@kynver-app/mcp-estimator 0.2.11 → 0.2.12

package/dist/lib/mcp-sse-server.js

@@ -4,7 +4,7 @@ import { createServer } from "node:http";
 import { timingSafeEqual } from "node:crypto";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 export const MAX_SSE_BODY_BYTES = 1 * 1024 * 1024;
-const FORBIDDEN_QUERY_KEYS = ["secret", "userId"];
+const FORBIDDEN_QUERY_KEYS = ["apiKey", "secret", "userId"];
 export function headerValue(req, name) {
     const v = req.headers[name];
     return typeof v === "string" ? v : Array.isArray(v) ? (v[0] ?? null) : null;
@@ -19,9 +19,6 @@ export function timingSafeEqualString(a, b) {
 export function hasForbiddenQueryAuth(url) {
     return FORBIDDEN_QUERY_KEYS.some((key) => url.searchParams.has(key));
 }
-function queryApiKey(url) {
-    return url.searchParams.get("apiKey")?.trim() ?? "";
-}
 export function resolveListenHost() {
     const configured = process.env.MCP_SSE_HOST?.trim();
     return configured || "127.0.0.1";
@@ -130,7 +127,7 @@ function resolveInternalAuth(req, serviceSecret) {
 }
 function verifyPostAuth(req, url, sessionAuth, serviceSecret) {
     if (sessionAuth.kind === "apiKey") {
-        const token = bearerToken(req) || queryApiKey(url);
+        const token = bearerToken(req);
         return token.length > 0 && timingSafeEqualString(token, sessionAuth.apiKey);
     }
     const internal = resolveInternalAuth(req, serviceSecret);
@@ -170,7 +167,6 @@ export function startKynverMcpSseServer(options) {
     const maxSessionsPerUser = intFromEnv("MCP_SSE_MAX_SESSIONS_PER_USER", 20);
     const idleTimeoutMs = intFromEnv("MCP_SSE_IDLE_TIMEOUT_MS", 5 * 60 * 1000);
     const rateLimitPerMin = intFromEnv("MCP_SSE_RATE_LIMIT_PER_MIN", 120);
-    const rejectQueryApiKey = /^(1|true|yes)$/i.test(process.env.MCP_SSE_REJECT_QUERY_APIKEY ?? "");
     const rateLimiter = createFixedWindowRateLimiter(rateLimitPerMin, 60 * 1000);
     // Close idle SSE sessions so a flood of half-open connections can't pin memory.
     const idleSweep = setInterval(() => {
@@ -198,15 +194,6 @@ export function startKynverMcpSseServer(options) {
                 });
                 return;
             }
-            if (url.searchParams.has("apiKey")) {
-                if (rejectQueryApiKey) {
-                    json(res, 400, {
-                        error: "apiKey via query param is disabled. Use Authorization: Bearer <key>.",
-                    });
-                    return;
-                }
-                console.warn("[MCP SSE] WARNING: apiKey in query string may leak via logs. Prefer Authorization header when your client supports it.");
-            }
             let userId = null;
             let auth = null;
             const internal = serviceSecret ? resolveInternalAuth(req, serviceSecret) : null;
@@ -215,7 +202,7 @@ export function startKynverMcpSseServer(options) {
                 auth = internal.auth;
             }
             else {
-                const apiKey = bearerToken(req) || queryApiKey(url);
+                const apiKey = bearerToken(req);
                 if (apiKey) {
                     userId = await resolveUserFromApiKey(baseUrl, apiKey);
                     if (userId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/mcp-estimator",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "files": [
     "dist",
     "!dist/**/__tests__/**",

