@j0hanz/fetch-url-mcp 1.12.13 → 2.0.1

package/dist/http/native.js

@@ -1,10 +1,11 @@
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { ErrorCode, isInitializeRequest, } from '@modelcontextprotocol/sdk/types.js';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { isInitializeRequest, ProtocolErrorCode, } from '@modelcontextprotocol/server';
 import { randomUUID } from 'node:crypto';
 import { once } from 'node:events';
 import { readFileSync } from 'node:fs';
 import { createServer, } from 'node:http';
 import { createServer as createHttpsServer, } from 'node:https';
+import { SocketAddress } from 'node:net';
 import { freemem, hostname, totalmem } from 'node:os';
 import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
 import process from 'node:process';
@@ -13,14 +14,16 @@ import { pipeline } from 'node:stream/promises';
 import { config, enableHttpMode, serverVersion } from '../lib/config.js';
 import { composeCloseHandlers, createSessionStore, createSlotTracker, ensureSessionCapacity, logDebug, logError, Loggers, logInfo, logWarn, registerMcpSessionOwnerKey, registerMcpSessionServer, reserveSessionSlot, resolveMcpSessionIdByServer, runWithRequestContext, runWithTraceContext, startSessionCleanupLoop, unregisterMcpSessionServer, unregisterMcpSessionServerByServer, } from '../lib/core.js';
 import { getErrorMessage, toError } from '../lib/error/index.js';
-import { acceptsEventStream, acceptsJsonAndEventStream, isMcpRequestBody, sendJsonRpcError, } from '../lib/mcp-interop.js';
+import { acceptsEventStream, acceptsJsonAndEventStream, isJsonRpcBatchRequest, isMcpRequestBody, } from '../lib/mcp-interop.js';
 import { createDefaultBlockList, normalizeIpForBlockList, } from '../lib/net/index.js';
 import { isObject } from '../lib/utils.js';
 import { createMcpServerForHttpSession } from '../server.js';
 import { buildAuthenticatedOwnerKey } from '../tasks/index.js';
 import { getTransformPoolStats } from '../transform/index.js';
 import { applyInsufficientScopeAuthHeaders, applyUnauthorizedAuthHeaders, assertHttpModeConfiguration, authService, buildAuthFingerprint, buildProtectedResourceMetadataDocument, corsPolicy, ensureMcpProtocolVersion, hostOriginPolicy, isInsufficientScopeError, isOAuthMetadataEnabled, isProtectedResourceMetadataPath, SUPPORTED_MCP_PROTOCOL_VERSIONS, } from './auth.js';
+import { getHeaderValue, sendEmpty, sendError, sendJson, } from './helpers.js';
 import { RateLimiter } from './rate-limit.js';
+export { getHeaderValue, sendEmpty, sendError, sendJson, setNoStoreHeaders, } from './helpers.js';
 const DROP_LOG_INTERVAL_MS = 10_000;
 const MISSING_SESSION_ID_MESSAGE = "We couldn't find a session ID for your request. Please ensure you have an active session.";
 const SESSION_NOT_INITIALIZED_MESSAGE = "Your session hasn't been initialized yet. Please wait a moment and try again.";
@@ -79,39 +82,17 @@ function drainConnectionsOnShutdown(server) {
     }
 }
 // ---------------------------------------------------------------------------
-// Response helpers
-// ---------------------------------------------------------------------------
-function setNoStoreHeaders(res) {
-    res.setHeader('X-Content-Type-Options', 'nosniff');
-    res.setHeader('Cache-Control', 'no-store');
-}
-export function sendJson(res, status, body) {
-    res.statusCode = status;
-    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-    setNoStoreHeaders(res);
-    res.end(JSON.stringify(body));
-}
-export function sendEmpty(res, status) {
-    res.statusCode = status;
-    res.setHeader('Content-Length', '0');
-    res.end();
-}
-export function sendError(res, code, message, status = 400, id) {
-    sendJsonRpcError(res, status, code, message, id ?? null);
-}
-// ---------------------------------------------------------------------------
