@j0hanz/fetch-url-mcp 1.12.8 → 1.12.10

package/dist/http/native.js

@@ -1,5 +1,5 @@
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { ErrorCode, isInitializeRequest, } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'node:crypto';
 import { once } from 'node:events';
 import { readFileSync } from 'node:fs';
@@ -10,16 +10,21 @@ import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
 import process from 'node:process';
 import { Writable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import { composeCloseHandlers, config, createSessionStore, createSlotTracker, enableHttpMode, ensureSessionCapacity, logDebug, logError, Loggers, logInfo, logWarn, registerMcpSessionOwnerKey, registerMcpSessionServer, reserveSessionSlot, resolveMcpSessionIdByServer, runWithRequestContext, serverVersion, startSessionCleanupLoop, unregisterMcpSessionServer, unregisterMcpSessionServerByServer, } from '../lib/core.js';
+import { config, enableHttpMode, serverVersion } from '../lib/config.js';
+import { composeCloseHandlers, createSessionStore, createSlotTracker, ensureSessionCapacity, logDebug, logError, Loggers, logInfo, logWarn, registerMcpSessionOwnerKey, registerMcpSessionServer, reserveSessionSlot, resolveMcpSessionIdByServer, runWithRequestContext, runWithTraceContext, startSessionCleanupLoop, unregisterMcpSessionServer, unregisterMcpSessionServerByServer, } from '../lib/core.js';
 import { getErrorMessage, toError } from '../lib/error/index.js';
-import { acceptsEventStream, acceptsJsonAndEventStream, isMcpRequestBody, } from '../lib/mcp-interop.js';
+import { acceptsEventStream, acceptsJsonAndEventStream, isMcpRequestBody, sendJsonRpcError, } from '../lib/mcp-interop.js';
 import { createDefaultBlockList, normalizeIpForBlockList, } from '../lib/net/index.js';
-import { applyHttpServerTuning, drainConnectionsOnShutdown, isObject, } from '../lib/utils.js';
+import { isObject } from '../lib/utils.js';
 import { createMcpServerForHttpSession } from '../server.js';
 import { buildAuthenticatedOwnerKey } from '../tasks/index.js';
 import { getTransformPoolStats } from '../transform/index.js';
-import { applyInsufficientScopeAuthHeaders, applyUnauthorizedAuthHeaders, assertHttpModeConfiguration, authService, buildAuthFingerprint, buildProtectedResourceMetadataDocument, corsPolicy, DEFAULT_MCP_PROTOCOL_VERSION, ensureMcpProtocolVersion, hostOriginPolicy, isInsufficientScopeError, isOAuthMetadataEnabled, isProtectedResourceMetadataPath, SUPPORTED_MCP_PROTOCOL_VERSIONS, } from './auth.js';
-import { createRateLimitManagerImpl, } from './rate-limit.js';
+import { applyInsufficientScopeAuthHeaders, applyUnauthorizedAuthHeaders, assertHttpModeConfiguration, authService, buildAuthFingerprint, buildProtectedResourceMetadataDocument, corsPolicy, ensureMcpProtocolVersion, hostOriginPolicy, isInsufficientScopeError, isOAuthMetadataEnabled, isProtectedResourceMetadataPath, SUPPORTED_MCP_PROTOCOL_VERSIONS, } from './auth.js';
+import { RateLimiter } from './rate-limit.js';
+const DROP_LOG_INTERVAL_MS = 10_000;
+const MISSING_SESSION_ID_MESSAGE = "We couldn't find a session ID for your request. Please ensure you have an active session.";
+const SESSION_NOT_INITIALIZED_MESSAGE = "Your session hasn't been initialized yet. Please wait a moment and try again.";
+const SESSION_NOT_FOUND_MESSAGE = "We couldn't find your session. It might have expired or been closed.";
 function abortControllerBestEffort(controller) {
     if (!controller.signal.aborted)
         controller.abort();
@@ -32,6 +37,47 @@ function destroyRequestBestEffort(req) {
         // Best-effort only.
