@leanmcp/core 0.3.12 → 0.3.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/chunk-LPEX4YW6.mjs +13 -0
- package/dist/index.d.mts +185 -17
- package/dist/index.d.ts +185 -17
- package/dist/index.js +153 -1
- package/dist/index.mjs +143 -1
- package/dist/server-BEQUIEE2.mjs +25808 -0
- package/package.json +8 -3
package/README.md
CHANGED
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
var __defProp = Object.defineProperty;
|
|
2
|
+
var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
|
|
3
|
+
var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
|
|
4
|
+
get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
|
|
5
|
+
}) : x)(function(x) {
|
|
6
|
+
if (typeof require !== "undefined") return require.apply(this, arguments);
|
|
7
|
+
throw Error('Dynamic require of "' + x + '" is not supported');
|
|
8
|
+
});
|
|
9
|
+
|
|
10
|
+
export {
|
|
11
|
+
__name,
|
|
12
|
+
__require
|
|
13
|
+
};
|
package/dist/index.d.mts
CHANGED
|
@@ -1,8 +1,36 @@
|
|
|
1
1
|
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
|
|
2
2
|
|
|
3
|
+
/**
|
|
4
|
+
* Security scheme for MCP tools (per MCP authorization spec)
|
|
5
|
+
*
|
|
6
|
+
* @example
|
|
7
|
+
* ```typescript
|
|
8
|
+
* @Tool({
|
|
9
|
+
* description: 'Fetch user data',
|
|
10
|
+
* securitySchemes: [{ type: 'oauth2', scopes: ['read:user'] }],
|
|
11
|
+
* })
|
|
12
|
+
* async fetchUser() { ... }
|
|
13
|
+
* ```
|
|
14
|
+
*/
|
|
15
|
+
interface SecurityScheme {
|
|
16
|
+
/** Type of security - 'noauth' for anonymous, 'oauth2' for OAuth */
|
|
17
|
+
type: 'noauth' | 'oauth2';
|
|
18
|
+
/** Required OAuth scopes (for oauth2 type) */
|
|
19
|
+
scopes?: string[];
|
|
20
|
+
}
|
|
3
21
|
interface ToolOptions {
|
|
4
22
|
description?: string;
|
|
5
23
|
inputClass?: any;
|
|
24
|
+
/**
|
|
25
|
+
* Security schemes for this tool (MCP authorization spec)
|
|
26
|
+
*
|
|
27
|
+
* - `noauth`: Tool is callable anonymously
|
|
28
|
+
* - `oauth2`: Tool requires OAuth 2.0 access token
|
|
29
|
+
*
|
|
30
|
+
* If both are listed, tool works anonymously but OAuth unlocks more features.
|
|
31
|
+
* If omitted, tool inherits server-level defaults.
|
|
32
|
+
*/
|
|
33
|
+
securitySchemes?: SecurityScheme[];
|
|
6
34
|
}
|
|
7
35
|
interface PromptOptions {
|
|
8
36
|
description?: string;
|
|
@@ -30,6 +58,14 @@ interface PromptOptions {
|
|
|
30
58
|
* async analyzeSentiment(args: AnalyzeSentimentInput): Promise<AnalyzeSentimentOutput> {
|
|
31
59
|
* // Tool name will be: "analyzeSentiment"
|
|
32
60
|
* }
|
|
61
|
+
*
|
|
62
|
+
* @example
|
|
63
|
+
* // Tool with OAuth requirement
|
|
64
|
+
* @Tool({
|
|
65
|
+
* description: 'Fetch private user data',
|
|
66
|
+
* securitySchemes: [{ type: 'oauth2', scopes: ['read:user'] }],
|
|
67
|
+
* })
|
|
68
|
+
* async fetchPrivateData() { ... }
|
|
33
69
|
*/
|
|
34
70
|
declare function Tool(options?: ToolOptions): MethodDecorator;
|
|
35
71
|
/**
|
|
@@ -253,6 +289,49 @@ interface HTTPServerOptions {
|
|
|
253
289
|
sessionTimeout?: number;
|
|
254
290
|
stateless?: boolean;
|
|
255
291
|
dashboard?: boolean;
|
|
292
|
+
/** OAuth/Auth configuration (MCP authorization spec) */
|
|
293
|
+
auth?: HTTPServerAuthOptions;
|
|
294
|
+
}
|
|
295
|
+
/**
|
|
296
|
+
* OAuth/Auth configuration for MCP server
|
|
