@goke/mcp 0.0.13 → 0.1.1

package/dist/__test__/http-multi-tenant.test.js

@@ -1,10 +1,11 @@
 /**
  * Multi-tenant remote-MCP test.
  *
- * Proves that one goke cli exposed over the MCP streamable-HTTP
- * transport can serve multiple concurrent users with fully isolated
- * state (in-memory fs + cwd + env) — no shared host process stdio,
- * no cross-tenant leaks.
+ * Proves that one goke cli exposed over stateless MCP streamable HTTP
+ * can serve multiple concurrent users with fully isolated state
+ * (in-memory fs + cwd + env) — no shared host process stdio, no
+ * cross-tenant leaks, no mcp-session-id map. Isolation comes from
+ * the `x-tenant-id` header on each POST, not from `Mcp-Session-Id`.
  *
  * Wiring choices worth calling out:
  *
@@ -14,23 +15,25 @@
  *     transport's `fetch` hook without ever binding a TCP socket
  *     or spinning up `node:http` / Express. Same wire protocol,
  *     zero sockets.
- *   - `enableJsonResponse: true` switches the transport off SSE and
- *     into pure request/response JSON. GET SSE opens are answered
- *     with `405`, which the client treats as "server does not offer
- *     SSE" and moves on (see `_startOrAuthSse` in the SDK client).
- *   - Each session gets its own cli **clone** via
+ *   - `sessionIdGenerator: undefined` is stateless mode. The
+ *     transport does not emit or expect `mcp-session-id`. Each
+ *     POST builds a fresh Server + transport, then closes them.
+ *   - `enableJsonResponse: true` switches the transport off SSE
+ *     and into pure request/response JSON. GET SSE opens are
+ *     answered with `405`, which the client treats as "server
+ *     does not offer SSE" and moves on (see `_startOrAuthSse`
+ *     in the SDK client).
+ *   - Each request gets its own cli **clone** via
  *     `baseCli.clone({ cwd, env, fs })`. The clone inherits the
  *     command tree but owns its own `{ cwd, env, fs }`, which is
  *     what `runCliTool` forwards into every action through
  *     `ctx.process.*` / `ctx.fs`.
  */
-import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { Server as McpLowLevelServer } from "@modelcontextprotocol/sdk/server/index.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { goke } from "goke";
 import { describe, expect, it } from "vitest";
 import { z } from "zod";
@@ -80,7 +83,7 @@ class InMemoryFs {
  * One cli definition, reused across tenants. Commands read / write
  * through `ctx.fs` and resolve paths against `ctx.process.cwd`, so
  * the *same* code runs per tenant but talks to a tenant-specific
- * filesystem when invoked via the session-scoped clone below.
+ * filesystem when invoked via the per-request clone below.
  */
 function buildBaseCli() {
     const cli = goke("notes-app");
@@ -102,32 +105,30 @@ function buildBaseCli() {
     return cli;
 }
 /**
- * Build a `FetchLike` that routes MCP streamable-HTTP traffic into
- * in-process session-scoped `WebStandardStreamableHTTPServerTransport`
- * instances. One transport + one cli clone per session. Each session
- * is keyed by `mcp-session-id`; initialization requests pick a tenant
- * via the `x-tenant-id` header.
- *
- * Returns both the custom fetch and the transports map so tests can
- * inspect session state if needed.
+ * Build a `FetchLike` that handles each MCP POST with a fresh
+ * `WebStandardStreamableHTTPServerTransport` and cli clone.
+ * Tenant identity comes from `x-tenant-id` on every request.
+ * Nothing is keyed by `mcp-session-id`.
  */
 function createMultiTenantFetch(options) {
     const { baseCli, resolveTenant } = options;
-    const transports = new Map();
+    const sessionHeaders = [];
     const customFetch = async (url, init) => {
         const method = (init?.method ?? "GET").toUpperCase();
         const headers = new Headers(init?.headers);
-        // Pure request/response mode: tell the client there's no SSE
-        // available on GET. `_startOrAuthSse` in the SDK client treats
-        // 405 as "server does not offer SSE" and moves on gracefully.
-        if (method === "GET") {
-            return new Response(null, { status: 405 });
+        const sessionHeader = headers.get("mcp-session-id");
+        if (sessionHeader) {
+            sessionHeaders.push(sessionHeader);
+        }
+        const origin = headers.get("origin");