 // Request helpers
 // ---------------------------------------------------------------------------
-export function getHeaderValue(req, name) {
-    const val = req.headers[name];
-    if (!val)
-        return null;
-    return Array.isArray(val) ? (val[0] ?? null) : val;
-}
 export function getMcpSessionId(req) {
     return (getHeaderValue(req, 'mcp-session-id') ??
         getHeaderValue(req, 'x-mcp-session-id'));
 }
+function attachAuthInfoToRequest(req, auth) {
+    const requestWithAuth = req;
+    requestWithAuth.auth = auth;
+    return requestWithAuth;
+}
 const SINGLE_VALUE_HEADER_NAMES = [
     'authorization',
     'x-api-key',
@@ -197,9 +178,84 @@ function normalizeRemoteAddress(address) {
         return normalized.ip;
     return trimmed;
 }
+function trimMatchingQuotes(value) {
+    return value.length >= 2 &&
+        ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'")))
+        ? value.slice(1, -1)
+        : value;
+}
+function parseForwardedAddressToken(token) {
+    const trimmed = trimMatchingQuotes(token.trim());
+    if (!trimmed)
+        return null;
+    const lowered = trimmed.toLowerCase();
+    if (lowered === 'unknown' || lowered.startsWith('_'))
+        return null;
+    if (trimmed.startsWith('[')) {
+        const endBracket = trimmed.indexOf(']');
+        if (endBracket === -1)
+            return null;
+        return normalizeRemoteAddress(trimmed.slice(1, endBracket));
+    }
+    const socketAddress = SocketAddress.parse(trimmed);
+    if (socketAddress) {
+        return normalizeRemoteAddress(socketAddress.address);
+    }
+    const normalized = normalizeRemoteAddress(trimmed);
+    if (normalized)
+        return normalized;
+    const firstColon = trimmed.indexOf(':');
+    const lastColon = trimmed.lastIndexOf(':');
+    if (firstColon !== -1 && firstColon === lastColon) {
+        return normalizeRemoteAddress(trimmed.slice(0, firstColon));
+    }
+    return null;
+}
+function resolveXForwardedForIp(headerValue) {
+    for (const part of headerValue.split(',')) {
+        const resolved = parseForwardedAddressToken(part);
+        if (resolved)
+            return resolved;
+    }
+    return null;
+}
+function resolveForwardedHeaderIp(headerValue) {
+    for (const element of headerValue.split(',')) {
+        for (const part of element.split(';')) {
+            const separatorIndex = part.indexOf('=');
+            if (separatorIndex === -1)
+                continue;
+            const key = part.slice(0, separatorIndex).trim().toLowerCase();
+            if (key !== 'for')
+                continue;
+            const resolved = parseForwardedAddressToken(part.slice(separatorIndex + 1));
+            if (resolved)
+                return resolved;
+        }
+    }
+    return null;
+}
+export function resolveClientIp(req) {
+    if (config.server.http.trustProxy) {
+        const xForwardedFor = getHeaderValue(req, 'x-forwarded-for');
+        const forwardedForIp = xForwardedFor
+            ? resolveXForwardedForIp(xForwardedFor)
+            : null;
+        if (forwardedForIp)
+            return forwardedForIp;
+        const forwarded = getHeaderValue(req, 'forwarded');
+        const forwardedIp = forwarded ? resolveForwardedHeaderIp(forwarded) : null;
+        if (forwardedIp)
+            return forwardedIp;
+    }
+    return normalizeRemoteAddress(req.socket.remoteAddress);
+}
 export function registerInboundBlockList(server) {
-    if (!config.server.http.blockPrivateConnections)
+    if (!config.server.http.blockPrivateConnections ||
+        config.server.http.trustProxy) {
         return;
+    }
     const blockList = createDefaultBlockList();
     server.on('connection', (socket) => {
         const raw = socket.remoteAddress?.trim();