     }
 }
+function applyHttpServerTuning(server) {
+    const { headersTimeoutMs, requestTimeoutMs, keepAliveTimeoutMs, keepAliveTimeoutBufferMs, maxHeadersCount, maxConnections, } = config.server.http;
+    if (headersTimeoutMs !== undefined)
+        server.headersTimeout = headersTimeoutMs;
+    if (requestTimeoutMs !== undefined)
+        server.requestTimeout = requestTimeoutMs;
+    if (keepAliveTimeoutMs !== undefined)
+        server.keepAliveTimeout = keepAliveTimeoutMs;
+    if (keepAliveTimeoutBufferMs !== undefined)
+        server.keepAliveTimeoutBuffer = keepAliveTimeoutBufferMs;
+    if (maxHeadersCount !== undefined)
+        server.maxHeadersCount = maxHeadersCount;
+    if (typeof maxConnections === 'number' && maxConnections > 0) {
+        server.maxConnections = maxConnections;
+        server.dropMaxConnection = true;
+        if (typeof server.on === 'function') {
+            let lastLoggedAt = 0;
+            let droppedSinceLastLog = 0;
+            const onDrop = (data) => {
+                droppedSinceLastLog += 1;
+                const now = Date.now();
+                if (now - lastLoggedAt < DROP_LOG_INTERVAL_MS)
+                    return;
+                logWarn('Incoming connection dropped (maxConnections reached)', {
+                    maxConnections,
+                    dropped: droppedSinceLastLog,
+                    data,
+                }, Loggers.LOG_HTTP);
+                lastLoggedAt = now;
+                droppedSinceLastLog = 0;
+            };
+            server.on('drop', onDrop);
+        }
+    }
+}
+function drainConnectionsOnShutdown(server) {
+    if (typeof server.closeIdleConnections === 'function') {
+        server.closeIdleConnections();
+        logDebug('Closed idle HTTP connections during shutdown', undefined, Loggers.LOG_HTTP);
+    }
+}
 // ---------------------------------------------------------------------------
 // Response helpers
 // ---------------------------------------------------------------------------
@@ -50,10 +96,8 @@ export function sendEmpty(res, status) {
     res.setHeader('Content-Length', '0');
     res.end();
 }
-export function sendError(res, _code, message, status = 400, 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars -- kept for call-site compat
-_id) {
-    sendJson(res, status, { error: message });
+export function sendError(res, code, message, status = 400, id) {
+    sendJsonRpcError(res, status, code, message, id ?? null);
 }
 // ---------------------------------------------------------------------------
 // Request helpers
@@ -262,18 +306,20 @@ function isRequestReadAborted(req) {
     return req.destroyed && !req.complete;
 }
 class JsonBodyReader {
+    validateContentLength(req, limit) {
+        const contentLengthHeader = getHeaderValue(req, 'content-length');
+        if (!contentLengthHeader)
+            return;
+        const contentLength = Number.parseInt(contentLengthHeader, 10);
+        if (Number.isFinite(contentLength) && contentLength > limit) {
+            throw new JsonBodyError('payload-too-large', 'Payload too large');
+        }
+    }
     async read(req, limit = DEFAULT_BODY_LIMIT_BYTES, signal) {
         const contentType = getHeaderValue(req, 'content-type');
         if (!contentType?.includes('application/json'))
             return undefined;
-        const contentLengthHeader = getHeaderValue(req, 'content-length');
-        if (contentLengthHeader) {
-            const contentLength = Number.parseInt(contentLengthHeader, 10);
-            if (Number.isFinite(contentLength) && contentLength > limit) {
-                const error = new JsonBodyError('payload-too-large', 'Payload too large');
-                throw error;
-            }
-        }
+        this.validateContentLength(req, limit);
         if (signal?.aborted || isRequestReadAborted(req)) {
             const error = new JsonBodyError('read-failed', 'Request aborted');
             throw error;
@@ -285,24 +331,35 @@ class JsonBodyReader {
             return JSON.parse(body);
         }
         catch (err) {
-            const error = new JsonBodyError('invalid-json', getErrorMessage(err));
-            throw error;
+            throw new JsonBodyError('invalid-json', getErrorMessage(err));
         }
     }
-    async readBody(req, limit, signal) {
-        const abortListener = signal != null
-            ? () => {
-                destroyRequestBestEffort(req);
-            }
-            : null;
-        if (signal != null && abortListener) {
-            if (signal.aborted) {
-                abortListener();
-            }
-            else {
-                signal.addEventListener('abort', abortListener, { once: true });
-            }
+    setupAbortListener(req, signal) {
+        if (signal == null)
+            return null;
+        const listener = () => {
+            destroyRequestBestEffort(req);
+        };
+        if (signal.aborted) {
+            listener();
         }
+        else {
+            signal.addEventListener('abort', listener, { once: true });
+        }
+        return listener;
+    }
+    cleanupAbortListener(signal, listener) {
+        if (!signal || !listener)
+            return;
+        try {
+            signal.removeEventListener('abort', listener);
+        }
+        catch {
+            // Best-effort cleanup.