+        if (origin && origin !== "http://in-memory-mcp.test") {
+            return new Response(null, { status: 403 });
+        }
+        if (method !== "POST") {
+            return new Response(null, { status: 405, headers: { Allow: "POST" } });
         }
-        // Parse POST body once and hand it to the transport via
-        // `parsedBody` in `HandleRequestOptions` so we don't have to
-        // worry about Request body streams being single-use.
         let parsedBody = undefined;
-        if (method === "POST" && init?.body != null) {
+        if (init?.body != null) {
             const rawBody = init.body;
             const bodyText = typeof rawBody === "string"
                 ? rawBody
@@ -136,28 +137,10 @@ function createMultiTenantFetch(options) {
                 parsedBody = JSON.parse(bodyText);
             }
         }
-        // Rebuild a plain Request with the same method + headers. The
-        // transport reads accept/content-type from here and uses
-        // `parsedBody` for the actual JSON-RPC payload.
         const request = new Request(url.toString(), {
             method,
             headers,
         });
-        const sessionId = headers.get("mcp-session-id");
-        // Existing session: route to its transport.
-        if (sessionId && transports.has(sessionId)) {
-            return transports.get(sessionId).handleRequest(request, { parsedBody });
-        }
-        // New session: must be an initialize POST.
-        if (method !== "POST" || !isInitializeRequest(parsedBody)) {
-            return new Response(JSON.stringify({
-                jsonrpc: "2.0",
-                error: { code: -32000, message: "Bad Request: No valid session ID provided" },
-                id: null,
-            }), { status: 400, headers: { "content-type": "application/json" } });
-        }
-        // Resolve the tenant from the custom header, build a cli clone
-        // with its cwd/env/fs, and spin up a session-scoped MCP server.
         const tenantId = headers.get("x-tenant-id");
         if (!tenantId) {
             return new Response("missing x-tenant-id header", { status: 401 });
@@ -171,26 +154,19 @@ function createMultiTenantFetch(options) {
         const mcpServer = new McpLowLevelServer({ name: "notes-app-mcp", version: "1.0.0" }, { capabilities: {} });
         addCliToolsToMcp({ cli: tenantCli, server: mcpServer });
         const transport = new WebStandardStreamableHTTPServerTransport({
-            sessionIdGenerator: () => randomUUID(),
-            // Pure request/response — no SSE streaming to clean up.
+            sessionIdGenerator: undefined,
             enableJsonResponse: true,
-            onsessioninitialized: (sid) => {
-                transports.set(sid, transport);
-            },
-            onsessionclosed: (sid) => {
-                transports.delete(sid);
-            },
         });
-        transport.onclose = () => {
-            const sid = transport.sessionId;
-            if (sid) {
-                transports.delete(sid);
-            }
-        };
         await mcpServer.connect(transport);
-        return transport.handleRequest(request, { parsedBody });
+        try {
+            return await transport.handleRequest(request, { parsedBody });
+        }
+        finally {
+            await transport.close();
+            await mcpServer.close();
+        }
     };
-    return { fetch: customFetch, transports };
+    return { fetch: customFetch, sessionHeaders };
 }
 // ─── Tests ────────────────────────────────────────────────────────
 describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () => {
@@ -207,7 +183,7 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
             env: { ROLE: "reader" },
             fs: new InMemoryFs(),
         });
-        const { fetch: tenantFetch } = createMultiTenantFetch({
+        const { fetch: tenantFetch, sessionHeaders } = createMultiTenantFetch({
             baseCli,
             resolveTenant: (id) => {
                 const tenant = tenants.get(id);
@@ -216,8 +192,6 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
                 return tenant;
             },
         });
-        // The URL is a placeholder — the in-process fetch never looks