package/dist/tools/create-estimate.d.ts

@@ -1,107 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    type: z.ZodEnum<["replacement", "repair_service"]>;
-    projectName: z.ZodString;
-    roofMaterial: z.ZodOptional<z.ZodString>;
-    footprintSqFt: z.ZodOptional<z.ZodNumber>;
-    pitch: z.ZodOptional<z.ZodString>;
-    layers: z.ZodOptional<z.ZodNumber>;
-    ridgeLengthFt: z.ZodOptional<z.ZodNumber>;
-    eavesFt: z.ZodOptional<z.ZodNumber>;
-    lineItems: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        serviceCode: z.ZodString;
-        materialType: z.ZodOptional<z.ZodString>;
-        quantity: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}>;
-export declare const name = "estimator_create_estimate";
-export declare const description = "Create a roofing estimate. For replacement: provide dimensions and material. For repair: provide service items with quantities.";
-export declare const inputSchemaZod: z.ZodObject<{
-    type: z.ZodEnum<["replacement", "repair_service"]>;
-    projectName: z.ZodString;
-    roofMaterial: z.ZodOptional<z.ZodString>;
-    footprintSqFt: z.ZodOptional<z.ZodNumber>;
-    pitch: z.ZodOptional<z.ZodString>;
-    layers: z.ZodOptional<z.ZodNumber>;
-    ridgeLengthFt: z.ZodOptional<z.ZodNumber>;
-    eavesFt: z.ZodOptional<z.ZodNumber>;
-    lineItems: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        serviceCode: z.ZodString;
-        materialType: z.ZodOptional<z.ZodString>;
-        quantity: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }, {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}, {
-    type: "replacement" | "repair_service";
-    projectName: string;
-    roofMaterial?: string | undefined;
-    footprintSqFt?: number | undefined;
-    pitch?: string | undefined;
-    layers?: number | undefined;
-    ridgeLengthFt?: number | undefined;
-    eavesFt?: number | undefined;
-    lineItems?: {
-        serviceCode: string;
-        quantity: number;
-        materialType?: string | undefined;
-    }[] | undefined;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/create-estimate.js

@@ -1,64 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const lineItemSchema = z.object({
-    serviceCode: z.string(),
-    materialType: z.string().optional(),
-    quantity: z.number(),
-});
-const inputSchema = z.object({
-    type: z.enum(["replacement", "repair_service"]),
-    projectName: z.string(),
-    roofMaterial: z.string().optional(),
-    // For replacement
-    footprintSqFt: z.number().optional(),
-    pitch: z.string().optional(),
-    layers: z.number().optional(),
-    ridgeLengthFt: z.number().optional(),
-    eavesFt: z.number().optional(),
-    // For repair
-    lineItems: z.array(lineItemSchema).optional(),
-});
-export const name = "estimator_create_estimate";
-export const description = "Create a roofing estimate. For replacement: provide dimensions and material. For repair: provide service items with quantities.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    // Build a descriptive message for the estimator agent
-    let message;
-    if (args.type === "replacement") {
-        const parts = [
-            `Create a roof replacement estimate for project "${args.projectName}".`,
-        ];
-        if (args.roofMaterial)
-            parts.push(`Material: ${args.roofMaterial}.`);
-        if (args.footprintSqFt != null)
-            parts.push(`Footprint: ${args.footprintSqFt} sq ft.`);
-        if (args.pitch)
-            parts.push(`Pitch: ${args.pitch}.`);
-        if (args.layers != null)
-            parts.push(`Layers: ${args.layers}.`);
-        if (args.ridgeLengthFt != null)
-            parts.push(`Ridge length: ${args.ridgeLengthFt} ft.`);
-        if (args.eavesFt != null)
-            parts.push(`Eaves: ${args.eavesFt} ft.`);
-        message = parts.join(" ");
-    }
-    else {
-        const parts = [
-            `Create a roof repair/service estimate for project "${args.projectName}".`,
-        ];
-        if (args.roofMaterial)
-            parts.push(`Material: ${args.roofMaterial}.`);
-        if (args.lineItems && args.lineItems.length > 0) {
-            const itemDescriptions = args.lineItems.map((item) => {
-                const mat = item.materialType ? ` (${item.materialType})` : "";
-                return `${item.serviceCode}${mat} x${item.quantity}`;
-            });
-            parts.push(`Line items: ${itemDescriptions.join(", ")}.`);
-        }
-        message = parts.join(" ");
-    }
-    const data = await client.post("/v1/agents/kynver-estimator/chat", { message });
-    return JSON.stringify(data);
-}