@@ -231,7 +287,7 @@ export function buildRequestContext(req, res, signal) {
         res,
         url,
         method: req.method,
-        ip: normalizeRemoteAddress(req.socket.remoteAddress),
+        ip: resolveClientIp(req),
         body: undefined,
         ...(signal ? { signal } : {}),
     };
@@ -255,41 +311,6 @@ export async function closeMcpServerBestEffort(server, context) {
         logWarn('MCP server close failed', { context, error }, Loggers.LOG_HTTP);
     }
 }
-export function createTransportAdapter(transportImpl) {
-    const noopOnClose = () => { };
-    const noopOnError = () => { };
-    const noopOnMessage = () => { };
-    const baseOnClose = transportImpl.onclose;
-    let oncloseHandler = noopOnClose;
-    let onerrorHandler = noopOnError;
-    let onmessageHandler = noopOnMessage;
-    return {
-        start: () => transportImpl.start(),
-        send: (message, options) => transportImpl.send(message, options),
-        close: () => transportImpl.close(),
-        get onclose() {
-            return oncloseHandler;
-        },
-        set onclose(handler) {
-            oncloseHandler = handler;
-            transportImpl.onclose = composeCloseHandlers(baseOnClose, handler);
-        },
-        get onerror() {
-            return onerrorHandler;
-        },
-        set onerror(handler) {
-            onerrorHandler = handler;
-            transportImpl.onerror = handler;
-        },
-        get onmessage() {
-            return onmessageHandler;
-        },
-        set onmessage(handler) {
-            onmessageHandler = handler;
-            transportImpl.onmessage = handler;
-        },
-    };
-}
 export class JsonBodyError extends Error {
     kind;
     constructor(kind, message) {
@@ -744,7 +765,7 @@ class McpSessionGateway {
         const transport = await this.getOrCreateTransport(ctx, requestId);
         if (!transport)
             return;
-        await transport.handleRequest(ctx.req, ctx.res, body);
+        await transport.handleRequest(attachAuthInfoToRequest(ctx.req, ctx.auth), ctx.res, body);
     }
     async handleGet(ctx) {
         const sessionState = this.getRequiredAuthenticatedSession(ctx, null, {
@@ -763,12 +784,12 @@ class McpSessionGateway {
                 status: 406,
                 sessionId,
             });
-            sendError(ctx.res, ErrorCode.InvalidRequest, 'We need you to use "text/event-stream" for this connection.', 406);
+            sendError(ctx.res, ProtocolErrorCode.InvalidRequest, 'We need you to use "text/event-stream" for this connection.', 406);
             return;
         }
         logDebug('MCP GET received', { sessionId }, Loggers.LOG_HTTP);
         this.store.touch(sessionId);
-        await session.transport.handleRequest(ctx.req, ctx.res);
+        await session.transport.handleRequest(attachAuthInfoToRequest(ctx.req, ctx.auth), ctx.res);
     }
     async handleDelete(ctx) {
         const sessionState = this.getRequiredAuthenticatedSession(ctx, null, {
@@ -791,14 +812,47 @@ class McpSessionGateway {
                 reason: 'accept_missing_json_or_event_stream',
                 status: 406,
             });
-            sendError(ctx.res, ErrorCode.InvalidRequest, 'We need the request to accept both "application/json" and "text/event-stream".', 406);
+            sendError(ctx.res, ProtocolErrorCode.InvalidRequest, 'We need the request to accept both "application/json" and "text/event-stream".', 406);
             return null;
         }
         const { body } = ctx;
-        if (isObject(body) && !Array.isArray(body)) {
+        if (body === undefined) {
+            logGatewayRejection({
+                message: 'Rejected MCP POST request',
+                method: ctx.method,
+                path: ctx.url.pathname,
+                reason: 'missing_json_body',
