@lightsage/mcp 0.4.16 → 0.4.18

package/README.md

@@ -33,9 +33,9 @@ Lightsage Public API: Public API for Lightsage CLI and external integrations.
 <details>
 <summary>Claude Desktop</summary>
 
-Install the MCP server as a Desktop Extension using the pre-built [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.16/mcp-server.mcpb) file:
+Install the MCP server as a Desktop Extension using the pre-built [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.18/mcp-server.mcpb) file:
 
-Simply drag and drop the [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.16/mcp-server.mcpb) file onto Claude Desktop to install the extension.
+Simply drag and drop the [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.18/mcp-server.mcpb) file onto Claude Desktop to install the extension.
 
 The MCP bundle package includes the MCP server and all necessary configuration. Once installed, the server will be available without additional setup.
 

package/api/mcp.js

@@ -10,6 +10,15 @@ import {
   exchangeFailureResponse,
 } from "../lib/oauth.js";
 import { registerProfileTool } from "../lib/profile.js";
+import {
+  apiKeyCaller,
+  clearVerifiedCaller,
+  flushTracking,
+  instrumentServer,
+  isTrackedApiKey,
+  setVerifiedCaller,
+  trackingEnabled,
+} from "../lib/tracker.js";
 
 const logLevel = process.env.MCP_LOG_LEVEL || "info";
 const logger = createConsoleLogger(logLevel);
@@ -79,6 +88,9 @@ export default async function handler(req, res) {
     return;
   }
 
+  // Only this handler may say who the caller is (see lib/tracker.js)
+  clearVerifiedCaller(req);
+
   const headers = new Headers();
   for (const [key, value] of Object.entries(req.headers)) {
     if (Array.isArray(value)) {
@@ -118,6 +130,8 @@ export default async function handler(req, res) {
       res.status(401).json({ error: "unauthorized" });
       return;
     }
+    // The user, not the token: tokens rotate, so sessions would split
+    setVerifiedCaller(req, `oauth:${auth.userId}`);
 
     try {
       const identity = await exchangeForLightsageIdentity(
@@ -140,6 +154,17 @@ export default async function handler(req, res) {
   }
 
   const flags = getFlags();
+
+  // Record analytics only for callers who proved who they are. A request key
+  // is checked against the API, because tools that never call it accept any
+  // value. A static server key is the deployment's own.
+  if (trackingEnabled && requestApiKey) {
+    if (await isTrackedApiKey(requestApiKey, flags["server-url"])) {
+      setVerifiedCaller(req, apiKeyCaller(requestApiKey));
+    }
+  } else if (trackingEnabled && !useOAuth && !requestApiKey) {
+    setVerifiedCaller(req, "static:server");
+  }
   // OAuth-enabled deployments may use either a caller-supplied request key or
   // an OAuth-exchanged key, but must never fall back to a static server key.
   const disableStaticAuth = useOAuth
@@ -162,6 +187,10 @@ export default async function handler(req, res) {
     registerProfileTool(mcpServer, profile);
   }
 
+  if (req.headers["x-lightsage-verified-caller"]) {
+    instrumentServer(mcpServer);
+  }
+
   mcpServer.server.onerror = (error) => {
     logger.error("MCP protocol error", {
       error: error instanceof Error ? error.message : String(error),
@@ -171,4 +200,5 @@ export default async function handler(req, res) {
 
   await mcpServer.connect(transport);
   await transport.handleRequest(req, res, req.body);
+  await flushTracking(res);
 }