(lowerMethod)) {
+      throw new Error(
+        `[OpenAPI Adapter: ${adapterName}] generateOptions.${optionName} lists "${method}", which is not an HTTP method; use one of ${HTTP_METHODS.join(", ")}.`
+      );
+    }
+    return lowerMethod;
+  });
+}
 function createConsoleLogger(prefix) {
   const formatMessage = (level, msg) => `[${prefix}] ${level}: ${msg}`;
   return {
@@ -1332,9 +1428,14 @@ var OpenapiAdapter = class extends DynamicAdapter {
   poller = null;
   updateCallbacks = /* @__PURE__ */ new Set();
   rebuildChain = Promise.resolve();
+  methodFilters;
   constructor(options) {
     super();
     this.options = options;
+    this.methodFilters = {
+      includeMethods: normalizeMethods(options.name, "includeMethods", options.generateOptions?.includeMethods),
+      excludeMethods: normalizeMethods(options.name, "excludeMethods", options.generateOptions?.excludeMethods)
+    };
     this.logger = options.logger ?? createConsoleLogger(`openapi:${options.name}`);
     if (options.polling?.enabled && !("url" in options)) {
       throw new Error(
@@ -1358,6 +1459,8 @@ var OpenapiAdapter = class extends DynamicAdapter {
     const generateOptions = this.options.generateOptions;
     let openapiTools = await this.generator.generateTools({
       ...generateOptions,
+      ...this.methodFilters,
+      filterFn: this.operationFilter(),
       preferredStatusCodes: generateOptions?.preferredStatusCodes ?? [200, 201, 202, 204],
       includeDeprecated: generateOptions?.includeDeprecated ?? false,
       includeAllResponses: generateOptions?.includeAllResponses ?? true,
@@ -1443,28 +1546,31 @@ var OpenapiAdapter = class extends DynamicAdapter {
   resolveRefResolution() {
     return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
   }
+  /**
+   * `generateOptions.filterFn`, and with `includeOperations` set, only the operations it names: the
+   * generator lets an operation with no `operationId` through that list.
+   */
+  operationFilter() {
+    const { includeOperations, filterFn } = this.options.generateOptions ?? {};
+    if (!includeOperations) return filterFn;
+    return (operation) => operation.operationId !== void 0 && includeOperations.includes(operation.operationId) && (filterFn?.(operation) ?? true);
+  }
   async initializeGenerator() {
-    const refResolution = this.resolveRefResolution();
+    const loadOptions = {
+      ...this.options.loadOptions,
+      baseUrl: this.options.baseUrl,
+      validate: this.options.loadOptions?.validate ?? true,
+      dereference: this.options.loadOptions?.dereference ?? true,
+      // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+      // internal target would otherwise be fetched. With mcp-from-openapi
+      // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+      followRedirects: this.options.loadOptions?.followRedirects ?? false,
+      refResolution: this.resolveRefResolution()
+    };
     if ("url" in this.options) {
-      return await OpenAPIToolGenerator.fromURL(this.options.url, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        headers: this.options.loadOptions?.headers,
-        timeout: this.options.loadOptions?.timeout,
-        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
-        // internal target would otherwise be fetched. With mcp-from-openapi
-        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
-        followRedirects: this.options.loadOptions?.followRedirects ?? false,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromURL(this.options.url, loadOptions);
     } else if ("spec" in this.options) {
-      return await OpenAPIToolGenerator.fromJSON(this.options.spec, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromJSON(this.options.spec, loadOptions);
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");
     }

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.9.1",
-    "@frontmcp/di": "1.9.1",
-    "@frontmcp/sdk": "1.9.1",
-    "@frontmcp/utils": "1.9.1",
+    "@frontmcp/auth": "1.9.3",
+    "@frontmcp/di": "1.9.3",
+    "@frontmcp/sdk": "1.9.3",
+    "@frontmcp/utils": "1.9.3",
     "js-yaml": "^4.1.0",
     "mcp-from-openapi": "2.8.0",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1"
+    "@frontmcp/lazy-zod": "1.9.3"
   }
 }

package/esm/skills/index.mjs

@@ -843,7 +843,7 @@ var SaasPullSource = class {
         bundle = await this.loadCache();
         if (!bundle) {
           throw new Error(
-            `[saas-source] initial pull failed and no cached bundle is available at ${this.cachePath()}: ${e.message}`,
+            `[saas-source] initial pull failed and no cached bundle is available ${this.cacheLocation()}: ${e.message}`,
             { cause: e }
           );
         }
@@ -989,6 +989,10 @@ var SaasPullSource = class {
       trimmed.startsWith("{") || trimmed.startsWith("[") ? { kind: "json", content: body } : { kind: "yaml", content: body }
     );
   }
+  /** Where the last-good bundle is kept, for messages: an injected store (a Worker's KV) has no file path. */
+  cacheLocation() {
+    return this.deps.cache ? "in the injected bundle cache" : `at ${this.cachePath()}`;
+  }
   cachePath() {
     const dir = this.cacheDir ?? DEFAULT_CACHE_DIR;
     return pathResolve(dir, `${this.options.expectedAudience.replace(/[^a-zA-Z0-9_.-]/g, "_")}.json`);