-        // at the host, just the method/headers/body.
         const endpoint = new URL("http://in-memory-mcp.test/mcp");
         async function connectTenant(tenantId) {
             const transport = new StreamableHTTPClientTransport(endpoint, {
@@ -232,26 +206,21 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
             await client.connect(transport);
             return client;
         }
-        return { tenants, connectTenant };
+        return { tenants, connectTenant, sessionHeaders };
     }
     function firstTextBlock(result) {
         const content = result.content ?? [];
         return content.find((block) => block.type === "text")?.text ?? "";
     }
-    it("routes each session to its own cli clone with tenant-specific cwd/env/fs", async () => {
-        const { tenants, connectTenant } = setupScenario();
+    it("routes each request to its own cli clone with tenant-specific cwd/env/fs", async () => {
+        const { tenants, connectTenant, sessionHeaders } = setupScenario();
         const aliceClient = await connectTenant("tenant-a");
         const bobClient = await connectTenant("tenant-b");
         try {
-            // Each client sees the same tool catalog — it comes from the
-            // shared cli definition.
             const aliceTools = (await aliceClient.listTools()).tools.map((t) => t.name).sort();
             const bobTools = (await bobClient.listTools()).tools.map((t) => t.name).sort();
             expect(aliceTools).toEqual(["load", "save"]);
             expect(bobTools).toEqual(["load", "save"]);
-            // Both tenants write a file called `notes.txt` with different
-            // content. Since each session uses its own cli clone (with
-            // its own cwd + fs), the writes land in separate Maps.
             const aliceSave = await aliceClient.callTool({
                 name: "save",
                 arguments: { filename: "notes.txt", content: "alice-secret" },
@@ -264,7 +233,6 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
             expect(firstTextBlock(aliceSave)).toContain("tenant-a");
             expect(firstTextBlock(bobSave)).toContain("/workspace-b/notes.txt");
             expect(firstTextBlock(bobSave)).toContain("tenant-b");
-            // Each tenant reads back what it wrote.
             const aliceLoad = await aliceClient.callTool({
                 name: "load",
                 arguments: { filename: "notes.txt" },
@@ -277,14 +245,13 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
             expect(firstTextBlock(aliceLoad)).not.toContain("bob-secret");
             expect(firstTextBlock(bobLoad)).toContain("bob-secret");
             expect(firstTextBlock(bobLoad)).not.toContain("alice-secret");
-            // Sanity check: the underlying in-memory maps really are
-            // disjoint. Tenant A's fs only has tenant A's file.
             const tenantAFs = tenants.get("tenant-a").fs;
             const tenantBFs = tenants.get("tenant-b").fs;
             expect([...tenantAFs.files.keys()]).toEqual(["/workspace-a/notes.txt"]);
             expect([...tenantBFs.files.keys()]).toEqual(["/workspace-b/notes.txt"]);
             expect(tenantAFs.files.get("/workspace-a/notes.txt")).toBe("alice-secret");
             expect(tenantBFs.files.get("/workspace-b/notes.txt")).toBe("bob-secret");
+            expect(sessionHeaders).toEqual([]);
         }
         finally {
             await aliceClient.close();
@@ -306,4 +273,22 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
             await bobClient.close();
         }
     });
+    it("rejects a present Origin that is not allowed", async () => {
+        const { fetch } = createMultiTenantFetch({
+            baseCli: buildBaseCli(),
+            resolveTenant: () => {
+                throw new Error("tenant must not be resolved for a forbidden origin");
+            },
+        });
+        const response = await fetch("http://in-memory-mcp.test/mcp", {
+            method: "POST",
+            headers: {
+                origin: "https://evil.example",
+                "x-tenant-id": "tenant-a",
+                "content-type": "application/json",
+            },
+            body: "{}",
+        });
+        expect(response.status).toBe(403);
+    });
 });

