@gavdi/cap-mcp 0.9.8 → 0.9.9-alpha.3

package/README.md

@@ -3,7 +3,7 @@
 > This implementation is based on the Model Context Protocol (MCP) put forward by Anthropic.
 > For more information on MCP, please have a look at their [official documentation.](https://modelcontextprotocol.io/introduction)
 
-> 🔧 **In active development - 1.0 release scheduled for Summer 2025**
+> 🔧 **In active development - 1.0 release scheduled for September 2025**
 
 # CAP-MCP Plugin
 
@@ -15,7 +15,7 @@ Transform your CAP OData services into AI-accessible resources, tools, and promp
 The Model Context Protocol bridges the gap between your enterprise data and AI agents.
 By integrating MCP with your CAP applications, you unlock:
 
-- **AI-Native Data Access**: Your CAP services become directly accessible to AI agents like Claude, enabling natural language queries against your business data
+- **AI-Native Data Access**: Your CAP services become directly accessible to MCP enabled AI agents like Claude, enabling natural language queries against your business data
 - **Enterprise Integration**: Seamlessly connect AI tools to your SAP systems, databases, and business logic
 - **Intelligent Automation**: Enable AI agents to perform complex business operations by combining multiple CAP service calls
 - **Developer Productivity**: Allow AI assistants to help developers understand, query, and work with your CAP data models
@@ -23,19 +23,11 @@ By integrating MCP with your CAP applications, you unlock:
 
 ## ⚠️ Development Status
 
-**This plugin is currently in active development (v0.9.2) and approaching production readiness.**
+**This plugin is currently in active development and approaching production readiness.**
 APIs and annotations may change in future releases. Authentication and security features are implemented and tested.
 
 Version 1.0 of the plugin is scheduled for release in Summer 2025 after final stability testing and documentation completion.
 
-## 📦 Installation
-
-```bash
-npm install @gavdi/cap-mcp
-```
-
-The plugin follows CAP's standard plugin architecture and will automatically integrate with your CAP application.
-
 ## 🚀 Quick Setup
 
 ### Prerequisites
@@ -51,6 +43,8 @@ The plugin follows CAP's standard plugin architecture and will automatically int
 npm install @gavdi/cap-mcp
 ```
 
+The plugin follows CAP's standard plugin architecture and will automatically integrate with your CAP application upon installation.
+
 ### Step 2: Configure Your CAP Application
 
 Add MCP configuration to your `package.json`:
@@ -83,7 +77,7 @@ service CatalogService {
     resource: ['filter', 'orderby', 'select', 'top', 'skip']
   }
   entity Books as projection on my.Books;
-  
+
   // Optionally expose Books as tools for LLMs (query/get enabled by default config)
   annotate CatalogService.Books with @mcp.wrap: {
     tools: true,
@@ -135,17 +129,6 @@ This plugin transforms your annotated CAP services into a fully functional MCP s
 - Start demo app: `npm run mock`
 - Inspector: `npx @modelcontextprotocol/inspector`
 
-### New wrapper tools
-
-When `wrap_entities_to_actions` is enabled (globally or via `@mcp.wrap.tools: true`), you will see tools named like:
-
-- `CatalogService_Books_query`
-- `CatalogService_Books_get`
-- `CatalogService_Books_create` (if enabled)
-- `CatalogService_Books_update` (if enabled)
-
-Each tool includes a description with fields and OData notes to guide the model. You can add `@mcp.wrap.hint` per entity to enrich descriptions for LLMs.
-
 ### Bruno collection
 
 The `bruno/` folder contains HTTP requests for the MCP endpoint (handy for local manual testing using Bruno or any HTTP client). You may add calls for `tools/list` and `tools/call` to exercise the new wrapper tools.
@@ -197,6 +180,33 @@ service CatalogService {
 - **Dynamic Filtering**: Complex filter expressions using OData syntax
 - **Flexible Selection**: Choose specific fields and sort orders
 
+### Wrapper tools
+
+When `wrap_entities_to_actions` is enabled (globally or via `@mcp.wrap.tools: true`), you will see tools named like:
+
+- `CatalogService_Books_query`
+- `CatalogService_Books_get`
+- `CatalogService_Books_create` (if enabled)
+- `CatalogService_Books_update` (if enabled)
+
+Each tool includes a description with fields and OData notes to guide the model. You can add `@mcp.wrap.hint` per entity to enrich descriptions for LLMs.