297
|
+
*
|
|
298
|
+
* Enables MCP authorization spec compliance by exposing
|
|
299
|
+
* `/.well-known/oauth-protected-resource` (RFC 9728)
|
|
300
|
+
*/
|
|
301
|
+
interface HTTPServerAuthOptions {
|
|
302
|
+
/** Resource identifier (defaults to server URL) */
|
|
303
|
+
resource?: string;
|
|
304
|
+
/** Authorization servers (defaults to self) */
|
|
305
|
+
authorizationServers?: string[];
|
|
306
|
+
/** Supported OAuth scopes */
|
|
307
|
+
scopesSupported?: string[];
|
|
308
|
+
/** Documentation URL */
|
|
309
|
+
documentationUrl?: string;
|
|
310
|
+
/** Enable built-in OAuth authorization server */
|
|
311
|
+
enableOAuthServer?: boolean;
|
|
312
|
+
/** OAuth server options (when enableOAuthServer is true) */
|
|
313
|
+
oauthServerOptions?: {
|
|
314
|
+
/** Session secret for signing tokens/state */
|
|
315
|
+
sessionSecret: string;
|
|
316
|
+
/** JWT signing secret (defaults to sessionSecret if not provided) */
|
|
317
|
+
jwtSigningSecret?: string;
|
|
318
|
+
/** JWT encryption secret for encrypting upstream tokens */
|
|
319
|
+
jwtEncryptionSecret?: Buffer;
|
|
320
|
+
/** Issuer URL for JWTs */
|
|
321
|
+
issuer?: string;
|
|
322
|
+
/** Access token TTL in seconds (default: 3600) */
|
|
323
|
+
tokenTTL?: number;
|
|
324
|
+
/** Upstream OAuth provider configuration */
|
|
325
|
+
upstreamProvider?: {
|
|
326
|
+
id: string;
|
|
327
|
+
authorizationEndpoint: string;
|
|
328
|
+
tokenEndpoint: string;
|
|
329
|
+
clientId: string;
|
|
330
|
+
clientSecret: string;
|
|
331
|
+
scopes?: string[];
|
|
332
|
+
userInfoEndpoint?: string;
|
|
333
|
+
};
|
|
334
|
+
};
|
|
256
335
|
}
|
|
257
336
|
interface MCPServerFactory {
|
|
258
337
|
(): Server | Promise<Server>;
|
|
@@ -348,6 +427,107 @@ declare function validateNonEmpty(value: string, fieldName: string): void;
|
|
|
348
427
|
*/
|
|
349
428
|
declare function validateUrl(url: string, allowedProtocols?: string[]): void;
|
|
350
429
|
|
|
430
|
+
/**
|
|
431
|
+
* MCP Authorization Helpers
|
|
432
|
+
*
|
|
433
|
+
* Utilities for implementing MCP authorization spec in tools.
|
|
434
|
+
* Provides helpers for auth error responses and token verification.
|
|
435
|
+
*/
|
|
436
|
+
/**
|
|
437
|
+
* Options for creating an auth error response
|
|
438
|
+
*/
|
|
439
|
+
interface AuthErrorOptions {
|
|
440
|
+
/** URL to the protected resource metadata */
|
|
441
|
+
resourceMetadataUrl: string;
|
|
442
|
+
/** OAuth error code */
|
|
443
|
+
error?: 'invalid_token' | 'expired_token' | 'insufficient_scope';
|
|
444
|
+
/** Human-readable error description */
|
|
445
|
+
errorDescription?: string;
|
|
446
|
+
/** Required scopes that were missing */
|
|
447
|
+
requiredScopes?: string[];
|
|
448
|
+
}
|
|
449
|
+
/**
|
|
450
|
+
* MCP-compliant auth error result structure
|
|
451
|
+
*/
|
|
452
|
+
interface AuthErrorResult {
|
|
453
|
+
content: {
|
|
454
|
+
type: 'text';
|
|
455
|
+
text: string;
|
|
456
|
+
}[];
|
|
457
|
+
_meta: {
|
|
458
|
+
'mcp/www_authenticate': string[];
|
|
459
|
+
};
|
|
460
|
+
isError: true;
|
|
461
|
+
}
|
|
462
|
+
/**
|
|
463
|
+
* Create an MCP-compliant auth error result
|
|
464
|
+
*
|
|
465
|
+
* Returns the proper `_meta["mcp/www_authenticate"]` format that triggers
|
|
466
|
+
* ChatGPT's OAuth linking UI.