package/dist/auth.d.ts

@@ -1,8 +1,10 @@
 import type { OAuthFlowResult, StartOAuthFlowOptions } from "./types.js";
 /**
  * Start the OAuth flow for an MCP server.
- * This is an internal function - consumers should not call this directly.
- * It is automatically triggered by addMcpCommands when a 401 error occurs.
+ *
+ * Used internally by addMcpCommands on 401 errors, but also available
+ * for CLIs that need explicit control over the auth flow (e.g. a login
+ * command that runs the flow in a background daemon).
  *
  * This function:
  * 1. Starts a local callback server on a random port

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAiB,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA0BxF;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4E7F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAazD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAiB,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AA0BxF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4E7F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAazD"}

package/dist/auth.js

@@ -24,8 +24,10 @@ async function openBrowser(url) {
 }
 /**
  * Start the OAuth flow for an MCP server.
- * This is an internal function - consumers should not call this directly.
- * It is automatically triggered by addMcpCommands when a 401 error occurs.
+ *
+ * Used internally by addMcpCommands on 401 errors, but also available
+ * for CLIs that need explicit control over the auth flow (e.g. a login
+ * command that runs the flow in a background daemon).
  *
  * This function:
  * 1. Starts a local callback server on a random port

package/dist/cli-to-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-to-mcp.d.ts","sourceRoot":"","sources":["../src/cli-to-mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAS/E,OAAO,EAKL,KAAK,IAAI,EAIV,MAAM,MAAM,CAAC;AAwFd,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACpD;AAqfD,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,GAAG,EAAE,IAAI,CAAC;IACV,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IACnD,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAsClG;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAyCvE"}
+{"version":3,"file":"cli-to-mcp.d.ts","sourceRoot":"","sources":["../src/cli-to-mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAS/E,OAAO,EAML,KAAK,IAAI,EAIV,MAAM,MAAM,CAAC;AAwFd,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;CACpD;AA4fD,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,GAAG,EAAE,IAAI,CAAC;IACV,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IACnD,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAsClG;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAyCvE"}

package/dist/cli-to-mcp.js

@@ -5,7 +5,7 @@
  * or a high-level McpServer by mounting tools/list + tools/call handlers.
  */
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from "@modelcontextprotocol/sdk/types.js";
-import { coerceBySchema, extractJsonSchema, GokeProcessExit, } from "goke";
+import { coerceBySchema, extractJsonSchema, GokeProcessExit, schemaAcceptsOmittedValue, } from "goke";
 const CLI_TO_MCP_STATE = Symbol.for("@goke/mcp/cli-to-mcp-state");
 function createTextCaptureStream() {
     const chunks = [];
@@ -359,10 +359,15 @@ function createBinding(cli, command, toolName) {
             requiredNames.push(arg.value);
         }
     }
+    // `--days <days>` means "value required if the flag is present". The flag
+    // itself is required only when a non-optional schema rejects `undefined`.
     for (const option of options) {
         const normalized = normalizeOptionSchema(option);
         properties[option.name] = normalized.schema;
-        if (option.required) {
+        if (option.required
+            && option.default === undefined
+            && option.schema
+            && !schemaAcceptsOmittedValue(option.schema)) {
             requiredNames.push(option.name);
         }
         optionBindings.push({

