@huntapi/mcp 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HuntAPI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,150 @@
-# Temporary Holding Version
+# HuntAPI MCP Server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Official [Model Context Protocol](https://modelcontextprotocol.io) server for the [HuntAPI](https://www.huntapi.com) media download API.
+
+Download video and audio from public media URLs, or extract their metadata, with one async REST API.
+
+It lets Claude, Cursor, VS Code, Windsurf and any MCP client call the API as tools. Runs over **stdio** (local) or **Streamable HTTP** (self-hosted).
+
+## Requirements
+
+- Node.js 20 or newer
+- a HuntAPI API key — [sign up](https://app.huntapi.com/register), then copy it from the [dashboard](https://app.huntapi.com)
+
+## Hosted server (recommended)
+
+HuntAPI runs this server for you at **`https://mcp.huntapi.com/`** (Streamable HTTP). Send your API key in the `x-api-key` header; nothing to install.
+
+```sh
+claude mcp add --transport http huntapi https://mcp.huntapi.com/ --header "x-api-key: YOUR_API_KEY"
+```
+
+```json
+{
+  "mcpServers": {
+    "huntapi": {
+      "url": "https://mcp.huntapi.com/",
+      "headers": {
+        "x-api-key": "YOUR_API_KEY"
+      }
+    }
+  }
+}
+```
+
+The hosted server and this package expose the same API; run the package locally when you want stdio, your own network egress, or to self-host it.
+
+## Run it locally
+
+### Claude Code
+
+```sh
+claude mcp add huntapi --env HUNTAPI_API_KEY=YOUR_API_KEY -- npx -y @huntapi/mcp
+```
+
+### Claude Desktop, Cursor, Windsurf and other clients
+
+Add the server to the client's MCP configuration (`claude_desktop_config.json`, `.cursor/mcp.json`…):
+
+```json
+{
+  "mcpServers": {
+    "huntapi": {
+      "command": "npx",
+      "args": ["-y", "@huntapi/mcp"],
+      "env": {
+        "HUNTAPI_API_KEY": "YOUR_API_KEY"
+      }
+    }
+  }
+}
+```
+
+### VS Code
+
+```json
+{
+  "servers": {
+    "huntapi": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@huntapi/mcp"],
+      "env": {
+        "HUNTAPI_API_KEY": "${input:huntapi-api-key}"
+      }
+    }
+  },
+  "inputs": [
+    {
+      "type": "promptString",
+      "id": "huntapi-api-key",
+      "description": "HuntAPI API key",
+      "password": true
+    }
+  ]
+}
+```
+
+### Claude Desktop extension
+
+Download the `.mcpb` bundle from the releases page and open it; Claude Desktop asks for your API key.
+
+### Docker
+
+```sh
+docker build -t huntapi-mcp .
+docker run -i --rm -e HUNTAPI_API_KEY=YOUR_API_KEY huntapi-mcp
+```
+
+## Tools
+
+| Tool             | Description                                                                                                                                                                   |
+| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `audio_download` | Download audio from a URL via HuntAPI and receive a job id.                                                                                                                   |
+| `jobs`           | Poll status, progress (0–100), and result of an async HuntAPI job.                                                                                                            |
+| `media_metadata` | Extract metadata from a media URL without downloading the file.                                                                                                               |
+| `stats`          | Infrastructure health for an engine or endpoint over the last hour. Not scoped to your account or tenant. Enabled per account: HTTP 403 means contact support to activate it. |
+| `usage`          | Retrieve real-time usage statistics and credit balance for your Huntapi account.                                                                                              |
+| `video_download` | Video Download                                                                                                                                                                |
+| `wait_for_job`   | Wait for an async download job to finish.                                                                                                                                     |
+
+Every tool that calls the API consumes credits. JSON results are returned as text; images are returned inline and other files (PDF…) as embedded resources, up to 4 MB.
+
+## Streamable HTTP
+
+```sh
+npx @huntapi/mcp --http --port 3000
+```
+
+The endpoint is `POST /mcp` (stateless, JSON responses). Each client sends its own key in the `x-api-key` header (or `Authorization: Bearer <key>`); the server never uses a key of its own. It binds to `127.0.0.1` by default and rejects browser origins unless you allow them — put it behind TLS before exposing it.
+
+`createHttpHandler()` is exported for Fetch-compatible runtimes (Cloudflare Workers, Deno, Bun):
+
+```ts
+import { createHttpHandler } from "@huntapi/mcp";
+
+export default { fetch: createHttpHandler({ allowedOrigins: [] }) };
+```
+
+## Security
+
+- The API key is read from `HUNTAPI_API_KEY` (stdio) or the request headers (HTTP) and removed from error messages.
+- Content fetched from websites is untrusted: the server instructions tell the model to treat it as data, not instructions.
+- See [SECURITY.md](SECURITY.md) to report a vulnerability.
+
+## Development
+
+```sh
+npm install
+npm test
+npm run build
+npx @modelcontextprotocol/inspector node dist/stdio.js
+```
+
+## Built on the SDK
+
+The server uses the official [Node.js SDK](https://github.com/huntapi/huntapi-node) (`@huntapi/sdk`).
+
+## License
+
+MIT — see [LICENSE](LICENSE).