+
+Example:
+
+```cds
+  // Wrap Books entity as tools for query/get/create/update (demo)
+  annotate CatalogService.Books with @mcp.wrap: {
+    tools: true,
+    modes: [
+      'query',
+      'get',
+      'create',
+      'update'
+    ],
+    hint : 'Use for read and write demo operations'
+  };
+```
+
 ### Tool Annotations
 
 Convert CAP functions and actions into executable AI tools:
@@ -277,6 +287,7 @@ Configure the MCP plugin through your CAP application's `package.json` or `.cdsr
 | `name` | string | package.json name | MCP server name |
 | `version` | string | package.json version | MCP server version |
 | `auth` | `"inherit"` \| `"none"` | `"inherit"` | Authentication mode |
+| `instructions` | string | `null` | MCP server instructions for agents |
 | `capabilities.resources.listChanged` | boolean | `true` | Enable resource list change notifications |
 | `capabilities.resources.subscribe` | boolean | `false` | Enable resource subscriptions |
 | `capabilities.tools.listChanged` | boolean | `true` | Enable tool list change notifications |
@@ -539,9 +550,24 @@ npm test -- --testPathPattern=integration
 ## 🚨 Performance & Limitations
 
 ### Known Limitations
-- **SDK Bug**: Dynamic resource queries require all query parameters due to `@modelcontextprotocol/sdk` RFC template string issue
-- **Authentication Inheritance**: MCP authentication is tightly coupled to CAP's authentication system
-- **Session Cleanup**: MCP sessions are cleaned up on HTTP connection close, not on explicit disconnect
+
+#### No Interactive Authentication Support
+**The plugin currently does NOT support interactive OAuth flows** that allow end-users to log in through MCP clients like Claude Desktop, Cursor, or other consumer MCP applications.
+
+**What this means:**
+- ✅ Works with custom MCP clients that can inject pre-obtained bearer tokens
+- ✅ Works in development with `dummy` authentication  
+- ❌ **Does NOT work with Claude Desktop, Cursor, or similar clients expecting OAuth login flows**
+- ❌ End-users cannot authenticate interactively when connecting
+
+**Technical Context:** This limitation exists due to architectural constraints in the current Model Context Protocol SDK. The MCP community is actively working on a solution that would enable proper interactive authentication flows, but no timeline has been announced. This is expected to be resolved in the second half of 2025.
+
+**Workarounds:**
+- **For Development**: Use `"auth": { "kind": "dummy" }` in your CAP configuration
+- **For Production**: Custom MCP clients must obtain valid bearer tokens through your CAP application's existing authentication flow and include them in requests as `Authorization: Bearer <token>`
+
+#### SDK Bug
+- **Dynamic Resource Queries**: Require all query parameters due to `@modelcontextprotocol/sdk` RFC template string issue
 
 ### Performance Considerations
 - **Large Datasets**: Use `resource: ['top']` or similar constraints for entities with many records

package/lib/annotations.js

@@ -0,0 +1,257 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpPromptAnnotation = exports.McpToolAnnotation = exports.McpResourceAnnotation = exports.McpAnnotation = exports.McpAnnotations = exports.McpAnnotationKey = void 0;
+exports.parseAnnotations = parseAnnotations;
+const utils_1 = require("./utils");
+const DEFAULT_ALL_RESOURCE_OPTIONS = new Set([
+    "filter",
+    "sort",
+    "top",
+    "skip",
+    "select",
+]);
+exports.McpAnnotationKey = "@mcp";
+exports.McpAnnotations = {
+    // Resource annotations for MCP
+    MCP_RESOURCE: "@mcp.resource",
+    // Tool annotations for MCP
+    MCP_TOOL_NAME: "@mcp.tool.name",
+    MCP_TOOL_DESCRIPTION: "@mcp.tool.description",
+    // Prompt annotations for MCP
+    MCP_PROMPT: "@mcp.prompt",
+};
+class McpAnnotation {
+    _target;
+    _serviceName;
+    constructor(target, serviceName) {
+        this._target = target;
+        this._serviceName = serviceName;
+    }
+    get target() {
+        return this._target;
+    }
+    get serviceName() {
+        return this._serviceName;
+    }
+}
+exports.McpAnnotation = McpAnnotation;
+class McpResourceAnnotation extends McpAnnotation {
+    _includeAll;
+    _functionalities;
+    _properties;
+    constructor(target, serviceName, includeAll, functionalities, properties) {
+        super(target, serviceName);
+        this._includeAll = includeAll;
+        this._functionalities = functionalities;
+        this._properties = properties;
+    }
+    get includeAll() {
+        return this._includeAll;
+    }
+    get functionalities() {
+        return this._functionalities;
+    }
+    get properties() {
+        return this._properties;
+    }
+}
+exports.McpResourceAnnotation = McpResourceAnnotation;
+class McpToolAnnotation extends McpAnnotation {
+    _name;
+    _description;
+    _parameters;
+    _entityKey;
+    _operationKind;
+    _keyTypeMap;
+    constructor(name, description, operation, serviceName, parameters, entityKey, operationKind, keyTypeMap) {
+        super(operation, serviceName);
+        this._name = name;
+        this._description = description;
+        this._parameters = parameters;
