@kinginsun/mcp-drugsea 0.1.0 → 0.2.0

package/README.md

@@ -2,11 +2,11 @@
 
 MCP (Model Context Protocol) stdio server for [DrugSea / Yaohai](https://db.drugsea.cn) pharmaceutical databases.
 
-The server forwards tool calls to `https://api2.drugsea.cn` with header `X-Yaohai-Api-Key`. It covers:
+The server forwards tool calls to **`https://db3.drugsea.cn/api`** with personal user token auth (`Authorization: Bearer ysk_…`). It covers:
 
 - **yaohai-*** — cross-database catalog / search / detail / global / smart-search (`POST /g/mcp/yaohai/*`)
-- **product-cn-*** — already-marketed China products (`GET /product/cn/...`)
-- **reg-cn-*** — CDE registration / review pipeline (`GET /b/drugreg/cn/...` and facet prefix `/b/es/drugreg/cn/list`)
+- **product-cn-*** — already-marketed China products (search/detail via MCP on db3; facets via GET)
+- **reg-cn-*** — CDE registration / review pipeline (search/detail via MCP on db3; facets via GET)
 
 **GitHub:** [github.com/kinginsun/mcp-drugsea](https://github.com/kinginsun/mcp-drugsea)
 
@@ -24,25 +24,22 @@ npx -y @kinginsun/mcp-drugsea
 
 ## Configuration
 
-### `YAOHAI_MCP_API_KEY` (required)
+### `YAOHAI_MCP_TOKEN` (required)
 
-The server accepts either:
+Authentication uses **personal user tokens only** (`ysk_` + 32 hex chars). The legacy shared `X-Yaohai-Api-Key` header is **not supported**.
 
 | Credential | Format | HTTP header |
 |------------|--------|-------------|
-| Shared MCP key | opaque string (server env `YAOHAI_MCP_API_KEY`) | `X-Yaohai-Api-Key` |
 | Personal user token | `ysk_` + 32 hex chars | `Authorization: Bearer ysk_…` |
 
-This client auto-selects the header from the value shape. You may set `YAOHAI_MCP_TOKEN` instead of `YAOHAI_MCP_API_KEY` for a user token.
-
-**Note:** Production MCP with personal `ysk_` tokens is deployed at **`https://db3.drugsea.cn/api/g/mcp/*`**. Legacy `api2.drugsea.cn` accepts only the shared `X-Yaohai-Api-Key`. On db3, direct GET list/facet routes return encrypted payloads; this client auto-routes `product-cn-search` / `reg-cn-search` / detail through MCP POST when the base URL contains `db3.drugsea.cn`.
-
-Obtain a key from the DrugSea / Yaohai operator, then:
+Obtain a token from DrugSea / Yaohai (user account settings), then:
 
 ```bash
-export YAOHAI_MCP_API_KEY=your_api_key_here
+export YAOHAI_MCP_TOKEN=ysk_your_token_here
 ```
 
+On db3, direct GET list routes may return encrypted payloads; this client auto-routes `product-cn-search` / `reg-cn-search` / detail through MCP POST when the base URL contains `db3.drugsea.cn`.
+
 ### Optional
 
 | Variable | Default | Description |
@@ -60,7 +57,7 @@ export YAOHAI_MCP_API_KEY=your_api_key_here
       "command": "npx",
       "args": ["-y", "@kinginsun/mcp-drugsea"],
       "env": {
-        "YAOHAI_MCP_API_KEY": "your_api_key_here"
+        "YAOHAI_MCP_TOKEN": "ysk_your_token_here"
       }
     }
   }
@@ -76,7 +73,7 @@ export YAOHAI_MCP_API_KEY=your_api_key_here
       "command": "npx",
       "args": ["-y", "@kinginsun/mcp-drugsea"],
       "env": {
-        "YAOHAI_MCP_API_KEY": "your_api_key_here"
+        "YAOHAI_MCP_TOKEN": "ysk_your_token_here"
       }
     }
   }
@@ -99,7 +96,7 @@ If `total > 20`, summarize in chat (about 5–10 sample rows) instead of pasting
 
 xlsx export is not implemented in this MCP (v1 returns JSON samples only).
 
-`product-cn-*` and `reg-cn-*` list/facet/detail calls use the same GET routes as the website. Some API2 deployments IP-allowlist those paths and respond with `非法IP地址`. The `yaohai-*` tools use `POST /g/mcp/yaohai/*`, which is the MCP-keyed surface and is not subject to that list GET allowlist.
+`product-cn-*` and `reg-cn-*` list/facet/detail calls use the same routes as the website where applicable. Some deployments IP-allowlist direct GET paths. The `yaohai-*` tools use `POST /g/mcp/yaohai/*` with Bearer token auth.
 