+        }
+    }
+    async readBody(req, limit, signal) {
+        const abortListener = this.setupAbortListener(req, signal);
         try {
             const { chunks, size } = await this.collectChunks(req, limit, signal);
             if (chunks.length === 0)
@@ -317,14 +374,7 @@ class JsonBodyReader {
             return text;
         }
         finally {
-            if (signal && abortListener) {
-                try {
-                    signal.removeEventListener('abort', abortListener);
-                }
-                catch {
-                    // Best-effort cleanup.
-                }
-            }
+            this.cleanupAbortListener(signal, abortListener);
         }
     }
     async collectChunks(req, limit, signal) {
@@ -386,7 +436,7 @@ function unregisterSessionTaskScope(server) {
     unregisterMcpSessionServer(sessionId);
     return sessionId;
 }
-async function closeSessionResources(session, options) {
+function buildCloseTasks(session, options) {
     const closeTasks = [];
     if (options.closeTransportReason) {
         closeTasks.push(closeTransportBestEffort(session.transport, options.closeTransportReason));
@@ -394,6 +444,10 @@ async function closeSessionResources(session, options) {
     if (options.closeServerReason) {
         closeTasks.push(closeMcpServerBestEffort(session.server, options.closeServerReason));
     }
+    return closeTasks;
+}
+async function closeSessionResources(session, options) {
+    const closeTasks = buildCloseTasks(session, options);
     if (options.awaitClose && closeTasks.length > 0) {
         await Promise.all(closeTasks);
     }
@@ -564,19 +618,15 @@ export function sendHealthRouteResponse(store, ctx, authPresent) {
 }
 function resolveRequestedProtocolVersion(body) {
     if (!isObject(body))
-        return DEFAULT_MCP_PROTOCOL_VERSION;
+        return '';
     const { params } = body;
     if (!isObject(params))
-        return DEFAULT_MCP_PROTOCOL_VERSION;
+        return '';
     const { protocolVersion: value } = params;
     if (typeof value !== 'string')
-        return DEFAULT_MCP_PROTOCOL_VERSION;
+        return '';
     const normalized = value.trim();
-    if (normalized.length === 0)
-        return DEFAULT_MCP_PROTOCOL_VERSION;
-    return SUPPORTED_MCP_PROTOCOL_VERSIONS.has(normalized)
-        ? normalized
-        : DEFAULT_MCP_PROTOCOL_VERSION;
+    return normalized;
 }
 function resolveProtocolVersionHeader(req) {
     const header = getHeaderValue(req, 'mcp-protocol-version');
@@ -588,6 +638,15 @@ function resolveProtocolVersionHeader(req) {
 function isInitializedNotification(method) {
     return method === 'notifications/initialized';
 }
+function getBodyMeta(body) {
+    if (!isObject(body))
+        return undefined;
+    const { params } = body;
+    if (!isObject(params))
+        return undefined;
+    const meta = params['_meta'];
+    return isObject(meta) ? meta : undefined;
+}
 function isPingRequest(method) {
     return method === 'ping';
 }
@@ -704,9 +763,7 @@ class McpSessionGateway {
                 status: 406,
                 sessionId,
             });
-            sendJson(ctx.res, 406, {
-                error: 'We need you to use "text/event-stream" for this connection.',
-            });
+            sendError(ctx.res, ErrorCode.InvalidRequest, 'We need you to use "text/event-stream" for this connection.', 406);
             return;
         }
         logDebug('MCP GET received', { sessionId }, Loggers.LOG_HTTP);
@@ -734,9 +791,7 @@ class McpSessionGateway {
