@havesomecode/kibana-mcp-server 1.3.0 → 1.4.0

package/dist/src/tools/filter.d.ts

@@ -0,0 +1,180 @@
+import type { CallToolResult } from "@modelcontextprotocol/server";
+import { z } from "zod";
+import type { KibanaClient } from "../kibana/client.js";
+import type { SchemaCatalog } from "../kibana/schema_catalog.js";
+import type { SourceCatalog } from "../kibana/source_catalog.js";
+export declare const filterInputSchema: z.ZodObject<{
+    source_ids: z.ZodArray<z.ZodString>;
+    start_time: z.ZodString;
+    end_time: z.ZodString;
+    field: z.ZodString;
+    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+    filters: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        field: z.ZodString;
+        value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+    }, z.core.$strip>>>;
+    nested_filters: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        field: z.ZodString;
+        value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+    }, z.core.$strip>>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    mode: z.ZodDefault<z.ZodEnum<{
+        count: "count";
+        grouped_top_hits: "grouped_top_hits";
+        histogram: "histogram";
+        hits: "hits";
+        stats: "stats";
+        terms: "terms";
+    }>>;
+    sort: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    sort_by: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    extract_nested: z.ZodDefault<z.ZodBoolean>;
+    stats_field: z.ZodOptional<z.ZodString>;
+    top_hits_size: z.ZodDefault<z.ZodNumber>;
+    histogram_interval: z.ZodOptional<z.ZodString>;
+    group_by: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const filterOutputSchema: z.ZodObject<{
+    query_echo: z.ZodObject<{
+        source_ids: z.ZodArray<z.ZodString>;
+        start_time: z.ZodString;
+        end_time: z.ZodString;
+        text: z.ZodOptional<z.ZodString>;
+        filters: z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            resolved_field: z.ZodString;
+        }, z.core.$strip>>;
+        nested_filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            field: z.ZodString;
+            value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            resolved_field: z.ZodString;
+            query_strategy: z.ZodOptional<z.ZodEnum<{
+                flat_object_path: "flat_object_path";
+                nested: "nested";
+            }>>;
+        }, z.core.$strip>>>;
+        cursor: z.ZodOptional<z.ZodString>;
+        mode: z.ZodEnum<{
+            count: "count";
+            grouped_top_hits: "grouped_top_hits";
+            histogram: "histogram";
+            hits: "hits";
+            stats: "stats";
+            terms: "terms";
+        }>;
+        sort: z.ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>;
+        sort_by: z.ZodOptional<z.ZodString>;
+        resolved_sort_by_by_source: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            source_id: z.ZodString;
+            resolved_sort_by: z.ZodString;
+        }, z.core.$strip>>>;
+        advisories: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<{
+                non_nested_object_array: "non_nested_object_array";
+                preferred_exact_field: "preferred_exact_field";
+                schema_unavailable: "schema_unavailable";
+            }>;
+            source_id: z.ZodString;
+            purpose: z.ZodEnum<{
+                filter: "filter";
+                group_by: "group_by";
+                sort: "sort";
+            }>;
+            requested_field: z.ZodString;
+            resolved_field: z.ZodString;
+            reason: z.ZodString;
+        }, z.core.$strip>>>;
+        limit: z.ZodNumber;
+        stats_field: z.ZodOptional<z.ZodString>;
+        top_hits_size: z.ZodOptional<z.ZodNumber>;
+        histogram_interval: z.ZodOptional<z.ZodString>;
+        group_by: z.ZodOptional<z.ZodString>;
+        truncated: z.ZodBoolean;
+    }, z.core.$strip>;
+    total: z.ZodNumber;
+    next_cursor: z.ZodOptional<z.ZodString>;
+    hits: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        timestamp: z.ZodNullable<z.ZodString>;
+        summary: z.ZodString;
+        document_id: z.ZodNullable<z.ZodString>;
+        index: z.ZodNullable<z.ZodString>;
+        selected_fields: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        nested_matches: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            documents: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        raw_document: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>>;
