@langwatch/mcp-server 2.1.0 → 3.0.0

package/src/__tests__/http-transport.integration.test.ts

@@ -1,395 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { initConfig } from "../config.js";
-import type { ApiKeyVerifier } from "../http-security.js";
-import type { Server } from "http";
-
-/** Standard headers required by the MCP Streamable HTTP protocol for POST requests */
-const MCP_POST_HEADERS = {
-  "Content-Type": "application/json",
-  Accept: "application/json, text/event-stream",
-};
-
-const BEARER_TOKEN = "test-session-key";
-
-/**
- * Stands in for the LangWatch API. The standalone server has no database, so
- * it asks the API whether a key is real; here one key is.
- */
-function stubVerifier(validKeys: string[]): ApiKeyVerifier {
-  return {
-    verify: async (apiKey: string) => validKeys.includes(apiKey),
-    sweep: () => undefined,
-    clear: () => undefined,
-  };
-}
-
-/** Helper to create auth + MCP headers */
-function mcpHeaders({
-  sessionId,
-  apiKey,
-}: { sessionId?: string; apiKey?: string } = {}) {
-  const headers: Record<string, string> = {
-    ...MCP_POST_HEADERS,
-    Authorization: `Bearer ${apiKey ?? BEARER_TOKEN}`,
-  };
-  if (sessionId) {
-    headers["mcp-session-id"] = sessionId;
-  }
-  return headers;
-}
-
-function initializeBody() {
-  return JSON.stringify({
-    jsonrpc: "2.0",
-    method: "initialize",
-    params: {
-      protocolVersion: "2025-03-26",
-      capabilities: {},
-      clientInfo: { name: "test-client", version: "1.0.0" },
-    },
-    id: 1,
-  });
-}
-
-describe("HTTP transport", () => {
-  let httpServer: Server;
-  let port: number;
-  let baseUrl: string;
-
-  beforeAll(async () => {
-    // Initialize with no API key -- HTTP mode relies on per-session Bearer tokens
-    initConfig({
-      endpoint: "https://app.langwatch.ai",
-    });
-
-    const { startHttpServer } = await import("../http-server.js");
-    const result = await startHttpServer({
-      port: 0,
-      apiKeyVerifier: stubVerifier([BEARER_TOKEN, "my-langwatch-api-key"]),
-    });
-    httpServer = result.server;
-    port = result.port;
-    baseUrl = `http://127.0.0.1:${port}`;
-  });
-
-  afterAll(async () => {
-    await new Promise<void>((resolve) => {
-      httpServer.close(() => resolve());
-    });
-  });
-
-  describe("/health endpoint", () => {
-    it("returns ok status without authentication", async () => {
-      const response = await fetch(`${baseUrl}/health`);
-      const body = await response.json();
-
-      expect(response.status).toBe(200);
-      expect(body).toEqual({ status: "ok" });
-    });
-  });
-
-  describe("CORS headers", () => {
-    it("sends no Access-Control-Allow-Origin when the request has no Origin", async () => {
-      const response = await fetch(`${baseUrl}/health`);
-
-      expect(response.status).toBe(200);
-      expect(response.headers.get("access-control-allow-origin")).toBeNull();
-    });
-
-    it("reflects an allowed origin rather than answering with a wildcard", async () => {
-      const response = await fetch(`${baseUrl}/health`, {
-        headers: { Origin: "http://localhost:5173" },
-      });
-
-      expect(response.headers.get("access-control-allow-origin")).toBe(
-        "http://localhost:5173"
-      );
-      expect(response.headers.get("vary")).toContain("Origin");
-    });
-
-    it("responds to OPTIONS preflight requests", async () => {
-      const response = await fetch(`${baseUrl}/mcp`, {
-        method: "OPTIONS",
-      });
-
-      expect(response.status).toBe(204);
-      expect(response.headers.get("access-control-allow-methods")).toContain(
-        "POST"
-      );
-      expect(response.headers.get("access-control-allow-headers")).toContain(
-        "mcp-session-id"
-      );
-    });
-
-    it("includes Authorization in allowed headers for CORS", async () => {
-      const response = await fetch(`${baseUrl}/mcp`, {
-        method: "OPTIONS",
-      });
-
-      expect(response.headers.get("access-control-allow-headers")).toContain(
-        "Authorization"
-      );
-    });
-  });
-
-  describe("/mcp endpoint (Streamable HTTP)", () => {
-    describe("when no Bearer token is provided", () => {