|
|
467
|
+
*
|
|
468
|
+
* @example
|
|
469
|
+
* ```typescript
|
|
470
|
+
* @Tool({
|
|
471
|
+
* description: 'Fetch private data',
|
|
472
|
+
* securitySchemes: [{ type: 'oauth2', scopes: ['read:private'] }],
|
|
473
|
+
* })
|
|
474
|
+
* async fetchPrivateData(): Promise<any> {
|
|
475
|
+
* const token = this.getAccessToken();
|
|
476
|
+
*
|
|
477
|
+
* if (!token) {
|
|
478
|
+
* return createAuthError('Please authenticate to access this feature', {
|
|
479
|
+
* resourceMetadataUrl: `${process.env.PUBLIC_URL}/.well-known/oauth-protected-resource`,
|
|
480
|
+
* error: 'invalid_token',
|
|
481
|
+
* errorDescription: 'No access token provided',
|
|
482
|
+
* });
|
|
483
|
+
* }
|
|
484
|
+
*
|
|
485
|
+
* // Proceed with authenticated request...
|
|
486
|
+
* }
|
|
487
|
+
* ```
|
|
488
|
+
*
|
|
489
|
+
* @param message - User-facing error message
|
|
490
|
+
* @param options - Auth error options
|
|
491
|
+
* @returns MCP-compliant auth error result
|
|
492
|
+
*/
|
|
493
|
+
declare function createAuthError(message: string, options: AuthErrorOptions): AuthErrorResult;
|
|
494
|
+
/**
|
|
495
|
+
* Check if a result is an auth error
|
|
496
|
+
*/
|
|
497
|
+
declare function isAuthError(result: unknown): result is AuthErrorResult;
|
|
498
|
+
/**
|
|
499
|
+
* Extract access token from Authorization header
|
|
500
|
+
*
|
|
501
|
+
* @param authHeader - The Authorization header value
|
|
502
|
+
* @returns The bearer token, or null if not present/valid
|
|
503
|
+
*/
|
|
504
|
+
declare function extractBearerToken(authHeader: string | undefined): string | null;
|
|
505
|
+
/**
|
|
506
|
+
* Protected Resource Metadata (RFC 9728)
|
|
507
|
+
*/
|
|
508
|
+
interface ProtectedResourceMetadata {
|
|
509
|
+
/** Canonical resource identifier */
|
|
510
|
+
resource: string;
|
|
511
|
+
/** Authorization servers that can authorize access */
|
|
512
|
+
authorization_servers: string[];
|
|
513
|
+
/** Scopes supported by this resource */
|
|
514
|
+
scopes_supported?: string[];
|
|
515
|
+
/** Resource documentation URL */
|
|
516
|
+
resource_documentation?: string;
|
|
517
|
+
}
|
|
518
|
+
/**
|
|
519
|
+
* Generate Protected Resource Metadata document
|
|
520
|
+
*
|
|
521
|
+
* @param options - Metadata options
|
|
522
|
+
* @returns RFC 9728 compliant metadata
|
|
523
|
+
*/
|
|
524
|
+
declare function createProtectedResourceMetadata(options: {
|
|
525
|
+
resource: string;
|
|
526
|
+
authorizationServers?: string[];
|
|
527
|
+
scopesSupported?: string[];
|
|
528
|
+
documentationUrl?: string;
|
|
529
|
+
}): ProtectedResourceMetadata;
|
|
530
|
+
|
|
351
531
|
interface MCPServerOptions {
|
|
352
532
|
servicesDir: string;
|
|
353
533
|
port?: number;
|
|
@@ -488,16 +668,10 @@ declare class MCPServer {
|
|
|
488
668
|
method: string;
|
|
489
669
|
params?: {
|
|
490
670
|
[x: string]: unknown;
|
|
491
|
-
task?: {
|
|
492
|
-
[x: string]: unknown;
|
|
493
|
-
ttl?: number | null | undefined;
|
|
494
|
-
pollInterval?: number | undefined;
|
|
495
|
-
} | undefined;
|
|
496
671
|
_meta?: {
|
|
497
672
|
[x: string]: unknown;
|
|
498
673
|
progressToken?: string | number | undefined;
|
|
499
674
|
"io.modelcontextprotocol/related-task"?: {
|
|
500
|
-
[x: string]: unknown;
|
|
501
675
|
taskId: string;
|
|
502
676
|
} | undefined;
|
|
503
677
|
} | undefined;
|
|
@@ -508,8 +682,8 @@ declare class MCPServer {
|
|
|
508
682
|