                 reason: 'accept_missing_json_or_event_stream',
                 status: 406,
             });
-            sendJson(ctx.res, 406, {
-                error: 'We need the request to accept both "application/json" and "text/event-stream".',
-            });
+            sendError(ctx.res, ErrorCode.InvalidRequest, 'We need the request to accept both "application/json" and "text/event-stream".', 406);
             return null;
         }
         const { body } = ctx;
@@ -800,7 +855,7 @@ class McpSessionGateway {
                     mcpCode: -32600,
                     rpcId: requestId,
                 });
-                sendError(ctx.res, -32600, "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
+                sendError(ctx.res, -32600, MISSING_SESSION_ID_MESSAGE, 400, requestId);
                 return false;
             }
             return true;
@@ -823,7 +878,7 @@ class McpSessionGateway {
             sessionId,
             rpcId: requestId,
         });
-        sendError(ctx.res, -32600, "Your session hasn't been initialized yet. Please wait a moment and try again.", 400, requestId);
+        sendError(ctx.res, -32600, SESSION_NOT_INITIALIZED_MESSAGE, 400, requestId);
         return false;
     }
     async getOrCreateTransport(ctx, requestId) {
@@ -837,40 +892,39 @@ class McpSessionGateway {
             return null;
         return this.createNewSession(ctx, requestId, negotiatedProtocolVersion);
     }
+    rejectInitializeRequest(ctx, requestId, reason, mcpCode, message) {
+        logGatewayRejection({
+            message: 'Rejected MCP initialize request',
+            method: ctx.method,
+            path: ctx.url.pathname,
+            reason,
+            status: 400,
+            mcpCode,
+            rpcId: requestId,
+        });
+        sendError(ctx.res, mcpCode, message, 400, requestId);
+        return null;
+    }
     getInitializeProtocolVersion(ctx, requestId) {
         if (!isMcpRequestBody(ctx.body)) {
-            logGatewayRejection({
-                message: 'Rejected MCP initialize request',
-                method: ctx.method,
-                path: ctx.url.pathname,
-                reason: 'missing_session_id',
-                status: 400,
-                mcpCode: -32600,
-                rpcId: requestId,
-            });
-            sendError(ctx.res, -32600, "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
-            return null;
+            return this.rejectInitializeRequest(ctx, requestId, 'missing_session_id', -32600, MISSING_SESSION_ID_MESSAGE);
         }
         if (!isInitializeRequest(ctx.body)) {
             const invalidInitialize = ctx.body.method === 'initialize';
-            logGatewayRejection({
-                message: 'Rejected MCP initialize request',
-                method: ctx.method,
-                path: ctx.url.pathname,
-                reason: invalidInitialize
-                    ? 'invalid_initialize_request'
-                    : 'missing_session_id',
-                status: 400,
-                mcpCode: invalidInitialize ? -32602 : -32600,
-                rpcId: requestId,
-            });
-            sendError(ctx.res, invalidInitialize ? -32602 : -32600, invalidInitialize
+            return this.rejectInitializeRequest(ctx, requestId, invalidInitialize ? 'invalid_initialize_request' : 'missing_session_id', invalidInitialize ? -32602 : -32600, invalidInitialize
                 ? 'The initialize request format is invalid. Please double-check your parameters.'