-      it("returns 401 on initialize request", async () => {
-        const response = await fetch(`${baseUrl}/mcp`, {
-          method: "POST",
-          headers: MCP_POST_HEADERS,
-          body: initializeBody(),
-        });
-
-        expect(response.status).toBe(401);
-        const body = await response.json();
-        expect(body.error).toContain("Authorization");
-      });
-    });
-
-    it("rejects non-initialize POST without session ID", async () => {
-      const response = await fetch(`${baseUrl}/mcp`, {
-        method: "POST",
-        headers: {
-          ...MCP_POST_HEADERS,
-          Authorization: `Bearer ${BEARER_TOKEN}`,
-        },
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          method: "tools/list",
-          id: 1,
-        }),
-      });
-
-      expect(response.status).toBe(400);
-    });
-
-    it("accepts initialize request with Bearer token and returns session ID", async () => {
-      const response = await fetch(`${baseUrl}/mcp`, {
-        method: "POST",
-        headers: mcpHeaders(),
-        body: initializeBody(),
-      });
-
-      expect(response.status).toBe(200);
-      const sessionId = response.headers.get("mcp-session-id");
-      expect(sessionId).toBeTruthy();
-    });
-
-    it("lists all tools after initialization", async () => {
-      const initResponse = await fetch(`${baseUrl}/mcp`, {
-        method: "POST",
-        headers: mcpHeaders(),
-        body: initializeBody(),
-      });
-
-      const sessionId = initResponse.headers.get("mcp-session-id")!;
-
-      // Send initialized notification
-      await fetch(`${baseUrl}/mcp`, {
-        method: "POST",
-        headers: mcpHeaders({ sessionId }),
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          method: "notifications/initialized",
-        }),
-      });
-
-      // List tools
-      const toolsResponse = await fetch(`${baseUrl}/mcp`, {
-        method: "POST",
-        headers: mcpHeaders({ sessionId }),
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          method: "tools/list",
-          id: 2,
-        }),
-      });
-
-      expect(toolsResponse.status).toBe(200);
-      const text = await toolsResponse.text();
-      expect(text).toContain("fetch_langwatch_docs");
-      expect(text).toContain("discover_schema");
-      expect(text).toContain("search_traces");
-      expect(text).toContain("platform_create_prompt");
-    });
-  });
-
-  describe("DELETE /mcp", () => {
-    it("closes an existing session", async () => {
-      const initResponse = await fetch(`${baseUrl}/mcp`, {
-        method: "POST",
-        headers: mcpHeaders(),
-        body: initializeBody(),
-      });
-
-      const sessionId = initResponse.headers.get("mcp-session-id")!;
-
-      const deleteResponse = await fetch(`${baseUrl}/mcp`, {
-        method: "DELETE",
-        headers: {
-          "mcp-session-id": sessionId,
-          Authorization: `Bearer ${BEARER_TOKEN}`,
-        },
-      });
-
-      expect(deleteResponse.status).toBe(200);
-    });
-
-    it("returns 404 for unknown session", async () => {
-      const response = await fetch(`${baseUrl}/mcp`, {
-        method: "DELETE",
-        headers: {
-          "mcp-session-id": "nonexistent-session-id",
-          Authorization: `Bearer ${BEARER_TOKEN}`,
-        },
-      });
-
-      expect(response.status).toBe(404);
-    });
-  });
-
-  describe("OAuth 2.0 endpoints", () => {
-    describe("/.well-known/oauth-authorization-server", () => {
-      it("returns OAuth metadata with token endpoint", async () => {
-        const response = await fetch(
-          `${baseUrl}/.well-known/oauth-authorization-server`
-        );
-        const body = await response.json();
-
-        expect(response.status).toBe(200);
-        expect(body.token_endpoint).toContain("/oauth/token");
-        expect(body.grant_types_supported).toContain("client_credentials");
-      });
-    });
-
-    describe("/oauth/token", () => {
-      it("returns 400 for unsupported grant type", async () => {
-        const response = await fetch(`${baseUrl}/oauth/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: "grant_type=authorization_code&client_secret=test-key",
