@lovable.dev/mcp-js 0.13.0 → 0.14.0

package/README.md

@@ -49,7 +49,9 @@ That's the whole authoring surface. No imperative server construction, no route
 | `GET /.mcp/list-tools`           | `src/routes/[.mcp]/list-tools.ts`          | Tool catalog with JSON Schemas           |
 | `POST /.mcp/invoke-tool/<tool>`  | `src/routes/[.mcp]/invoke-tool/$tool.ts`   | REST dispatcher; one handler call per tool |
 
-MCP (`POST /mcp`) is the public wire format clients speak directly. REST (`/.mcp/list-tools`, `/.mcp/invoke-tool/<tool>`) is internal RPC — only an upstream MCP proxy calls it; never a browser or a hand-rolled client. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth policy protects them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, MCP and REST both require the proxy/client to pass `Authorization: Bearer <token>`. CORS and rate limiting still belong at the app host or edge.
+The table shows the default `path: "/mcp"`. The REST companions co-locate under the parent of the configured `path`, so `mcpPlugin({ path: "/api/public/mcp" })` emits them at `/api/public/.mcp/list-tools` and `/api/public/.mcp/invoke-tool/<tool>` (file: `src/routes/api/public/[.mcp]/...`). Pass `restRoutes: false` to drop them.
+
+MCP (`POST <path>`, `/mcp` by default) is the public wire format clients speak directly. REST (the `.mcp/*` companions, co-located under the `path` parent) is internal RPC — only an upstream MCP proxy calls it; never a browser or a hand-rolled client. All runtime routes import the same `defineMcp` result, so they stay in sync on which tools exist and which auth policy protects them. If `defineMcp({ auth: ... })` is omitted, the handlers stay unauthenticated; if OAuth auth is configured, MCP and REST both require the proxy/client to pass `Authorization: Bearer <token>`. CORS and rate limiting still belong at the app host or edge.
 
 The OAuth metadata route is emitted by default and returns `404` until OAuth auth is configured. Disable it with `mcpPlugin({ protectedResourceMetadataRoute: false })` only if the app owns `/.well-known/oauth-protected-resource` itself.
 

package/dist/{chunk-SIITHGUD.js → chunk-NOFPRSSI.js}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.13.0";
+var version = "0.14.0";
 
 export {
   version

package/dist/cli/extract-manifest.cjs

@@ -13,7 +13,7 @@ function isFileMissing(err) {
 }
 
 // package.json
-var version = "0.13.0";
+var version = "0.14.0";
 
 // src/protocols/rest/list-tools.ts
 var import_zod_compat = require("@modelcontextprotocol/sdk/server/zod-compat.js");

package/dist/cli/extract-manifest.js

@@ -7,7 +7,7 @@ import "../chunk-QC3DXQTH.js";
 import "../chunk-6DXGZZA4.js";
 import {
   version
-} from "../chunk-SIITHGUD.js";
+} from "../chunk-NOFPRSSI.js";
 import {
   isFileMissing
 } from "../chunk-Y3ZFPEQH.js";

package/dist/stacks/supabase/vite.cjs

@@ -32,7 +32,7 @@ var import_node_fs = require("fs");
 var import_node_path = require("path");
 
 // package.json
-var version = "0.13.0";
+var version = "0.14.0";
 
 // src/core/fs-errors.ts
 function isFileMissing(err) {

package/dist/stacks/supabase/vite.js

@@ -1,6 +1,6 @@
 import {
   version
-} from "../../chunk-SIITHGUD.js";
+} from "../../chunk-NOFPRSSI.js";
 import {
   isFileMissing
 } from "../../chunk-Y3ZFPEQH.js";