+        this._entityKey = entityKey;
+        this._operationKind = operationKind;
+        this._keyTypeMap = keyTypeMap;
+    }
+    get name() {
+        return this._name;
+    }
+    get description() {
+        return this._description;
+    }
+    get parameters() {
+        return this._parameters;
+    }
+    get entityKey() {
+        return this._entityKey;
+    }
+    get operationKind() {
+        return this._operationKind;
+    }
+    get keyTypeMap() {
+        return this._keyTypeMap;
+    }
+}
+exports.McpToolAnnotation = McpToolAnnotation;
+class McpPromptAnnotation extends McpAnnotation {
+    _name;
+    _template;
+    constructor(target, serviceName, name, template) {
+        super(target, serviceName);
+        this._name = name;
+        this._template = template;
+    }
+    get name() {
+        return this._name;
+    }
+    get template() {
+        return this._template;
+    }
+}
+exports.McpPromptAnnotation = McpPromptAnnotation;
+function parseAnnotations(services) {
+    const annotations = [];
+    for (const serviceName of Object.keys(services)) {
+        const srv = services[serviceName];
+        if (srv.name === "CatalogService") {
+            utils_1.LOGGER.debug("SERVICE: ", srv.model.definitions);
+        }
+        const entities = srv.entities;
+        const operations = srv.operations; // Refers to action and function imports
+        // Find entities
+        for (const entityName of Object.keys(entities)) {
+            const target = entities[entityName];
+            const res = findEntityAnnotations(target, entityName, srv);
+            if (target.actions) {
+                const bound = parseBoundOperations(target.actions, entityName, target, srv);
+                if (bound && bound.length > 0) {
+                    annotations.push(...bound);
+                }
+            }
+            if (!res)
+                continue;
+            annotations.push(res);
+        }
+        // Find operations
+        for (const operationName of Object.keys(operations)) {
+            const op = operations[operationName];
+            const res = findOperationAnnotations(op, operationName, srv);
+            if (!res)
+                continue;
+            annotations.push(res);
+        }
+    }
+    const result = formatAnnotations(annotations);
+    return result;
+}
+function formatAnnotations(annotationList) {
+    const result = new Map();
+    for (const annotation of annotationList) {
+        if (annotation.operation) {
+            if (!annotation.annotations[exports.McpAnnotations.MCP_TOOL_NAME] ||
+                !annotation.annotations[exports.McpAnnotations.MCP_TOOL_DESCRIPTION]) {
+                utils_1.LOGGER.error(`Invalid annotation found for operation`, annotation);
+                throw new Error(`Invalid annotations for operation '${annotation.operation}'`);
+            }
+            else if (typeof annotation.annotations[exports.McpAnnotations.MCP_TOOL_NAME] !==
+                "string" ||
+                typeof annotation.annotations[exports.McpAnnotations.MCP_TOOL_DESCRIPTION] !==
+                    "string") {
+                utils_1.LOGGER.error("Invalid data for annotations", annotation);
+                throw new Error(`Invalid annotation data for operation '${annotation.operation}'`);
+            }
+            const entry = new McpToolAnnotation(annotation.annotations[exports.McpAnnotations.MCP_TOOL_NAME], annotation.annotations[exports.McpAnnotations.MCP_TOOL_DESCRIPTION], annotation.operation, annotation.serviceName, mapOperationInput(annotation.context), // TODO: Parse the parameters from the context and place them in the class
+            annotation.entityKey, annotation.operationKind, annotation.keyTypeMap);
+            result.set(entry.target, entry);
+            continue;
+        }
+        if (!annotation.entityKey) {
+            utils_1.LOGGER.error("Invalid entry", annotation);
+            throw new Error(`Invalid annotated entry found with no target`);
+        }
+        if (!annotation.annotations[exports.McpAnnotations.MCP_RESOURCE]) {
+            utils_1.LOGGER.error("No valid annotations found for entry", annotation);
+            throw new Error(`Invalid annotations for entry target: '${annotation.entityKey}'`);
+        }
+        const includeAll = annotation.annotations[exports.McpAnnotations.MCP_RESOURCE] === true;
+        const functionalities = Array.isArray(annotation.annotations[exports.McpAnnotations.MCP_RESOURCE])
+            ? new Set(annotation.annotations[exports.McpAnnotations.MCP_RESOURCE])
+            : DEFAULT_ALL_RESOURCE_OPTIONS;
+        const entry = new McpResourceAnnotation(annotation.entityKey, annotation.serviceName, includeAll, functionalities, (0, utils_1.parseEntityElements)(annotation.context));
+        result.set(entry.target, entry);
+    }
+    utils_1.LOGGER.debug("Formatted annotations", result);
+    return result;
+}
+function findEntityAnnotations(entry, entityKey, service) {
+    const annotations = findAnnotations(entry);
+    return Object.keys(annotations).length > 0
+        ? {