[x: string]: unknown;
|
|
509
683
|
_meta?: {
|
|
510
684
|
[x: string]: unknown;
|
|
685
|
+
progressToken?: string | number | undefined;
|
|
511
686
|
"io.modelcontextprotocol/related-task"?: {
|
|
512
|
-
[x: string]: unknown;
|
|
513
687
|
taskId: string;
|
|
514
688
|
} | undefined;
|
|
515
689
|
} | undefined;
|
|
@@ -518,8 +692,8 @@ declare class MCPServer {
|
|
|
518
692
|
[x: string]: unknown;
|
|
519
693
|
_meta?: {
|
|
520
694
|
[x: string]: unknown;
|
|
695
|
+
progressToken?: string | number | undefined;
|
|
521
696
|
"io.modelcontextprotocol/related-task"?: {
|
|
522
|
-
[x: string]: unknown;
|
|
523
697
|
taskId: string;
|
|
524
698
|
} | undefined;
|
|
525
699
|
} | undefined;
|
|
@@ -549,16 +723,10 @@ declare class MCPServerRuntime {
|
|
|
549
723
|
method: string;
|
|
550
724
|
params?: {
|
|
551
725
|
[x: string]: unknown;
|
|
552
|
-
task?: {
|
|
553
|
-
[x: string]: unknown;
|
|
554
|
-
ttl?: number | null | undefined;
|
|
555
|
-
pollInterval?: number | undefined;
|
|
556
|
-
} | undefined;
|
|
557
726
|
_meta?: {
|
|
558
727
|
[x: string]: unknown;
|
|
559
728
|
progressToken?: string | number | undefined;
|
|
560
729
|
"io.modelcontextprotocol/related-task"?: {
|
|
561
|
-
[x: string]: unknown;
|
|
562
730
|
taskId: string;
|
|
563
731
|
} | undefined;
|
|
564
732
|
} | undefined;
|
|
@@ -569,8 +737,8 @@ declare class MCPServerRuntime {
|
|
|
569
737
|
[x: string]: unknown;
|
|
570
738
|
_meta?: {
|
|
571
739
|
[x: string]: unknown;
|
|
740
|
+
progressToken?: string | number | undefined;
|
|
572
741
|
"io.modelcontextprotocol/related-task"?: {
|
|
573
|
-
[x: string]: unknown;
|
|
574
742
|
taskId: string;
|
|
575
743
|
} | undefined;
|
|
576
744
|
} | undefined;
|
|
@@ -579,8 +747,8 @@ declare class MCPServerRuntime {
|
|
|
579
747
|
[x: string]: unknown;
|
|
580
748
|
_meta?: {
|
|
581
749
|
[x: string]: unknown;
|
|
750
|
+
progressToken?: string | number | undefined;
|
|
582
751
|
"io.modelcontextprotocol/related-task"?: {
|
|
583
|
-
[x: string]: unknown;
|
|
584
752
|
taskId: string;
|
|
585
753
|
} | undefined;
|
|
586
754
|
} | undefined;
|
|
@@ -594,4 +762,4 @@ declare class MCPServerRuntime {
|
|
|
594
762
|
*/
|
|
595
763
|
declare function startMCPServer(options: MCPServerOptions): Promise<MCPServerRuntime>;
|
|
596
764
|
|
|
597
|
-
export { Auth, type AuthOptions, Deprecated, type HTTPServerInput, type HTTPServerOptions, LogLevel, type LogPayload, Logger, type LoggerHandler, type LoggerOptions, MCPServer, type MCPServerConstructorOptions, type MCPServerFactory, type MCPServerOptions, MCPServerRuntime, Optional, Prompt, type PromptOptions, Render, Resource, type ResourceOptions, SchemaConstraint, Tool, type ToolOptions, UI, UserEnvs, classToJsonSchema, classToJsonSchemaWithConstraints, createHTTPServer, defaultLogger, getDecoratedMethods, getMethodMetadata, startMCPServer, validateNonEmpty, validatePath, validatePort, validateServiceName, validateUrl };
|
|
765
|
+
export { Auth, type AuthErrorOptions, type AuthErrorResult, type AuthOptions, Deprecated, type HTTPServerAuthOptions, type HTTPServerInput, type HTTPServerOptions, LogLevel, type LogPayload, Logger, type LoggerHandler, type LoggerOptions, MCPServer, type MCPServerConstructorOptions, type MCPServerFactory, type MCPServerOptions, MCPServerRuntime, Optional, Prompt, type PromptOptions, type ProtectedResourceMetadata, Render, Resource, type ResourceOptions, SchemaConstraint, type SecurityScheme, Tool, type ToolOptions, UI, UserEnvs, classToJsonSchema, classToJsonSchemaWithConstraints, createAuthError, createHTTPServer, createProtectedResourceMetadata, defaultLogger, extractBearerToken, getDecoratedMethods, getMethodMetadata, isAuthError, startMCPServer, validateNonEmpty, validatePath, validatePort, validateServiceName, validateUrl };