 ## Tools
 
@@ -143,17 +140,17 @@ xlsx export is not implemented in this MCP (v1 returns JSON samples only).
 
 ```bash
 echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
-  | YAOHAI_MCP_API_KEY=your_key node dist/index.js
+  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js
 ```
 
 ```bash
 echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"yaohai-catalog","arguments":{"q":"医保"}}}' \
-  | YAOHAI_MCP_API_KEY=your_key node dist/index.js
+  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js
 ```
 
 ```bash
 echo '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"product-cn-search","arguments":{"query":{"drug_name":"阿司匹林"},"limit":3}}}' \
-  | YAOHAI_MCP_API_KEY=your_key node dist/index.js
+  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js
 ```
 
 ## Requirements

package/dist/api.js

@@ -2,12 +2,35 @@ import http from "node:http";
 import https from "node:https";
 import { URL } from "node:url";
 import { normalizeRecord, parseFacetList } from "./normalize.js";
-export class MissingApiKeyError extends Error {
-    constructor() {
-        super("Set YAOHAI_MCP_API_KEY (shared key) or YAOHAI_MCP_TOKEN (ysk_… user token)");
-        this.name = "MissingApiKeyError";
+export class MissingTokenError extends Error {
+    constructor(message) {
+        super(message ??
+            "Set YAOHAI_MCP_TOKEN to your personal DrugSea token (ysk_ + 32 hex chars)");
+        this.name = "MissingTokenError";
     }
 }
+/** @deprecated Use MissingTokenError */
+export const MissingApiKeyError = MissingTokenError;
+const USER_TOKEN_RE = /^ysk_[0-9a-f]{32}$/i;
+export function getUserToken() {
+    const token = process.env.YAOHAI_MCP_TOKEN?.trim() || "";
+    if (!token) {
+        throw new MissingTokenError();
+    }
+    if (!USER_TOKEN_RE.test(token)) {
+        throw new MissingTokenError("YAOHAI_MCP_TOKEN must be a personal user token: ysk_ + 32 hex chars");
+    }
+    return token;
+}
+/** @deprecated Use getUserToken */
+export const getApiKey = getUserToken;
+export function getAuthHeaders(extra = {}) {
+    const token = getUserToken();
+    return {
+        ...extra,
+        Authorization: `Bearer ${token}`,
+    };
+}
 export class ApiError extends Error {
     status;
     raw;
@@ -18,27 +41,6 @@ export class ApiError extends Error {
         this.raw = raw;
     }
 }
-export function getApiKey() {
-    const token = process.env.YAOHAI_MCP_TOKEN?.trim() || "";
-    const key = process.env.YAOHAI_MCP_API_KEY?.trim() || "";
-    const value = token || key;
-    if (!value) {
-        throw new MissingApiKeyError();
-    }
-    return value;
-}
-/** Shared server key → X-Yaohai-Api-Key; user token ysk_… → Authorization Bearer. */
-export function getAuthHeaders(extra = {}) {
-    const credential = getApiKey();
-    const headers = { ...extra };
-    if (credential.startsWith("ysk_")) {
-        headers.Authorization = `Bearer ${credential}`;
-    }
-    else {
-        headers["X-Yaohai-Api-Key"] = credential;
-    }
-    return headers;
-}
 export function getBaseUrl() {
     return (process.env.YAOHAI_BASE_URL || "https://db3.drugsea.cn/api").replace(/\/$/, "");
 }

package/dist/index.js

@@ -5,7 +5,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextpro
 import { clampLimit, clampOffset, fetchDetail, fetchFacets, listSearch, mcpDbDetail, mcpDbSearch, prefersMcpListApi, yaohaiPost, } from "./api.js";
 import { ATC_HINT, PRODUCT_CN_COMMON_FIELDS, PRODUCT_CN_DETAIL_PATH, PRODUCT_CN_FACET_FIELDS, PRODUCT_CN_FACET_PREFIX, PRODUCT_CN_VIEW_TYPES, REG_CN_COMMON_FIELDS, REG_CN_DETAIL_PATH, REG_CN_FACET_FIELDS, REG_CN_FACET_PREFIX, REG_CN_VIEW_TYPES, applyProductCnDefaults, applyRegCnDefaults, productCnSearchPath, regCnSearchPath, } from "./fields.js";
 import { EmptyObjectSchema, ProductCnDetailSchema, ProductCnFacetsSchema, ProductCnSearchSchema, RegCnDetailSchema, RegCnFacetsSchema, RegCnSearchSchema, YaohaiCatalogSchema, YaohaiDetailSchema, YaohaiGlobalSearchSchema, YaohaiSearchSchema, YaohaiSmartSearchSchema, } from "./types.js";
-const PACKAGE_VERSION = "0.1.0";
+const PACKAGE_VERSION = "0.2.0";
 const YAOHAI_LIMIT_MAX = 50;
 const YAOHAI_LIMIT_DEFAULT = 10;
 const CN_LIMIT_MAX = 100;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinginsun/mcp-drugsea",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "MCP server for DrugSea / Yaohai pharmaceutical databases: cross-db search, China marketed products (product_cn), and CDE registration review (reg_cn).",
   "type": "module",
   "main": "dist/index.js",