package/dist/stacks/tanstack/vite.cjs

@@ -56,20 +56,28 @@ function wellKnownRouteFile(routesDir, urlPath) {
   });
   return (0, import_node_path.resolve)(routesDir, ...fileSegments);
 }
-function resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath) {
+function resolveRestRoutes(routesDir, mcpUrlPath) {
+  const parentSegments = mcpUrlPath.replace(/^\/+/, "").replace(/\/+$/, "").split("/").slice(0, -1);
+  const restDir = (0, import_node_path.resolve)(routesDir, ...parentSegments, "[.mcp]");
+  const restUrlBase = `/${[...parentSegments, ".mcp"].join("/")}`;
+  return {
+    listToolsRouteFile: (0, import_node_path.resolve)(restDir, "list-tools.ts"),
+    invokeToolRouteFile: (0, import_node_path.resolve)(restDir, "invoke-tool", "$tool.ts"),
+    listToolsLiteral: `${restUrlBase}/list-tools`,
+    invokeToolLiteral: `${restUrlBase}/invoke-tool/$tool`
+  };
+}
+function resolveAllRoutes(projectRoot, routesDirOption, routeFileName, mcpUrlPath, metadataUrlPath) {
   const routesDir = (0, import_node_path.resolve)(projectRoot, routesDirOption);
   assertContains(projectRoot, routesDir, `routesDir "${routesDirOption}"`);
   const mcpRouteFile = (0, import_node_path.resolve)(routesDir, routeFileName);
   assertContains(routesDir, mcpRouteFile, `routeFileName "${routeFileName}"`);
   const metadataRouteFile = wellKnownRouteFile(routesDir, metadataUrlPath);
   assertContains(routesDir, metadataRouteFile, `metadataPath "${metadataUrlPath}"`);
-  return {
-    routesDir,
-    mcpRouteFile,
-    metadataRouteFile,
-    listToolsRouteFile: (0, import_node_path.resolve)(routesDir, "[.mcp]", "list-tools.ts"),
-    invokeToolRouteFile: (0, import_node_path.resolve)(routesDir, "[.mcp]", "invoke-tool", "$tool.ts")
-  };
+  const rest = resolveRestRoutes(routesDir, mcpUrlPath);
+  assertContains(routesDir, rest.listToolsRouteFile, `REST routes for path "${mcpUrlPath}"`);
+  assertContains(routesDir, rest.invokeToolRouteFile, `REST routes for path "${mcpUrlPath}"`);
+  return { routesDir, mcpRouteFile, metadataRouteFile, ...rest };
 }
 function assertUrlPathShape(urlPath) {
   if (!urlPath.startsWith("/")) {
@@ -231,12 +239,15 @@ function mcpPlugin(options = {}) {
   const trustForwardedHost = options.trustForwardedHost !== false;
   let projectRoot = process.cwd();
   let mcpEntry = (0, import_node_path.resolve)(projectRoot, mcpEntryOption);
-  let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
-    projectRoot,
-    routesDirOption,
-    routeFileName,
-    metadataUrlPath
-  );
+  let {
+    routesDir,
+    mcpRouteFile,
+    metadataRouteFile,
+    listToolsRouteFile,
+    invokeToolRouteFile,
+    listToolsLiteral,
+    invokeToolLiteral
+  } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath);
   const regenerate = () => {
     let mcpEntryExists = true;
     try {
@@ -262,13 +273,13 @@ function mcpPlugin(options = {}) {
         routes.push(
           {
             file: listToolsRouteFile,
-            routeLiteral: "/.mcp/list-tools",
+            routeLiteral: listToolsLiteral,
             handlerFactory: "createTanStackListToolsHandler",
             spaFallbackNote: true
           },
           {
             file: invokeToolRouteFile,
-            routeLiteral: "/.mcp/invoke-tool/$tool",
+            routeLiteral: invokeToolLiteral,
             handlerFactory: "createTanStackInvokeToolHandler",
             spaFallbackNote: true
           }
@@ -310,12 +321,15 @@ function mcpPlugin(options = {}) {
     configResolved(config) {
       projectRoot = config.root;
       mcpEntry = (0, import_node_path.resolve)(projectRoot, mcpEntryOption);
-      ({ routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
-        projectRoot,
-        routesDirOption,
-        routeFileName,
-        metadataUrlPath
-      ));
+      ({
+        routesDir,
+        mcpRouteFile,
+        metadataRouteFile,
+        listToolsRouteFile,
+        invokeToolRouteFile,
+        listToolsLiteral,
+        invokeToolLiteral
+      } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath));
       regenerate();
     },
     configureServer(server) {

