@fruggr/zendesk-mcp-server 1.8.0 → 1.9.0

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { homedir, release } from "node:os";
@@ -19,6 +19,7 @@ import remarkParse from "remark-parse";
 import remarkRehype from "remark-rehype";
 import remarkStringify from "remark-stringify";
 import { unified } from "unified";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 //#region src/auth/api-token.ts
 /**
@@ -566,6 +567,7 @@ const Namespace = z.enum([
 	"help_center",
 	"users"
 ]);
+const Transport = z.enum(["stdio", "http"]);
 const ConfigSchema = z.object({
 	subdomain: z.string().min(1, "ZENDESK_SUBDOMAIN is required"),
 	oauthClientId: z.string().min(1),
@@ -576,8 +578,25 @@ const ConfigSchema = z.object({
 	readOnly: z.boolean(),
 	namespaces: z.array(Namespace).optional(),
 	tools: z.array(z.string()).optional(),
+	transport: Transport,
+	host: z.string().min(1),
+	port: z.number().int().min(0).max(65535),
+	publicUrl: z.string().url().optional(),
+	/**
+	* Additional browser origins allowed by CORS in HTTP mode. The default
+	* allowlist (the major web MCP clients + localhost-any-port for dev) is
+	* always applied; this list extends it. Native MCP clients (Claude
+	* Desktop, Claude Code CLI, Cursor, VS Code, Zed…) are unaffected
+	* because they send no Origin header.
+	*/
+	corsOrigins: z.array(z.string().url().transform((value) => new URL(value).origin).refine((origin) => origin !== "null", { message: "CORS origin must be an http(s) URL with a host" })).default([]),
 	callbackPort: z.number().int().min(1).max(65535).optional()
 });
+const parsePort = (raw, label) => {
+	if (!/^\d+$/.test(raw)) throw new Error(`Invalid ${label} value. Expected an integer 0-65535.`);
+	return Number(raw);
+};
+const parsePortEnv = (raw, label) => raw === void 0 || raw === "" ? void 0 : parsePort(raw, label);
 const parseCliArgs = (args) => {
 	const result = {};
 	let positionalIndex = 0;
@@ -600,8 +619,24 @@ const parseCliArgs = (args) => {
 		} else if (arg === "--log-level" && next) {
 			result.logLevel = next;
 			i++;
+		} else if (arg === "--transport" && next) {
+			result.transport = next;
+			i++;
+		} else if (arg === "--host" && next) {
+			result.host = next;
+			i++;
+		} else if (arg === "--port" && next) {
+			result.port = parsePort(next, "--port");
+			i++;
+		} else if (arg === "--public-url" && next) {
+			result.publicUrl = next;
+			i++;
+		} else if (arg === "--cors-origin" && next) {
+			result.corsOrigins = result.corsOrigins ?? [];
+			result.corsOrigins.push(next);
+			i++;
 		} else if (arg === "--callback-port" && next) {
-			result.callbackPort = Number(next);
+			result.callbackPort = parsePort(next, "--callback-port");
 			i++;
 		} else if (!arg.startsWith("-") && positionalIndex === 0) {
 			result.subdomain = arg;
@@ -615,18 +650,31 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 	const subdomain = cli.subdomain ?? process.env["ZENDESK_SUBDOMAIN"] ?? "";
 	const oauthClientId = process.env["ZENDESK_OAUTH_CLIENT_ID"] ?? (subdomain ? `${subdomain}_zendesk` : "");
 	const mode = cli.tools?.length ? "all" : cli.mode ?? "namespace";
-	const envCallbackPort = process.env["ZENDESK_OAUTH_CALLBACK_PORT"];
-	const callbackPort = cli.callbackPort ?? (envCallbackPort ? Number(envCallbackPort) : void 0);