+    counts_by_source: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>>;
+    histograms: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        buckets: z.ZodArray<z.ZodObject<{
+            key: z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>;
+            key_as_string: z.ZodOptional<z.ZodString>;
+            count: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+    groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        field: z.ZodString;
+        buckets: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            count: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+    stats: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        field: z.ZodString;
+        summary: z.ZodObject<{
+            count: z.ZodNumber;
+            min: z.ZodNullable<z.ZodNumber>;
+            max: z.ZodNullable<z.ZodNumber>;
+            avg: z.ZodNullable<z.ZodNumber>;
+            sum: z.ZodNumber;
+            p50: z.ZodNullable<z.ZodNumber>;
+            p95: z.ZodNullable<z.ZodNumber>;
+            p99: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+    grouped_hits: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        group_by: z.ZodString;
+        buckets: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            count: z.ZodNumber;
+            hits: z.ZodArray<z.ZodObject<{
+                source_id: z.ZodString;
+                timestamp: z.ZodNullable<z.ZodString>;
+                summary: z.ZodString;
+                document_id: z.ZodNullable<z.ZodString>;
+                index: z.ZodNullable<z.ZodString>;
+                selected_fields: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+                nested_matches: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    path: z.ZodString;
+                    documents: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>>>;
+                raw_document: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare function executeFilter(input: z.infer<typeof filterInputSchema>, sourceCatalog: SourceCatalog, kibanaClient: Pick<KibanaClient, "executeMany">, options?: {
+    schemaCatalog?: SchemaCatalog;
+    callerSignal?: AbortSignal;
+}): Promise<z.infer<typeof filterOutputSchema>>;
+export declare function formatFilterResult(result: z.infer<typeof filterOutputSchema>): string;
+export declare function createFilterCallToolResult(result: z.infer<typeof filterOutputSchema>): CallToolResult;

package/dist/src/tools/query.d.ts

@@ -0,0 +1,181 @@
+import type { CallToolResult } from "@modelcontextprotocol/server";
+import { z } from "zod";
+import type { KibanaClient } from "../kibana/client.js";
+import type { SchemaCatalog } from "../kibana/schema_catalog.js";
+import type { SourceCatalog } from "../kibana/source_catalog.js";
+export declare const queryInputSchema: z.ZodObject<{
+    source_ids: z.ZodArray<z.ZodString>;
+    start_time: z.ZodString;
+    end_time: z.ZodString;
+    text: z.ZodOptional<z.ZodString>;
+    filters: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        field: z.ZodString;
+        value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+    }, z.core.$strip>>>;
+    nested_filters: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        field: z.ZodString;
+        value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+    }, z.core.$strip>>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    mode: z.ZodDefault<z.ZodEnum<{
+        count: "count";
+        grouped_top_hits: "grouped_top_hits";
+        histogram: "histogram";
+        hits: "hits";
+        stats: "stats";
+        terms: "terms";
+    }>>;
+    sort: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    sort_by: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    extract_nested: z.ZodDefault<z.ZodBoolean>;
+    stats_field: z.ZodOptional<z.ZodString>;
+    top_hits_size: z.ZodDefault<z.ZodNumber>;
+    histogram_interval: z.ZodOptional<z.ZodString>;
+    group_by: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const queryOutputSchema: z.ZodObject<{
+    query_echo: z.ZodObject<{
+        source_ids: z.ZodArray<z.ZodString>;
+        start_time: z.ZodString;
+        end_time: z.ZodString;
+        text: z.ZodOptional<z.ZodString>;
+        filters: z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            resolved_field: z.ZodString;
+        }, z.core.$strip>>;
+        nested_filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            field: z.ZodString;
+            value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            resolved_field: z.ZodString;