|
package/dist/index.d.ts
CHANGED
|
@@ -1,8 +1,36 @@
|
|
|
1
1
|
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
|
|
2
2
|
|
|
3
|
+
/**
|
|
4
|
+
* Security scheme for MCP tools (per MCP authorization spec)
|
|
5
|
+
*
|
|
6
|
+
* @example
|
|
7
|
+
* ```typescript
|
|
8
|
+
* @Tool({
|
|
9
|
+
* description: 'Fetch user data',
|
|
10
|
+
* securitySchemes: [{ type: 'oauth2', scopes: ['read:user'] }],
|
|
11
|
+
* })
|
|
12
|
+
* async fetchUser() { ... }
|
|
13
|
+
* ```
|
|
14
|
+
*/
|
|
15
|
+
interface SecurityScheme {
|
|
16
|
+
/** Type of security - 'noauth' for anonymous, 'oauth2' for OAuth */
|
|
17
|
+
type: 'noauth' | 'oauth2';
|
|
18
|
+
/** Required OAuth scopes (for oauth2 type) */
|
|
19
|
+
scopes?: string[];
|
|
20
|
+
}
|
|
3
21
|
interface ToolOptions {
|
|
4
22
|
description?: string;
|
|
5
23
|
inputClass?: any;
|
|
24
|
+
/**
|
|
25
|
+
* Security schemes for this tool (MCP authorization spec)
|
|
26
|
+
*
|
|
27
|
+
* - `noauth`: Tool is callable anonymously
|
|
28
|
+
* - `oauth2`: Tool requires OAuth 2.0 access token
|
|
29
|
+
*
|
|
30
|
+
* If both are listed, tool works anonymously but OAuth unlocks more features.
|
|
31
|
+
* If omitted, tool inherits server-level defaults.
|
|
32
|
+
*/
|
|
33
|
+
securitySchemes?: SecurityScheme[];
|
|
6
34
|
}
|
|
7
35
|
interface PromptOptions {
|
|
8
36
|
description?: string;
|
|
@@ -30,6 +58,14 @@ interface PromptOptions {
|
|
|
30
58
|
* async analyzeSentiment(args: AnalyzeSentimentInput): Promise<AnalyzeSentimentOutput> {
|
|
31
59
|
* // Tool name will be: "analyzeSentiment"
|
|
32
60
|
* }
|
|
61
|
+
*
|
|
62
|
+
* @example
|
|
63
|
+
* // Tool with OAuth requirement
|
|
64
|
+
* @Tool({
|
|
65
|
+
* description: 'Fetch private user data',
|
|
66
|
+
* securitySchemes: [{ type: 'oauth2', scopes: ['read:user'] }],
|
|
67
|
+
* })
|
|
68
|
+
* async fetchPrivateData() { ... }
|
|
33
69
|
*/
|
|
34
70
|
declare function Tool(options?: ToolOptions): MethodDecorator;
|
|
35
71
|
/**
|
|
@@ -253,6 +289,49 @@ interface HTTPServerOptions {
|
|
|
253
289
|
sessionTimeout?: number;
|
|
254
290
|
stateless?: boolean;
|
|
255
291
|
dashboard?: boolean;
|
|
292
|
+
/** OAuth/Auth configuration (MCP authorization spec) */
|
|
293
|
+
auth?: HTTPServerAuthOptions;
|
|
294
|
+
}
|
|
295
|
+
/**
|
|
296
|
+
* OAuth/Auth configuration for MCP server
|
|
297
|
+
*
|
|
298
|
+
* Enables MCP authorization spec compliance by exposing
|
|
299
|
+
* `/.well-known/oauth-protected-resource` (RFC 9728)
|
|
300
|
+
*/
|
|
301
|
+
interface HTTPServerAuthOptions {
|
|
302
|
+
/** Resource identifier (defaults to server URL) */
|
|
303
|
+
resource?: string;
|
|
304
|
+
/** Authorization servers (defaults to self) */
|
|
305
|
+
authorizationServers?: string[];
|
|
306
|
+
/** Supported OAuth scopes */
|
|
307
|
+
scopesSupported?: string[];
|
|
308
|
+
/** Documentation URL */
|
|
309
|
+
documentationUrl?: string;
|
|
310
|
+
/** Enable built-in OAuth authorization server */
|
|
311
|
+