package/dist/stacks/tanstack/vite.d.cts

@@ -16,13 +16,15 @@ interface McpPluginOptions {
      */
     routesDir?: string;
     /**
-     * Public URL path for the MCP-protocol route only.
+     * Public URL path for the MCP-protocol route.
      *
-     * The REST companion routes are fixed at `/.mcp/list-tools` and
-     * `/.mcp/invoke-tool/$tool` and are not affected by this option — the
-     * `[.mcp]` namespace exists to keep them from colliding with
-     * user-defined URLs, so making them follow `path` would defeat the
-     * purpose. Set `restRoutes: false` to drop the companions entirely.
+     * The REST companion routes co-locate with this path under a `.mcp`
+     * sub-segment of the same parent prefix: `/mcp` keeps them at
+     * `/.mcp/list-tools` and `/.mcp/invoke-tool/$tool`, while
+     * `/api/public/mcp` moves them to `/api/public/.mcp/*`. The `.mcp`
+     * namespace keeps them from colliding with user-defined URLs without
+     * anchoring them at the root. Set `restRoutes: false` to drop the
+     * companions entirely.
      *
      * Must start with `/` and use only `/mcp`-style segments; anything more
      * exotic doesn't map cleanly to a TanStack file name.
@@ -37,7 +39,7 @@ interface McpPluginOptions {
     routeFileName?: string;
     /**
      * Set to `false` to skip emitting the REST companion routes at
-     * `/.mcp/list-tools` and `/.mcp/<tool>`. Set
+     * `<path-parent>/.mcp/list-tools` and `<path-parent>/.mcp/<tool>`. Set
      * `protectedResourceMetadataRoute: false` as well if you want the MCP
      * protocol route to be the only emitted surface.
      * @default true

package/dist/stacks/tanstack/vite.d.ts

@@ -16,13 +16,15 @@ interface McpPluginOptions {
      */
     routesDir?: string;
     /**
-     * Public URL path for the MCP-protocol route only.
+     * Public URL path for the MCP-protocol route.
      *
-     * The REST companion routes are fixed at `/.mcp/list-tools` and
-     * `/.mcp/invoke-tool/$tool` and are not affected by this option — the
-     * `[.mcp]` namespace exists to keep them from colliding with
-     * user-defined URLs, so making them follow `path` would defeat the
-     * purpose. Set `restRoutes: false` to drop the companions entirely.
+     * The REST companion routes co-locate with this path under a `.mcp`
+     * sub-segment of the same parent prefix: `/mcp` keeps them at
+     * `/.mcp/list-tools` and `/.mcp/invoke-tool/$tool`, while
+     * `/api/public/mcp` moves them to `/api/public/.mcp/*`. The `.mcp`
+     * namespace keeps them from colliding with user-defined URLs without
+     * anchoring them at the root. Set `restRoutes: false` to drop the
+     * companions entirely.
      *
      * Must start with `/` and use only `/mcp`-style segments; anything more
      * exotic doesn't map cleanly to a TanStack file name.
@@ -37,7 +39,7 @@ interface McpPluginOptions {
     routeFileName?: string;
     /**
      * Set to `false` to skip emitting the REST companion routes at
-     * `/.mcp/list-tools` and `/.mcp/<tool>`. Set
+     * `<path-parent>/.mcp/list-tools` and `<path-parent>/.mcp/<tool>`. Set
      * `protectedResourceMetadataRoute: false` as well if you want the MCP
      * protocol route to be the only emitted surface.
      * @default true