+            query_strategy: z.ZodOptional<z.ZodEnum<{
+                flat_object_path: "flat_object_path";
+                nested: "nested";
+            }>>;
+        }, z.core.$strip>>>;
+        cursor: z.ZodOptional<z.ZodString>;
+        mode: z.ZodEnum<{
+            count: "count";
+            grouped_top_hits: "grouped_top_hits";
+            histogram: "histogram";
+            hits: "hits";
+            stats: "stats";
+            terms: "terms";
+        }>;
+        sort: z.ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>;
+        sort_by: z.ZodOptional<z.ZodString>;
+        resolved_sort_by_by_source: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            source_id: z.ZodString;
+            resolved_sort_by: z.ZodString;
+        }, z.core.$strip>>>;
+        advisories: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<{
+                non_nested_object_array: "non_nested_object_array";
+                preferred_exact_field: "preferred_exact_field";
+                schema_unavailable: "schema_unavailable";
+            }>;
+            source_id: z.ZodString;
+            purpose: z.ZodEnum<{
+                filter: "filter";
+                group_by: "group_by";
+                sort: "sort";
+            }>;
+            requested_field: z.ZodString;
+            resolved_field: z.ZodString;
+            reason: z.ZodString;
+        }, z.core.$strip>>>;
+        limit: z.ZodNumber;
+        stats_field: z.ZodOptional<z.ZodString>;
+        top_hits_size: z.ZodOptional<z.ZodNumber>;
+        histogram_interval: z.ZodOptional<z.ZodString>;
+        group_by: z.ZodOptional<z.ZodString>;
+        truncated: z.ZodBoolean;
+    }, z.core.$strip>;
+    total: z.ZodNumber;
+    next_cursor: z.ZodOptional<z.ZodString>;
+    hits: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        timestamp: z.ZodNullable<z.ZodString>;
+        summary: z.ZodString;
+        document_id: z.ZodNullable<z.ZodString>;
+        index: z.ZodNullable<z.ZodString>;
+        selected_fields: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        nested_matches: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            documents: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        raw_document: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>>;
+    counts_by_source: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>>;
+    histograms: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        buckets: z.ZodArray<z.ZodObject<{
+            key: z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>;
+            key_as_string: z.ZodOptional<z.ZodString>;
+            count: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+    groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        field: z.ZodString;
+        buckets: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            count: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+    stats: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        field: z.ZodString;
+        summary: z.ZodObject<{
+            count: z.ZodNumber;
+            min: z.ZodNullable<z.ZodNumber>;
+            max: z.ZodNullable<z.ZodNumber>;
+            avg: z.ZodNullable<z.ZodNumber>;
+            sum: z.ZodNumber;
+            p50: z.ZodNullable<z.ZodNumber>;
+            p95: z.ZodNullable<z.ZodNumber>;
+            p99: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+    grouped_hits: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source_id: z.ZodString;
+        group_by: z.ZodString;
+        buckets: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            count: z.ZodNumber;
+            hits: z.ZodArray<z.ZodObject<{
+                source_id: z.ZodString;
+                timestamp: z.ZodNullable<z.ZodString>;
+                summary: z.ZodString;
+                document_id: z.ZodNullable<z.ZodString>;
+                index: z.ZodNullable<z.ZodString>;
+                selected_fields: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+                nested_matches: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    path: z.ZodString;
+                    documents: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>>>;
+                raw_document: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare function executeQuery(input: z.infer<typeof queryInputSchema>, sourceCatalog: SourceCatalog, kibanaClient: Pick<KibanaClient, "executeMany">, options?: {
+    resolveFieldAliases?: boolean;
+    resolvePreferredExactFields?: boolean;
+    schemaCatalog?: SchemaCatalog;
