@lerianstudio/matcher-mcp 1.3.0 → 1.4.0-beta.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +26 -0
- package/dist/auth/request-token.js +50 -2
- package/dist/auth/request-token.js.map +1 -1
- package/dist/config.js +61 -0
- package/dist/config.js.map +1 -1
- package/dist/copilot/agent.js +181 -0
- package/dist/copilot/agent.js.map +1 -0
- package/dist/copilot/provider-anthropic.js +151 -0
- package/dist/copilot/provider-anthropic.js.map +1 -0
- package/dist/copilot/provider-factory.js +46 -0
- package/dist/copilot/provider-factory.js.map +1 -0
- package/dist/copilot/provider-openrouter.js +154 -0
- package/dist/copilot/provider-openrouter.js.map +1 -0
- package/dist/copilot/provider-shared.js +23 -0
- package/dist/copilot/provider-shared.js.map +1 -0
- package/dist/copilot/provider.js +15 -0
- package/dist/copilot/provider.js.map +1 -0
- package/dist/copilot/rate-limit.js +77 -0
- package/dist/copilot/rate-limit.js.map +1 -0
- package/dist/copilot/sse.js +69 -0
- package/dist/copilot/sse.js.map +1 -0
- package/dist/copilot/system-prompt.js +113 -0
- package/dist/copilot/system-prompt.js.map +1 -0
- package/dist/copilot/tenant-config.js +145 -0
- package/dist/copilot/tenant-config.js.map +1 -0
- package/dist/copilot/tools.js +241 -0
- package/dist/copilot/tools.js.map +1 -0
- package/dist/copilot/turns-handler.js +322 -0
- package/dist/copilot/turns-handler.js.map +1 -0
- package/dist/observability/otel.js +184 -2
- package/dist/observability/otel.js.map +1 -1
- package/dist/spec/openapi.yaml +82 -1
- package/dist/tools/context/create.js +3 -1
- package/dist/tools/context/create.js.map +1 -1
- package/dist/tools/context/index.js +3 -1
- package/dist/tools/context/index.js.map +1 -1
- package/dist/tools/context/next-step.js +93 -0
- package/dist/tools/context/next-step.js.map +1 -0
- package/dist/tools/source/create.js +3 -1
- package/dist/tools/source/create.js.map +1 -1
- package/dist/transport/body-limit.js +27 -0
- package/dist/transport/body-limit.js.map +1 -1
- package/dist/transport/http.js +35 -25
- package/dist/transport/http.js.map +1 -1
- package/package.json +3 -1
package/dist/transport/http.js
CHANGED
|
@@ -12,35 +12,15 @@ import { createServer } from 'node:http';
|
|
|
12
12
|
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
|
|
13
13
|
import { runWithBearerToken } from '../auth/request-token.js';
|
|
14
14
|
import { loadConfig } from '../config.js';
|
|
15
|
+
import { handleAgentTurn } from '../copilot/turns-handler.js';
|
|
15
16
|
import { buildMcpServer } from '../server.js';
|
|
16
|
-
import {
|
|
17
|
+
import { BodyTooLargeError, HEADERS_TIMEOUT_MS, readBody, REQUEST_TIMEOUT_MS, } from './body-limit.js';
|
|
17
18
|
/** The conventional MCP protocol endpoint path. */
|
|
18
19
|
const MCP_PATH = '/mcp';
|
|
20
|
+
/** The copilot agent turn endpoint (SSE). */
|
|
21
|
+
const AGENT_PATH = '/agent/turns';
|
|
19
22
|
/** Liveness endpoint, separate from the MCP protocol (used by the container). */
|
|
20
23
|
const HEALTHZ_PATH = '/healthz';
|
|
21
|
-
/**
|
|
22
|
-
* Read the request body and return it as a string, bounded by `maxBodyBytes`.
|
|
23
|
-
* The SDK's Node transport can parse the body itself, but reading it here lets
|
|
24
|
-
* us pass a pre-parsed JSON body and keeps the handler in control of malformed
|
|
25
|
-
* input — and, critically, lets us cap an unbounded read.
|
|
26
|
-
*
|
|
27
|
-
* The size guard is checked BEFORE each chunk is retained, so an over-limit
|
|
28
|
-
* payload is rejected (via `BodyTooLargeError`) without ever buffering more than
|
|
29
|
-
* the limit (+ one chunk) of an attacker's body. The guard counts only bytes —
|
|
30
|
-
* it never inspects body content, headers, or any token.
|
|
31
|
-
*/
|
|
32
|
-
async function readBody(req, maxBodyBytes) {
|
|
33
|
-
const guard = new BodySizeGuard(maxBodyBytes);
|
|
34
|
-
const chunks = [];
|
|
35
|
-
for await (const chunk of req) {
|
|
36
|
-
const buf = chunk;
|
|
37
|
-
// Throws BodyTooLargeError the moment the running total exceeds the limit,
|
|
38
|
-
// before the over-limit chunk is appended to memory.
|
|
39
|
-
guard.add(buf.length);
|
|
40
|
-
chunks.push(buf);
|
|
41
|
-
}
|
|
42
|
-
return Buffer.concat(chunks).toString('utf8');
|
|
43
|
-
}
|
|
44
24
|
/**
|
|
45
25
|
* Handle a single MCP protocol request in stateless mode: spin up a transport
|
|
46
26
|
* + server, connect, dispatch, and tear both down when the response finishes.
|
|
@@ -87,6 +67,33 @@ export function createHttpServer(info, config = loadConfig()) {
|
|
|
87
67
|
res.end('ok');
|
|
88
68
|
return;
|
|
89
69
|
}
|
|
70
|
+
if (req.method === 'POST' && path === AGENT_PATH) {
|
|
71
|
+
// Same bearer relay as /mcp: seed the request-scoped auth store so the
|
|
72
|
+
// agent's read tools recover the caller's token from the ALS store. The
|
|
73
|
+
// header is forwarded verbatim and never logged here (token-relay rule).
|
|
74
|
+
// Per-tenant rate limiting (task 4.2.2) lives INSIDE handleAgentTurn as its
|
|
75
|
+
// first action after the bearer check — it needs the request-scoped tenant
|
|
76
|
+
// decode and the SSE sink (to emit `rate_limited`), and still gates before
|
|
77
|
+
// the body read and any provider spin-up.
|
|
78
|
+
runWithBearerToken(req.headers.authorization, () => {
|
|
79
|
+
// handleAgentTurn owns its own SSE error+done on every named failure and
|
|
80
|
+
// does not rethrow; this catch is a last resort if it throws before the
|
|
81
|
+
// sink could emit. Never leak a token or a stack into the response.
|
|
82
|
+
handleAgentTurn(config, req, res).catch((err) => {
|
|
83
|
+
if (!res.headersSent) {
|
|
84
|
+
res.writeHead(500, { 'Content-Type': 'application/json' });
|
|
85
|
+
res.end(JSON.stringify({ error: 'internal server error' }));
|
|
86
|
+
}
|
|
87
|
+
else {
|
|
88
|
+
res.end();
|
|
89
|
+
}
|
|
90
|
+
// Log only the message string, never the raw error object (it may
|
|
91
|
+
// carry request context) — token-relay rule.
|
|
92
|
+
console.error('matcher-mcp agent turn handling failed:', err instanceof Error ? err.message : String(err));
|
|
93
|
+
});
|
|
94
|
+
});
|
|
95
|
+
return;
|
|
96
|
+
}
|
|
90
97
|
if (path === MCP_PATH) {
|
|
91
98
|
// Seed the request-scoped auth store at the boundary so tool handlers can
|
|
92
99
|
// recover the caller's bearer token even when the SDK does not thread the
|
|
@@ -117,7 +124,10 @@ export function createHttpServer(info, config = loadConfig()) {
|
|
|
117
124
|
error: { code: -32603, message: 'internal server error' },
|
|
118
125
|
id: null,
|
|
119
126
|
}));
|
|
120
|
-
|
|
127
|
+
// Log only the message string, never the raw error object (it may
|
|
128
|
+
// carry request context) — token-relay rule, matching the sibling
|
|
129
|
+
// /agent/turns and turns-handler paths.