enableOAuthServer?: boolean;
|
|
312
|
+
/** OAuth server options (when enableOAuthServer is true) */
|
|
313
|
+
oauthServerOptions?: {
|
|
314
|
+
/** Session secret for signing tokens/state */
|
|
315
|
+
sessionSecret: string;
|
|
316
|
+
/** JWT signing secret (defaults to sessionSecret if not provided) */
|
|
317
|
+
jwtSigningSecret?: string;
|
|
318
|
+
/** JWT encryption secret for encrypting upstream tokens */
|
|
319
|
+
jwtEncryptionSecret?: Buffer;
|
|
320
|
+
/** Issuer URL for JWTs */
|
|
321
|
+
issuer?: string;
|
|
322
|
+
/** Access token TTL in seconds (default: 3600) */
|
|
323
|
+
tokenTTL?: number;
|
|
324
|
+
/** Upstream OAuth provider configuration */
|
|
325
|
+
upstreamProvider?: {
|
|
326
|
+
id: string;
|
|
327
|
+
authorizationEndpoint: string;
|
|
328
|
+
tokenEndpoint: string;
|
|
329
|
+
clientId: string;
|
|
330
|
+
clientSecret: string;
|
|
331
|
+
scopes?: string[];
|
|
332
|
+
userInfoEndpoint?: string;
|
|
333
|
+
};
|
|
334
|
+
};
|
|
256
335
|
}
|
|
257
336
|
interface MCPServerFactory {
|
|
258
337
|
(): Server | Promise<Server>;
|
|
@@ -348,6 +427,107 @@ declare function validateNonEmpty(value: string, fieldName: string): void;
|
|
|
348
427
|
*/
|
|
349
428
|
declare function validateUrl(url: string, allowedProtocols?: string[]): void;
|
|
350
429
|
|
|
430
|
+
/**
|
|
431
|
+
* MCP Authorization Helpers
|
|
432
|
+
*
|
|
433
|
+
* Utilities for implementing MCP authorization spec in tools.
|
|
434
|
+
* Provides helpers for auth error responses and token verification.
|
|
435
|
+
*/
|
|
436
|
+
/**
|
|
437
|
+
* Options for creating an auth error response
|
|
438
|
+
*/
|
|
439
|
+
interface AuthErrorOptions {
|
|
440
|
+
/** URL to the protected resource metadata */
|
|
441
|
+
resourceMetadataUrl: string;
|
|
442
|
+
/** OAuth error code */
|
|
443
|
+
error?: 'invalid_token' | 'expired_token' | 'insufficient_scope';
|
|
444
|
+
/** Human-readable error description */
|
|
445
|
+
errorDescription?: string;
|
|
446
|
+
/** Required scopes that were missing */
|
|
447
|
+
requiredScopes?: string[];
|
|
448
|
+
}
|
|
449
|
+
/**
|
|
450
|
+
* MCP-compliant auth error result structure
|
|
451
|
+
*/
|
|
452
|
+
interface AuthErrorResult {
|
|
453
|
+
content: {
|
|
454
|
+
type: 'text';
|
|
455
|
+
text: string;
|
|
456
|
+
}[];
|
|
457
|
+
_meta: {
|
|
458
|
+
'mcp/www_authenticate': string[];
|
|
459
|
+
};
|
|
460
|
+
isError: true;
|
|
461
|
+
}
|
|
462
|
+
/**
|
|
463
|
+
* Create an MCP-compliant auth error result
|
|
464
|
+
*
|
|
465
|
+
* Returns the proper `_meta["mcp/www_authenticate"]` format that triggers
|
|
466
|
+
* ChatGPT's OAuth linking UI.
|
|
467
|
+
*
|
|
468
|
+
* @example
|
|
469
|
+
* ```typescript
|
|
470
|
+
* @Tool({
|
|
471
|
+
* description: 'Fetch private data',
|
|
472
|
+
* securitySchemes: [{ type: 'oauth2', scopes: ['read:private'] }],
|
|
473
|
+
* })
|
|
474
|
+
* async fetchPrivateData(): Promise<any> {
|
|
475
|
+
* const token = this.getAccessToken();
|
|
476
|
+
*
|
|
477
|
+
* if (!token) {
|
|
478
|
+
* return createAuthError('Please authenticate to access this feature', {
|
|
479
|
+
* resourceMetadataUrl: `${process.env.PUBLIC_URL}/.well-known/oauth-protected-resource`,
|
|
480
|
+
* error: 'invalid_token',
|
|
481
|
+
* errorDescription: 'No access token provided',
|
|
482
|
+
* });
|
|
483
|
+
* }
|
|
484
|
+
*
|
|
485
|
+
* // Proceed with authenticated request...