-                : "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
-            return null;
+                : MISSING_SESSION_ID_MESSAGE);
         }
         const negotiatedProtocolVersion = resolveRequestedProtocolVersion(ctx.body);
+        if (negotiatedProtocolVersion.length === 0 ||
+            !SUPPORTED_MCP_PROTOCOL_VERSIONS.has(negotiatedProtocolVersion)) {
+            return this.rejectInitializeRequest(ctx, requestId, 'unsupported_protocol_version', -32600, `The protocol version '${negotiatedProtocolVersion || '(missing)'}' isn't supported right now. Please check and try again.`);
+        }
         const headerProtocolVersion = resolveProtocolVersionHeader(ctx.req);
+        if (headerProtocolVersion &&
+            !SUPPORTED_MCP_PROTOCOL_VERSIONS.has(headerProtocolVersion)) {
+            return this.rejectInitializeRequest(ctx, requestId, 'unsupported_protocol_version_header', -32600, `The protocol version '${headerProtocolVersion}' isn't supported right now. Please check and try again.`);
+        }
         if (headerProtocolVersion &&
             headerProtocolVersion !== negotiatedProtocolVersion) {
             logGatewayRejection({
@@ -908,20 +962,30 @@ class McpSessionGateway {
             return null;
         return { sessionId, session };
     }
+    sendMissingSessionId(res, requestId = null) {
+        sendError(res, -32600, MISSING_SESSION_ID_MESSAGE, 400, requestId);
+        return null;
+    }
+    sendSessionNotInitialized(res, requestId = null) {
+        sendError(res, -32600, SESSION_NOT_INITIALIZED_MESSAGE, 400, requestId);
+        return null;
+    }
+    sendSessionUnavailable(res, requestId = null, status = 404) {
+        sendError(res, -32600, SESSION_NOT_FOUND_MESSAGE, status, requestId);
+        return null;
+    }
     getRequiredAuthenticatedSession(ctx, requestId = null, options) {
         const state = this.getOptionalAuthenticatedSession(ctx, requestId);
         if (!state)
             return null;
         const { sessionId, session } = state;
         if (!sessionId || !session) {
-            sendError(ctx.res, -32600, "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
-            return null;
+            return this.sendMissingSessionId(ctx.res, requestId);
         }
         if (!this.ensureSessionProtocolVersion(ctx, session))
             return null;
         if (options?.requireInitialized && !session.protocolInitialized) {
-            sendError(ctx.res, -32600, "Your session hasn't been initialized yet. Please wait a moment and try again.", 400, requestId);
-            return null;
+            return this.sendSessionNotInitialized(ctx.res, requestId);
         }
         return { sessionId, session };
     }
@@ -937,7 +1001,7 @@ class McpSessionGateway {
                 sessionId,
                 rpcId: requestId,
             });
-            sendError(res, -32600, "We couldn't find your session. It might have expired or been closed.", 404, requestId);
+            sendError(res, -32600, SESSION_NOT_FOUND_MESSAGE, 404, requestId);
             return null;
         }
         if (!authFingerprint || session.authFingerprint !== authFingerprint) {
@@ -950,8 +1014,7 @@ class McpSessionGateway {
                 sessionId,
                 rpcId: requestId,
             });
-            sendError(res, -32600, "We couldn't find your session. It might have expired or been closed.", 404, requestId);
-            return null;
+            return this.sendSessionUnavailable(res, requestId);
         }
         return session;
     }
@@ -1134,6 +1197,13 @@ class HttpDispatcher {
         this.store = store;
         this.mcpGateway = mcpGateway;
     }
+    sendAuthFailure(ctx, status, message) {
+        if (isMcpRoute(ctx.url.pathname)) {
+            sendError(ctx.res, -32000, message, status);
+            return;
+        }
+        sendJson(ctx.res, status, { error: message });
+    }
     async tryHandleHealthRoute(ctx) {
         if (!shouldHandleHealthRoute(ctx))
             return false;
@@ -1155,7 +1225,7 @@ class HttpDispatcher {
             return false;
         if (!isProtectedResourceMetadataPath(ctx.url.pathname))
             return false;