package/SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are released for the latest published version of the HuntAPI MCP server.
+
+## Reporting a vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues.
+
+Email **contact@huntapi.com** with a description of the issue, the affected version, and steps to reproduce. We acknowledge reports within three business days and keep you informed until the issue is resolved.
+
+## Handling API keys
+
+- Keep your HuntAPI API key out of source control. Load it from the `HUNTAPI_API_KEY` environment variable or a secret manager.
+- Rotate the key from the [HuntAPI dashboard](https://app.huntapi.com) if you believe it was exposed.

package/dist/catalog.d.ts

@@ -0,0 +1,3 @@
+import type { EndpointEntry } from "./types.js";
+export declare const MODE: "catalog" | "tools";
+export declare const CATALOG: readonly EndpointEntry[];

package/dist/catalog.js

@@ -0,0 +1,190 @@
+// Generated from the HuntAPI OpenAPI document. Do not edit by hand.
+export const MODE = "tools";
+export const CATALOG = [
+    {
+        name: "audio_download",
+        title: "Audio Download",
+        path: "/v1/audio/download",
+        methods: ["GET", "POST"],
+        description: "Audio Download. Download audio from a URL via HuntAPI and receive a job id. Credit cost: 1 credit per call.",
+        params: [
+            {
+                name: "query",
+                type: "string",
+                required: true,
+                description: "URL to download audio from.",
+            },
+            {
+                name: "download_type",
+                type: "string",
+                required: false,
+                description: "Desired download type. Supported values: audio (default).",
+                default: "audio",
+            },
+            {
+                name: "max_duration",
+                type: "number",
+                required: false,
+                description: "Maximum duration of the downloaded content in seconds. If the audio is longer than this value, only the content up to this duration will be downloaded.",
+            },
+            {
+                name: "audio_quality",
+                type: "string",
+                required: false,
+                description: "Desired audio quality.",
+                default: "best",
+            },
+            {
+                name: "audio_format",
+                type: "string",
+                required: false,
+                description: "Desired output format for the audio.",
+                default: "mp3",
+            },
+            {
+                name: "webhook_url",
+                type: "string",
+                required: false,
+                description: "URL of the webhook where results will be sent. When specified, the system will attempt to send the response to this URL up to 3 times with a 5-second delay between each attempt. The results will be sent as a POST request.",
+            },
+            {
+                name: "webhook_authorization",
+                type: "string",
+                required: false,
+                description: "Authorization header for the webhook. This parameter allows you to add authentication to your webhook endpoint.",
+            },
+            {
+                name: "fields",
+                type: "string",
+                required: false,
+                description: "Comma-separated list of fields to keep in the response, with dot notation for nested fields (e.g. name,location.city). Does not change the credit cost.",
+            },
+        ],
+    },
+    {
+        name: "jobs",
+        title: "Jobs",
+        path: "/v1/jobs/{id}",
+        methods: ["GET"],
+        description: "Jobs. Poll status, progress (0–100), and result of an async HuntAPI job.",
+        params: [
+            {
+                name: "id",
+                type: "string",
+                required: true,
+                description: "Job UUID returned as job_id by async endpoints such as /v1/video/download and /v1/audio/download.",
+            },
+        ],
+    },
+    {
+        name: "media_metadata",
+        title: "Media Metadata",
+        path: "/v1/media/metadata",
+        methods: ["GET"],
+        description: "Media Metadata. Extract metadata from a media URL without downloading the file. Credit cost: 1 credit per call.",