+    callerSignal?: AbortSignal;
+}): Promise<z.infer<typeof queryOutputSchema>>;
+export declare function formatQueryResult(result: z.infer<typeof queryOutputSchema>): string;
+export declare function createQueryCallToolResult(result: z.infer<typeof queryOutputSchema>): CallToolResult;

package/dist/src/transports/http.d.ts

@@ -0,0 +1,15 @@
+import { type StartupConfiguration } from "../config/startup.js";
+export interface HttpServerOptions {
+    host?: string;
+    port?: number;
+    path?: string;
+    profileHeader?: string;
+}
+export interface HttpServerHandle {
+    url: string;
+    close: () => Promise<void>;
+}
+export declare function startHttpMcpServer(envInput?: NodeJS.ProcessEnv, options?: HttpServerOptions, dependencies?: {
+    startupConfiguration?: StartupConfiguration;
+}): Promise<HttpServerHandle>;
+export declare function parsePort(value: string | undefined): number | undefined;

package/dist/src/transports/http.js

@@ -0,0 +1,291 @@
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { createServer, } from "node:http";
+import { Readable } from "node:stream";
+import { WebStandardStreamableHTTPServerTransport, createMcpHandler, isLegacyRequest, localhostAllowedHostnames, localhostAllowedOrigins, validateHostHeader, validateOriginHeader, } from "@modelcontextprotocol/server";
+import { HTTP_AUTH_TOKEN_ENV, HTTP_HOST_ENV, HTTP_PATH_ENV, HTTP_PORT_ENV, HTTP_PROFILE_HEADER_ENV, } from "../config/config_file.js";
+import { loadStartupConfiguration } from "../config/startup.js";
+import { normalizeProfileName } from "../profiles/names.js";
+import { ProfileRuntimeRegistry } from "../profiles/runtime.js";
+import { createApplication } from "../server.js";
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_PORT = 3000;
+const DEFAULT_PATH = "/mcp";
+const HEALTH_PATH = "/healthz";
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+const MAX_LEGACY_SESSIONS = 128;
+const MAX_LEGACY_SESSION_REQUESTS = 1024;
+const LEGACY_SESSION_IDLE_MS = 30 * 60 * 1000;
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1", "localhost"]);
+class HttpRequestError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export async function startHttpMcpServer(envInput = process.env, options = {}, dependencies = {}) {
+    const { env, startupConfiguration } = dependencies.startupConfiguration
+        ? { env: envInput, startupConfiguration: dependencies.startupConfiguration }
+        : await loadStartupConfiguration(envInput);
+    try {
+        return await listen(resolveHttpOptions(env, options), startupConfiguration);
+    }
+    catch (error) {
+        await startupConfiguration.close().catch(() => { });
+        throw error;
+    }
+}
+async function listen(resolved, startupConfiguration) {
+    const registry = new ProfileRuntimeRegistry(startupConfiguration);
+    if (resolved.profileHeader && !registry.supportsNamedProfiles) {
+        throw new Error("A profile header requires named profiles: use saved profiles, a store in the configuration file, or the {profile} placeholder in KIBANA_SOURCE_CATALOG_PATH.");
+    }
+    if (!resolved.profileHeader && !registry.hasDefault) {
+        throw new Error("The HTTP transport needs a profile header, or a default profile named with --profile or KIBANA_PROFILE to serve every caller the same catalog. The legacy 'configure' tool is available over stdio only.");
+    }
+    // Modern and handshake-free legacy calls stay per-request.
+    const handler = createMcpHandler((context) => {
+        const requestProfile = resolved.profileHeader
+            ? readProfileHeader(context.requestInfo?.headers, resolved.profileHeader)
+            : undefined;
+        return createApplication(undefined, { profileRegistry: registry, requestProfile }).server;
+    });
+    const legacySessions = new Map();
+    let initializingSessions = 0;
+    const fetchHandler = async (request) => {
+        if (!(await isLegacyRequest(request)))
+            return handler.fetch(request);
+        for (const session of legacySessions.values()) {
+            if (Date.now() - session.lastUsed >= LEGACY_SESSION_IDLE_MS)
+                await session.server.close();
+        }
+        const profile = resolved.profileHeader
+            ? readProfileHeader(request.headers, resolved.profileHeader)
+            : undefined;
+        const sessionId = request.headers.get("mcp-session-id");
+        if (sessionId) {
+            let session = legacySessions.get(sessionId);
+            // ponytail: recycle bounded sessions until the SDK releases cancelled request metadata.