+	const transport = cli.transport ?? process.env["TRANSPORT"] ?? "stdio";
+	const host = cli.host ?? process.env["HOST"] ?? "0.0.0.0";
+	const port = cli.port ?? parsePortEnv(process.env["PORT"], "PORT") ?? 3e3;
+	const publicUrl = cli.publicUrl ?? process.env["PUBLIC_URL"];
+	const corsFromEnv = (process.env["CORS_ORIGIN"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	const corsOrigins = [...cli.corsOrigins ?? [], ...corsFromEnv];
+	const callbackPort = cli.callbackPort ?? parsePortEnv(process.env["ZENDESK_OAUTH_CALLBACK_PORT"], "ZENDESK_OAUTH_CALLBACK_PORT");
+	const zendeskEmail = process.env["ZENDESK_EMAIL"];
+	const zendeskApiToken = process.env["ZENDESK_API_TOKEN"];
+	if (transport === "http" && zendeskEmail && zendeskApiToken) throw new Error("API token authentication (ZENDESK_EMAIL + ZENDESK_API_TOKEN) is not supported in HTTP mode. HTTP mode requires per-user OAuth 2.1 PKCE - unset these variables and configure your MCP client to perform the OAuth flow against Zendesk.");
 	return ConfigSchema.parse({
 		subdomain,
 		oauthClientId,
-		zendeskEmail: process.env["ZENDESK_EMAIL"],
-		zendeskApiToken: process.env["ZENDESK_API_TOKEN"],
+		zendeskEmail,
+		zendeskApiToken,
 		logLevel: cli.logLevel ?? process.env["LOG_LEVEL"] ?? "info",
 		mode,
 		readOnly: cli.readOnly ?? false,
 		namespaces: cli.namespaces,
 		tools: cli.tools,
+		transport,
+		host,
+		port,
+		publicUrl,
+		corsOrigins,
 		callbackPort
 	});
 };
@@ -2231,27 +2279,34 @@ const aggregateAnnotations = (tools) => ({
 	idempotentHint: tools.every((t) => t.annotations.idempotentHint),
 	openWorldHint: true
 });
-const registerProxyTool = (server, toolName, title, tools, handlerMap, readOnlyMode, onUnauthorized) => {
+const buildProxyDispatch = (tools, onUnauthorized) => {
+	const operationNames = tools.map((t) => t.name);
+	const localHandlers = new Map(tools.map((t) => [t.name, t]));
+	return async (args) => {
+		const { operation, params } = args;
+		const def = localHandlers.get(operation);
+		if (!def) return { content: [{
+			type: "text",
+			text: `Unknown operation "${operation}". Available: ${operationNames.join(", ")}`
+		}] };
+		return runHandler(def, def.inputSchema.parse(params), onUnauthorized);
+	};
+};
+const registerProxyTool = (server, toolName, title, tools, readOnlyMode, onUnauthorized) => {
 	const operationNames = tools.map((t) => t.name);
 	const operationList = buildOperationList(tools);
 	const annotations = aggregateAnnotations(tools);
 	const prefix = readOnlyMode ? "[RO] " : "";
+	const dispatch = buildProxyDispatch(tools, onUnauthorized);
 	server.registerTool(toolName, {
 		title,
 		description: `${prefix}${title}. Specify the operation and its parameters.\n\nAvailable operations:\n${operationList}`,
-		inputSchema: z.object({
+		inputSchema: {
 			operation: z.string().describe(`One of: ${operationNames.join(", ")}`),
 			params: z.record(z.string(), z.unknown()).default({}).describe("Operation parameters")
-		}),
+		},
 		annotations
-	}, async ({ operation, params }) => {
-		const def = handlerMap.get(operation);
-		if (!def) return { content: [{
-			type: "text",
-			text: `Unknown operation "${operation}". Available: ${operationNames.join(", ")}`
-		}] };
-		return runHandler(def, def.inputSchema.parse(params), onUnauthorized);