+        params: [
+            {
+                name: "query",
+                type: "string",
+                required: true,
+                description: "Media URL to inspect (YouTube, Instagram, TikTok, Vimeo, X, Facebook, Twitch, Reddit, etc.).",
+            },
+            {
+                name: "fields",
+                type: "string",
+                required: false,
+                description: "Comma-separated list of fields to keep in the response, with dot notation for nested fields (e.g. name,location.city). Does not change the credit cost.",
+            },
+        ],
+    },
+    {
+        name: "stats",
+        title: "Stats",
+        path: "/v1/stats",
+        methods: ["GET"],
+        description: "Stats. Infrastructure health for an engine or endpoint over the last hour. Not scoped to your account or tenant. Enabled per account: HTTP 403 means contact support to activate it.",
+        params: [
+            {
+                name: "engine",
+                type: "string",
+                required: false,
+                description: "API family to check, for example video. Provide at least engine or path.",
+            },
+            {
+                name: "path",
+                type: "string",
+                required: false,
+                description: "Specific endpoint to check, for example /v1/video/download. If you also pass engine, use an endpoint from that API.",
+            },
+        ],
+    },
+    {
+        name: "usage",
+        title: "Usage",
+        path: "/v1/usage",
+        methods: ["GET"],
+        description: "Usage. Retrieve real-time usage statistics and credit balance for your Huntapi account.",
+        params: [],
+    },
+    {
+        name: "video_download",
+        title: "Video Download",
+        path: "/v1/video/download",
+        methods: ["GET", "POST"],
+        description: "Video Download. Credit cost: 1 credit per call.",
+        params: [
+            {
+                name: "query",
+                type: "string",
+                required: true,
+                description: "Video URL to download.",
+            },
+            {
+                name: "download_type",
+                type: "string",
+                required: false,
+                description: "Desired download type. You have three options:",
+                default: "audio_video",
+            },
+            {
+                name: "max_duration",
+                type: "number",
+                required: false,
+                description: "Maximum duration of the downloaded content in seconds. If the video/audio is longer than this value, only the content up to this duration will be downloaded.",
+            },
+            {
+                name: "video_quality",
+                type: "string",
+                required: false,
+                description: "Desired video quality. Available options:",
+                default: "best",
+            },
+            {
+                name: "video_format",
+                type: "string",
+                required: false,
+                description: "Desired output format for the video. Available options:",
+                default: "mp4",
+            },
+            {
+                name: "webhook_url",
+                type: "string",
+                required: false,
+                description: "URL of the webhook where results will be sent. When specified, the system will attempt to send the response to this URL up to 3 times with a 5-second delay between each attempt. The results will be sent as a POST request.",
+            },
+            {
+                name: "webhook_authorization",
+                type: "string",
+                required: false,
+                description: "Authorization header for the webhook. This parameter allows you to add authentication to your webhook endpoint. This value will be included in the Authorization header when making the webhook request to your server.",
+            },
+            {
+                name: "fields",
+                type: "string",
+                required: false,
+                description: "Comma-separated list of fields to keep in the response, with dot notation for nested fields (e.g. name,location.city). Does not change the credit cost.",
+            },
+        ],
+    },
+];
+//# sourceMappingURL=catalog.js.map