package/dist/stacks/tanstack/vite.js

@@ -25,20 +25,28 @@ function wellKnownRouteFile(routesDir, urlPath) {
   });
   return resolve(routesDir, ...fileSegments);
 }
-function resolveAllRoutes(projectRoot, routesDirOption, routeFileName, metadataUrlPath) {
+function resolveRestRoutes(routesDir, mcpUrlPath) {
+  const parentSegments = mcpUrlPath.replace(/^\/+/, "").replace(/\/+$/, "").split("/").slice(0, -1);
+  const restDir = resolve(routesDir, ...parentSegments, "[.mcp]");
+  const restUrlBase = `/${[...parentSegments, ".mcp"].join("/")}`;
+  return {
+    listToolsRouteFile: resolve(restDir, "list-tools.ts"),
+    invokeToolRouteFile: resolve(restDir, "invoke-tool", "$tool.ts"),
+    listToolsLiteral: `${restUrlBase}/list-tools`,
+    invokeToolLiteral: `${restUrlBase}/invoke-tool/$tool`
+  };
+}
+function resolveAllRoutes(projectRoot, routesDirOption, routeFileName, mcpUrlPath, metadataUrlPath) {
   const routesDir = resolve(projectRoot, routesDirOption);
   assertContains(projectRoot, routesDir, `routesDir "${routesDirOption}"`);
   const mcpRouteFile = resolve(routesDir, routeFileName);
   assertContains(routesDir, mcpRouteFile, `routeFileName "${routeFileName}"`);
   const metadataRouteFile = wellKnownRouteFile(routesDir, metadataUrlPath);
   assertContains(routesDir, metadataRouteFile, `metadataPath "${metadataUrlPath}"`);
-  return {
-    routesDir,
-    mcpRouteFile,
-    metadataRouteFile,
-    listToolsRouteFile: resolve(routesDir, "[.mcp]", "list-tools.ts"),
-    invokeToolRouteFile: resolve(routesDir, "[.mcp]", "invoke-tool", "$tool.ts")
-  };
+  const rest = resolveRestRoutes(routesDir, mcpUrlPath);
+  assertContains(routesDir, rest.listToolsRouteFile, `REST routes for path "${mcpUrlPath}"`);
+  assertContains(routesDir, rest.invokeToolRouteFile, `REST routes for path "${mcpUrlPath}"`);
+  return { routesDir, mcpRouteFile, metadataRouteFile, ...rest };
 }
 function assertUrlPathShape(urlPath) {
   if (!urlPath.startsWith("/")) {
@@ -200,12 +208,15 @@ function mcpPlugin(options = {}) {
   const trustForwardedHost = options.trustForwardedHost !== false;
   let projectRoot = process.cwd();
   let mcpEntry = resolve(projectRoot, mcpEntryOption);
-  let { routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
-    projectRoot,
-    routesDirOption,
-    routeFileName,
-    metadataUrlPath
-  );
+  let {
+    routesDir,
+    mcpRouteFile,
+    metadataRouteFile,
+    listToolsRouteFile,
+    invokeToolRouteFile,
+    listToolsLiteral,
+    invokeToolLiteral
+  } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath);
   const regenerate = () => {
     let mcpEntryExists = true;
     try {
@@ -231,13 +242,13 @@ function mcpPlugin(options = {}) {
         routes.push(
           {
             file: listToolsRouteFile,
-            routeLiteral: "/.mcp/list-tools",
+            routeLiteral: listToolsLiteral,
             handlerFactory: "createTanStackListToolsHandler",
             spaFallbackNote: true
           },
           {
             file: invokeToolRouteFile,
-            routeLiteral: "/.mcp/invoke-tool/$tool",
+            routeLiteral: invokeToolLiteral,
             handlerFactory: "createTanStackInvokeToolHandler",
             spaFallbackNote: true
           }
@@ -279,12 +290,15 @@ function mcpPlugin(options = {}) {
     configResolved(config) {
       projectRoot = config.root;
       mcpEntry = resolve(projectRoot, mcpEntryOption);
-      ({ routesDir, mcpRouteFile, metadataRouteFile, listToolsRouteFile, invokeToolRouteFile } = resolveAllRoutes(
-        projectRoot,
-        routesDirOption,
-        routeFileName,
-        metadataUrlPath
-      ));
+      ({
+        routesDir,
+        mcpRouteFile,
+        metadataRouteFile,
+        listToolsRouteFile,
+        invokeToolRouteFile,
+        listToolsLiteral,
+        invokeToolLiteral
+      } = resolveAllRoutes(projectRoot, routesDirOption, routeFileName, urlPath, metadataUrlPath));
       regenerate();
     },
     configureServer(server) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {