@langwatch/mcp-server 1.0.0 → 2.0.0

package/.python-version

@@ -0,0 +1 @@
+3.11

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [2.0.0](https://github.com/langwatch/langwatch/compare/mcp-server@v1.0.0...mcp-server@v2.0.0) (2026-08-07)
+
+
+### ⚠ BREAKING CHANGES
+
+* **mcp-server:** three behaviors change for callers of the HTTP server. A client that authenticated once at initialize and then sent only the session id must now send Authorization: Bearer <key> on every request. GET /sse?apiKey=<key> no longer authenticates; use the Authorization header. A deployment relying on the implicit 0.0.0.0 bind must pass --host 0.0.0.0, which the published container image already does.
+
+### Features
+
+* **api-docs:** publish the REST API the SDKs actually call, and gate route coverage ([#6605](https://github.com/langwatch/langwatch/issues/6605)) ([25884bf](https://github.com/langwatch/langwatch/commit/25884bf3992eb99c00c3c7bafb09b979b02f0013))
+
+
+### Bug Fixes
+
+* **mcp-server:** authorize every request to the standalone HTTP server ([#6641](https://github.com/langwatch/langwatch/issues/6641)) ([af324de](https://github.com/langwatch/langwatch/commit/af324deeb3700f2745783a46e6fd5e8625ef868e))
+
+
+### Code Refactoring
+
+* **build:** single pnpm workspace + restructure into sdks/ platform/ services/ mcp/ infra/ (ADR-076) ([#6405](https://github.com/langwatch/langwatch/issues/6405)) ([2bbeb7d](https://github.com/langwatch/langwatch/commit/2bbeb7dd2e0747e81478f22c3165adb9163c9f99))
+
 ## [1.0.0](https://github.com/langwatch/langwatch/compare/mcp-server@v0.10.1...mcp-server@v1.0.0) (2026-07-24)
 
 

package/CONTRIBUTING.md

@@ -15,7 +15,7 @@ Thank you for your interest in contributing to the LangWatch MCP Server! This gu
 1. **Clone the repository and navigate to the MCP server directory:**
    ```bash
    git clone https://github.com/langwatch/langwatch.git
-   cd langwatch/mcp-server
+   cd langwatch/mcp/typescript
    ```
 
 2. **Install dependencies and build the MCP server:**

package/README.md

@@ -16,7 +16,7 @@ For Claude Code (manual) or other MCP clients (Cursor, Copilot, etc.), add an en
 - `args`: `-y`, then the package name `@langwatch/mcp-server` on a separate token
 - `env.LANGWATCH_API_KEY`: your LangWatch API key
 
-The API key is required for observability and prompt tools. Documentation tools work without it.
+In stdio mode the API key is required for observability and prompt tools, and documentation tools work without it. In HTTP mode every MCP request needs a valid key, including documentation-tool requests, because the server authenticates the request before it reaches any tool.
 
 > The config is described in prose rather than as a JSON snippet because some CLI agents (notably Gemini CLI 0.36.0 and earlier) parse `@`-prefixed runs as file paths and can crash with `ENAMETOOLONG` when a multi-line JSON snippet wraps the scoped package name in double quotes. See [#3104](https://github.com/langwatch/langwatch/issues/3104). The bash form above is safe — the package name is followed by a whitespace terminator.
 
