@kynver-app/mcp-estimator 0.2.10 → 0.2.12

package/dist/lib/mcp-sse-server.d.ts

@@ -23,6 +23,21 @@ export declare function headerValue(req: IncomingMessage, name: string): string
 export declare function timingSafeEqualString(a: string, b: string): boolean;
 export declare function hasForbiddenQueryAuth(url: URL): boolean;
 export declare function resolveListenHost(): string;
+/** Positive integer from env, else fallback. */
+export declare function intFromEnv(name: string, fallback: number): number;
+/**
+ * Resolve + validate the Kynver API origin the server sends bearer keys to.
+ * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
+ * anything that isn't https (http is allowed only for localhost dev).
+ */
+export declare function resolveApiBaseUrl(): string;
+/** First client IP from x-forwarded-for, else the socket address. */
+export declare function clientIp(req: IncomingMessage): string;
+type RateLimiter = {
+    check: (key: string) => boolean;
+};
+/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
+export declare function createFixedWindowRateLimiter(limit: number, windowMs: number): RateLimiter;
 export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<unknown>;
 export declare function validateMcporterServerName(name: string): string;
 export declare function startKynverMcpSseServer(options: StartKynverMcpSseServerOptions): void;

package/dist/lib/mcp-sse-server.js

@@ -4,7 +4,7 @@ import { createServer } from "node:http";
 import { timingSafeEqual } from "node:crypto";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 export const MAX_SSE_BODY_BYTES = 1 * 1024 * 1024;
-const FORBIDDEN_QUERY_KEYS = ["secret", "userId"];
+const FORBIDDEN_QUERY_KEYS = ["apiKey", "secret", "userId"];
 export function headerValue(req, name) {
     const v = req.headers[name];
     return typeof v === "string" ? v : Array.isArray(v) ? (v[0] ?? null) : null;
@@ -19,13 +19,65 @@ export function timingSafeEqualString(a, b) {
 export function hasForbiddenQueryAuth(url) {
     return FORBIDDEN_QUERY_KEYS.some((key) => url.searchParams.has(key));
 }
-function queryApiKey(url) {
-    return url.searchParams.get("apiKey")?.trim() ?? "";
-}
 export function resolveListenHost() {
     const configured = process.env.MCP_SSE_HOST?.trim();
     return configured || "127.0.0.1";
 }
+/** Positive integer from env, else fallback. */
+export function intFromEnv(name, fallback) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+/**
+ * Resolve + validate the Kynver API origin the server sends bearer keys to.
+ * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
+ * anything that isn't https (http is allowed only for localhost dev).
+ */
+export function resolveApiBaseUrl() {
+    const raw = process.env.KYNVER_API_URL?.trim();
+    if (!raw)
+        return "https://kynver.com";
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`Invalid KYNVER_API_URL: ${raw}`);
+    }
+    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && isLocalhost)) {
+        throw new Error(`KYNVER_API_URL must be https (got "${parsed.protocol}//${parsed.hostname}"); API keys are sent to this origin.`);
+    }
+    return raw.replace(/\/$/, "");
+}
+/** First client IP from x-forwarded-for, else the socket address. */
+export function clientIp(req) {
+    const fwd = headerValue(req, "x-forwarded-for");
+    if (fwd)
+        return fwd.split(",")[0].trim();
+    return req.socket?.remoteAddress ?? "unknown";
+}
+/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
+export function createFixedWindowRateLimiter(limit, windowMs) {
+    const hits = new Map();
+    return {
+        check(key) {
+            const now = Date.now();
+            const entry = hits.get(key);
+            if (!entry || now >= entry.resetAt) {
+                hits.set(key, { count: 1, resetAt: now + windowMs });
+                return true;
+            }
+            if (entry.count >= limit)
+                return false;
+            entry.count += 1;
+            return true;
+        },
+    };
+}
 export function parseJsonBody(req, maxBytes = MAX_SSE_BODY_BYTES) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -75,7 +127,7 @@ function resolveInternalAuth(req, serviceSecret) {
 }
 function verifyPostAuth(req, url, sessionAuth, serviceSecret) {
     if (sessionAuth.kind === "apiKey") {
-        const token = bearerToken(req) || queryApiKey(url);
+        const token = bearerToken(req);
         return token.length > 0 && timingSafeEqualString(token, sessionAuth.apiKey);
     }
     const internal = resolveInternalAuth(req, serviceSecret);
@@ -106,23 +158,42 @@ function json(res, status, body) {
 }
 export function startKynverMcpSseServer(options) {
     const port = parseInt(process.env.PORT ?? String(options.defaultPort), 10);
-    const baseUrl = process.env.KYNVER_API_URL ?? "https://kynver.com";
+    const baseUrl = resolveApiBaseUrl();
     const serviceSecret = process.env.KYNVER_SERVICE_SECRET ?? "";
     const host = resolveListenHost();
     const sessions = {};
+    // Resource / abuse limits (env-overridable; in-process per server).
+    const maxSessions = intFromEnv("MCP_SSE_MAX_SESSIONS", 200);
+    const maxSessionsPerUser = intFromEnv("MCP_SSE_MAX_SESSIONS_PER_USER", 20);
+    const idleTimeoutMs = intFromEnv("MCP_SSE_IDLE_TIMEOUT_MS", 5 * 60 * 1000);
+    const rateLimitPerMin = intFromEnv("MCP_SSE_RATE_LIMIT_PER_MIN", 120);
+    const rateLimiter = createFixedWindowRateLimiter(rateLimitPerMin, 60 * 1000);
+    // Close idle SSE sessions so a flood of half-open connections can't pin memory.
+    const idleSweep = setInterval(() => {
+        const now = Date.now();
+        for (const [sid, entry] of Object.entries(sessions)) {
+            if (now - entry.lastActivity > idleTimeoutMs) {
+                delete sessions[sid];
+                void entry.transport.close().catch(() => { });
+            }
+        }
+    }, 60 * 1000);
+    idleSweep.unref?.();
     const httpServer = createServer(async (req, res) => {
         const url = parseUrl(req, port);
         const path = url.pathname;
         if (req.method === "GET" && path === "/sse") {
+            // Pre-auth rate limit by client IP (we don't know the user yet).
+            if (!rateLimiter.check(`sse:${clientIp(req)}`)) {
+                json(res, 429, { error: "Too many requests. Slow down and retry." });
+                return;
+            }
             if (hasForbiddenQueryAuth(url)) {
                 json(res, 400, {
                     error: "Internal auth via query params is not allowed. Use X-Kynver-User-Id and X-Kynver-Service-Secret headers.",
                 });
                 return;
             }
-            if (url.searchParams.has("apiKey")) {
-                console.warn("[MCP SSE] WARNING: apiKey in query string may leak via logs. Prefer Authorization header when your client supports it.");
-            }
             let userId = null;
             let auth = null;
             const internal = serviceSecret ? resolveInternalAuth(req, serviceSecret) : null;
@@ -131,7 +202,7 @@ export function startKynverMcpSseServer(options) {
                 auth = internal.auth;
             }
             else {
-                const apiKey = bearerToken(req) || queryApiKey(url);
+                const apiKey = bearerToken(req);
                 if (apiKey) {
                     userId = await resolveUserFromApiKey(baseUrl, apiKey);
                     if (userId)
@@ -144,9 +215,20 @@ export function startKynverMcpSseServer(options) {
                 });
                 return;
             }
+            // Connection caps — bound total + per-user concurrent SSE sessions so an
+            // authenticated caller can't exhaust memory/sockets by opening many.
+            const allEntries = Object.values(sessions);
+            if (allEntries.length >= maxSessions) {
+                json(res, 503, { error: "Server at capacity. Try again shortly." });
+                return;
+            }
+            if (allEntries.filter((s) => s.userId === userId).length >= maxSessionsPerUser) {
+                json(res, 429, { error: "Too many concurrent connections for this account." });
+                return;
+            }
             console.log(`[MCP SSE] New connection (${options.label}, user: ${userId.slice(0, 8)}...)`);
             const transport = new SSEServerTransport("/messages", res);
-            sessions[transport.sessionId] = { transport, userId, auth };
+            sessions[transport.sessionId] = { transport, userId, auth, lastActivity: Date.now() };
             res.on("close", () => {
                 delete sessions[transport.sessionId];
             });
@@ -165,6 +247,12 @@ export function startKynverMcpSseServer(options) {
                 json(res, 401, { error: "Unauthorized. Re-send the same credentials used to open the SSE session." });
                 return;
             }
+            // Per-user rate limit on tool/message traffic.
+            if (!rateLimiter.check(`msg:${entry.userId}`)) {
+                json(res, 429, { error: "Too many requests. Slow down and retry." });
+                return;
+            }
+            entry.lastActivity = Date.now();
             try {
                 const body = await parseJsonBody(req);
                 await options.requestContext.run({ userId: entry.userId }, async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/mcp-estimator",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "files": [
     "dist",
     "!dist/**/__tests__/**",

package/dist/tools/create-estimate.d.ts

@@ -1,107 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    type: z.ZodEnum<["replacement", "repair_service"]>;
-    projectName: z.ZodString;
-    roofMaterial: z.ZodOptional<z.ZodString>;
-    footprintSqFt: z.ZodOptional<z.ZodNumber>;
-    pitch: z.ZodOptional<z.ZodString>;
-    layers: z.ZodOptional<z.ZodNumber>;
-    ridgeLengthFt: z.ZodOptional<z.ZodNumber>;
-    eavesFt: z.ZodOptional<z.ZodNumber>;
-    lineItems: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        serviceCode: z.ZodString;
-        materialType: z.ZodOptional<z.ZodString>;
-        quantity: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}>;
-export declare const name = "estimator_create_estimate";
-export declare const description = "Create a roofing estimate. For replacement: provide dimensions and material. For repair: provide service items with quantities.";
-export declare const inputSchemaZod: z.ZodObject<{
-    type: z.ZodEnum<["replacement", "repair_service"]>;
-    projectName: z.ZodString;
-    roofMaterial: z.ZodOptional<z.ZodString>;
-    footprintSqFt: z.ZodOptional<z.ZodNumber>;
-    pitch: z.ZodOptional<z.ZodString>;
-    layers: z.ZodOptional<z.ZodNumber>;
-    ridgeLengthFt: z.ZodOptional<z.ZodNumber>;
-    eavesFt: z.ZodOptional<z.ZodNumber>;
-    lineItems: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        serviceCode: z.ZodString;
-        materialType: z.ZodOptional<z.ZodString>;
-        quantity: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/create-estimate.js

@@ -1,64 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const lineItemSchema = z.object({
-    serviceCode: z.string(),
-    materialType: z.string().optional(),
-    quantity: z.number(),
-});
-const inputSchema = z.object({
-    type: z.enum(["replacement", "repair_service"]),
-    projectName: z.string(),
-    roofMaterial: z.string().optional(),
-    // For replacement
-    footprintSqFt: z.number().optional(),
-    pitch: z.string().optional(),
-    layers: z.number().optional(),
-    ridgeLengthFt: z.number().optional(),
-    eavesFt: z.number().optional(),
-    // For repair
-    lineItems: z.array(lineItemSchema).optional(),
-});
-export const name = "estimator_create_estimate";
-export const description = "Create a roofing estimate. For replacement: provide dimensions and material. For repair: provide service items with quantities.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    // Build a descriptive message for the estimator agent
-    let message;
-    if (args.type === "replacement") {
-        const parts = [
-            `Create a roof replacement estimate for project "${args.projectName}".`,
-        ];
-        if (args.roofMaterial)
-            parts.push(`Material: ${args.roofMaterial}.`);
-        if (args.footprintSqFt != null)
-            parts.push(`Footprint: ${args.footprintSqFt} sq ft.`);
-        if (args.pitch)
-            parts.push(`Pitch: ${args.pitch}.`);
-        if (args.layers != null)
-            parts.push(`Layers: ${args.layers}.`);
-        if (args.ridgeLengthFt != null)
-            parts.push(`Ridge length: ${args.ridgeLengthFt} ft.`);
-        if (args.eavesFt != null)
-            parts.push(`Eaves: ${args.eavesFt} ft.`);
-        message = parts.join(" ");
-    }
-    else {
-        const parts = [
-            `Create a roof repair/service estimate for project "${args.projectName}".`,
-        ];
-        if (args.roofMaterial)
-            parts.push(`Material: ${args.roofMaterial}.`);
-        if (args.lineItems && args.lineItems.length > 0) {
-            const itemDescriptions = args.lineItems.map((item) => {
-                const mat = item.materialType ? ` (${item.materialType})` : "";
-                return `${item.serviceCode}${mat} x${item.quantity}`;
-            });
-            parts.push(`Line items: ${itemDescriptions.join(", ")}.`);
-        }
-        message = parts.join(" ");
-    }
-    const data = await client.post("/v1/agents/kynver-estimator/chat", { message });
-    return JSON.stringify(data);
-}

package/dist/tools/estimator-chat.d.ts

@@ -1,25 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    message: z.ZodString;
-    conversationId: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    message: string;
-    conversationId?: string | undefined;
-}, {
-    message: string;
-    conversationId?: string | undefined;
-}>;
-export declare const name = "estimator_chat";
-export declare const description = "Chat with the Kynver roofing estimator agent. Describe work to get estimates, manage your price catalog, or ask questions about your pricing.";
-export declare const inputSchemaZod: z.ZodObject<{
-    message: z.ZodString;
-    conversationId: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    message: string;
-    conversationId?: string | undefined;
-}, {
-    message: string;
-    conversationId?: string | undefined;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/estimator-chat.js

@@ -1,15 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const inputSchema = z.object({
-    message: z.string(),
-    conversationId: z.string().optional(),
-});
-export const name = "estimator_chat";
-export const description = "Chat with the Kynver roofing estimator agent. Describe work to get estimates, manage your price catalog, or ask questions about your pricing.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    const data = await client.post("/v1/agents/kynver-estimator/chat", { message: args.message, conversationId: args.conversationId });
-    return JSON.stringify(data);
-}

package/dist/tools/get-estimate.d.ts

@@ -1,19 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    estimateId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    estimateId: string;
-}, {
-    estimateId: string;
-}>;
-export declare const name = "estimator_get_estimate";
-export declare const description = "Get a specific estimate with all line items and totals.";
-export declare const inputSchemaZod: z.ZodObject<{
-    estimateId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    estimateId: string;
-}, {
-    estimateId: string;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/get-estimate.js

@@ -1,14 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const inputSchema = z.object({
-    estimateId: z.string(),
-});
-export const name = "estimator_get_estimate";
-export const description = "Get a specific estimate with all line items and totals.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    const data = await client.get(`/estimator/estimates/${args.estimateId}`);
-    return JSON.stringify(data);
-}

package/dist/tools/list-catalog.d.ts

@@ -1,25 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    category: z.ZodOptional<z.ZodString>;
-    materialType: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}>;
-export declare const name = "estimator_list_catalog";
-export declare const description = "List items in the service catalog (your prices). Optionally filter by category or material type.";
-export declare const inputSchemaZod: z.ZodObject<{
-    category: z.ZodOptional<z.ZodString>;
-    materialType: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/list-catalog.js

@@ -1,22 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const inputSchema = z.object({
-    category: z.string().optional(),
-    materialType: z.string().optional(),
-});
-export const name = "estimator_list_catalog";
-export const description = "List items in the service catalog (your prices). Optionally filter by category or material type.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    const params = new URLSearchParams();
-    if (args.category)
-        params.set("category", args.category);
-    if (args.materialType)
-        params.set("materialType", args.materialType);
-    const q = params.toString();
-    const path = q ? `/estimator/catalog?${q}` : "/estimator/catalog";
-    const data = await client.get(path);
-    return JSON.stringify(data);
-}