@mcp-abap-adt/proxy 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.4] - 2025-12-02
+
+### Added
+- **Documentation for BTP-Only authentication mode**
+  - Added "Scenario 2: BTP Authentication Only (No SAP Configuration)" in `doc/USAGE.md`
+  - Documented use case for connecting to any BTP service without SAP ABAP configuration
+  - Explained that `x-mcp-destination` is optional when using `x-btp-destination` or `--btp`
+  - Updated README.md with "BTP-Only Mode" section explaining behavior when only `--btp` is provided
+- **Enhanced help text in `bin/mcp-abap-adt-proxy.js`**
+  - Added detailed "Usage Modes" section with three modes:
+    1. BTP Authentication Mode (with `--btp` only)
+    2. BTP + SAP Configuration Mode (`--btp + --mcp`)
+    3. Local Testing Mode (only `--mcp` or `--mcp-url`)
+  - Added examples for each usage mode
+  - Added information about headers for HTTP/SSE transports
+  - Added service keys location and structure documentation
+  - Clarified that `abap.url` in service key is used as MCP server URL (even for non-SAP services)
+
+### Documentation
+- Improved clarity on when to use each authentication mode
+- Added examples showing BTP-only usage (without SAP configuration)
+- Documented that proxy works with any BTP service, not just SAP ABAP
+
 ## [0.1.3] - 2025-12-02
 
 ### Fixed

package/README.md

@@ -81,9 +81,15 @@ The proxy uses two service keys (URLs are obtained from service keys):
 
 **BTP Authentication Mode** (with `x-btp-destination` or `--btp`):
 1. `x-btp-destination` (or `--btp`) → Gets JWT token from auth-broker → Adds `Authorization: Bearer <token>` header
-2. `x-mcp-destination` (or `--mcp`) → Gets JWT token and SAP config from auth-broker → Adds SAP headers (`x-sap-jwt-token`, `x-sap-url`, etc.)
+2. `x-mcp-destination` (or `--mcp`) → Gets JWT token and SAP config from auth-broker → Adds SAP headers (`x-sap-jwt-token`, `x-sap-url`, etc.) - **optional**
 3. MCP server URL obtained from service key for `x-btp-destination`
 
+**BTP-Only Mode** (with only `x-btp-destination`/`--btp`, without `x-mcp-destination`):
+- Works with any BTP service, not just SAP ABAP
+- Only adds `Authorization: Bearer <token>` header (no SAP headers)
+- MCP server URL obtained from BTP destination service key
+- Suitable for BTP services that don't require SAP ABAP configuration
+
 **Local Testing Mode** (with only `x-mcp-destination`/`--mcp` or `x-mcp-url`/`--mcp-url`):
 1. `x-mcp-url` (or `--mcp-url`) → Direct URL to MCP server (no authentication)
 2. `x-mcp-destination` (or `--mcp`) → Gets MCP server URL from service key for MCP destination (optional token)
@@ -96,6 +102,8 @@ The proxy uses two service keys (URLs are obtained from service keys):
 - **[API Documentation](./doc/API.md)** - API reference and interfaces
 - **[Architecture](./doc/ARCHITECTURE.md)** - System architecture and design
 - **[Troubleshooting](./doc/TROUBLESHOOTING.md)** - Common issues and solutions
+- **[Routing Logic Specification](./doc/ROUTING_LOGIC.md)** - Detailed routing logic and scenarios
+- **[Implementation Analysis](./doc/IMPLEMENTATION_ANALYSIS.md)** - Current implementation analysis
 - **[Roadmap](./ROADMAP.md)** - Development roadmap and progress
 
 ## How It Works

package/bin/mcp-abap-adt-proxy.js

@@ -94,6 +94,49 @@ Transport Modes:
   - http / streamable-http: HTTP server (default if stdin is TTY, port 3001)
   - sse: Server-Sent Events server (port 3002)
 
+Usage Modes:
+
+1. BTP Authentication Mode (with --btp):
+   - Adds Authorization: Bearer <token> header from BTP destination
+   - Gets MCP server URL from BTP destination service key
+   - Works with any BTP service, not just SAP ABAP
+   Example: mcp-abap-adt-proxy --btp=ai
+
+2. BTP + SAP Configuration Mode (--btp + --mcp):
+   - Adds Authorization: Bearer <token> header from BTP destination
+   - Adds SAP headers (x-sap-jwt-token, x-sap-url, etc.) from MCP destination
+   - Gets MCP server URL from BTP destination service key
+   - Suitable for SAP ABAP systems that require both BTP and SAP authentication
+   Example: mcp-abap-adt-proxy --btp=ai --mcp=trial
+
+3. Local Testing Mode (only --mcp or --mcp-url):
+   - No BTP authentication required
+   - Gets MCP server URL from MCP destination service key (--mcp) or uses direct URL (--mcp-url)
+   - Optional SAP token (won't fail if unavailable)
+   - Enables local integration testing without BTP authentication
+   Example: mcp-abap-adt-proxy --mcp=trial
+   Example: mcp-abap-adt-proxy --mcp-url=http://localhost:3000/mcp
+
+Headers (for HTTP/SSE transports):
+  - x-btp-destination: Destination for BTP Cloud authorization (optional if --btp is used)
+  - x-mcp-destination: Destination for SAP ABAP connection (optional if --mcp is used)
+  - x-mcp-url: Direct MCP server URL (optional if --mcp-url is used)
+  
+  At least one of the above headers (or corresponding --btp/--mcp/--mcp-url parameter) is required.
+
+Service Keys:
+  Service keys should be placed in:
+  - Unix: ~/.config/mcp-abap-adt/service-keys/<destination>.json
+  - Windows: %USERPROFILE%\\Documents\\mcp-abap-adt\\service-keys\\<destination>.json
+  
+  For BTP destination, service key should contain:
+  {
+    "uaa": { "url": "...", "clientid": "...", "clientsecret": "..." },
+    "abap": { "url": "https://your-mcp-server.com" }
+  }
+  
+  The "abap.url" field is used as the MCP server URL (even for non-SAP services).
+
 For more information, see: https://github.com/fr0ster/mcp-abap-adt-proxy
 `);
 }