|
|
486
|
+
* }
|
|
487
|
+
* ```
|
|
488
|
+
*
|
|
489
|
+
* @param message - User-facing error message
|
|
490
|
+
* @param options - Auth error options
|
|
491
|
+
* @returns MCP-compliant auth error result
|
|
492
|
+
*/
|
|
493
|
+
declare function createAuthError(message: string, options: AuthErrorOptions): AuthErrorResult;
|
|
494
|
+
/**
|
|
495
|
+
* Check if a result is an auth error
|
|
496
|
+
*/
|
|
497
|
+
declare function isAuthError(result: unknown): result is AuthErrorResult;
|
|
498
|
+
/**
|
|
499
|
+
* Extract access token from Authorization header
|
|
500
|
+
*
|
|
501
|
+
* @param authHeader - The Authorization header value
|
|
502
|
+
* @returns The bearer token, or null if not present/valid
|
|
503
|
+
*/
|
|
504
|
+
declare function extractBearerToken(authHeader: string | undefined): string | null;
|
|
505
|
+
/**
|
|
506
|
+
* Protected Resource Metadata (RFC 9728)
|
|
507
|
+
*/
|
|
508
|
+
interface ProtectedResourceMetadata {
|
|
509
|
+
/** Canonical resource identifier */
|
|
510
|
+
resource: string;
|
|
511
|
+
/** Authorization servers that can authorize access */
|
|
512
|
+
authorization_servers: string[];
|
|
513
|
+
/** Scopes supported by this resource */
|
|
514
|
+
scopes_supported?: string[];
|
|
515
|
+
/** Resource documentation URL */
|
|
516
|
+
resource_documentation?: string;
|
|
517
|
+
}
|
|
518
|
+
/**
|
|
519
|
+
* Generate Protected Resource Metadata document
|
|
520
|
+
*
|
|
521
|
+
* @param options - Metadata options
|
|
522
|
+
* @returns RFC 9728 compliant metadata
|
|
523
|
+
*/
|
|
524
|
+
declare function createProtectedResourceMetadata(options: {
|
|
525
|
+
resource: string;
|
|
526
|
+
authorizationServers?: string[];
|
|
527
|
+
scopesSupported?: string[];
|
|
528
|
+
documentationUrl?: string;
|
|
529
|
+
}): ProtectedResourceMetadata;
|
|
530
|
+
|
|
351
531
|
interface MCPServerOptions {
|
|
352
532
|
servicesDir: string;
|
|
353
533
|
port?: number;
|
|
@@ -488,16 +668,10 @@ declare class MCPServer {
|
|
|
488
668
|
method: string;
|
|
489
669
|
params?: {
|
|
490
670
|
[x: string]: unknown;
|
|
491
|
-
task?: {
|
|
492
|
-
[x: string]: unknown;
|
|
493
|
-
ttl?: number | null | undefined;
|
|
494
|
-
pollInterval?: number | undefined;
|
|
495
|
-
} | undefined;
|
|
496
671
|
_meta?: {
|
|
497
672
|
[x: string]: unknown;
|
|
498
673
|
progressToken?: string | number | undefined;
|
|
499
674
|
"io.modelcontextprotocol/related-task"?: {
|
|
500
|
-
[x: string]: unknown;
|
|
501
675
|
taskId: string;
|
|
502
676
|
} | undefined;
|
|
503
677
|
} | undefined;
|
|
@@ -508,8 +682,8 @@ declare class MCPServer {
|
|
|
508
682
|
[x: string]: unknown;
|
|
509
683
|
_meta?: {
|
|
510
684
|
[x: string]: unknown;
|
|
685
|
+
progressToken?: string | number | undefined;
|
|
511
686
|
"io.modelcontextprotocol/related-task"?: {
|
|
512
|
-
[x: string]: unknown;
|
|
513
687
|
taskId: string;
|
|
514
688
|
} | undefined;
|
|
515
689
|
} | undefined;
|
|
@@ -518,8 +692,8 @@ declare class MCPServer {
|
|
|
518
692
|
[x: string]: unknown;
|
|
519
693
|
_meta?: {
|
|
520
694
|
[x: string]: unknown;
|
|
695
|
+
progressToken?: string | number | undefined;
|
|
521
696
|
"io.modelcontextprotocol/related-task"?: {
|