-	});
+	}, async (args) => dispatch(args));
 };
 const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized) => {
 	const pkg = readPackageInfo();
@@ -2268,14 +2323,12 @@ const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized
 		namespaces: config.namespaces,
 		tools: config.tools
 	});
-	const handlerMap = /* @__PURE__ */ new Map();
-	for (const tool of filteredTools) handlerMap.set(tool.name, tool);
 	switch (config.mode) {
 		case "all":
 			for (const tool of filteredTools) server.registerTool(tool.name, {
 				title: tool.title,
 				description: tool.description,
-				inputSchema: tool.inputSchema,
+				inputSchema: tool.inputSchema.shape,
 				annotations: tool.annotations
 			}, async (params) => runHandler(tool, params, onUnauthorized));
 			break;
@@ -2283,12 +2336,12 @@ const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized
 			const grouped = groupByNamespace(filteredTools);
 			for (const [namespace, tools] of grouped) {
 				const label = NAMESPACE_LABELS[namespace];
-				if (label) registerProxyTool(server, label.toolName, label.title, tools, handlerMap, config.readOnly, onUnauthorized);
+				if (label) registerProxyTool(server, label.toolName, label.title, tools, config.readOnly, onUnauthorized);
 			}
 			break;
 		}
 		case "single":
-			registerProxyTool(server, "zendesk", "Zendesk", filteredTools, handlerMap, config.readOnly, onUnauthorized);
+			registerProxyTool(server, "zendesk", "Zendesk", filteredTools, config.readOnly, onUnauthorized);
 			break;
 	}
 	logger.info("tools_registered", {
@@ -2298,6 +2351,350 @@ const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized
 	return server;
 };
 //#endregion
+//#region src/transports/http.ts
+const WILDCARD_HOSTS = new Set([
+	"0.0.0.0",
+	"::",
+	"*"
+]);
+const DEFAULT_BROWSER_MCP_CLIENT_ORIGINS = [
+	"https://chatgpt.com",
+	"https://chat.openai.com",
+	"https://claude.ai",
+	"https://gemini.google.com",
+	"https://copilot.microsoft.com",
+	"https://www.perplexity.ai",
+	"https://chat.mistral.ai",
+	"https://grok.com"
+];
+const CORS_ALLOWED_METHODS = "GET, POST, DELETE, OPTIONS";
+const CORS_ALLOWED_HEADERS = "Authorization, Content-Type, Accept, mcp-session-id, mcp-protocol-version, last-event-id";
+const CORS_EXPOSE_HEADERS = "mcp-session-id";
+const CORS_MAX_AGE = "600";
+const LOCALHOST_HOSTNAMES = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+const ALLOWED_PROTOCOLS = new Set(["http:", "https:"]);
+/**
+* Returns the origin string to reflect in `Access-Control-Allow-Origin`, or
+* `undefined` if the origin is not allowed.
+*
+* The returned value is **never the raw `Origin` request header**. It comes
+* from one of three sanitization points:
+*
+*   1. An entry of the hardcoded `DEFAULT_BROWSER_MCP_CLIENT_ORIGINS` array.
+*   2. An entry of the operator-configured `extraOrigins` array.
+*   3. A loopback origin rebuilt from validated URL components after the
+*      hostname has been allowlisted against `LOCALHOST_HOSTNAMES`.
+*
+* This shape keeps the dataflow from request header to response header
+* gated by a constant allowlist, which is the pattern CodeQL's
+* `js/cors-misconfiguration-for-credentials` rule recognises as safe when
+* combined with `Access-Control-Allow-Credentials: true`.