+                status: 400,
+                mcpCode: -32600,
+            });
+            sendError(ctx.res, ProtocolErrorCode.InvalidRequest, 'We need a valid JSON object in the request body for MCP POST requests.', 400);
+            return null;
+        }
+        if (isJsonRpcBatchRequest(body)) {
+            logGatewayRejection({
+                message: 'Rejected MCP POST request',
+                method: ctx.method,
+                path: ctx.url.pathname,
+                reason: 'jsonrpc_batch_unsupported',
+                status: 400,
+                mcpCode: -32600,
+            });
+            sendError(ctx.res, ProtocolErrorCode.InvalidRequest, 'JSON-RPC batch requests are not supported on this endpoint.', 400);
+            return null;
+        }
+        if (isObject(body)) {
             return body;
         }
-        return { id: undefined, method: undefined };
+        logGatewayRejection({
+            message: 'Rejected MCP POST request',
+            method: ctx.method,
+            path: ctx.url.pathname,
+            reason: 'invalid_json_body',
+            status: 400,
+            mcpCode: -32600,
+        });
+        sendError(ctx.res, ProtocolErrorCode.InvalidRequest, 'We need a valid JSON object in the request body for MCP POST requests.', 400);
+        return null;
     }
     resolvePostRequestState(ctx, body) {
         const requestId = body.id ?? null;
@@ -1060,8 +1114,9 @@ class McpSessionGateway {
             tracker.releaseSlot();
         };
         try {
-            const transport = createTransportAdapter(transportImpl);
-            await sessionServer.connect(transport);
+            const preConnectOnClose = transportImpl.onclose;
+            await sessionServer.connect(transportImpl);
+            transportImpl.onclose = composeCloseHandlers(preConnectOnClose, transportImpl.onclose);
         }
         catch (err) {
             logWarn('Session transport connect failed', {
@@ -1107,7 +1162,7 @@ class McpSessionGateway {
             tracker.releaseSlot();
             throw error;
         }
-        const transportImpl = new StreamableHTTPServerTransport({
+        const transportImpl = new NodeStreamableHTTPServerTransport({
             sessionIdGenerator: () => newSessionId,
         });
         const unpublishedSession = {
@@ -1345,22 +1400,22 @@ class HttpRequestPipeline {
         const { signal, cleanup } = createRequestAbortSignal(rawReq);
         const path = resolveRequestPath(rawReq);
         const startTime = performance.now();
-        rawRes.once('finish', () => {
-            logRequestCompletion({
-                path,
-                statusCode: rawRes.statusCode,
-                durationMs: performance.now() - startTime,
-                requestId,
-                ...(rawReq.method ? { method: rawReq.method } : {}),
-                ...(sessionId ? { sessionId } : {}),
-            });
-        });
         try {
             await runWithRequestContext({
                 requestId,
                 operationId: requestId,
                 ...(sessionId ? { sessionId } : {}),
             }, async () => {
+                rawRes.once('finish', () => {
+                    logRequestCompletion({
+                        path,
+                        statusCode: rawRes.statusCode,
+                        durationMs: performance.now() - startTime,
+                        requestId,
+                        ...(rawReq.method ? { method: rawReq.method } : {}),
+                        ...(sessionId ? { sessionId } : {}),
+                    });
+                });
                 if (this.rejectDuplicateHeaders(rawReq, rawRes))
                     return;
                 const ctx = this.buildContext(rawReq, rawRes, signal);