-        });
-        const body = await response.json();
-
-        expect(response.status).toBe(400);
-        expect(body.error).toBe("unsupported_grant_type");
-      });
-
-      it("returns 400 when client_secret is missing", async () => {
-        const response = await fetch(`${baseUrl}/oauth/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: "grant_type=client_credentials",
-        });
-        const body = await response.json();
-
-        expect(response.status).toBe(400);
-        expect(body.error).toBe("invalid_request");
-      });
-
-      it("issues an access token for valid client credentials", async () => {
-        const response = await fetch(`${baseUrl}/oauth/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: "grant_type=client_credentials&client_secret=my-langwatch-api-key",
-        });
-        const body = await response.json();
-
-        expect(response.status).toBe(200);
-        expect(body.access_token).toBeTruthy();
-        expect(body.token_type).toBe("Bearer");
-        expect(body.expires_in).toBe(3600);
-      });
-
-      it("issued token works for MCP initialize request", async () => {
-        // Get OAuth token
-        const tokenResponse = await fetch(`${baseUrl}/oauth/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: `grant_type=client_credentials&client_secret=${BEARER_TOKEN}`,
-        });
-        expect(tokenResponse.status).toBe(200);
-        const { access_token } = await tokenResponse.json();
-        expect(access_token).toBeTruthy();
-
-        // Use OAuth token for MCP initialize
-        const response = await fetch(`${baseUrl}/mcp`, {
-          method: "POST",
-          headers: {
-            ...MCP_POST_HEADERS,
-            Authorization: `Bearer ${access_token}`,
-          },
-          body: initializeBody(),
-        });
-
-        expect(response.status).toBe(200);
-        expect(response.headers.get("mcp-session-id")).toBeTruthy();
-      });
-
-      it("issued token works for SSE connection", async () => {
-        const controller = new AbortController();
-
-        // Get OAuth token
-        const tokenResponse = await fetch(`${baseUrl}/oauth/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: `grant_type=client_credentials&client_secret=${BEARER_TOKEN}`,
-        });
-        expect(tokenResponse.status).toBe(200);
-        const { access_token } = await tokenResponse.json();
-        expect(access_token).toBeTruthy();
-
-        // Use OAuth token for SSE
-        const response = await fetch(`${baseUrl}/sse`, {
-          signal: controller.signal,
-          headers: { Authorization: `Bearer ${access_token}` },
-        });
-
-        expect(response.status).toBe(200);
-        expect(response.headers.get("content-type")).toContain(
-          "text/event-stream"
-        );
-
-        controller.abort();
-      });
-    });
-  });
-
-  describe("/sse endpoint (legacy SSE)", () => {
-    it("returns 401 without authorization", async () => {
-      const controller = new AbortController();
-
-      const response = await fetch(`${baseUrl}/sse`, {
-        signal: controller.signal,
-      });
-
-      expect(response.status).toBe(401);
-      controller.abort();
-    });
-
-    it("establishes SSE connection with Bearer token in header", async () => {
-      const controller = new AbortController();
-
-      const response = await fetch(`${baseUrl}/sse`, {
-        signal: controller.signal,
-        headers: { Authorization: `Bearer ${BEARER_TOKEN}` },
-      });
-
-      expect(response.status).toBe(200);
-      expect(response.headers.get("content-type")).toContain(
-        "text/event-stream"
-      );
-
-      const reader = response.body!.getReader();
-      const decoder = new TextDecoder();
-      const { value } = await reader.read();
-      const text = decoder.decode(value);
-
-      expect(text).toContain("event: endpoint");
-      expect(text).toContain("/messages?sessionId=");
-
-      controller.abort();
-    });
-  });
-});

package/src/__tests__/integration.integration.test.ts

@@ -1,284 +0,0 @@
-import { createServer, type Server } from "http";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { initConfig } from "../config.js";