+*/
+const resolveAllowedOrigin = (origin, extraOrigins) => {
+	const defaultMatch = DEFAULT_BROWSER_MCP_CLIENT_ORIGINS.find((entry) => entry === origin);
+	if (defaultMatch) return defaultMatch;
+	const extraMatch = extraOrigins?.find((entry) => entry === origin);
+	if (extraMatch) return extraMatch;
+	try {
+		const url = new URL(origin);
+		if (!ALLOWED_PROTOCOLS.has(url.protocol)) return void 0;
+		if (!LOCALHOST_HOSTNAMES.has(url.hostname)) return void 0;
+		const port = url.port || (url.protocol === "https:" ? "443" : "80");
+		return `${url.protocol}//${url.hostname}:${port}`;
+	} catch {
+		return;
+	}
+};
+const applyCorsHeaders = (req, res, extraOrigins) => {
+	const requestOrigin = req.headers["origin"];
+	if (typeof requestOrigin !== "string" || requestOrigin.length === 0) return;
+	const allowedOrigin = resolveAllowedOrigin(requestOrigin, extraOrigins);
+	if (!allowedOrigin) return;
+	res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
+	res.setHeader("Vary", "Origin");
+	res.setHeader("Access-Control-Allow-Credentials", "true");
+	res.setHeader("Access-Control-Expose-Headers", CORS_EXPOSE_HEADERS);
+};
+const handleCorsPreflight = (req, res, extraOrigins) => {
+	if (req.method !== "OPTIONS") return false;
+	applyCorsHeaders(req, res, extraOrigins);
+	if (res.getHeader("Access-Control-Allow-Origin")) {
+		res.setHeader("Access-Control-Allow-Methods", CORS_ALLOWED_METHODS);
+		res.setHeader("Access-Control-Allow-Headers", CORS_ALLOWED_HEADERS);
+		res.setHeader("Access-Control-Max-Age", CORS_MAX_AGE);
+	}
+	res.writeHead(204);
+	res.end();
+	return true;
+};
+const resolveResourceUrl = (config, logger = silentLogger) => {
+	if (config.publicUrl) return config.publicUrl.replace(/\/+$/, "");
+	if (!WILDCARD_HOSTS.has(config.host)) return `http://${config.host}:${config.port}`;
+	logger.warn("public_url_unset", {
+		host: config.host,
+		advertised: `http://${config.host}:${config.port}`,
+		hint: "OAuth discovery will advertise a non-routable resource identifier and spec-compliant MCP clients may refuse the connection. Set PUBLIC_URL (or --public-url) to the URL clients use to reach this server (e.g. https://your-host.example.com)."
+	});
+	return `http://${config.host}:${config.port}`;
+};
+const MISSING_BEARER_MESSAGE = "Missing Authorization: Bearer <zendesk-oauth-token> header. HTTP mode requires per-user OAuth 2.1 PKCE - obtain a token from Zendesk via your MCP client.";
+const extractBearer = (request) => {
+	const header = request.headers["authorization"];
+	if (typeof header !== "string") return void 0;
+	if (!header.toLowerCase().startsWith("bearer ")) return void 0;
+	return header.slice(7).trim();
+};
+const buildOAuthMetadata = (config, logger = silentLogger) => {
+	const { authorizeUrl, tokenUrl } = getOAuthUrls(config.subdomain);
+	const issuer = `https://${config.subdomain}.zendesk.com`;
+	const resource = resolveResourceUrl(config, logger);
+	return {
+		protectedResource: {
+			authorization_servers: [issuer],
+			resource,
+			bearer_methods_supported: ["header"],
+			scopes_supported: ["read", "write"]
+		},
+		authorizationServer: {
+			issuer,
+			authorization_endpoint: authorizeUrl,
+			token_endpoint: tokenUrl,
+			response_types_supported: ["code"],
+			grant_types_supported: ["authorization_code", "refresh_token"],
+			code_challenge_methods_supported: ["S256"],
+			token_endpoint_auth_methods_supported: ["none"],
+			scopes_supported: ["read", "write"]
+		}
+	};
+};
+const sendJson = (res, status, body) => {
+	res.writeHead(status, { "Content-Type": "application/json" });
+	res.end(JSON.stringify(body));
+};
+const sendJsonRpcError = (res, status, code, message, headers = {}) => {
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		...headers
+	});
+	res.end(JSON.stringify({
+		error: {
+			code,
+			message
+		},
+		id: null,
+		jsonrpc: "2.0"
+	}));
+};
+const sendUnauthorized = (res, resource) => {
+	sendJsonRpcError(res, 401, -32e3, MISSING_BEARER_MESSAGE, { "WWW-Authenticate": `Bearer resource_metadata="${resource}/.well-known/oauth-protected-resource", error="invalid_token", error_description="${MISSING_BEARER_MESSAGE}"` });
+};
+const readJsonBody = (req, maxBodyBytes) => new Promise((resolve) => {
+	const chunks = [];
+	let total = 0;
+	let settled = false;
+	const settle = (result) => {
+		if (settled) return;
+		settled = true;
+		resolve(result);
+	};
+	req.on("data", (chunk) => {
+		total += chunk.length;
+		if (total > maxBodyBytes) {
+			req.removeAllListeners("data");
+			settle({
+				ok: false,
+				status: 413,
+				rpcCode: -32600,
+				message: `Request body exceeds ${maxBodyBytes} bytes.`
+			});
+			return;
+		}
+		chunks.push(chunk);
+	});
+	req.on("end", () => {
+		const raw = Buffer.concat(chunks).toString("utf8");
+		if (!raw) {
+			settle({
+				ok: true,
+				value: void 0
+			});
+			return;
+		}
+		try {
+			settle({
+				ok: true,
+				value: JSON.parse(raw)
+			});
+		} catch {
+			settle({
+				ok: false,
+				status: 400,
+				rpcCode: -32700,
+				message: "Parse error: request body is not valid JSON."