package/dist/http/rate-limit.d.ts

@@ -1,4 +1,4 @@
-import type { RequestContext } from './native.js';
+import { type RequestContext } from './helpers.js';
 interface RateLimitConfig {
     maxRequests: number;
     windowMs: number;

package/dist/http/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/http/rate-limit.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAYlD,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAcD,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAEpB,OAAO,EAAE,eAAe;IAIrD,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,WAAW;IAQnB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;IAyCnC,IAAI,IAAI,IAAI;CAGb"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/http/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,cAAc,EAAY,MAAM,cAAc,CAAC;AAY7D,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAMD,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAEpB,OAAO,EAAE,eAAe;IAIrD,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,WAAW;IAQnB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;IAyCnC,IAAI,IAAI,IAAI;CAGb"}

package/dist/http/rate-limit.js

@@ -1,15 +1,9 @@
-import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+import { ProtocolErrorCode } from '@modelcontextprotocol/server';
 import { Loggers, logWarn } from '../lib/core.js';
 import { isAbortError } from '../lib/error/index.js';
 import { sendJsonRpcError } from '../lib/mcp-interop.js';
 import { startAbortableIntervalLoop } from '../lib/utils.js';
-function sendJson(res, status, body) {
-    res.statusCode = status;
-    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-    res.setHeader('X-Content-Type-Options', 'nosniff');
-    res.setHeader('Cache-Control', 'no-store');
-    res.end(JSON.stringify(body));
-}
+import { sendJson } from './helpers.js';
 function isMcpEndpoint(pathname) {
     return pathname === '/mcp' || pathname === '/mcp/';
 }
@@ -83,7 +77,7 @@ export class RateLimiter {
             const retryAfter = Math.max(1, Math.ceil((entry.resetTime - now) / 1000));
             ctx.res.setHeader('Retry-After', String(retryAfter));
             if (isMcpEndpoint(ctx.url.pathname)) {
-                sendJsonRpcError(ctx.res, 429, ErrorCode.InvalidRequest, 'Rate limit exceeded', null, { retryAfter });
+                sendJsonRpcError(ctx.res, 429, ProtocolErrorCode.InvalidRequest, 'Rate limit exceeded', null, { retryAfter });
             }
             else {
                 sendJson(ctx.res, 429, { error: 'Rate limit exceeded', retryAfter });

package/dist/lib/config.d.ts

@@ -40,6 +40,7 @@ interface AppServerHttpConfig {
     keepAliveTimeoutBufferMs: number | undefined;
     maxHeadersCount: number | undefined;
     maxConnections: number;
+    trustProxy: boolean;
     blockPrivateConnections: boolean;
     shutdownCloseIdleConnections: boolean;
     shutdownCloseAllConnections: boolean;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AA4CA,eAAO,MAAM,aAAa,EAAE,MAA2C,CAAC;AAIxE,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,CAAC;AAkCf,KAAK,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AACjD,KAAK,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAqQnC,UAAU,oBAAoB;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyCD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC;IAC3B,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,GAAG,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC;IAC/B,eAAe,EAAE,GAAG,GAAG,SAAS,CAAC;IACjC,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC;IAC/B,WAAW,EAAE,GAAG,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAuGD,UAAU,YAAY;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAQD,UAAU,mBAAmB;IAC3B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,OAAO,CAAC;IACjC,4BAA4B,EAAE,OAAO,CAAC;IACtC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAuCD,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAWD,UAAU,kBAAkB;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,mBAAmB,CAAC;IAChC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACxD;AAkBD,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAmBD,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AA2BD,UAAU,wBAAwB;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAiBD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8ClB,CAAC;AAEF,wBAAgB,cAAc,IAAI,IAAI,CAErC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AA4CA,eAAO,MAAM,aAAa,EAAE,MAA2C,CAAC;AAIxE,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,CAAC;AAkCf,KAAK,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AACjD,KAAK,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAqQnC,UAAU,oBAAoB;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyCD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC;IAC3B,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,GAAG,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC;IAC/B,eAAe,EAAE,GAAG,GAAG,SAAS,CAAC;IACjC,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC;IAC/B,WAAW,EAAE,GAAG,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAuGD,UAAU,YAAY;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAQD,UAAU,mBAAmB;IAC3B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,4BAA4B,EAAE,OAAO,CAAC;IACtC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AA4CD,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAWD,UAAU,kBAAkB;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,mBAAmB,CAAC;IAChC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACxD;AAkBD,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAmBD,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AA2BD,UAAU,wBAAwB;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAiBD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8ClB,CAAC;AAEF,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/lib/config.js