|
|
130
|
+
console.error('matcher-mcp request handling failed:', err instanceof Error ? err.message : String(err));
|
|
121
131
|
});
|
|
122
132
|
});
|
|
123
133
|
return;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/transport/http.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,wEAAwE;AACxE,6BAA6B;AAE7B,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAElG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAA;AAC9D,OAAO,EACL,
|
|
1
|
+
{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/transport/http.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,wEAAwE;AACxE,6BAA6B;AAE7B,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAElG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAA;AAC9D,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,GACnB,MAAM,iBAAiB,CAAA;AAExB,mDAAmD;AACnD,MAAM,QAAQ,GAAG,MAAM,CAAA;AACvB,6CAA6C;AAC7C,MAAM,UAAU,GAAG,cAAc,CAAA;AACjC,iFAAiF;AACjF,MAAM,YAAY,GAAG,UAAU,CAAA;AAU/B;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAgB,EAChB,MAAc,EACd,GAAoB,EACpB,GAAmB;IAEnB,uEAAuE;IACvE,yEAAyE;IACzE,IAAI,UAAmB,CAAA;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QACpD,UAAU,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,mEAAmE;QACnE,iEAAiE;QACjE,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IAEnC,yEAAyE;IACzE,yBAAyB;IACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAE/B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAgB,EAAE,SAAiB,UAAU,EAAE;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEjC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACb,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACjD,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,0CAA0C;YAC1C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE;gBACjD,yEAAyE;gBACzE,wEAAwE;gBACxE,oEAAoE;gBACpE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACvD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAA;oBAC7D,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,GAAG,EAAE,CAAA;oBACX,CAAC;oBACD,kEAAkE;oBAClE,6CAA6C;oBAC7C,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,wDAAwD;YACxD,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE;gBACjD,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBAC9D,sEAAsE;oBACtE,yDAAyD;oBACzD,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;wBACrC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;4BACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBACnE,CAAC;wBACD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE;4BAC1D,EAAE,EAAE,IAAI;yBACT,CAAC,CACH,CAAA;wBACD,OAAM;oBACR,CAAC;oBACD,mEAAmE;oBACnE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;oBAC5D,CAAC;oBACD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;wBACb,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;wBACzD,EAAE,EAAE,IAAI;qBACT,CAAC,CACH,CAAA;oBACD,kEAAkE;oBAClE,kEAAkE;oBAClE,wCAAwC;oBACxC,OAAO,CAAC,KAAK,CACX,sCAAsC,EACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,6EAA6E;IAC7E,uCAAuC;IACvC,UAAU,CAAC,cAAc,GAAG,kBAAkB,CAAA;IAC9C,UAAU,CAAC,cAAc,GAAG,kBAAkB,CAAA;IAE9C,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,IAAgB;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAEjD,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YAClC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC1C,OAAO,CAAC;gBACN,UAAU;gBACV,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAC7B,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACrD,CAAC,CAAC;aACL,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lerianstudio/matcher-mcp",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.4.0-beta.2",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Model Context Protocol server for the Matcher reconciliation engine",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -45,6 +45,7 @@
|
|
|
45
45
|
"lint": "eslint ."
|
|
46
46
|
},
|
|
47
47
|
"dependencies": {
|
|
48
|
+
"@anthropic-ai/sdk": "^0.110.0",
|
|
48
49
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
49
50
|
"@opentelemetry/api": "1.9.1",
|
|
50
51
|
"@opentelemetry/exporter-metrics-otlp-http": "0.219.0",
|
|
@@ -54,6 +55,7 @@
|
|
|
54
55
|
"@opentelemetry/sdk-node": "0.219.0",
|
|
55
56
|
"@opentelemetry/semantic-conventions": "1.41.1",
|
|
56
57
|
"ajv": "^8.20.0",
|
|
58
|
+
"openai": "^6.45.0",
|
|
57
59
|
"yaml": "^2.9.0",
|
|
58
60
|
"zod": "^4.4.3"
|
|
59
61
|
},
|