+            serviceName: service.name,
+            annotations: annotations,
+            entityKey: entityKey,
+            context: entry,
+        }
+        : undefined;
+}
+function findOperationAnnotations(operation, operationName, service) {
+    const annotations = findAnnotations(operation);
+    return Object.keys(annotations).length > 0
+        ? {
+            serviceName: service.name,
+            annotations: annotations,
+            operation: operationName,
+            operationKind: operation.kind,
+            context: operation,
+        }
+        : undefined;
+}
+function parseBoundOperations(operations, entityKey, entity, service) {
+    const res = new Array();
+    for (const [operationName, operation] of Object.entries(operations)) {
+        const annotation = findBoundOperationAnnotations(operation, operationName, entityKey, service);
+        if (!annotation)
+            continue;
+        annotation.keyTypeMap = new Map();
+        for (const [k, v] of Object.entries(entity.keys)) {
+            if (!v.type) {
+                utils_1.LOGGER.error("Invalid key type", k);
+                throw new Error("Invalid key type found for bound operation");
+            }
+            annotation.keyTypeMap.set(k, v.type.replace("cds.", ""));
+        }
+        res.push(annotation);
+    }
+    return res;
+}
+function findBoundOperationAnnotations(operation, operationName, entityKey, service) {
+    const annotations = findAnnotations(operation);
+    return Object.keys(annotations).length > 0
+        ? {
+            serviceName: service.name,
+            annotations: annotations,
+            operation: operationName,
+            operationKind: operation.kind,
+            entityKey: entityKey,
+            context: operation,
+        }
+        : undefined;
+}
+function findAnnotations(entry) {
+    const annotations = {};
+    for (const [k, v] of Object.entries(entry)) {
+        if (!k.includes(exports.McpAnnotationKey))
+            continue;
+        annotations[k] = v;
+    }
+    return annotations;
+}
+function mapOperationInput(ctx) {
+    const params = ctx["params"];
+    if (!params)
+        return undefined;
+    const result = new Map();
+    for (const [k, v] of Object.entries(params)) {
+        result.set(k, v.type.replace("cds.", ""));
+    }
+    return result.size > 0 ? result : undefined;
+}

package/lib/auth/adapter.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/auth/handler.js

@@ -2,8 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authHandlerFactory = authHandlerFactory;
 exports.errorHandlerFactory = errorHandlerFactory;
+const logger_1 = require("../logger");
 /** JSON-RPC 2.0 error code for unauthorized requests */
 const RPC_UNAUTHORIZED = 10;
+/** HTTP Authenticate header **/
+const WWW_AUTHENTICATE = "WWW-Authenticate";
 /* @ts-ignore */
 const cds = global.cds || require("@sap/cds"); // This is a work around for missing cds context
 /**
@@ -31,9 +34,15 @@ const cds = global.cds || require("@sap/cds"); // This is a work around for miss
  * @throws {500} When CAP context is not properly loaded
  */
 function authHandlerFactory() {
-    const authKind = cds.env.requires.auth.kind;
     return (req, res, next) => {
+        const auth = cds.env.requires.auth;
+        const authKind = auth.kind;
+        const credentials = auth.credentials;
         if (!req.headers.authorization && authKind !== "dummy") {
+            logger_1.LOGGER.warn("No valid authorization header provided");
+            // We need to return a WWW-Authenticate response header here with .well-known metadata
+            // Otherwise the MCP client will not be able to figure out the auth flow
+            res.setHeader(WWW_AUTHENTICATE, `Bearer error='"invalid_token", resource_metadata="${credentials?.url}/.well-known/oauth-protected-resource"`);
             res.status(401).json({
                 jsonrpc: "2.0",
                 error: {
@@ -58,6 +67,9 @@ function authHandlerFactory() {
         }
         const user = ctx.user;
         if (!user || user === cds.User.anonymous) {
+            // We need to return a WWW-Authenticate response header here with .well-known metadata
+            // Otherwise the MCP client will not be able to figure out the auth flow
+            res.setHeader(WWW_AUTHENTICATE, `Bearer error='"invalid_token", resource_metadata="${credentials?.url}/.well-known/oauth-protected-resource"`);
             res.status(401).json({
                 jsonrpc: "2.0",
                 error: {

package/lib/auth/mock.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/auth/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/auth/utils.js

@@ -6,30 +6,10 @@ exports.registerAuthMiddleware = registerAuthMiddleware;
 exports.hasToolOperationAccess = hasToolOperationAccess;
 exports.getWrapAccesses = getWrapAccesses;
 const handler_1 = require("./handler");
-const proxyProvider_js_1 = require("@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js");
 const router_js_1 = require("@modelcontextprotocol/sdk/server/auth/router.js");
-/**
- * @fileoverview Authentication utilities for MCP-CAP integration.