package/dist/index.d.ts

@@ -9,7 +9,6 @@
  *
  * - **Auto-discovery**: Fetches all tools from the MCP server and creates CLI commands
  * - **Caching**: Tools are cached for 1 hour to avoid reconnecting on every invocation
- * - **Session reuse**: MCP session IDs are cached to skip initialization handshake
  * - **Type-aware parsing**: Handles string, number, boolean, object, and array arguments
  * - **JSON schema support**: Generates CLI options from tool input schemas
  * - **OAuth support**: Automatic OAuth authentication on 401 errors (lazy auth)
@@ -41,11 +40,12 @@
  */
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import type { Goke } from "goke";
+export { startOAuthFlow } from "./auth.js";
 import type { McpOAuthConfig } from "./types.js";
 export { addCliToolsToMcp, createMcpAction } from "./cli-to-mcp.js";
 export type { AddCliToolsToMcpOptions, CreateMcpActionOptions } from "./cli-to-mcp.js";
 export type { Transport };
-export type { McpOAuthConfig, McpOAuthState } from "./types.js";
+export type { McpOAuthConfig, McpOAuthState, StartOAuthFlowOptions, OAuthFlowResult } from "./types.js";
 export interface CachedMcpTools {
     tools: Array<{
         name: string;
@@ -53,7 +53,6 @@ export interface CachedMcpTools {
         inputSchema?: unknown;
     }>;
     timestamp: number;
-    sessionId?: string;
 }
 export interface AddMcpCommandsOptions {
     cli: Goke;
@@ -76,9 +75,8 @@ export interface AddMcpCommandsOptions {
     /**
      * Returns a transport to connect to the MCP server, or null if not configured.
      * Use this for stdio servers or any setup `getMcpUrl` cannot express.
-     * @param sessionId - Optional session ID from a still-valid cache
      */
-    getMcpTransport?: (sessionId?: string) => Transport | null | Promise<Transport | null>;
+    getMcpTransport?: () => Transport | null | Promise<Transport | null>;
     /**
      * Argv used to decide whether to skip live discovery.
      * Defaults to `process.argv.slice(2)`.
@@ -118,7 +116,6 @@ export interface AddMcpCommandsOptions {
  * Adds MCP tool commands to a goke CLI instance.
  *
  * Tools are cached for 1 hour to avoid connecting on every CLI invocation.
- * Session ID is also cached to skip MCP initialization handshake.
  *
  * OAuth is lazy - authentication only happens when a 401 error occurs.
  * After successful auth, the operation is automatically retried.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGvF,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAErC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEvF;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAEtD;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;CACxD;AA2JD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4NlF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGvF,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAExG,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAErC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAErE;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAEtD;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;CACxD;AAwJD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkNlF"}