@@ -390,6 +390,7 @@ function buildServerConfig() {
                 min: 0,
                 envName: 'SERVER_MAX_CONNECTIONS',
             }),
+            trustProxy: EnvParser.boolean(env['SERVER_TRUST_PROXY'], false, 'SERVER_TRUST_PROXY'),
             blockPrivateConnections: EnvParser.boolean(env['SERVER_BLOCK_PRIVATE_CONNECTIONS'], false, 'SERVER_BLOCK_PRIVATE_CONNECTIONS'),
             shutdownCloseIdleConnections: true,
             shutdownCloseAllConnections: false,

package/dist/lib/core.d.ts

@@ -1,5 +1,5 @@
-import { type McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import type { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { type McpServer } from '@modelcontextprotocol/server';
 type LogMetadata = Record<string, unknown>;
 export interface TraceContext {
     readonly traceparent?: string;
@@ -21,6 +21,7 @@ export declare function unregisterMcpSessionServer(sessionId: string): void;
 export declare function unregisterMcpSessionServerByServer(server: McpServer): void;
 export declare function resolveMcpSessionOwnerKey(sessionId: string): string | undefined;
 export declare function resolveMcpSessionIdByServer(server: McpServer): string | undefined;
+export declare function resolveMcpSessionServer(sessionId: string): McpServer | undefined;
 export declare function runWithRequestContext<T>(context: RequestContext, fn: () => T): T;
 export declare function extractTraceContext(meta: unknown): TraceContext | undefined;
 export declare function runWithTraceContext<T>(meta: unknown, fn: () => T): T;
@@ -56,7 +57,7 @@ export declare const Loggers: {
 };
 export interface SessionEntry {
     readonly server: McpServer;
-    readonly transport: StreamableHTTPServerTransport;
+    readonly transport: NodeStreamableHTTPServerTransport;
     createdAt: number;
     lastSeen: number;
     protocolInitialized: boolean;

package/dist/lib/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/lib/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAoCxG,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,UAAU,cAAc;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA4CD,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAKpD;AACD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,GAChB,IAAI,CAGN;AACD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,IAAI,CAGN;AACD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAGlE;AACD,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAK1E;AACD,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAEpB;AACD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,SAAS,GAChB,MAAM,GAAG,SAAS,CAEpB;AACD,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAuB3E;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAcpE;AAKD,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAGjD;AACD,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AACD,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAEnD;AACD,wBAAgB,eAAe,IAAI,YAAY,GAAG,SAAS,CAY1D;AAmfD,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AACD,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AACD,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AACD,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAcD,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,KAAK,GAAG,WAAW,EAC3B,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAIN;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAUnE;AACD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQhD;AA8KD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,YAAY,EACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;IACR,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GACA,eAAe,CAQjB;AACD;;GAEG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;CAWV,CAAC;AAMX,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,CAAC;IACrD,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,CAAC;IACxD,IAAI,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,YAAY,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;IAC1D,WAAW,EAAE,MAAM,YAAY,GAAG,SAAS,CAAC;CAC7C;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;CACvC;AAMD,KAAK,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;AAE7C,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,YAAY,GACnB,YAAY,CAWd;AA0FD,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,CAGrE;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,CAiBlE;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAMT;AAED,wBAAgB,qBAAqB,CAAC,EACpC,KAAK,EACL,WAAW,EACX,WAAW,GACZ,EAAE;IACD,KAAK,EAAE,YAAY,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;CAC/C,GAAG,OAAO,CAUV"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/lib/core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAoC9D,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,UAAU,cAAc;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA4CD,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAKpD;AACD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,SAAS,GAChB,IAAI,CAGN;AACD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,IAAI,CAGN;AACD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAGlE;AACD,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAK1E;AACD,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAEpB;AACD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,SAAS,GAChB,MAAM,GAAG,SAAS,CAEpB;AACD,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,GAChB,SAAS,GAAG,SAAS,CAEvB;AACD,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAuB3E;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAcpE;AAKD,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAGjD;AACD,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AACD,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAEnD;AACD,wBAAgB,eAAe,IAAI,YAAY,GAAG,SAAS,CAY1D;AAmfD,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AACD,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AACD,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AACD,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAEN;AAcD,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,KAAK,GAAG,WAAW,EAC3B,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAIN;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAUnE;AACD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQhD;AA8KD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,YAAY,EACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;IACR,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GACA,eAAe,CAQjB;AACD;;GAEG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;CAWV,CAAC;AAMX,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,iCAAiC,CAAC;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,CAAC;IACrD,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,CAAC;IACxD,IAAI,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,YAAY,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;IAC1D,WAAW,EAAE,MAAM,YAAY,GAAG,SAAS,CAAC;CAC7C;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;CACvC;AAMD,KAAK,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;AAE7C,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,YAAY,GACnB,YAAY,CAWd;AA0FD,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,CAGrE;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,CAiBlE;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAMT;AAED,wBAAgB,qBAAqB,CAAC,EACpC,KAAK,EACL,WAAW,EACX,WAAW,GACZ,EAAE;IACD,KAAK,EAAE,YAAY,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;CAC/C,GAAG,OAAO,CAUV"}