- *
- * This module provides utilities for integrating CAP authentication with MCP servers.
- * It supports all standard CAP authentication types and provides functions for:
- * - Determining authentication status
- * - Managing user access rights
- * - Registering authentication middleware
- *
- * Supported CAP authentication types:
- * - 'dummy': No authentication (privileged access)
- * - 'mocked': Mock users with predefined credentials
- * - 'basic': HTTP Basic Authentication
- * - 'jwt': Generic JWT token validation
- * - 'xsuaa': SAP BTP XSUAA OAuth2/JWT authentication
- * - 'ias': SAP Identity Authentication Service
- * - Custom string types for user-defined authentication strategies
- *
- * Access CAP auth configuration via: cds.env.requires.auth.kind
- */
+const logger_1 = require("../logger");
 /* @ts-ignore */
-const cds = global.cds || require("@sap/cds"); // This is a work around for missing cds context
+const cds = global.cds || require("@sap/cds"); // Use hosting app's CDS instance exclusively
 /**
  * Determines whether authentication is enabled for the MCP plugin.
  *
@@ -117,7 +97,8 @@ function getAccessRights(authEnabled) {
  * @since 1.0.0
  */
 function registerAuthMiddleware(expressApp) {
-    const middlewares = cds.middlewares.before; // No types exists for this part of the CDS library
+    logger_1.LOGGER.debug("Configuring auth middleware");
+    const middlewares = cds.middlewares?.before || []; // Handle missing middlewares gracefully
     // Build array of auth middleware to apply
     const authMiddleware = [];
     // Add CAP middleware
@@ -132,8 +113,10 @@ function registerAuthMiddleware(expressApp) {
     authMiddleware.push((0, handler_1.authHandlerFactory)());
     // Apply auth middleware to all /mcp routes EXCEPT health
     expressApp?.use(/^\/mcp(?!\/health).*/, ...authMiddleware);
-    // Then finally we add the oauth proxy to the xsuaa instance
+    // Note: .well-known/oauth-authorization-server endpoint is automatically created by mcpAuthRouter
+    // Configure OAuth proxy for enterprise authentication scenarios
     configureOAuthProxy(expressApp);
+    logger_1.LOGGER.debug("Auth middleware configured");
 }
 /**
  * Configures OAuth proxy middleware for enterprise authentication scenarios.
@@ -146,6 +129,7 @@ function registerAuthMiddleware(expressApp) {
  * - Access token verification and validation
  * - Client credential management
  * - Integration with CAP authentication configuration
+ * - Dynamic client registration for MCP clients
  *
  * The OAuth proxy is only configured for enterprise authentication types
  * (jwt, xsuaa, ias) and skips configuration for basic auth types.
@@ -175,42 +159,86 @@ function configureOAuthProxy(expressApp) {
     const config = cds.env.requires.auth;
     const kind = config.kind;
     const credentials = config.credentials;
+    logger_1.LOGGER.debug("Running auth with configuration kind", kind);
     // Safety guard - skip OAuth proxy for basic auth types
-    if (kind === "dummy" || kind === "mocked" || kind === "basic")
+    if (kind === "dummy" || kind === "mocked" || kind === "basic") {
+        logger_1.LOGGER.debug("Skipping OAuth proxy for auth type:", kind);
         return;
-    else if (!credentials ||
+    }
+    if (!credentials ||
         !credentials.clientid ||
         !credentials.clientsecret ||
         !credentials.url) {
-        throw new Error("Invalid security credentials");
+        logger_1.LOGGER.warn("OAuth proxy skipped - missing required XSUAA credentials");
+        return; // Don't throw error, just skip OAuth proxy
     }
-    const proxyProvider = new proxyProvider_js_1.ProxyOAuthServerProvider({
-        endpoints: {
-            authorizationUrl: `${credentials.url}/oauth/authorize`,
-            tokenUrl: `${credentials.url}/oauth/token`,
-            revocationUrl: `${credentials.url}/oauth/revoke`,
-        },
-        verifyAccessToken: async (token) => {
-            return {
-                token,
-                clientId: credentials.clientid,
-                scopes: ["uaa.resource"],
-            };
+    logger_1.LOGGER.debug("Configuring OAuth proxy with XSUAA endpoints");
+    const baseUrl = process.env.MCP_BASE_URL ||
+        process.env.MCP_SERVER_URL ||
+        "http://localhost:4004";
+    // const proxyProvider = new ProxyOAuthServerProvider({
+    //   endpoints: {
+    //     authorizationUrl: `${credentials.url}/oauth/authorize`,
+    //     tokenUrl: `${credentials.url}/oauth/token`,
+    //     revocationUrl: `${credentials.url}/oauth/revoke`,
+    //   },
+    //   verifyAccessToken: async (token: string) => {
+    //     try {
+    //       LOGGER.debug("OAuth proxy: verifyAccessToken called");
+    //
+    //       // Use CAP's built-in JWT verification for XSUAA
+    //       const decoded = await cds.auth.jwt.verify(token);
+    //       LOGGER.debug(
+    //         "Token decoded successfully for client:",
+    //         decoded.client_id || decoded.azp,
+    //       );
+    //
+    //       return {
+    //         token,
+    //         clientId: decoded.client_id || decoded.azp,