-
-// --- Canned responses for each API endpoint ---
-
-const CANNED_TRACES_SEARCH = {
-  traces: [
-    {
-      trace_id: "trace-001",
-      formatted_trace: "Root [server] 1200ms\n  LLM Call [llm] 500ms\n    Input: Hello, how are you?\n    Output: I am fine, thank you!",
-      input: { value: "Hello, how are you?" },
-      output: { value: "I am fine, thank you!" },
-      timestamps: { started_at: 1700000000000 },
-      metadata: { user_id: "user-42" },
-    },
-  ],
-  pagination: { totalHits: 1 },
-};
-
-const CANNED_TRACE_DETAIL = {
-  trace_id: "trace-001",
-  formatted_trace: "Root [server] 1200ms\n  LLM Call [llm] 500ms\n    Input: Hello\n    Output: Hi there",
-  timestamps: {
-    started_at: 1700000000000,
-    inserted_at: 1700000001000,
-  },
-  metadata: { user_id: "user-42", thread_id: "thread-1" },
-  evaluations: [
-    {
-      evaluator_id: "eval-1",
-      name: "Faithfulness",
-      score: 0.95,
-      passed: true,
-    },
-  ],
-};
-
-const CANNED_ANALYTICS = {
-  currentPeriod: [
-    { date: "2024-01-01", "0__trace_id_cardinality": 42 },
-    { date: "2024-01-02", "0__trace_id_cardinality": 58 },
-  ],
-  previousPeriod: [],
-};
-
-const CANNED_PROMPTS_LIST = [
-  {
-    id: "p1",
-    handle: "greeting-bot",
-    name: "Greeting Bot",
-    latestVersionNumber: 3,
-  },
-  {
-    id: "p2",
-    handle: "qa-assistant",
-    name: "QA Assistant",
-    latestVersionNumber: 1,
-  },
-];
-
-const CANNED_PROMPT_DETAIL = {
-  id: "p1",
-  handle: "greeting-bot",
-  name: "Greeting Bot",
-  version: 3,
-  versionId: "ver_p1v3",
-  commitMessage: "Updated tone",
-  model: "openai/gpt-4o",
-  messages: [{ role: "system", content: "You are a friendly bot." }],
-  parameters: {},
-  tags: [{ name: "latest", versionId: "ver_p1v3" }],
-};
-
-const CANNED_PROMPT_CREATED = {
-  id: "p-new",
-  handle: "new-prompt",
-  name: "New Prompt",
-  latestVersionNumber: 1,
-};
-
-const CANNED_PROMPT_UPDATED = {
-  id: "p1",
-  handle: "greeting-bot",
-  latestVersionNumber: 4,
-};
-
-// --- Mock HTTP Server ---
-
-function createMockServer(): Server {
-  return createServer((req, res) => {
-    const authToken = req.headers["x-auth-token"];
-    if (authToken !== "test-integration-key") {
-      res.writeHead(401, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ message: "Invalid auth token." }));
-      return;
-    }
-
-    let body = "";
-    req.on("data", (chunk: string) => (body += chunk));
-    req.on("end", () => {
-      const url = req.url ?? "";
-      res.setHeader("Content-Type", "application/json");
-
-      if (url === "/api/traces/search" && req.method === "POST") {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_TRACES_SEARCH));
-      } else if (
-        url.match(/^\/api\/traces\/[^/]+(\?|$)/) &&
-        req.method === "GET"
-      ) {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_TRACE_DETAIL));
-      } else if (
-        url === "/api/analytics/timeseries" &&
-        req.method === "POST"
-      ) {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_ANALYTICS));
-      } else if (url === "/api/prompts" && req.method === "GET") {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_PROMPTS_LIST));
-      } else if (url.match(/^\/api\/prompts\/[^/]+$/) && req.method === "GET") {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_PROMPT_DETAIL));
-      } else if (url === "/api/prompts" && req.method === "POST") {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_PROMPT_CREATED));
-      } else if (
-        url.match(/^\/api\/prompts\/[^/]+$/) &&
-        req.method === "PUT"
-      ) {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_PROMPT_UPDATED));
-      } else {
-        res.writeHead(404);
-        res.end(
-          JSON.stringify({ message: `Not found: ${req.method} ${url}` })
-        );
-      }
-    });
-  });
-}
-
-// --- Integration Tests ---
-
-describe("MCP tools integration", () => {
-  let server: Server;
-  let port: number;
-
-  beforeAll(async () => {
-    server = createMockServer();
-    await new Promise<void>((resolve) => {
-      server.listen(0, () => {
-        const addr = server.address();
-        port = typeof addr === "object" && addr ? addr.port : 0;