package/dist/index.js

@@ -9,7 +9,6 @@
  *
  * - **Auto-discovery**: Fetches all tools from the MCP server and creates CLI commands
  * - **Caching**: Tools are cached for 1 hour to avoid reconnecting on every invocation
- * - **Session reuse**: MCP session IDs are cached to skip initialization handshake
  * - **Type-aware parsing**: Handles string, number, boolean, object, and array arguments
  * - **JSON schema support**: Generates CLI options from tool input schemas
  * - **OAuth support**: Automatic OAuth authentication on 401 errors (lazy auth)
@@ -45,6 +44,7 @@ import { wrapJsonSchema } from "goke";
 import yaml from "js-yaml";
 import { FileOAuthProvider } from "./oauth-provider.js";
 import { startOAuthFlow, isAuthRequiredError } from "./auth.js";
+export { startOAuthFlow } from "./auth.js";
 export { addCliToolsToMcp, createMcpAction } from "./cli-to-mcp.js";
 const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 /**
@@ -140,7 +140,7 @@ function matchesRegisteredCommand({ argv, cli }) {
         return nameParts.every((part, i) => parts[i] === part);
     });
 }
-function createTransportWithAuth({ url, sessionId, oauthState, oauth, headers, }) {
+function createTransportWithAuth({ url, oauthState, oauth, headers, }) {
     let authProvider;
     if (oauth && oauthState?.tokens) {
         authProvider = new FileOAuthProvider({
@@ -157,7 +157,6 @@ function createTransportWithAuth({ url, sessionId, oauthState, oauth, headers, }
     }
     const hasHeaders = headers && Object.keys(headers).length > 0;
     return new StreamableHTTPClientTransport(url, {
-        sessionId,
         authProvider,
         requestInit: hasHeaders ? { headers } : undefined,
     });
@@ -166,16 +165,13 @@ function createTransportWithAuth({ url, sessionId, oauthState, oauth, headers, }
  * Adds MCP tool commands to a goke CLI instance.
  *
  * Tools are cached for 1 hour to avoid connecting on every CLI invocation.
- * Session ID is also cached to skip MCP initialization handshake.
  *
  * OAuth is lazy - authentication only happens when a 401 error occurs.
  * After successful auth, the operation is automatically retried.
  */
 export async function addMcpCommands(options) {
     const { cli, commandPrefix = "", clientName = "mcp-cli-client", getMcpUrl, getMcpTransport, getHeaders, oauth, loadCache, saveCache, argv = process.argv.slice(2), } = options;
-    // Helper to get transport - supports both old and new API
-    const getTransport = async (sessionId) => {
-        // New API: getMcpUrl + oauth
+    const getTransport = async () => {
         if (getMcpUrl) {
             const mcpUrl = getMcpUrl();
             if (!mcpUrl) {
@@ -185,15 +181,13 @@ export async function addMcpCommands(options) {
             const oauthState = oauth?.load();
             return createTransportWithAuth({
                 url,
-                sessionId,
                 oauthState,
                 oauth,
                 headers: getHeaders?.(),
             });
         }
-        // Custom / stdio transport
         if (getMcpTransport) {
-            return getMcpTransport(sessionId);
+            return getMcpTransport();
         }
         return null;
     };
@@ -226,10 +220,8 @@ export async function addMcpCommands(options) {
     const isCacheValid = cachedTools && (Date.now() - cachedTools.timestamp) < CACHE_TTL_MS;
     const skipLiveDiscovery = isHelpOrMetaArgv(argv) || matchesRegisteredCommand({ argv, cli });
     let tools;
-    let cachedSessionId;
     if (isCacheValid && cachedTools) {
         tools = cachedTools.tools;
-        cachedSessionId = cachedTools.sessionId;
     }
     else if (skipLiveDiscovery) {
         if (cachedTools) {
@@ -244,7 +236,6 @@ export async function addMcpCommands(options) {
                 await client.connect(transport);
                 const result = await client.listTools();
                 tools = result.tools;
-                const sessionId = transport.sessionId;
                 saveCache({
                     tools: tools.map((t) => ({
                         name: t.name,
@@ -252,9 +243,7 @@ export async function addMcpCommands(options) {
                         inputSchema: t.inputSchema,
                     })),
                     timestamp: Date.now(),
-                    sessionId,
                 });
-                cachedSessionId = sessionId;
             }
             catch (err) {
                 const shouldAuth = isAuthRequiredError(err) && oauth && getMcpUrl && !skipLiveDiscovery;
@@ -321,7 +310,7 @@ export async function addMcpCommands(options) {
             // Goke already coerced all values via schemas — just extract the relevant keys
             const parsedArgs = extractToolArguments(cliOptions, inputSchema);
             const executeWithRetry = async (isRetry = false) => {
-                const transport = await getTransport(isRetry ? undefined : cachedSessionId);
+                const transport = await getTransport();
                 if (!transport) {
                     console.error("MCP transport not available. Run login command first.");
                     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goke/mcp",
-  "version": "0.0.13",
+  "version": "0.1.1",
   "type": "module",
   "description": "Dynamically generate CLI commands from MCP server tools",
   "repository": {
@@ -40,7 +40,7 @@
   "author": "Tommaso De Rossi, morse <beats.by.morse@gmail.com>",
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "js-yaml": "^4.1.1"
   },
   "peerDependencies": {
@@ -51,7 +51,7 @@
     "@types/node": "^22.19.7",
     "vitest": "^3.1.0",
     "zod": "^4.3.6",
-    "goke": "^6.12.1"
+    "goke": "^6.16.0"
   },
   "scripts": {
     "clean": "rm -rf dist",