+            if (session &&
+                session.profile === profile &&
+                session.requests >= MAX_LEGACY_SESSION_REQUESTS) {
+                await session.server.close();
+                session = undefined;
+            }
+            if (!session || session.profile !== profile) {
+                return Response.json({
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: { code: -32001, message: "Session not found" },
+                }, { status: 404 });
+            }
+            session.lastUsed = Date.now();
+            session.requests += 1;
+            return session.transport.handleRequest(request);
+        }
+        const body = request.method === "POST"
+            ? await request
+                .clone()
+                .json()
+                .catch(() => undefined)
+            : undefined;
+        if (body?.method !== "initialize")
+            return handler.fetch(request);
+        if (legacySessions.size + initializingSessions >= MAX_LEGACY_SESSIONS) {
+            return Response.json({ error: "Too many MCP sessions. Close an existing session and retry." }, { status: 503 });
+        }
+        // The SDK owns request IDs and cancellation inside each unguessable client session.
+        initializingSessions += 1;
+        const server = createApplication(undefined, {
+            profileRegistry: registry,
+            requestProfile: profile,
+        }).server;
+        const transport = new WebStandardStreamableHTTPServerTransport({
+            sessionIdGenerator: randomUUID,
+            onsessioninitialized: (id) => {
+                legacySessions.set(id, { server, transport, profile, lastUsed: Date.now(), requests: 0 });
+            },
+        });
+        transport.onclose = () => {
+            legacySessions.delete(transport.sessionId ?? "");
+        };
+        try {
+            await server.connect(transport);
+            const response = await transport.handleRequest(request, { parsedBody: body });
+            if (!transport.sessionId || response.status >= 400)
+                await server.close();
+            return response;
+        }
+        catch (error) {
+            await server.close().catch(() => { });
+            throw error;
+        }
+        finally {
+            initializingSessions -= 1;
+        }
+    };
+    const httpServer = createServer((request, response) => {
+        void handleRequest(request, response, resolved, fetchHandler).catch(() => {
+            if (!response.headersSent) {
+                writeJson(response, 500, { error: "internal_error" });
+                return;
+            }
+            response.destroy();
+        });
+    });
+    await new Promise((resolveListen, rejectListen) => {
+        httpServer.once("error", rejectListen);
+        httpServer.listen(resolved.port, resolved.host, () => {
+            httpServer.off("error", rejectListen);
+            resolveListen();
+        });
+    });
+    const address = httpServer.address();
+    const urlHost = address.family === "IPv6" ? `[${address.address}]` : address.address;
+    return {
+        url: `http://${urlHost}:${address.port}${resolved.path}`,
+        close: async () => {
+            await handler.close();
+            await Promise.all([...legacySessions.values()].map((session) => session.server.close()));
+            await closeHttpServer(httpServer);
+            await startupConfiguration.close();
+        },
+    };
+}
+function resolveHttpOptions(envInput, options) {
+    const host = options.host?.trim() || envInput[HTTP_HOST_ENV]?.trim() || DEFAULT_HOST;
+    const port = options.port ?? parsePort(envInput[HTTP_PORT_ENV]) ?? DEFAULT_PORT;
+    const path = options.path?.trim() || envInput[HTTP_PATH_ENV]?.trim() || DEFAULT_PATH;
+    const profileHeader = (options.profileHeader?.trim() || envInput[HTTP_PROFILE_HEADER_ENV]?.trim())?.toLowerCase();
+    const authToken = envInput[HTTP_AUTH_TOKEN_ENV]?.trim() || undefined;
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new Error("HTTP port must be an integer between 0 and 65535.");
+    }
+    if (!path.startsWith("/") || path === HEALTH_PATH) {
+        throw new Error(`HTTP path must start with '/' and differ from ${HEALTH_PATH}.`);
+    }
+    if (profileHeader && !/^[a-z0-9!#$%&'*+.^_`|~-]+$/.test(profileHeader)) {
+        throw new Error("Profile header must be a valid HTTP header name.");
+    }
+    if (profileHeader === "authorization") {
+        throw new Error("Profile header must not be 'authorization'.");
+    }
+    // Without a token anyone who reaches the port can query Kibana and assert any profile.
+    if (!authToken && !LOOPBACK_HOSTS.has(host)) {
+        throw new Error(`Refusing to listen on non-loopback host '${host}' without ${HTTP_AUTH_TOKEN_ENV}.`);
+    }
+    return { host, port, path, profileHeader, authToken };
+}
+export function parsePort(value) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    return /^\d+$/.test(trimmed) ? Number(trimmed) : Number.NaN;
+}
+async function handleRequest(request, response, options, fetchHandler) {
+    const url = new URL(request.url ?? "/", "http://localhost");
+    if (url.pathname === HEALTH_PATH && request.method === "GET") {
+        writeJson(response, 200, { status: "ok" });
+        return;
+    }
+    if (url.pathname !== options.path) {
+        writeJson(response, 404, { error: "not_found" });
+        return;
+    }
+    if (options.authToken && !isAuthorized(request.headers.authorization, options.authToken)) {
+        response.setHeader("WWW-Authenticate", "Bearer");
+        writeJson(response, 401, { error: "invalid_token" });
+        return;
+    }
+    let webRequest;
+    const abortController = new AbortController();
+    response.once("close", () => abortController.abort());
+    try {
+        const headers = toWebHeaders(request);
+        if (!options.authToken &&
+            (!validateHostHeader(headers.get("host"), localhostAllowedHostnames()).ok ||
+                !validateOriginHeader(headers.get("origin"), localhostAllowedOrigins()).ok)) {
+            throw new HttpRequestError(403, "Untrusted Host or Origin.");
+        }
+        // Refused here to answer with a plain HTTP status; the MCP handler reads the value again.
+        if (options.profileHeader) {
+            readProfileHeader(headers, options.profileHeader);
+        }
+        webRequest = await toWebRequest(request, url, headers, abortController.signal);
+    }
+    catch (error) {
+        if (error instanceof HttpRequestError) {
+            writeJson(response, error.status, { error: error.message });
+            return;
+        }
+        throw error;
+    }
+    const webResponse = await fetchHandler(webRequest);
+    response.writeHead(webResponse.status, Object.fromEntries(webResponse.headers));
+    if (!webResponse.body) {
+        response.end();
+        return;
+    }
+    Readable.fromWeb(webResponse.body, {
+        signal: abortController.signal,
+    })
+        .on("error", () => response.destroy())
+        .pipe(response);
+}
+function readProfileHeader(headers, headerName) {
+    const value = headers?.get(headerName)?.trim();
+    if (!value) {
+        throw new HttpRequestError(401, `Missing required '${headerName}' header.`);
+    }
+    try {
+        return normalizeProfileName(value);
+    }
+    catch (error) {
+        throw new HttpRequestError(400, error instanceof Error ? error.message : String(error));
+    }
+}
+function isAuthorized(authorization, expectedToken) {
+    const match = /^Bearer +(.+)$/i.exec(authorization?.trim() ?? "");
+    if (!match) {
+        return false;
+    }
+    const digest = (value) => createHash("sha256").update(value).digest();
+    return timingSafeEqual(digest(match[1]), digest(expectedToken));
+}
+function toWebHeaders(request) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value === undefined)
+            continue;
+        headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+    }
+    return headers;
+}
+async function toWebRequest(request, url, headers, signal) {
+    const method = request.method ?? "GET";
+    if (method === "GET" || method === "HEAD") {
+        return new Request(url, { method, headers, signal });
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > MAX_BODY_BYTES) {
+            throw new HttpRequestError(413, "Request body is too large.");
+        }
+        chunks.push(buffer);
+    }
+    return new Request(url, { method, headers, body: Buffer.concat(chunks), signal });
+}
+function writeJson(response, status, body) {
+    response.writeHead(status, { "Content-Type": "application/json" });
+    response.end(JSON.stringify(body));
+}
+function closeHttpServer(httpServer) {
+    return new Promise((resolveClose, rejectClose) => {
+        httpServer.close((error) => (error ? rejectClose(error) : resolveClose()));
+        httpServer.closeAllConnections();
+    });
+}

package/dist/src/transports/stdio.d.ts

@@ -0,0 +1 @@
+export declare function startMcpServer(envInput?: NodeJS.ProcessEnv): Promise<void>;