+    //         scopes: decoded.scope?.split(" ") || [],
+    //         userId: decoded.sub,
+    //         expiresAt: decoded.exp, // Unix timestamp, not Date object
+    //       };
+    //     } catch (error) {
+    //       LOGGER.error("Token verification failed:", error);
+    //       throw new Error("Invalid access token");
+    //     }
+    //   },
+    //   getClient: async (client_id: string) => {
+    //     LOGGER.debug("OAuth proxy: Dynamic client registration requested");
+    //
+    //     return {
+    //       client_secret: credentials.clientsecret as string,
+    //       client_id,
+    //       redirect_uris: [
+    //         `${baseUrl}/oauth/callback`,
+    //         `${baseUrl}/mcp/oauth/callback`,
+    //         "http://localhost:3000/callback", // Claude Desktop default
+    //         "http://localhost:3000/auth/callback", // Alternative format
+    //       ],
+    //     };
+    //   },
+    // });
+    expressApp.use((0, router_js_1.mcpAuthMetadataRouter)({
+        oauthMetadata: {
+            issuer: credentials.url,
+            authorization_endpoint: `${credentials.url}/oauth/authorize`,
+            token_endpoint: `${credentials.url}/oauth/token`,
+            response_types_supported: ["code", "token"],
+            grant_types_supported: [
+                "authorization_code",
+                "client_credentials",
+                "urn:ietf:params:oauth:grant-type:jwt-bearer",
+                "refresh_token"
+            ],
+            token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic"],
+            code_challenge_methods_supported: ["S256"]
         },
-        getClient: async (client_id) => {
-            return {
-                client_secret: credentials.clientsecret,
-                client_id,
-                redirect_uris: ["http://localhost:3000/callback"], // Temporary value for now
-            };
-        },
-    });
-    expressApp.use((0, router_js_1.mcpAuthRouter)({
-        provider: proxyProvider,
-        issuerUrl: new URL(credentials.url),
-        //baseUrl: new URL(""), // I have left this out for the time being due to the defaulting to issuer
         serviceDocumentationUrl: new URL("https://docs.cloudfoundry.org/api/uaa/version/77.34.0/index.html#authorization"),
+        resourceServerUrl: new URL(baseUrl),
     }));
+    logger_1.LOGGER.info("OAuth proxy configured successfully for XSUAA integration");
 }
 /**
  * Checks whether the requesting user's access matches that of the roles required

package/lib/mcp/customResourceTemplate.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Custom URI template implementation that fixes the MCP SDK's broken
+ * URI template matching for grouped query parameters.
+ *
+ * This is duck typing implementation of the ResourceTemplate class.
+ * See @modelcontextprotocol/sdk/server/mcp.js
+ *
+ * This is only a temporary solution, as we should use the official implementation from the SDK
+ * Upon the SDK being fixed, we should switch over to that implementation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomResourceTemplate = exports.CustomUriTemplate = void 0;
+// TODO: Get rid of 'any' typing
+/**
+ * Custom URI template class that properly handles grouped query parameters
+ * in the format {?param1,param2,param3}
+ */
+class CustomUriTemplate {
+    template;
+    baseUri = "";
+    queryParams = [];
+    constructor(template) {
+        this.template = template;
+        this.parseTemplate();
+    }
+    toString() {
+        return this.template;
+    }
+    parseTemplate() {
+        // Extract base URI and query parameters from template
+        // Template format: odata://CatalogService/books{?filter,orderby,select,skip,top}
+        const queryTemplateMatch = this.template.match(/^([^{]+)\{\?([^}]+)\}$/);
+        if (!queryTemplateMatch) {
+            // No query parameters, treat as static URI
+            this.baseUri = this.template;
+            this.queryParams = [];
+            return;
+        }
+        this.baseUri = queryTemplateMatch[1];
+        this.queryParams = queryTemplateMatch[2]
+            .split(",")
+            .map((param) => param.trim())
+            .filter((param) => param.length > 0);
+    }
+    /**
+     * Matches a URI against this template and extracts variables
+     * @param uri The URI to match
+     * @returns Object with extracted variables or null if no match
+     */
+    match(uri) {
+        // Check if base URI matches
+        if (!uri.startsWith(this.baseUri)) {
+            return null;
+        }
+        // Extract query string
+        const queryStart = uri.indexOf("?");
+        if (queryStart === -1) {
+            // No query parameters in URI
+            if (this.queryParams.length === 0) {
+                return {}; // Static URI match
+            }
+            // Template expects query params but URI has none - still valid for optional params
+            return {};
+        }
+        const queryString = uri.substring(queryStart + 1);
+        const queryPairs = queryString.split("&");
+        const extractedVars = {};
+        // Parse query parameters with strict validation