package/dist/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAIpE,MAAM,CAAC,MAAM,IAAI,GAAwB,OAAO,CAAC;AAEjD,MAAM,CAAC,MAAM,OAAO,GAA6B;IAC/C;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACxB,WAAW,EACT,6GAA6G;QAC/G,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,6BAA6B;aAC3C;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,2DAA2D;gBAC7D,OAAO,EAAE,OAAO;aACjB;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,yJAAyJ;aAC5J;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,wBAAwB;gBACrC,OAAO,EAAE,MAAM;aAChB;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,sCAAsC;gBACnD,OAAO,EAAE,KAAK;aACf;YACD;gBACE,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,+NAA+N;aAClO;YACD;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,iHAAiH;aACpH;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,yJAAyJ;aAC5J;SACF;KACF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,WAAW,EACT,0EAA0E;QAC5E,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,mGAAmG;aACtG;SACF;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,WAAW,EACT,iHAAiH;QACnH,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,8FAA8F;aACjG;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,yJAAyJ;aAC5J;SACF;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,WAAW,EACT,sLAAsL;QACxL,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,0EAA0E;aAC7E;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,qHAAqH;aACxH;SACF;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,CAAC,KAAK,CAAC;QAChB,WAAW,EACT,yFAAyF;QAC3F,MAAM,EAAE,EAAE;KACX;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,iDAAiD;QAC9D,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,wBAAwB;aACtC;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,gDAAgD;gBAC7D,OAAO,EAAE,aAAa;aACvB;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,+JAA+J;aAClK;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,2CAA2C;gBACxD,OAAO,EAAE,MAAM;aAChB;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,yDAAyD;gBACtE,OAAO,EAAE,KAAK;aACf;YACD;gBACE,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,+NAA+N;aAClO;YACD;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,yNAAyN;aAC5N;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,yJAAyJ;aAC5J;SACF;KACF;CACF,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,17 @@
+import { type HuntApiClientOptions } from "@huntapi/sdk";
+import { type ToolClient } from "./server.js";
+export declare const MCP_PATH = "/mcp";
+export declare const DEFAULT_MAX_BODY_BYTES: number;
+export interface HttpHandlerOptions {
+    /** Origins accepted when a browser sends an Origin header. Empty rejects every browser origin. */
+    readonly allowedOrigins?: readonly string[];
+    readonly maxBodyBytes?: number;
+    /** Builds the SDK client for one request; override in tests. */
+    readonly clientFactory?: (options: HuntApiClientOptions) => ToolClient;
+}
+/**
+ * Fetch-style handler for a stateless, authenticated Streamable HTTP endpoint. Each POST gets a fresh
+ * server and transport; the caller's API key comes from the x-api-key header or a Bearer token.
+ * Works on Node.js (see serve.ts), Cloudflare Workers, Deno, Bun and any Fetch-compatible runtime.
+ */
+export declare function createHttpHandler(options?: HttpHandlerOptions): (request: Request) => Promise<Response>;