package/dist/tools/estimator-chat.d.ts

@@ -1,25 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    message: z.ZodString;
-    conversationId: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    message: string;
-    conversationId?: string | undefined;
-}, {
-    message: string;
-    conversationId?: string | undefined;
-}>;
-export declare const name = "estimator_chat";
-export declare const description = "Chat with the Kynver roofing estimator agent. Describe work to get estimates, manage your price catalog, or ask questions about your pricing.";
-export declare const inputSchemaZod: z.ZodObject<{
-    message: z.ZodString;
-    conversationId: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    message: string;
-    conversationId?: string | undefined;
-}, {
-    message: string;
-    conversationId?: string | undefined;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/estimator-chat.js

@@ -1,15 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const inputSchema = z.object({
-    message: z.string(),
-    conversationId: z.string().optional(),
-});
-export const name = "estimator_chat";
-export const description = "Chat with the Kynver roofing estimator agent. Describe work to get estimates, manage your price catalog, or ask questions about your pricing.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    const data = await client.post("/v1/agents/kynver-estimator/chat", { message: args.message, conversationId: args.conversationId });
-    return JSON.stringify(data);
-}

package/dist/tools/get-estimate.d.ts

@@ -1,19 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    estimateId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    estimateId: string;
-}, {
-    estimateId: string;
-}>;
-export declare const name = "estimator_get_estimate";
-export declare const description = "Get a specific estimate with all line items and totals.";
-export declare const inputSchemaZod: z.ZodObject<{
-    estimateId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    estimateId: string;
-}, {
-    estimateId: string;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/get-estimate.js

@@ -1,14 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const inputSchema = z.object({
-    estimateId: z.string(),
-});
-export const name = "estimator_get_estimate";
-export const description = "Get a specific estimate with all line items and totals.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    const data = await client.get(`/estimator/estimates/${args.estimateId}`);
-    return JSON.stringify(data);
-}

package/dist/tools/list-catalog.d.ts

@@ -1,25 +0,0 @@
-import { z } from "zod";
-declare const inputSchema: z.ZodObject<{
-    category: z.ZodOptional<z.ZodString>;
-    materialType: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}>;
-export declare const name = "estimator_list_catalog";
-export declare const description = "List items in the service catalog (your prices). Optionally filter by category or material type.";
-export declare const inputSchemaZod: z.ZodObject<{
-    category: z.ZodOptional<z.ZodString>;
-    materialType: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}, {
-    materialType?: string | undefined;
-    category?: string | undefined;
-}>;
-export declare function execute(args: z.infer<typeof inputSchema>): Promise<string>;
-export {};

package/dist/tools/list-catalog.js

@@ -1,22 +0,0 @@
-import { z } from "zod";
-import * as client from "../lib/kynver-client.js";
-const inputSchema = z.object({
-    category: z.string().optional(),
-    materialType: z.string().optional(),
-});
-export const name = "estimator_list_catalog";
-export const description = "List items in the service catalog (your prices). Optionally filter by category or material type.";
-export const inputSchemaZod = inputSchema;
-export async function execute(args) {
-    if (!client.hasApiKey())
-        return client.noApiKeyMessage();
-    const params = new URLSearchParams();
-    if (args.category)
-        params.set("category", args.category);
-    if (args.materialType)
-        params.set("materialType", args.materialType);
-    const q = params.toString();
-    const path = q ? `/estimator/catalog?${q}` : "/estimator/catalog";
-    const data = await client.get(path);
-    return JSON.stringify(data);
-}