+			});
+		}
+	});
+	req.on("error", () => settle({
+		ok: false,
+		status: 400,
+		rpcCode: -32600,
+		message: "Request body could not be read."
+	}));
+});
+const respondBodyError = (req, res, failure) => {
+	const headers = failure.status === 413 ? { Connection: "close" } : {};
+	sendJsonRpcError(res, failure.status, failure.rpcCode, failure.message, headers);
+	if (failure.status === 413) if (res.writableFinished) req.destroy();
+	else res.once("finish", () => req.destroy());
+};
+const SESSION_IDLE_TIMEOUT_MS = 1800 * 1e3;
+const SESSION_SWEEP_INTERVAL_MS = 60 * 1e3;
+const startHttpTransport = async (config, logger = silentLogger, options = {}) => {
+	const metadata = buildOAuthMetadata(config, logger);
+	const sessions = /* @__PURE__ */ new Map();
+	const idleTimeoutMs = options.sessionIdleTimeoutMs ?? SESSION_IDLE_TIMEOUT_MS;
+	const maxBodyBytes = options.maxBodyBytes ?? 4194304;
+	const handleMcpRequest = async (req, res) => {
+		const bearer = extractBearer(req);
+		if (!bearer) {
+			sendUnauthorized(res, metadata.protectedResource.resource);
+			return;
+		}
+		const sessionId = typeof req.headers["mcp-session-id"] === "string" ? req.headers["mcp-session-id"] : void 0;
+		if (sessionId) {
+			const session = sessions.get(sessionId);
+			if (session) {
+				session.auth.bearer = bearer;
+				session.lastActivityAt = Date.now();
+				const body = req.method === "POST" ? await readJsonBody(req, maxBodyBytes) : {
+					ok: true,
+					value: void 0
+				};
+				if (!body.ok) {
+					respondBodyError(req, res, body);
+					return;
+				}
+				await session.transport.handleRequest(req, res, body.value);
+				return;
+			}
+		}
+		if (req.method !== "POST") {
+			sendJsonRpcError(res, 400, -32e3, "No active session; initialize via POST first.");
+			return;
+		}
+		const body = await readJsonBody(req, maxBodyBytes);
+		if (!body.ok) {
+			respondBodyError(req, res, body);
+			return;
+		}
+		const auth = { bearer };
+		const server = createMcpServer(config, () => auth.bearer, logger);
+		const transport = new StreamableHTTPServerTransport({
+			sessionIdGenerator: () => randomUUID(),
+			onsessioninitialized: (newId) => {
+				sessions.set(newId, {
+					transport,
+					auth,
+					lastActivityAt: Date.now(),
+					close: async () => {
+						await transport.close();
+						await server.close();
+					}
+				});
+			}
+		});
+		transport.onclose = () => {
+			if (transport.sessionId) sessions.delete(transport.sessionId);
+		};
+		await server.connect(transport);
+		await transport.handleRequest(req, res, body.value);
+	};
+	const requestListener = async (req, res) => {
+		try {
+			if (handleCorsPreflight(req, res, config.corsOrigins)) return;
+			applyCorsHeaders(req, res, config.corsOrigins);
+			const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+			if (url.pathname === "/.well-known/oauth-protected-resource" && req.method === "GET") {
+				sendJson(res, 200, metadata.protectedResource);
+				return;
+			}
+			if (url.pathname === "/.well-known/oauth-authorization-server" && req.method === "GET") {
+				sendJson(res, 200, metadata.authorizationServer);
+				return;
+			}
+			if (url.pathname === "/healthz" && req.method === "GET") {
+				sendJson(res, 200, {
+					status: "ok",
+					subdomain: config.subdomain
+				});
+				return;
+			}
+			if (url.pathname === "/mcp") {
+				await handleMcpRequest(req, res);
+				return;
+			}