package/dist/http.js

@@ -0,0 +1,77 @@
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { HuntApiClient } from "@huntapi/sdk";
+import { createHuntApiMcpServer } from "./server.js";
+export const MCP_PATH = "/mcp";
+export const DEFAULT_MAX_BODY_BYTES = 256 * 1024;
+/**
+ * Fetch-style handler for a stateless, authenticated Streamable HTTP endpoint. Each POST gets a fresh
+ * server and transport; the caller's API key comes from the x-api-key header or a Bearer token.
+ * Works on Node.js (see serve.ts), Cloudflare Workers, Deno, Bun and any Fetch-compatible runtime.
+ */
+export function createHttpHandler(options = {}) {
+    const allowedOrigins = new Set(options.allowedOrigins ?? []);
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    const clientFactory = options.clientFactory ??
+        ((clientOptions) => new HuntApiClient(clientOptions));
+    return async (request) => {
+        const url = new URL(request.url);
+        if (url.pathname === "/health")
+            return Response.json({ status: "ok" });
+        if (url.pathname !== MCP_PATH)
+            return jsonError(404, "Not found.");
+        if (request.method !== "POST") {
+            return new Response(null, { status: 405, headers: { Allow: "POST" } });
+        }
+        const origin = request.headers.get("origin");
+        if (origin !== null && !allowedOrigins.has(origin))
+            return jsonError(403, "Origin not allowed.");
+        const apiKey = readApiKey(request.headers);
+        if (!apiKey) {
+            return new Response(JSON.stringify({
+                error: "Send your HuntAPI API key in the x-api-key header.",
+            }), {
+                status: 401,
+                headers: {
+                    "content-type": "application/json",
+                    "www-authenticate": 'Bearer realm="HuntAPI"',
+                },
+            });
+        }
+        const declaredLength = Number(request.headers.get("content-length") ?? "0");
+        if (declaredLength > maxBodyBytes)
+            return jsonError(413, "Request body too large.");
+        const body = await request.text();
+        if (new TextEncoder().encode(body).length > maxBodyBytes)
+            return jsonError(413, "Request body too large.");
+        const server = createHuntApiMcpServer({
+            client: clientFactory({ apiKey }),
+            sensitiveValues: [apiKey],
+        });
+        const transport = new WebStandardStreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+        });
+        await server.connect(transport);
+        try {
+            return await transport.handleRequest(new Request(request.url, {
+                method: "POST",
+                headers: request.headers,
+                body,
+            }));
+        }
+        finally {
+            void server.close();
+        }
+    };
+}
+function readApiKey(headers) {
+    const direct = headers.get("x-api-key")?.trim();
+    if (direct)
+        return direct;
+    const match = /^Bearer\s+(\S+)\s*$/i.exec(headers.get("authorization") ?? "");
+    return match?.[1];
+}
+function jsonError(status, message) {
+    return Response.json({ error: message }, { status });
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AACzH,OAAO,EAAE,aAAa,EAA6B,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAmB,MAAM,aAAa,CAAC;AAEtE,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAUjD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA8B,EAAE;IAEhC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa;QACrB,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAExD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAChD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,oDAAoD;aAC5D,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,wBAAwB;iBAC7C;aACF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC5E,IAAI,cAAc,GAAG,YAAY;YAC/B,OAAO,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,YAAY;YACtD,OAAO,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;YACjC,eAAe,EAAE,CAAC,MAAM,CAAC;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,aAAa,CAClC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBACvB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI;aACL,CAAC,CACH,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { CATALOG, MODE } from "./catalog.js";
+export { createHttpHandler, MCP_PATH, type HttpHandlerOptions, } from "./http.js";
+export { redact } from "./redaction.js";
+export { MAX_INLINE_BYTES, MAX_TEXT_CHARS, toErrorResult, toToolResult, } from "./result.js";
+export { describeEndpoint, inputObject, inputShape } from "./schema.js";
+export { startHttpServer, type ServeOptions } from "./serve.js";
+export { createHuntApiMcpServer, SERVER_INSTRUCTIONS, SERVER_NAME, type ServerDependencies, type ToolClient, } from "./server.js";
+export type { EndpointEntry, ParamEntry, ParamType } from "./types.js";
+export { VERSION } from "./version.js";

package/dist/index.js

@@ -0,0 +1,9 @@
+export { CATALOG, MODE } from "./catalog.js";
+export { createHttpHandler, MCP_PATH, } from "./http.js";
+export { redact } from "./redaction.js";
+export { MAX_INLINE_BYTES, MAX_TEXT_CHARS, toErrorResult, toToolResult, } from "./result.js";
+export { describeEndpoint, inputObject, inputShape } from "./schema.js";
+export { startHttpServer } from "./serve.js";
+export { createHuntApiMcpServer, SERVER_INSTRUCTIONS, SERVER_NAME, } from "./server.js";
+export { VERSION } from "./version.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,QAAQ,GAET,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,GAGZ,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,2 @@
+/** Removes secrets from text before it reaches a model or a log. */
+export declare function redact(text: string, sensitiveValues: readonly (string | null | undefined)[]): string;

package/dist/redaction.js

@@ -0,0 +1,10 @@
+/** Removes secrets from text before it reaches a model or a log. */
+export function redact(text, sensitiveValues) {
+    let out = text;
+    for (const value of sensitiveValues) {
+        if (value && value.length >= 4)
+            out = out.split(value).join("[REDACTED]");
+    }
+    return out;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,eAAuD;IAEvD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/result.d.ts