-        const document = buildProtectedResourceMetadataDocument(ctx.req);
+        const document = buildProtectedResourceMetadataDocument();
         sendJson(ctx.res, 200, document);
         return true;
     }
@@ -1217,11 +1287,11 @@ class HttpDispatcher {
             logWarn('Authentication failed', { message, method: ctx.method, path: ctx.url.pathname }, Loggers.LOG_AUTH);
             if (isInsufficientScopeError(err)) {
                 applyInsufficientScopeAuthHeaders(ctx.req, ctx.res, err.requiredScopes, message);
-                sendError(ctx.res, -32000, message, 403);
+                this.sendAuthFailure(ctx, 403, message);
                 return null;
             }
             applyUnauthorizedAuthHeaders(ctx.req, ctx.res);
-            sendError(ctx.res, -32000, message, 401);
+            this.sendAuthFailure(ctx, 401, message);
             return null;
         }
     }
@@ -1300,7 +1370,7 @@ class HttpRequestPipeline {
                     return;
                 if (!(await this.populateRequestBody(ctx, rawReq)))
                     return;
-                await this.dispatcher.dispatch(ctx);
+                await runWithTraceContext(getBodyMeta(ctx.body), () => this.dispatcher.dispatch(ctx));
             });
         }
         finally {
@@ -1342,9 +1412,6 @@ class HttpRequestPipeline {
             return false;
         }
         if (!this.rateLimiter.check(ctx)) {
-            sendJson(ctx.res, 429, {
-                error: "You're sending requests a bit too quickly. Please slow down and try again.",
-            });
             drainRequest(rawReq);
             return false;
         }
@@ -1459,7 +1526,7 @@ export async function startHttpServer() {
     assertHttpModeConfiguration();
     enableHttpMode();
     resetEventLoopMonitoring();
-    const rateLimiter = createRateLimitManagerImpl(config.rateLimit);
+    const rateLimiter = new RateLimiter(config.rateLimit);
     const sessionStore = createSessionStore(config.server.sessionTtlMs);
     const sessionCleanup = startSessionCleanupLoop(sessionStore, config.server.sessionTtlMs, {
         onEvictSession: (session) => {
@@ -1479,6 +1546,12 @@ export async function startHttpServer() {
     await listen(server, config.server.host, config.server.port);
     const port = resolveListeningPort(server, config.server.port);
     const protocol = config.server.https.enabled ? 'https' : 'http';
+    if (!config.auth.publicBaseUrl) {
+        const resolvedResourceUrl = new URL(config.auth.resourceUrl);
+        resolvedResourceUrl.port = String(port);
+        resolvedResourceUrl.protocol = `${protocol}:`;
+        config.auth.resourceUrl = resolvedResourceUrl;
+    }
     logInfo(`${protocol.toUpperCase()} server listening on port ${port}`, {
         platform: process.platform,
         arch: process.arch,

package/dist/http/rate-limit.d.ts

@@ -1,14 +1,22 @@
-import { type RequestContext } from './native.js';
+import type { RequestContext } from './native.js';
 interface RateLimitConfig {
     maxRequests: number;
     windowMs: number;
     cleanupIntervalMs: number;
     enabled: boolean;
 }
-export interface RateLimitManagerImpl {
+export declare class RateLimiter {
+    private readonly options;
+    private readonly store;
+    private readonly cleanup;
+    constructor(options: RateLimitConfig);
+    private startCleanupLoop;
+    private cleanupEntries;
+    private resetEntry;
+    private incrementEntry;
+    private createEntry;
     check(ctx: RequestContext): boolean;
     stop(): void;
 }
-export declare function createRateLimitManagerImpl(options: RateLimitConfig): RateLimitManagerImpl;
 export {};
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/http/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/http/rate-limit.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,cAAc,EAAY,MAAM,aAAa,CAAC;AAY5D,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC;IACpC,IAAI,IAAI,IAAI,CAAC;CACd;AA+FD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,eAAe,GACvB,oBAAoB,CAGtB"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/http/rate-limit.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAYlD,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAcD,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAEpB,OAAO,EAAE,eAAe;IAIrD,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,WAAW;IAQnB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;IAyCnC,IAAI,IAAI,IAAI;CAGb"}