-        initConfig({
-          apiKey: "test-integration-key",
-          endpoint: `http://localhost:${port}`,
-        });
-        resolve();
-      });
-    });
-  });
-
-  afterAll(async () => {
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-  });
-
-  describe("search_traces", () => {
-    it("returns formatted trace digests from mock server", async () => {
-      const { handleSearchTraces } = await import(
-        "../tools/search-traces.js"
-      );
-      const result = await handleSearchTraces({
-        startDate: "24h",
-        endDate: "now",
-      });
-      expect(result).toContain("trace-001");
-      expect(result).toContain("LLM Call [llm] 500ms");
-      expect(result).toContain("1 trace");
-    });
-  });
-
-  describe("get_trace", () => {
-    it("returns formatted trace digest from mock server", async () => {
-      const { handleGetTrace } = await import("../tools/get-trace.js");
-      const result = await handleGetTrace({ traceId: "trace-001" });
-      expect(result).toContain("trace-001");
-      expect(result).toContain("LLM Call [llm] 500ms");
-      expect(result).toContain("Faithfulness");
-      expect(result).toContain("PASSED");
-    });
-  });
-
-  describe("get_analytics", () => {
-    it("returns formatted analytics data from mock server", async () => {
-      const { handleGetAnalytics } = await import(
-        "../tools/get-analytics.js"
-      );
-      const result = await handleGetAnalytics({
-        metric: "metadata.trace_id",
-        aggregation: "cardinality",
-        startDate: "7d",
-      });
-      expect(result).toContain("42");
-      expect(result).toContain("58");
-    });
-  });
-
-  describe("platform_list_prompts", () => {
-    it("returns formatted prompt list from mock server", async () => {
-      const { handleListPrompts } = await import("../tools/list-prompts.js");
-      const result = await handleListPrompts();
-      expect(result).toContain("greeting-bot");
-      expect(result).toContain("Greeting Bot");
-      expect(result).toContain("qa-assistant");
-    });
-  });
-
-  describe("platform_get_prompt", () => {
-    it("returns formatted prompt details from mock server", async () => {
-      const { handleGetPrompt } = await import("../tools/get-prompt.js");
-      const result = await handleGetPrompt({ idOrHandle: "greeting-bot" });
-      expect(result).toContain("Greeting Bot");
-      expect(result).toContain("gpt-4o");
-      expect(result).toContain("You are a friendly bot.");
-      expect(result).toContain("v3");
-    });
-  });
-
-  describe("platform_create_prompt", () => {
-    it("returns success message from mock server", async () => {
-      const { handleCreatePrompt } = await import(
-        "../tools/create-prompt.js"
-      );
-      const result = await handleCreatePrompt({
-        name: "New Prompt",
-        messages: [{ role: "system", content: "You are helpful." }],
-        model: "openai/gpt-4o",
-      });
-      expect(result).toContain("created successfully");
-      expect(result).toContain("p-new");
-    });
-  });
-
-  describe("platform_update_prompt", () => {
-    it("returns success message from mock server", async () => {
-      const { handleUpdatePrompt } = await import(
-        "../tools/update-prompt.js"
-      );
-      const result = await handleUpdatePrompt({
-        idOrHandle: "greeting-bot",
-        model: "openai/gpt-4o-mini",
-        commitMessage: "Switch to mini",
-      });
-      expect(result).toContain("updated successfully");
-      expect(result).toContain("Switch to mini");
-    });
-  });
-
-  describe("when API key is invalid", () => {
-    afterAll(() => {
-      initConfig({
-        apiKey: "test-integration-key",
-        endpoint: `http://localhost:${port}`,
-      });
-    });
-
-    it("throws an error with 401 status", async () => {
-      initConfig({
-        apiKey: "bad-key",
-        endpoint: `http://localhost:${port}`,
-      });
-
-      const { handleSearchTraces } = await import(
-        "../tools/search-traces.js"
-      );
-      await expect(
-        handleSearchTraces({ startDate: "24h" })
-      ).rejects.toThrow("401");
-    });
-  });
-});