+        for (const pair of queryPairs) {
+            const equalIndex = pair.indexOf("=");
+            if (equalIndex > 0) {
+                const key = pair.substring(0, equalIndex);
+                const value = pair.substring(equalIndex + 1);
+                if (key && value !== undefined) {
+                    const decodedKey = decodeURIComponent(key);
+                    const decodedValue = decodeURIComponent(value);
+                    // SECURITY: Reject entire URI if ANY unauthorized parameter is present
+                    if (!this.queryParams.includes(decodedKey)) {
+                        return null; // Unauthorized parameter found - reject entire URI
+                    }
+                    extractedVars[decodedKey] = decodedValue;
+                }
+            }
+            else if (pair.trim().length > 0) {
+                // Handle malformed parameters (missing = or empty key)
+                // SECURITY: Reject malformed query parameters
+                return null;
+            }
+        }
+        // For static templates (no parameters allowed), reject any query string
+        if (this.queryParams.length === 0 && queryString.trim().length > 0) {
+            return null;
+        }
+        return extractedVars;
+    }
+    /**
+     * Expands the template with given variables
+     * @param variables Object containing variable values
+     * @returns Expanded URI string
+     */
+    expand(variables) {
+        if (this.queryParams.length === 0) {
+            return this.baseUri;
+        }
+        const queryPairs = [];
+        for (const param of this.queryParams) {
+            const value = variables[param];
+            if (value !== undefined && value !== null && value !== "") {
+                queryPairs.push(`${encodeURIComponent(param)}=${encodeURIComponent(value)}`);
+            }
+        }
+        if (queryPairs.length === 0) {
+            return this.baseUri;
+        }
+        return `${this.baseUri}?${queryPairs.join("&")}`;
+    }
+    /**
+     * Gets the variable names from the template
+     */
+    get variableNames() {
+        return [...this.queryParams];
+    }
+}
+exports.CustomUriTemplate = CustomUriTemplate;
+/**
+ * Custom ResourceTemplate that uses our CustomUriTemplate for proper URI matching
+ * Duck-types the MCP SDK's ResourceTemplate interface for compatibility
+ */
+class CustomResourceTemplate {
+    _uriTemplate;
+    _callbacks;
+    constructor(uriTemplate, callbacks) {
+        this._callbacks = callbacks;
+        this._uriTemplate = new CustomUriTemplate(uriTemplate);
+    }
+    /**
+     * Gets the URI template pattern - must match MCP SDK interface
+     */
+    get uriTemplate() {
+        return this._uriTemplate;
+    }
+    /**
+     * Gets the list callback, if one was provided
+     */
+    get listCallback() {
+        return this._callbacks.list;
+    }
+    /**
+     * Gets the callback for completing a specific URI template variable
+     */
+    completeCallback(variable) {
+        return this._callbacks.complete?.[variable];
+    }
+}
+exports.CustomResourceTemplate = CustomResourceTemplate;

package/lib/mcp.js

@@ -40,7 +40,9 @@ class McpPlugin {
         logger_1.LOGGER.debug("Event received for 'bootstrap'");
         this.expressApp = app;
         this.expressApp.use("/mcp", express_1.default.json());
-        if (this.config.auth === "inherit") {
+        // To make it more safe, if there is a mispelling we will always implement auth
+        // Users will have to explicitly write none
+        if (this.config.auth !== "none") {
             (0, utils_2.registerAuthMiddleware)(this.expressApp);
         }
         await this.registerApiEndpoints();

package/lib/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/utils.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_SESSION_HEADER = exports.LOGGER = void 0;
+exports.createMcpServer = createMcpServer;
+exports.handleMcpSessionRequest = handleMcpSessionRequest;
+exports.parseEntityElements = parseEntityElements;
+const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
+const zod_1 = require("zod");
+const structures_1 = require("./annotations/structures");
+/* @ts-ignore */
+const cds = global.cds || require("@sap/cds"); // This is a work around for missing cds context
+exports.LOGGER = cds.log("cds-mcp");
+exports.MCP_SESSION_HEADER = "mcp-session-id";
+function createMcpServer(annotations) {
+    const packageInfo = require("../package.json");
+    const server = new mcp_js_1.McpServer({
+        name: packageInfo.name,
+        version: packageInfo.version,
+        capabilities: {
+            tools: { listChanged: true },
+            resources: { listChanged: true },
+            prompts: { listChanged: true },
+        },
+    });
+    exports.LOGGER.debug("Annotations found for server = ", annotations);
+    if (!annotations)
+        return server;
+    // TODO: Handle the parsed annotations
+    // TODO: Error handling
+    // TODO: This should only be mapped once, not per each server instance. Maybe this should be pre-packaged on load?