package/dist/lib/core.js

@@ -1,4 +1,4 @@
-import {} from '@modelcontextprotocol/sdk/server/mcp.js';
+import {} from '@modelcontextprotocol/server';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
 import process from 'node:process';
@@ -80,6 +80,9 @@ export function resolveMcpSessionOwnerKey(sessionId) {
 export function resolveMcpSessionIdByServer(server) {
     return findSessionIdByServer(server);
 }
+export function resolveMcpSessionServer(sessionId) {
+    return sessionServers.get(sessionId);
+}
 export function runWithRequestContext(context, fn) {
     return requestContext.run(context, fn);
 }

package/dist/lib/error/classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../../src/lib/error/classify.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AA+JtB,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,EACX,eAAe,SAAqB,GACnC,iBAAiB,CAInB;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,iBAAiB,CAuCnB"}
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../../src/lib/error/classify.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAsLtB,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,EACX,eAAe,SAAqB,GACnC,iBAAiB,CAInB;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,iBAAiB,CAuCnB"}

package/dist/lib/error/classify.js

@@ -1,8 +1,8 @@
-import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import { ProtocolError, ProtocolErrorCode, SdkError, SdkErrorCode, } from '@modelcontextprotocol/server';
 import { logError, logWarn } from '../core.js';
 import { FetchError, isAbortError, isSystemError } from './classes.js';
 import { ErrorCategory, SystemErrors } from './codes.js';
-import { createToolErrorResponse, sanitizeToolErrorDetails, stripMcpErrorPrefix, } from './payload.js';
+import { createToolErrorResponse, sanitizeToolErrorDetails, stripProtocolErrorPrefix, } from './payload.js';
 function toToolErrorResponse(payload) {
     return createToolErrorResponse(payload.error, payload.url, payload);
 }
@@ -111,7 +111,7 @@ function mapGenericToolError(error, url, fallbackMessage) {
 }
 function mapMcpToolError(error, url) {
     return {
-        error: stripMcpErrorPrefix(error.message),
+        error: stripProtocolErrorPrefix(error.message),
         url,
         category: ErrorCategory.MCP_ERROR,
         code: error.code,
@@ -119,21 +119,42 @@ function mapMcpToolError(error, url) {
         ...(error.data !== undefined ? { data: error.data } : {}),
     };
 }
+function resolveSdkErrorCategory(code) {
+    switch (code) {
+        case SdkErrorCode.ConnectionClosed:
+            return ErrorCategory.UPSTREAM_ABORTED;
+        case SdkErrorCode.RequestTimeout:
+            return ErrorCategory.UPSTREAM_TIMEOUT;
+        case SdkErrorCode.SendFailed:
+            return ErrorCategory.FETCH_ERROR;
+        default:
+            return ErrorCategory.MCP_ERROR;
+    }
+}
 function resolveToolErrorPayload(error, url, fallbackMessage) {
     if (error instanceof FetchError) {
         return mapFetchToolError(error, url);
     }
-    if (error instanceof McpError) {
+    if (error instanceof ProtocolError) {
         return mapMcpToolError(error, url);
     }
+    if (error instanceof SdkError) {
+        return {
+            error: error.message,
+            url,
+            category: resolveSdkErrorCategory(error.code),
+            code: error.code,
+            ...(error.data !== undefined ? { data: error.data } : {}),
+        };
+    }