package/dist/http/rate-limit.js

@@ -1,11 +1,19 @@
+import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
 import { Loggers, logWarn } from '../lib/core.js';
 import { isAbortError } from '../lib/error/index.js';
+import { sendJsonRpcError } from '../lib/mcp-interop.js';
 import { startAbortableIntervalLoop } from '../lib/utils.js';
-import { sendJson } from './native.js';
-// ---------------------------------------------------------------------------
-// Rate limiter
-// ---------------------------------------------------------------------------
-class RateLimiter {
+function sendJson(res, status, body) {
+    res.statusCode = status;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Cache-Control', 'no-store');
+    res.end(JSON.stringify(body));
+}
+function isMcpEndpoint(pathname) {
+    return pathname === '/mcp' || pathname === '/mcp/';
+}
+export class RateLimiter {
     options;
     store = new Map();
     cleanup = new AbortController();
@@ -74,7 +82,12 @@ class RateLimiter {
             logWarn('Rate limit exceeded', { ip: key }, Loggers.LOG_RATE_LIMIT);
             const retryAfter = Math.max(1, Math.ceil((entry.resetTime - now) / 1000));
             ctx.res.setHeader('Retry-After', String(retryAfter));
-            sendJson(ctx.res, 429, { error: 'Rate limit exceeded', retryAfter });
+            if (isMcpEndpoint(ctx.url.pathname)) {
+                sendJsonRpcError(ctx.res, 429, ErrorCode.InvalidRequest, 'Rate limit exceeded', null, { retryAfter });
+            }
+            else {
+                sendJson(ctx.res, 429, { error: 'Rate limit exceeded', retryAfter });
+            }
             return false;
         }
         return true;
@@ -83,7 +96,3 @@ class RateLimiter {
         this.cleanup.abort();
     }
 }
-export function createRateLimitManagerImpl(options) {
-    const limiter = new RateLimiter(options);
-    return limiter;
-}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAUA,UAAU,SAAS;IACjB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,cAAc,GAAG,eAAe,GAAG,eAAe,CAAC;AA2CxD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CA2BpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAWA,UAAU,SAAS;IACjB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,cAAc,GAAG,eAAe,GAAG,eAAe,CAAC;AA2CxD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CA2BpE"}

package/dist/index.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import process from 'node:process';
 import { parseArgs } from 'node:util';
-import { logError, Loggers, serverVersion } from './lib/core.js';
+import { serverVersion } from './lib/config.js';
+import { logError, Loggers } from './lib/core.js';
 import { getErrorMessage, toError } from './lib/error/index.js';
 import { startHttpServer } from './http/index.js';
 import { startStdioServer } from './server.js';

package/dist/lib/config.d.ts

@@ -16,6 +16,7 @@ interface AuthConfig {
     revocationUrl: URL | undefined;
     registrationUrl: URL | undefined;
     introspectionUrl: URL | undefined;
+    publicBaseUrl: URL | undefined;
     resourceUrl: URL;
     requiredScopes: string[];
     clientId: string | undefined;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAgDA,eAAO,MAAM,aAAa,EAAE,MAA2C,CAAC;AAIxE,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,CAAC;AAkCf,KAAK,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AACjD,KAAK,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAgPnC,UAAU,oBAAoB;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyCD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC;IAC3B,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,GAAG,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC;IAC/B,eAAe,EAAE,GAAG,GAAG,SAAS,CAAC;IACjC,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,WAAW,EAAE,GAAG,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAqGD,UAAU,YAAY;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAQD,UAAU,mBAAmB;IAC3B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,OAAO,CAAC;IACjC,4BAA4B,EAAE,OAAO,CAAC;IACtC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAuCD,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAWD,UAAU,kBAAkB;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,mBAAmB,CAAC;IAChC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACxD;AAkBD,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAmBD,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AA2BD,UAAU,wBAAwB;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAiBD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8ClB,CAAC;AAEF,wBAAgB,cAAc,IAAI,IAAI,CAErC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AA4CA,eAAO,MAAM,aAAa,EAAE,MAA2C,CAAC;AAIxE,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,CAAC;AAkCf,KAAK,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AACjD,KAAK,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAqQnC,UAAU,oBAAoB;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyCD,UAAU,UAAU;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC;IAC3B,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,GAAG,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC;IAC/B,eAAe,EAAE,GAAG,GAAG,SAAS,CAAC;IACjC,gBAAgB,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC;IAC/B,WAAW,EAAE,GAAG,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAuGD,UAAU,YAAY;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAQD,UAAU,mBAAmB;IAC3B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,OAAO,CAAC;IACjC,4BAA4B,EAAE,OAAO,CAAC;IACtC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAuCD,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAWD,UAAU,kBAAkB;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,mBAAmB,CAAC;IAChC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACxD;AAkBD,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAmBD,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AA2BD,UAAU,wBAAwB;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAiBD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8ClB,CAAC;AAEF,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/lib/config.js

@@ -1,9 +1,10 @@
 import { readFileSync } from 'node:fs';
 import { findPackageJSON } from 'node:module';
+import { isIP } from 'node:net';
 import process from 'node:process';
+import { domainToASCII } from 'node:url';
 import { z } from 'zod';
-import { getErrorMessage } from './error/index.js';
-import { buildIpv4, isIP, normalizeHostname, stripTrailingDots, } from './net/url.js';
+import { getErrorMessage } from './error/classes.js';
 // ── Version ─────────────────────────────────────────────────────────
 function getObjectProperty(value, key) {
     return value[key];
@@ -87,6 +88,25 @@ const ENV_BOOLEAN_SCHEMA = z.stringbool({
     falsy: ['false', '0', 'no', 'off'],
 });
 // ── Host parsing helpers ────────────────────────────────────────────
+function buildIpv4(parts) {
+    return parts.join('.');
+}
+function stripTrailingDots(value) {
+    let result = value;
+    while (result.endsWith('.'))
+        result = result.slice(0, -1);
+    return result;
+}
+function normalizeHostname(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    const lowered = trimmed.toLowerCase();
+    if (isIP(lowered))
+        return stripTrailingDots(lowered);
+    const ascii = domainToASCII(lowered);
+    return ascii ? stripTrailingDots(ascii) : null;
+}
 function tryParseUrlHost(raw) {
     if (raw.includes('://')) {
         const hostname = URL.parse(raw)?.hostname;
@@ -277,7 +297,8 @@ function buildAuthConfig(baseUrl) {
     const revocationUrl = parseUrl('OAUTH_REVOCATION_URL');
     const registrationUrl = parseUrl('OAUTH_REGISTRATION_URL');
     const introspectionUrl = parseUrl('OAUTH_INTROSPECTION_URL');
-    const resourceUrl = new URL('/mcp', baseUrl);
+    const publicBaseUrl = parseUrl('PUBLIC_BASE_URL');
+    const resourceUrl = new URL('/mcp', publicBaseUrl ?? baseUrl);
     const oauthConfigured = issuerUrl !== undefined ||
         authorizationUrl !== undefined ||
         tokenUrl !== undefined ||
@@ -293,6 +314,7 @@ function buildAuthConfig(baseUrl) {
         revocationUrl,
         registrationUrl,
         introspectionUrl,
+        publicBaseUrl,
         resourceUrl,
         requiredScopes: EnvParser.list(env['OAUTH_REQUIRED_SCOPES']),
         clientId: env['OAUTH_CLIENT_ID'],