@kya-os/mcp 1.2.0

package/dist/logging/logger.js

@@ -0,0 +1,82 @@
+/**
+ * Transport-aware Logger for MCP-I
+ *
+ * Provides a lightweight, dependency-free logging interface that:
+ * - Maps log levels correctly for Cloudflare Workers
+ * - Routes all logs to stderr for stdio transport (so stdout remains protocol-only)
+ * - Supports runtime configuration of log level and transport mode
+ */
+const SEVERITY = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40,
+};
+export function createDefaultConsoleLogger() {
+    let level = 'info';
+    let forceStderr = false;
+    function shouldLog(l) {
+        return SEVERITY[l] >= SEVERITY[level];
+    }
+    function write(l, ...args) {
+        if (!shouldLog(l))
+            return;
+        if (forceStderr) {
+            console.error(...args);
+            return;
+        }
+        switch (l) {
+            case 'debug':
+                if (typeof console.debug === 'function') {
+                    console.debug(...args);
+                }
+                else {
+                    console.log(...args);
+                }
+                break;
+            case 'info':
+                if (typeof console.info === 'function') {
+                    console.info(...args);
+                }
+                else {
+                    console.log(...args);
+                }
+                break;
+            case 'warn':
+                if (typeof console.warn === 'function') {
+                    console.warn(...args);
+                }
+                else {
+                    console.error(...args);
+                }
+                break;
+            case 'error':
+                console.error(...args);
+                break;
+        }
+    }
+    return {
+        configure(opts = {}) {
+            if (opts.level)
+                level = opts.level;
+            if (opts.forceStderr === true) {
+                forceStderr = true;
+            }
+            else if (opts.forceStderr === false) {
+                forceStderr = false;
+            }
+            else if (opts.transport === 'stdio') {
+                forceStderr = true;
+            }
+            else if (opts.transport === 'sse' || opts.transport === 'http') {
+                forceStderr = false;
+            }
+        },
+        debug: (...a) => write('debug', ...a),
+        info: (...a) => write('info', ...a),
+        warn: (...a) => write('warn', ...a),
+        error: (...a) => write('error', ...a),
+    };
+}
+export const logger = createDefaultConsoleLogger();
+//# sourceMappingURL=logger.js.map

package/dist/logging/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/logging/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,QAAQ,GAA0B;IACtC,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAUF,MAAM,UAAU,0BAA0B;IACxC,IAAI,KAAK,GAAU,MAAM,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,SAAS,SAAS,CAAC,CAAQ;QACzB,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,SAAS,KAAK,CAAC,CAAQ,EAAE,GAAG,IAAe;QACzC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO;QAE1B,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,OAAO;gBACV,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvB,CAAC;gBACD,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvB,CAAC;gBACD,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACvC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,KAAK,OAAO;gBACV,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvB,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,CAAC,IAAI,GAAG,EAAE;YACjB,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACnC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC9B,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;gBACtC,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBACtC,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBACjE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QACD,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * MCP-I Middleware
+ *
+ * Primary entry point: `withMCPI(server, { crypto })` — adds identity,
+ * handshake, and auto-proofs to any McpServer instance in one call.
+ *
+ * For the low-level `Server` API or custom patterns, use `createMCPIMiddleware` directly.
+ */
+export { createMCPIMiddleware, type MCPIConfig, type MCPIDelegationConfig, type MCPIIdentityConfig, type MCPIMiddleware, type MCPIToolDefinition, type MCPIToolHandler, type MCPIServer, } from './with-mcpi.js';
+export { withMCPI, generateIdentity, type WithMCPIOptions, } from './with-mcpi-server.js';
+export { createMCPITransport, type Transport, type JSONRPCMessage, } from './mcpi-transport.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,12 @@
+/**
+ * MCP-I Middleware
+ *
+ * Primary entry point: `withMCPI(server, { crypto })` — adds identity,
+ * handshake, and auto-proofs to any McpServer instance in one call.
+ *
+ * For the low-level `Server` API or custom patterns, use `createMCPIMiddleware` directly.
+ */
+export { createMCPIMiddleware, } from './with-mcpi.js';
+export { withMCPI, generateIdentity, } from './with-mcpi-server.js';
+export { createMCPITransport, } from './mcpi-transport.js';
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,oBAAoB,GAQrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,QAAQ,EACR,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC"}

package/dist/middleware/mcpi-transport.d.ts

@@ -0,0 +1,39 @@
+/**
+ * MCPITransport — Proof-injecting Transport Wrapper
+ *
+ * Wraps any MCP Transport to intercept `tools/call` responses and attach
+ * MCP-I detached proofs. Uses only the public Transport interface — no
+ * private SDK internals accessed.
+ *
+ * The McpServer never knows this wrapper exists. It sees a normal transport.
+ * The connected client sees normal MCP responses with an added `_meta.proof`.
+ *
+ * How it works:
+ *   1. Incoming `tools/call` requests are captured (by id) to record tool
+ *      name and arguments for proof generation.
+ *   2. Outgoing responses for those ids get a proof injected into `_meta`.
+ *   3. All other message types pass through unmodified.
+ *
+ * @module mcpi-transport
+ */
+import type { MCPIMiddleware } from "./with-mcpi.js";
+/** Minimal Transport interface — matches @modelcontextprotocol/sdk Transport */
+export interface Transport {
+    start(): Promise<void>;
+    send(message: JSONRPCMessage): Promise<void>;
+    close(): Promise<void>;
+    onmessage?: (message: JSONRPCMessage) => void;
+    onclose?: () => void;
+    onerror?: (error: Error) => void;
+}
+export type JSONRPCMessage = Record<string, unknown>;
+/**
+ * Creates a transport wrapper that injects MCP-I proofs into `tools/call`
+ * responses.
+ *
+ * @param inner   - The real transport (Stdio, HTTP, etc.)
+ * @param mcpi    - Configured MCPIMiddleware instance
+ * @param exclude - Tool names to skip proof generation for
+ */
+export declare function createMCPITransport(inner: Transport, mcpi: MCPIMiddleware, exclude?: string[]): Transport;
+//# sourceMappingURL=mcpi-transport.d.ts.map

package/dist/middleware/mcpi-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpi-transport.d.ts","sourceRoot":"","sources":["../../src/middleware/mcpi-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,gBAAgB,CAAC;AAGtE,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAarD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,MAAM,EAAiC,GAC/C,SAAS,CAwGX"}

package/dist/middleware/mcpi-transport.js

@@ -0,0 +1,121 @@
+/**
+ * MCPITransport — Proof-injecting Transport Wrapper
+ *
+ * Wraps any MCP Transport to intercept `tools/call` responses and attach
+ * MCP-I detached proofs. Uses only the public Transport interface — no
+ * private SDK internals accessed.
+ *
+ * The McpServer never knows this wrapper exists. It sees a normal transport.
+ * The connected client sees normal MCP responses with an added `_meta.proof`.
+ *
+ * How it works:
+ *   1. Incoming `tools/call` requests are captured (by id) to record tool
+ *      name and arguments for proof generation.
+ *   2. Outgoing responses for those ids get a proof injected into `_meta`.
+ *   3. All other message types pass through unmodified.
+ *
+ * @module mcpi-transport
+ */
+import { logger } from "../logging/index.js";
+/**
+ * Creates a transport wrapper that injects MCP-I proofs into `tools/call`
+ * responses.
+ *
+ * @param inner   - The real transport (Stdio, HTTP, etc.)
+ * @param mcpi    - Configured MCPIMiddleware instance
+ * @param exclude - Tool names to skip proof generation for
+ */
+export function createMCPITransport(inner, mcpi, exclude = ["_mcpi", "_mcpi_handshake"]) {
+    // Request id → { toolName, args } for pending tool calls
+    const pending = new Map();
+    const wrapper = {
+        start: () => inner.start(),
+        close: () => inner.close(),
+        // McpServer writes into wrapper.onmessage — forward to inner so the
+        // real transport can drive it.
+        set onmessage(handler) {
+            inner.onmessage = handler;
+        },
+        get onmessage() {
+            return inner.onmessage;
+        },
+        set onclose(handler) {
+            inner.onclose = handler;
+        },
+        get onclose() {
+            return inner.onclose;
+        },
+        set onerror(handler) {
+            inner.onerror = handler;
+        },
+        get onerror() {
+            return inner.onerror;
+        },
+        // McpServer calls send() for every outgoing message.
+        // Intercept tools/call responses here to inject proofs.
+        async send(message) {
+            const id = message.id;
+            const call = id !== undefined ? pending.get(id) : undefined;
+            if (call) {
+                pending.delete(id);
+                try {
+                    const rawResult = message.result;
+                    if (rawResult && !rawResult.isError) {
+                        const handler = async () => rawResult;
+                        const addProof = mcpi.wrapWithProof(call.toolName, handler);
+                        const proofed = await addProof(call.args);
+                        if (proofed._meta !== undefined) {
+                            message = {
+                                ...message,
+                                result: proofed,
+                            };
+                        }
+                    }
+                }
+                catch (error) {
+                    logger.error("[mcpi-transport] Proof injection failed", {
+                        tool: call.toolName,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    const rawResult = message.result;
+                    if (rawResult) {
+                        rawResult._meta = {
+                            proofError: "Proof generation failed — response is unproven",
+                        };
+                        message = { ...message, result: rawResult };
+                    }
+                }
+            }
+            return inner.send(message);
+        },
+    };
+    // Intercept incoming messages from the real transport to capture
+    // tools/call requests before McpServer processes them.
+    // We defer setting inner.onmessage until McpServer has set wrapper.onmessage
+    // via server.connect() — so we proxy through the getter/setter above and
+    // add our interception in a one-time initializer on start().
+    const originalStart = inner.start.bind(inner);
+    wrapper.start = async () => {
+        await originalStart();
+        // At this point McpServer has called server.connect(wrapper) which set
+        // wrapper.onmessage = <McpServer handler>. That assignment forwarded to
+        // inner.onmessage via the setter above. Now we inject our interceptor.
+        const downstream = inner.onmessage;
+        inner.onmessage = (message) => {
+            if (message.method === "tools/call" &&
+                message.id !== undefined) {
+                const params = message.params;
+                const toolName = params?.name;
+                if (toolName && !exclude.includes(toolName)) {
+                    pending.set(message.id, {
+                        toolName,
+                        args: params?.arguments ?? {},
+                    });
+                }
+            }
+            downstream?.(message);
+        };
+    };
+    return wrapper;
+}
+//# sourceMappingURL=mcpi-transport.js.map

package/dist/middleware/mcpi-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpi-transport.js","sourceRoot":"","sources":["../../src/middleware/mcpi-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyB7C;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAgB,EAChB,IAAoB,EACpB,UAAoB,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAEhD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEhD,MAAM,OAAO,GAAc;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAE1B,oEAAoE;QACpE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,OAAoD;YAChE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,SAAS;YACX,OAAO,KAAK,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,OAAiC;YAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,OAA2C;YACrD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,qDAAqD;QACrD,wDAAwD;QACxD,KAAK,CAAC,IAAI,CAAC,OAAuB;YAChC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE5D,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;wBACpC,MAAM,OAAO,GAAoB,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;wBACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC5D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;4BAChC,OAAO,GAAG;gCACR,GAAG,OAAO;gCACV,MAAM,EAAE,OAAO;6BAChB,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;wBACtD,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,EAAE,CAAC;wBACd,SAAS,CAAC,KAAK,GAAG;4BAChB,UAAU,EAAE,gDAAgD;yBAC7D,CAAC;wBACF,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IAEF,iEAAiE;IACjE,uDAAuD;IACvD,6EAA6E;IAC7E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,aAAa,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,CAAC,SAAS,GAAG,CAAC,OAAuB,EAAE,EAAE;YAC5C,IACE,OAAO,CAAC,MAAM,KAAK,YAAY;gBAC/B,OAAO,CAAC,EAAE,KAAK,SAAS,EACxB,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAEV,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC;gBAC9B,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;wBACtB,QAAQ;wBACR,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/middleware/with-mcpi-server.d.ts

@@ -0,0 +1,78 @@
+/**
+ * McpServer Adapter for MCP-I
+ *
+ * Adds MCP-I identity, session management, and proof generation to a
+ * standard McpServer instance with a single function call.
+ *
+ * Usage:
+ *   import { withMCPI } from '@kya-os/mcp/middleware';
+ *   const mcpi = await withMCPI(server, { crypto: new NodeCryptoProvider() });
+ *   // All tools registered on `server` now get proofs automatically.
+ *   await server.connect(transport); // transport is transparently wrapped
+ */
+import type { CryptoProvider } from "../providers/base.js";
+import { type MCPIIdentityConfig, type MCPIDelegationConfig, type MCPIMiddleware } from "./with-mcpi.js";
+import { type Transport } from "./mcpi-transport.js";
+export interface WithMCPIOptions {
+    /** Platform-specific crypto implementation (required) */
+    crypto: CryptoProvider;
+    /** Identity config — auto-generated if omitted */
+    identity?: MCPIIdentityConfig;
+    /** Session configuration */
+    session?: {
+        sessionTtlMinutes?: number;
+    };
+    /** Auto-create sessions for non-MCP-I clients (default: true) */
+    autoSession?: boolean;
+    /** Attach proofs to all tool responses (default: true) */
+    proofAllTools?: boolean;
+    /** Tools to skip proof generation for */
+    excludeTools?: string[];
+    /** Delegation verification config */
+    delegation?: MCPIDelegationConfig;
+    /**
+     * How the MCP-I protocol tool is exposed on the server.
+     * - "tool" (default): auto-register `_mcpi`
+     * - "none": do not register MCP-I tool (use middleware APIs for custom runtime hooks)
+     */
+    handshakeExposure?: "tool" | "none";
+}
+/**
+ * Generate a fresh Ed25519 identity for MCP-I.
+ *
+ * @param crypto - Platform-specific crypto provider
+ * @returns Identity config with DID, kid, and key material
+ */
+export declare function generateIdentity(crypto: CryptoProvider): Promise<MCPIIdentityConfig>;
+/**
+ * Minimal McpServer interface — avoids hard dependency on @modelcontextprotocol/sdk.
+ * Matches the subset of McpServer's public API that withMCPI() uses.
+ */
+interface McpServerLike {
+    connect(transport: Transport): Promise<unknown>;
+    registerTool(...args: unknown[]): void;
+}
+/**
+ * Add MCP-I to a McpServer instance.
+ *
+ * 1. Auto-generates Ed25519 identity (or uses provided one)
+ * 2. Registers `_mcpi` tool by default (`handshakeExposure: "tool"`)
+ * 3. Patches `server.connect()` to transparently wrap the transport with
+ *    MCPITransport, which injects detached proofs into all `tools/call`
+ *    responses using only the public Transport interface.
+ *
+ * The user-facing API is unchanged — register tools before or after this
+ * call, then connect as normal:
+ *
+ * ```ts
+ * const mcpi = await withMCPI(server, { crypto: new NodeCryptoProvider() });
+ * await server.connect(transport); // MCPITransport wraps silently
+ * ```
+ *
+ * @param server  - McpServer instance
+ * @param options - Configuration
+ * @returns The MCPIMiddleware instance for advanced usage (wrapWithDelegation, etc.)
+ */
+export declare function withMCPI(server: McpServerLike, options: WithMCPIOptions): Promise<MCPIMiddleware>;
+export {};
+//# sourceMappingURL=with-mcpi-server.d.ts.map

package/dist/middleware/with-mcpi-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-mcpi-server.d.ts","sourceRoot":"","sources":["../../src/middleware/with-mcpi-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG1E,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,MAAM,EAAE,cAAc,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,4BAA4B;IAC5B,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iEAAiE;IACjE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qCAAqC;IACrC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAS7B;AAED;;;GAGG;AACH,UAAU,aAAa;IACrB,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAuEzB"}