package/src/__test__/add-cli-tools-to-mcp.test.ts

@@ -219,11 +219,7 @@ describe("addCliToolsToMcp", () => {
                 "type": "number",
                 "description": "Right operand"
               }
-            },
-            "required": [
-              "left",
-              "right"
-            ]
+            }
           }
         },
         {
@@ -265,10 +261,7 @@ describe("addCliToolsToMcp", () => {
                 "type": "boolean",
                 "description": "Dry run flag"
               }
-            },
-            "required": [
-              "title"
-            ]
+            }
           }
         }
       ]"
@@ -325,11 +318,7 @@ describe("addCliToolsToMcp", () => {
                 "type": "number",
                 "description": "Right operand"
               }
-            },
-            "required": [
-              "left",
-              "right"
-            ]
+            }
           }
         },
         {
@@ -371,10 +360,7 @@ describe("addCliToolsToMcp", () => {
                 "type": "boolean",
                 "description": "Dry run flag"
               }
-            },
-            "required": [
-              "title"
-            ]
+            }
           }
         }
       ]"

package/src/__test__/add-mcp-commands-help.test.ts

@@ -1,7 +1,10 @@
 // First-run help and stale-cache behavior for addMcpCommands.
 import http from 'node:http'
 import { describe, expect, it } from 'vitest'
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
+import { Server } from '@modelcontextprotocol/sdk/server/index.js'
 import { goke } from 'goke'
+import { addCliToolsToMcp } from '../cli-to-mcp.js'
 import { addMcpCommands, type CachedMcpTools } from '../index.js'
 
 const staleCache = (over: Partial<CachedMcpTools> = {}): CachedMcpTools => ({
@@ -13,7 +16,6 @@ const staleCache = (over: Partial<CachedMcpTools> = {}): CachedMcpTools => ({
     },
   ],
   timestamp: Date.now() - 2 * 60 * 60 * 1000,
-  sessionId: 'stale-session',
   ...over,
 })
 
@@ -136,4 +138,69 @@ describe('addMcpCommands first-run help', () => {
 
     expect(transportCalls).toBe(0)
   })
+
+  it('does not pass a session id into getMcpTransport', async () => {
+    const sessionIds: Array<string | undefined> = []
+    const cli = goke('testcli')
+
+    await addMcpCommands({
+      cli,
+      argv: ['find_bookmarks'],
+      getMcpTransport: (sessionId?: string) => {
+        sessionIds.push(sessionId)
+        return null
+      },
+      loadCache: () => ({
+        tools: [
+          {
+            name: 'find_bookmarks',
+            description: 'Find bookmarks',
+            inputSchema: { type: 'object', properties: {} },
+          },
+        ],
+        timestamp: Date.now(),
+        sessionId: 'should-not-be-reused',
+      }),
+      saveCache: () => {},
+    })
+
+    const command = cli.commands.find((entry) => entry.name === 'find_bookmarks')
+    try {
+      await command?.commandAction?.({})
+    } catch {
+      // transport is null, so the action exits
+    }
+
+    expect(sessionIds).toEqual([undefined])
+  })
+
+  it('caches tools without a session id', async () => {
+    const saved: CachedMcpTools[] = []
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
+    const serverCli = goke('server-cli')
+    serverCli.command('ping', 'Ping').action(() => 'pong')
+
+    const server = new Server({ name: 'test-server', version: '1.0.0' }, { capabilities: {} })
+    addCliToolsToMcp({ cli: serverCli, server })
+    await server.connect(serverTransport)
+
+    const cli = goke('testcli')
+    try {
+      await addMcpCommands({
+        cli,
+        argv: ['ping'],
+        getMcpTransport: () => clientTransport,
+        loadCache: () => undefined,
+        saveCache: (cache) => {
+          if (cache) saved.push(cache)
+        },
+      })
+    } finally {
+      await server.close()
+    }
+
+    expect(saved).toHaveLength(1)
+    expect(saved[0]?.tools.map((tool) => tool.name)).toEqual(['ping'])
+    expect(saved[0]).not.toHaveProperty('sessionId')
+  })
 })