     return mapGenericToolError(error, url, fallbackMessage);
 }
 export function handleToolError(error, url, fallbackMessage = 'Operation failed') {
     return toToolErrorResponse(resolveToolErrorPayload(error, url, fallbackMessage));
 }
 export function classifyAndLogToolError(error, meta, loggerName, toolName, fallbackMessage) {
-    if (error instanceof McpError) {
-        if (error.code === ErrorCode.MethodNotFound) {
+    if (error instanceof ProtocolError) {
+        if (error.code === ProtocolErrorCode.MethodNotFound) {
             logError(`${toolName} tool protocol error`, { url: meta.url, durationMs: meta.durationMs, error }, loggerName);
             throw error;
         }

package/dist/lib/error/payload.d.ts

@@ -1,4 +1,4 @@
-import { type CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { type CallToolResult } from '@modelcontextprotocol/server';
 export type ToolErrorResponse = CallToolResult & {
     isError: true;
 };
@@ -29,5 +29,5 @@ export declare function createToolErrorResponse(message: string, url: string, ex
 export declare function createToolErrorPayload(message: string, url: string, extra?: ToolErrorExtra): ToolErrorPayload;
 export declare function tryReadToolErrorPayload(value: unknown): ToolErrorPayload | undefined;
 export declare function tryReadToolErrorMessage(value: unknown): string | undefined;
-export declare function stripMcpErrorPrefix(message: string): string;
+export declare function stripProtocolErrorPrefix(message: string): string;
 //# sourceMappingURL=payload.d.ts.map

package/dist/lib/error/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/lib/error/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAOzE,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG;IAC/C,OAAO,EAAE,IAAI,CAAC;CACf,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAmBD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAqBrC;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,cAAc,GACrB,iBAAiB,CAOnB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,cAAc,GACrB,gBAAgB,CAgBlB;AAiBD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,GACb,gBAAgB,GAAG,SAAS,CA2B9B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE1E;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/lib/error/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOnE,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG;IAC/C,OAAO,EAAE,IAAI,CAAC;CACf,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAmBD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAqBrC;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,cAAc,GACrB,iBAAiB,CAOnB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,cAAc,GACrB,gBAAgB,CAgBlB;AAiBD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,GACb,gBAAgB,GAAG,SAAS,CA2B9B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE1E;AAID,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhE"}

package/dist/lib/error/payload.js

@@ -1,4 +1,4 @@
-import {} from '@modelcontextprotocol/sdk/types.js';
+import {} from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { isObject } from '../utils.js';
 import { SystemErrors } from './codes.js';
@@ -103,6 +103,6 @@ export function tryReadToolErrorMessage(value) {
     return tryReadToolErrorPayload(value)?.error;
 }
 const mcpErrorPrefixPattern = /^MCP error -?\d+:\s*/;
-export function stripMcpErrorPrefix(message) {
+export function stripProtocolErrorPrefix(message) {
     return message.replace(mcpErrorPrefixPattern, '');
 }