@@ -0,0 +1,8 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { type ApiResponse } from "@huntapi/sdk";
+/** Largest JSON text returned to the model, in characters. */
+export declare const MAX_TEXT_CHARS = 200000;
+/** Largest file returned inline (image or embedded resource), in bytes. */
+export declare const MAX_INLINE_BYTES: number;
+export declare function toToolResult(response: ApiResponse, path: string): CallToolResult;
+export declare function toErrorResult(error: unknown, sensitiveValues: readonly (string | null | undefined)[]): CallToolResult;

package/dist/result.js

@@ -0,0 +1,103 @@
+import { HuntApiApiError, HuntApiError, HuntApiSerializationError, } from "@huntapi/sdk";
+import { redact } from "./redaction.js";
+/** Largest JSON text returned to the model, in characters. */
+export const MAX_TEXT_CHARS = 200_000;
+/** Largest file returned inline (image or embedded resource), in bytes. */
+export const MAX_INLINE_BYTES = 4 * 1024 * 1024;
+const INLINE_IMAGE_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+    "image/gif",
+]);
+export function toToolResult(response, path) {
+    if (response.kind === "json") {
+        const text = JSON.stringify(response.data, null, 2) ?? "null";
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: text.length > MAX_TEXT_CHARS
+                        ? `${text.slice(0, MAX_TEXT_CHARS)}\n… (truncated: ${text.length} characters in total)`
+                        : text,
+                },
+            ],
+        };
+    }
+    const mimeType = (response.contentType ?? "application/octet-stream")
+        .split(";", 1)[0]
+        .trim()
+        .toLowerCase();
+    const size = response.bytes.length;
+    const summary = {
+        type: "text",
+        text: `${mimeType} response from ${path} (${size} bytes).`,
+    };
+    if (size > MAX_INLINE_BYTES) {
+        return {
+            content: [
+                {
+                    ...summary,
+                    text: `${summary.text} Too large to return inline; call the API directly or use the SDK.`,
+                },
+            ],
+        };
+    }
+    const data = Buffer.from(response.bytes).toString("base64");
+    if (INLINE_IMAGE_TYPES.has(mimeType)) {
+        return { content: [{ type: "image", data, mimeType }, summary] };
+    }
+    const uri = `huntapi://response${path}`;
+    if (mimeType.startsWith("text/") ||
+        mimeType === "image/svg+xml" ||
+        mimeType.endsWith("+xml")) {
+        return {
+            content: [
+                {
+                    type: "resource",
+                    resource: {
+                        uri,
+                        mimeType,
+                        text: Buffer.from(response.bytes).toString("utf8"),
+                    },
+                },
+                summary,
+            ],
+        };
+    }
+    return {
+        content: [
+            { type: "resource", resource: { uri, mimeType, blob: data } },
+            summary,
+        ],
+    };
+}
+export function toErrorResult(error, sensitiveValues) {
+    let text;
+    if (error instanceof HuntApiApiError) {
+        const body = error.responseBody === undefined
+            ? ""
+            : `\n${JSON.stringify(error.responseBody).slice(0, 2_000)}`;
+        text = `HuntAPI API error ${error.status}: ${error.message}${body}`;
+        if (error.status === 401)
+            text += "\nCheck the HUNTAPI_API_KEY API key.";
+        if (error.status === 402)
+            text += "\nThe account has no credits left.";
+        if (error.status === 429)
+            text += "\nRate limit exceeded; retry later.";
+    }
+    else if (error instanceof HuntApiSerializationError) {
+        text = `Invalid parameters: ${error.message}`;
+    }
+    else if (error instanceof HuntApiError) {
+        text = `${error.name}: ${error.message}`;
+    }
+    else {
+        text = `Unexpected error: ${error instanceof Error ? error.message : String(error)}`;
+    }
+    return {
+        isError: true,
+        content: [{ type: "text", text: redact(text, sensitiveValues) }],
+    };
+}
+//# sourceMappingURL=result.js.map