|
522
|
-
[x: string]: unknown;
|
|
523
697
|
taskId: string;
|
|
524
698
|
} | undefined;
|
|
525
699
|
} | undefined;
|
|
@@ -549,16 +723,10 @@ declare class MCPServerRuntime {
|
|
|
549
723
|
method: string;
|
|
550
724
|
params?: {
|
|
551
725
|
[x: string]: unknown;
|
|
552
|
-
task?: {
|
|
553
|
-
[x: string]: unknown;
|
|
554
|
-
ttl?: number | null | undefined;
|
|
555
|
-
pollInterval?: number | undefined;
|
|
556
|
-
} | undefined;
|
|
557
726
|
_meta?: {
|
|
558
727
|
[x: string]: unknown;
|
|
559
728
|
progressToken?: string | number | undefined;
|
|
560
729
|
"io.modelcontextprotocol/related-task"?: {
|
|
561
|
-
[x: string]: unknown;
|
|
562
730
|
taskId: string;
|
|
563
731
|
} | undefined;
|
|
564
732
|
} | undefined;
|
|
@@ -569,8 +737,8 @@ declare class MCPServerRuntime {
|
|
|
569
737
|
[x: string]: unknown;
|
|
570
738
|
_meta?: {
|
|
571
739
|
[x: string]: unknown;
|
|
740
|
+
progressToken?: string | number | undefined;
|
|
572
741
|
"io.modelcontextprotocol/related-task"?: {
|
|
573
|
-
[x: string]: unknown;
|
|
574
742
|
taskId: string;
|
|
575
743
|
} | undefined;
|
|
576
744
|
} | undefined;
|
|
@@ -579,8 +747,8 @@ declare class MCPServerRuntime {
|
|
|
579
747
|
[x: string]: unknown;
|
|
580
748
|
_meta?: {
|
|
581
749
|
[x: string]: unknown;
|
|
750
|
+
progressToken?: string | number | undefined;
|
|
582
751
|
"io.modelcontextprotocol/related-task"?: {
|
|
583
|
-
[x: string]: unknown;
|
|
584
752
|
taskId: string;
|
|
585
753
|
} | undefined;
|
|
586
754
|
} | undefined;
|
|
@@ -594,4 +762,4 @@ declare class MCPServerRuntime {
|
|
|
594
762
|
*/
|
|
595
763
|
declare function startMCPServer(options: MCPServerOptions): Promise<MCPServerRuntime>;
|
|
596
764
|
|
|
597
|
-
export { Auth, type AuthOptions, Deprecated, type HTTPServerInput, type HTTPServerOptions, LogLevel, type LogPayload, Logger, type LoggerHandler, type LoggerOptions, MCPServer, type MCPServerConstructorOptions, type MCPServerFactory, type MCPServerOptions, MCPServerRuntime, Optional, Prompt, type PromptOptions, Render, Resource, type ResourceOptions, SchemaConstraint, Tool, type ToolOptions, UI, UserEnvs, classToJsonSchema, classToJsonSchemaWithConstraints, createHTTPServer, defaultLogger, getDecoratedMethods, getMethodMetadata, startMCPServer, validateNonEmpty, validatePath, validatePort, validateServiceName, validateUrl };
|
|
765
|
+
export { Auth, type AuthErrorOptions, type AuthErrorResult, type AuthOptions, Deprecated, type HTTPServerAuthOptions, type HTTPServerInput, type HTTPServerOptions, LogLevel, type LogPayload, Logger, type LoggerHandler, type LoggerOptions, MCPServer, type MCPServerConstructorOptions, type MCPServerFactory, type MCPServerOptions, MCPServerRuntime, Optional, Prompt, type PromptOptions, type ProtectedResourceMetadata, Render, Resource, type ResourceOptions, SchemaConstraint, type SecurityScheme, Tool, type ToolOptions, UI, UserEnvs, classToJsonSchema, classToJsonSchemaWithConstraints, createAuthError, createHTTPServer, createProtectedResourceMetadata, defaultLogger, extractBearerToken, getDecoratedMethods, getMethodMetadata, isAuthError, startMCPServer, validateNonEmpty, validatePath, validatePort, validateServiceName, validateUrl };
|