+    for (const [_, v] of annotations.entries()) {
+        switch (v.constructor) {
+            case structures_1.McpToolAnnotation:
+                const model = v;
+                const parameters = buildParameters(model.parameters);
+                exports.LOGGER.debug("Adding tool", model);
+                if (model.entityKey) {
+                    const keys = buildParameters(model.keyTypeMap);
+                    server.tool(model.name, { ...keys, ...parameters }, async (data) => {
+                        const service = cds.services[model.serviceName];
+                        const received = data;
+                        const receivedKeys = {};
+                        const receivedParams = {};
+                        for (const [k, v] of Object.entries(received)) {
+                            if (model.keyTypeMap?.has(k)) {
+                                receivedKeys[k] = v;
+                            }
+                            if (!model.parameters?.has(k))
+                                continue;
+                            receivedParams[k] = v;
+                        }
+                        const response = await service.send({
+                            event: model.target,
+                            entity: model.entityKey,
+                            data: receivedParams,
+                            params: [receivedKeys],
+                        });
+                        return {
+                            content: Array.isArray(response)
+                                ? response.map((el) => ({ type: "text", text: String(el) }))
+                                : [{ type: "text", text: String(response) }], // TODO: This should be dynamic based on the return type
+                        };
+                    });
+                    continue;
+                }
+                server.tool(model.name, parameters, async (data) => {
+                    exports.LOGGER.debug("Tool call received, targeting service: ", model.serviceName, model.target);
+                    const service = cds.services[model.serviceName];
+                    const response = await service.send(model.target, data);
+                    exports.LOGGER.debug("MCP Tool response received and being packaged");
+                    return {
+                        content: Array.isArray(response)
+                            ? response.map((el) => ({ type: "text", text: String(el) }))
+                            : [{ type: "text", text: String(response) }], // TODO: This should be dynamic based on the return type
+                    };
+                });
+                continue;
+            case structures_1.McpResourceAnnotation:
+                exports.LOGGER.debug("This is a resource");
+                continue;
+            case structures_1.McpPromptAnnotation:
+                exports.LOGGER.debug("This is a prompt");
+                continue;
+            default:
+                exports.LOGGER.error("Invalid annotation data type");
+                throw new Error("Invalid annotation");
+        }
+    }
+    return server;
+}
+async function handleMcpSessionRequest(req, res, sessions) {
+    const sessionIdHeader = req.headers[exports.MCP_SESSION_HEADER];
+    if (!sessionIdHeader || !sessions.has(sessionIdHeader)) {
+        res.status(400).send("Invalid or missing session ID");
+        return;
+    }
+    const session = sessions.get(sessionIdHeader);
+    if (!session) {
+        res.status(400).send("Invalid session");
+        return;
+    }
+    await session.transport.handleRequest(req, res);
+}
+function parseEntityElements(entity) {
+    const elements = entity.elements;
+    if (!elements) {
+        exports.LOGGER.error("Invalid object - cannot be parsed", entity);
+        throw new Error("Failed to parse entity object");
+    }
+    const result = new Map();
+    for (const el of elements) {
+        if (!el.type)
+            continue;
+        result.set(el.name, el.type?.replace("cds.", ""));
+    }
+    return result;
+}
+function buildParameters(params) {
+    if (!params || params.size <= 0)
+        return {};
+    const result = {};
+    for (const [k, v] of params.entries()) {
+        result[k] = determineParameterType(v);
+    }
+    return result;
+}
+function determineParameterType(paramType) {
+    switch (paramType) {
+        case "String":
+            return zod_1.z.string();
+        case "Integer":
+            return zod_1.z.number();
+        default:
+            return zod_1.z.number();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gavdi/cap-mcp",
-  "version": "0.9.8",
+  "version": "0.9.9-alpha.3",
   "description": "MCP Pluging for CAP",
   "keywords": [
     "MCP",
@@ -41,12 +41,12 @@
     "express": "^4"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.17.1",
+    "@modelcontextprotocol/sdk": "^1.17.4",
     "zod": "^3.25.67",
     "zod-to-json-schema": "^3.24.5"
   },
   "devDependencies": {
-    "@cap-js/cds-types": "^0.12.0",
+    "@cap-js/cds-types": "^0.13.0",
     "@release-it/conventional-changelog": "^10.0.1",
     "@types/express": "^5.0.3",
     "@types/jest": "^30.0.0",