+			res.writeHead(404, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({
+				error: "Not found",
+				path: url.pathname
+			}));
+		} catch (err) {
+			const message = err instanceof Error ? err.message : "Internal Server Error";
+			if (!res.headersSent) sendJsonRpcError(res, 500, -32603, message);
+			else if (!res.writableEnded) res.end();
+		}
+	};
+	const httpServer = createServer((req, res) => {
+		requestListener(req, res);
+	});
+	await new Promise((resolve, reject) => {
+		httpServer.once("error", reject);
+		httpServer.listen(config.port, config.host, () => {
+			httpServer.off("error", reject);
+			resolve();
+		});
+	});
+	const addr = httpServer.address();
+	const boundPort = typeof addr === "object" && addr !== null ? addr.port : config.port;
+	logger.info("http_transport_ready", {
+		host: config.host,
+		port: boundPort
+	});
+	const sweepIdleSessions = async () => {
+		const cutoff = Date.now() - idleTimeoutMs;
+		for (const [id, session] of sessions) {
+			if (session.lastActivityAt > cutoff) continue;
+			sessions.delete(id);
+			try {
+				await session.close();
+			} catch (err) {
+				logger.warn("session_close_failed", {
+					sessionId: id,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+		}
+	};
+	const sweeper = setInterval(() => void sweepIdleSessions(), options.sweepIntervalMs ?? SESSION_SWEEP_INTERVAL_MS);
+	sweeper.unref();
+	return {
+		port: boundPort,
+		close: async () => {
+			clearInterval(sweeper);
+			await Promise.all([...sessions.values()].map((session) => session.close()));
+			sessions.clear();
+			httpServer.closeAllConnections();
+			await new Promise((resolve, reject) => {
+				httpServer.close((err) => err ? reject(err) : resolve());
+			});
+		}
+	};
+};
+//#endregion
 //#region src/transports/stdio.ts
 const startStdioTransport = async (server, logger = silentLogger) => {
 	const transport = new StdioServerTransport();
@@ -2306,21 +2703,26 @@ const startStdioTransport = async (server, logger = silentLogger) => {
 };
 //#endregion
 //#region src/index.ts
+const buildStdioServer = (config, logger) => {
+	if (config.zendeskEmail && config.zendeskApiToken) {
+		const staticToken = buildBasicAuthHeader(config.zendeskEmail, config.zendeskApiToken);
+		return createMcpServer(config, () => staticToken, logger);
+	}
+	const tokenStore = createTokenStore({
+		subdomain: config.subdomain,
+		oauthClientId: config.oauthClientId,
+		callbackPort: config.callbackPort
+	}, logger);
+	return createMcpServer(config, tokenStore.getToken, logger, tokenStore.invalidate);
+};
 const main = async () => {
 	const config = loadConfig();
 	const logger = createLogger(config.logLevel);
-	if (config.zendeskEmail && config.zendeskApiToken) {
-		const staticToken = buildBasicAuthHeader(config.zendeskEmail, config.zendeskApiToken);
-		const getToken = () => staticToken;
-		await startStdioTransport(createMcpServer(config, getToken, logger), logger);
-	} else {
-		const tokenStore = createTokenStore({
-			subdomain: config.subdomain,
-			oauthClientId: config.oauthClientId,
-			callbackPort: config.callbackPort
-		}, logger);
-		await startStdioTransport(createMcpServer(config, tokenStore.getToken, logger, tokenStore.invalidate), logger);
+	if (config.transport === "stdio") {
+		await startStdioTransport(buildStdioServer(config, logger), logger);
+		return;
 	}
+	await startHttpTransport(config, logger);
 };
 main().catch((error) => {
 	console.error("Fatal error:", error);