@@ -26,6 +26,60 @@ The API key is required for observability and prompt tools. Documentation tools
 |---------|---------|-------------|
 | `LANGWATCH_API_KEY` | `--apiKey` | API key for authentication |
 | `LANGWATCH_ENDPOINT` | `--endpoint` | API endpoint (default: `https://app.langwatch.ai`) |
+| | `--http` | Serve over HTTP and SSE instead of stdio |
+| | `--port` | HTTP port (default: `3000`) |
+| `LANGWATCH_MCP_HTTP_HOST` | `--host` | HTTP listen address (default: `127.0.0.1`) |
+| `LANGWATCH_MCP_ALLOWED_ORIGINS` | `--allowedOrigin` | Browser origins allowed to call the HTTP server |
+| `LANGWATCH_MCP_TRUST_PROXY` | | Use `X-Forwarded-For` as the rate limit key (default: off) |
+
+### HTTP mode
+
+In HTTP mode each client brings its own API key in an `Authorization: Bearer <key>`
+header, on every MCP request rather than only at session start. That covers
+`/mcp`, `/sse`, and `/messages`. The key is checked against the LangWatch API
+before a session is created and re-checked on each request, so a session id by
+itself grants no access and revoking a key stops its sessions being served
+within a minute. The API key is never read from a query parameter.
+
+Because authentication happens before routing, this applies to the documentation
+tools too: unlike stdio mode, they are not reachable without a valid key.
+
+Three routes do not take the bearer. `/health` reports liveness only.
+`/.well-known/oauth-authorization-server` is the discovery document clients read
+before they hold a token. `/oauth/token` exchanges an API key, sent as
+`client_secret` in the form body, for a short-lived access token; it verifies
+that key against the LangWatch API before issuing anything, and the token it
+returns is what later MCP requests carry.
+
+The server listens on `127.0.0.1` by default, per the MCP transport guidance for
+local servers. Pass `--host 0.0.0.0` to accept connections from other machines,
+and only behind a network boundary you trust.
+
+Requests carrying a browser `Origin` header are checked against an allowlist.
+Loopback origins are always allowed; anything else has to be listed:
+
+```bash
+npx @langwatch/mcp-server --http --port 3000 \
+  --allowedOrigin https://your-app.example.com
+```
+
+#### Running behind a proxy
+
+Forwarded proxy headers resolve the external scheme that the OAuth metadata
+document advertises, so they are read by default.
+
+They do not decide the rate limit. Failed authentication is limited per client
+address, and that address comes from the socket rather than from
+`X-Forwarded-For`, so a client reaching the port directly cannot rotate a header
+to reset its own counter. Behind a real proxy every request shares the proxy's
+socket address, which means the whole proxy is limited as one client. Set
+`LANGWATCH_MCP_TRUST_PROXY=true` there to limit per real client instead, and
+only when the proxy overwrites `X-Forwarded-For` on the way in.
+
+This is defense in depth, not the security boundary. API keys are verified
+against the LangWatch API before a session is created and re-checked on every
+request; the rate limit exists to make guessing expensive, not to decide who
+gets in. A spoofable rate limit does not let anyone authenticate.
 
 ## Tools
 

package/dist/{archive-project-MK3673A7.js → archive-project-4EQGLBJJ.js}

@@ -1,9 +1,9 @@
 import {
   archiveProject
-} from "./chunk-XY4STOBE.js";
-import "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
+} from "./chunk-7RHG56OH.js";
+import "./chunk-A2LEVYQ5.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/archive-project.ts
 async function handleArchiveProject(params) {
@@ -17,4 +17,4 @@ async function handleArchiveProject(params) {
 export {
   handleArchiveProject
 };
-//# sourceMappingURL=archive-project-MK3673A7.js.map
+//# sourceMappingURL=archive-project-4EQGLBJJ.js.map

package/dist/{archive-scenario-KATSXRIN.js → archive-scenario-W6BXYDZ3.js}

@@ -1,9 +1,9 @@
 import {
   archiveScenario
-} from "./chunk-O3LWVN67.js";
-import "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
+} from "./chunk-J42FWRJ2.js";
+import "./chunk-A2LEVYQ5.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/archive-scenario.ts
 async function handleArchiveScenario(params) {
@@ -17,4 +17,4 @@ async function handleArchiveScenario(params) {
 export {
   handleArchiveScenario
 };
-//# sourceMappingURL=archive-scenario-KATSXRIN.js.map
+//# sourceMappingURL=archive-scenario-W6BXYDZ3.js.map

package/dist/{archive-suite-C3KX6IIZ.js → archive-suite-4T6BSRS7.js}

@@ -1,9 +1,9 @@
 import {
   archiveSuite
-} from "./chunk-WDH5P5RF.js";
-import "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
+} from "./chunk-YZLYHLLI.js";
+import "./chunk-A2LEVYQ5.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/archive-suite.ts
 async function handleArchiveSuite(params) {
@@ -13,4 +13,4 @@ async function handleArchiveSuite(params) {
 export {
   handleArchiveSuite
 };
-//# sourceMappingURL=archive-suite-C3KX6IIZ.js.map
+//# sourceMappingURL=archive-suite-4T6BSRS7.js.map

package/dist/{assign-prompt-tag-E3C5W6PI.js → assign-prompt-tag-VLXUWEKU.js}

@@ -1,8 +1,8 @@
 import {
   assignPromptTag
-} from "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
+} from "./chunk-A2LEVYQ5.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/assign-prompt-tag.ts
 async function handleAssignPromptTag(params) {
@@ -17,4 +17,4 @@ async function handleAssignPromptTag(params) {
 export {
   handleAssignPromptTag
 };
-//# sourceMappingURL=assign-prompt-tag-E3C5W6PI.js.map
+//# sourceMappingURL=assign-prompt-tag-VLXUWEKU.js.map