package/dist/middleware/with-mcpi-server.js

@@ -0,0 +1,109 @@
+/**
+ * McpServer Adapter for MCP-I
+ *
+ * Adds MCP-I identity, session management, and proof generation to a
+ * standard McpServer instance with a single function call.
+ *
+ * Usage:
+ *   import { withMCPI } from '@kya-os/mcp/middleware';
+ *   const mcpi = await withMCPI(server, { crypto: new NodeCryptoProvider() });
+ *   // All tools registered on `server` now get proofs automatically.
+ *   await server.connect(transport); // transport is transparently wrapped
+ */
+import { generateDidKeyFromBase64, didKeyFragment } from "../utils/did-helpers.js";
+import { MCPI_ACTIONS, createMCPIMiddleware, } from "./with-mcpi.js";
+import { createMCPITransport } from "./mcpi-transport.js";
+import { z } from "zod";
+/**
+ * Generate a fresh Ed25519 identity for MCP-I.
+ *
+ * @param crypto - Platform-specific crypto provider
+ * @returns Identity config with DID, kid, and key material
+ */
+export async function generateIdentity(crypto) {
+    const keyPair = await crypto.generateKeyPair();
+    const did = generateDidKeyFromBase64(keyPair.publicKey);
+    return {
+        did,
+        kid: `${did}#${didKeyFragment(did)}`,
+        privateKey: keyPair.privateKey,
+        publicKey: keyPair.publicKey,
+    };
+}
+/**
+ * Add MCP-I to a McpServer instance.
+ *
+ * 1. Auto-generates Ed25519 identity (or uses provided one)
+ * 2. Registers `_mcpi` tool by default (`handshakeExposure: "tool"`)
+ * 3. Patches `server.connect()` to transparently wrap the transport with
+ *    MCPITransport, which injects detached proofs into all `tools/call`
+ *    responses using only the public Transport interface.
+ *
+ * The user-facing API is unchanged — register tools before or after this
+ * call, then connect as normal:
+ *
+ * ```ts
+ * const mcpi = await withMCPI(server, { crypto: new NodeCryptoProvider() });
+ * await server.connect(transport); // MCPITransport wraps silently
+ * ```
+ *
+ * @param server  - McpServer instance
+ * @param options - Configuration
+ * @returns The MCPIMiddleware instance for advanced usage (wrapWithDelegation, etc.)
+ */
+export async function withMCPI(server, options) {
+    const identity = options.identity ?? (await generateIdentity(options.crypto));
+    const mcpi = createMCPIMiddleware({
+        identity,
+        session: options.session,
+        delegation: options.delegation,
+        autoSession: options.autoSession ?? true,
+    }, options.crypto);
+    if ((options.handshakeExposure ?? "tool") === "tool") {
+        // Register the unified _mcpi tool for protocol operations.
+        server.registerTool("_mcpi", {
+            description: "MCP-I protocol — identity verification, session handshake, and server metadata",
+            annotations: { title: "MCP-I Protocol", readOnlyHint: true },
+            inputSchema: {
+                action: z
+                    .enum(MCPI_ACTIONS)
+                    .describe("Protocol operation to perform"),
+                nonce: z
+                    .string()
+                    .optional()
+                    .describe("Client-generated unique nonce (handshake)"),
+                audience: z
+                    .string()
+                    .optional()
+                    .describe("Intended audience (handshake)"),
+                timestamp: z
+                    .number()
+                    .optional()
+                    .describe("Unix epoch seconds (handshake)"),
+                agentDid: z
+                    .string()
+                    .optional()
+                    .describe("Client agent DID (handshake, optional)"),
+            },
+        }, async (args) => {
+            const result = await mcpi.handleMCPI(args);
+            return {
+                ...result,
+                content: result.content.map((c) => ({ ...c, type: "text" })),
+            };
+        });
+    }
+    // Auto-proof interception via transport wrapper (public API only).
+    //
+    // We patch server.connect() so that whatever transport the caller passes
+    // is silently wrapped with MCPITransport before McpServer sees it.
+    // Tool registration order does not matter — proofs are injected at the
+    // transport boundary, after McpServer has already dispatched the call.
+    if (options.proofAllTools !== false) {
+        const exclude = ["_mcpi", "_mcpi_handshake", ...(options.excludeTools ?? [])];
+        const originalConnect = server.connect.bind(server);
+        server.connect = (transport) => originalConnect(createMCPITransport(transport, mcpi, exclude));
+    }
+    return mcpi;
+}
+//# sourceMappingURL=with-mcpi-server.js.map

package/dist/middleware/with-mcpi-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-mcpi-server.js","sourceRoot":"","sources":["../../src/middleware/with-mcpi-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,YAAY,EACZ,oBAAoB,GAIrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAkB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAqB,EACrB,OAAwB;IAExB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,oBAAoB,CAC/B;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;KACzC,EACD,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,2DAA2D;QAC3D,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;YACE,WAAW,EACT,gFAAgF;YAClF,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE;YAC5D,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC;qBACN,IAAI,CAAC,YAAY,CAAC;qBAClB,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,2CAA2C,CAAC;gBACxD,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,wCAAwC,CAAC;aACtD;SACF,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAClC,IAA+B,CAChC,CAAC;YACF,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,mEAAmE;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,GAAG,CAAC,SAAoB,EAAE,EAAE,CACxC,eAAe,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}