@jclvsh/xmark 0.6.0 → 0.6.2

package/dist/hosted-transport.d.ts

@@ -8,3 +8,22 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
  * opens an event stream that never ends).
  */
 export declare function serveStatelessMcp(server: McpServer, request: Request): Promise<Response>;
+/**
+ * True when a JSON-RPC payload (one message or a batch) only asks who the server is and which
+ * tools it has. A host may answer these without a key, so an agent or a directory can see what
+ * the server does before signing up. Every message must be on the list: one tool call in a
+ * batch makes the whole payload need a key.
+ */
+export declare function isDiscoveryPayload(payload: unknown): boolean;
+/**
+ * True when the request's body is a discovery payload. Reads a clone, so the request can still
+ * be served afterwards, and stops at MAX_DISCOVERY_BODY_BYTES: a larger body, or a chunked one
+ * with no Content-Length, is never buffered whole.
+ */
+export declare function isDiscoveryRequest(request: Request): Promise<boolean>;
+/**
+ * The API client for a keyless discovery server: it has no key, so every use throws. Listing
+ * tools never touches the client; a tool call that reached this server would fail here, before
+ * any REST request.
+ */
+export declare function keylessClient<Client extends object>(): Client;

package/dist/hosted-transport.js

@@ -15,3 +15,70 @@ export async function serveStatelessMcp(server, request) {
     await server.connect(transport);
     return transport.handleRequest(request);
 }
+/** JSON-RPC methods that describe the server and change nothing. */
+const DISCOVERY_METHODS = new Set(["initialize", "notifications/initialized", "ping", "tools/list"]);
+/** A handshake is three messages; a longer keyless batch is not a handshake. */
+const MAX_DISCOVERY_BATCH = 10;
+/**
+ * True when a JSON-RPC payload (one message or a batch) only asks who the server is and which
+ * tools it has. A host may answer these without a key, so an agent or a directory can see what
+ * the server does before signing up. Every message must be on the list: one tool call in a
+ * batch makes the whole payload need a key.
+ */
+export function isDiscoveryPayload(payload) {
+    const messages = Array.isArray(payload) ? payload : [payload];
+    if (messages.length === 0 || messages.length > MAX_DISCOVERY_BATCH)
+        return false;
+    return messages.every((message) => {
+        if (typeof message !== "object" || message === null)
+            return false;
+        const method = message.method;
+        return typeof method === "string" && DISCOVERY_METHODS.has(method);
+    });
+}
+/** A handshake fits in a few hundred bytes; a keyless body past this is not one. */
+const MAX_DISCOVERY_BODY_BYTES = 16_384;
+/**
+ * True when the request's body is a discovery payload. Reads a clone, so the request can still
+ * be served afterwards, and stops at MAX_DISCOVERY_BODY_BYTES: a larger body, or a chunked one
+ * with no Content-Length, is never buffered whole.
+ */
+export async function isDiscoveryRequest(request) {
+    const stream = request.clone().body;
+    if (!stream)
+        return false;
+    const reader = stream.getReader();
+    const bytes = new Uint8Array(MAX_DISCOVERY_BODY_BYTES);
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (size + value.byteLength > MAX_DISCOVERY_BODY_BYTES) {
+                // Not awaited: cancelling one side of a cloned body only settles once the other
+                // side is cancelled too, and the caller is about to answer without reading it.
+                void reader.cancel().catch(() => undefined);
+                return false;
+            }
+            bytes.set(value, size);
+            size += value.byteLength;
+        }
+        return isDiscoveryPayload(JSON.parse(new TextDecoder().decode(bytes.subarray(0, size))));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The API client for a keyless discovery server: it has no key, so every use throws. Listing
+ * tools never touches the client; a tool call that reached this server would fail here, before
+ * any REST request.
+ */
+export function keylessClient() {
+    return new Proxy({}, {
+        get(_target, property) {
+            throw new Error(`an api key is required (client.${String(property)} was used without one)`);
+        },
+    });
+}

package/dist/hosted.d.ts

@@ -8,3 +8,12 @@ export interface HostedMcpOptions {
 }
 /** One hosted MCP request: a per-request client and server over the stateless transport. */
 export declare function handleHostedMcpRequest(request: Request, options: HostedMcpOptions): Promise<Response>;
+/**
+ * One keyless discovery request (initialize, tools/list): the same hosted server and tool list,
+ * built on a client that cannot make a REST call. The host checks the request with
+ * isDiscoveryRequest first; anything else needs a key and goes to handleHostedMcpRequest.
+ */
+export declare function handleHostedMcpDiscovery(request: Request, options: {
+    version: string;
+}): Promise<Response>;
+export { isDiscoveryPayload, isDiscoveryRequest } from "./hosted-transport.js";

package/dist/hosted.js

@@ -1,5 +1,5 @@
 import { XmarkClient } from "./client.js";
-import { serveStatelessMcp } from "./hosted-transport.js";
+import { keylessClient, serveStatelessMcp } from "./hosted-transport.js";
 import { createXmarkServer } from "./server.js";
 /** One hosted MCP request: a per-request client and server over the stateless transport. */
 export function handleHostedMcpRequest(request, options) {
@@ -7,3 +7,17 @@ export function handleHostedMcpRequest(request, options) {
     const server = createXmarkServer({ client, version: options.version, profile: "hosted" });
     return serveStatelessMcp(server, request);
 }
+/**
+ * One keyless discovery request (initialize, tools/list): the same hosted server and tool list,
+ * built on a client that cannot make a REST call. The host checks the request with
+ * isDiscoveryRequest first; anything else needs a key and goes to handleHostedMcpRequest.
+ */
+export function handleHostedMcpDiscovery(request, options) {
+    const server = createXmarkServer({
+        client: keylessClient(),
+        version: options.version,
+        profile: "hosted",
+    });
+    return serveStatelessMcp(server, request);
+}
+export { isDiscoveryPayload, isDiscoveryRequest } from "./hosted-transport.js";

package/package.json

@@ -1,6 +1,7 @@
 {
 	"name": "@jclvsh/xmark",
-	"version": "0.6.0",
+	"version": "0.6.2",
+	"mcpName": "io.github.JCLVSH/xmark",
 	"description": "MCP server and CLI for the xmark API — chat with your X bookmarks from inside Claude Code, Cursor, or any MCP client.",
 	"type": "module",
 	"main": "dist/index.js",