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAwB,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAOjF;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,gBAAgB,CAAC,CAAmB;gBAEhC,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAqClE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;;OAGG;YACW,kBAAkB;IA4EhC;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAkD1B;;OAEG;YACW,eAAe;IAsH7B;;OAEG;YACW,kBAAkB;IAsEhC;;OAEG;YACW,cAAc;IA+R5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAwB,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAOjF;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,gBAAgB,CAAC,CAAmB;gBAEhC,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAqClE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;;OAGG;YACW,kBAAkB;IA4EhC;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAkD1B;;OAEG;YACW,eAAe;IAsH7B;;OAEG;YACW,kBAAkB;IA6EhC;;OAEG;YACW,cAAc;IA+R5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}

package/dist/index.js

@@ -341,11 +341,16 @@ class McpAbapAdtProxyServer {
             });
         }
         catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
             logger_js_1.logger.error("Failed to handle cloud-llm-hub proxy request", {
                 type: "CLOUD_LLM_HUB_PROXY_ERROR",
-                error: error instanceof Error ? error.message : String(error),
+                error: errorMessage,
                 stack: error instanceof Error ? error.stack : undefined,
             });
+            // Output error to stderr for user visibility (only if verbose mode is enabled)
+            if ((0, cloudLlmHubProxy_js_1.shouldWriteStderr)()) {
+                process.stderr.write(`[MCP Proxy] ✗ Connection error: ${errorMessage}\n`);
+            }
             if (!res.headersSent) {
                 res.writeHead(500, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({
@@ -353,7 +358,7 @@ class McpAbapAdtProxyServer {
                     id: intercepted.body?.id || null,
                     error: {
                         code: -32000,
-                        message: error instanceof Error ? error.message : "Unknown error",
+                        message: errorMessage,
                     },
                 }));
             }
@@ -643,3 +648,28 @@ class McpAbapAdtProxyServer {
 exports.McpAbapAdtProxyServer = McpAbapAdtProxyServer;
 // Export for use in bin script
 exports.default = McpAbapAdtProxyServer;
+// Auto-start server when run directly (unless MCP_SKIP_AUTO_START is set)
+if (process.env.MCP_SKIP_AUTO_START !== "true") {
+    const server = new McpAbapAdtProxyServer();
+    server.run().catch((error) => {
+        logger_js_1.logger.error("Fatal error while running MCP proxy server", {
+            type: "SERVER_FATAL_ERROR",
+            error: error instanceof Error ? error.message : String(error),
+        });
+        // Always write fatal errors to stderr (even in non-verbose mode, as these are critical)
+        // But skip in test environment
+        const isTestEnv = process.env.NODE_ENV === "test" ||
+            process.env.JEST_WORKER_ID !== undefined ||
+            typeof globalThis.jest !== "undefined";
+        if (!isTestEnv) {
+            process.stderr.write(`[MCP Proxy] ✗ Fatal error: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+        // On Windows, add a small delay before exit to allow error message to be visible
+        if (process.platform === 'win32') {
+            setTimeout(() => process.exit(1), 100);
+        }
+        else {
+            process.exit(1);
+        }
+    });
+}

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAoC3D;AA+ED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA6C5G"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAoC3D;AA+ED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA+C5G"}

package/dist/lib/config.js

@@ -157,12 +157,13 @@ function mergeConfig(fileConfig, envConfig) {
 function validateConfig(config) {
     const errors = [];
     const warnings = [];
-    // Cloud LLM Hub URL is only required if we're using proxy functionality
-    // For direct cloud and basic auth, it's not needed
-    if (!config.cloudLlmHubUrl) {
-        warnings.push("CLOUD_LLM_HUB_URL is not set - proxy to cloud-llm-hub will not work");
+    // Cloud LLM Hub URL is only required if we're not using BTP/MCP destinations
+    // If --btp, --mcp, or --mcp-url is provided, URL will be obtained from service keys
+    const hasDestination = config.btpDestination || config.mcpDestination || config.mcpUrl;
+    if (!config.cloudLlmHubUrl && !hasDestination) {
+        warnings.push("CLOUD_LLM_HUB_URL is not set and no destination provided (--btp, --mcp, or --mcp-url) - proxy will not work without a destination");
     }
-    else {
+    else if (config.cloudLlmHubUrl) {
         try {
             new URL(config.cloudLlmHubUrl);
         }

package/dist/lib/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,oBAAY,QAAQ;IAClB,KAAK,IAAI;IACT,IAAI,IAAI;IACR,IAAI,IAAI;IACR,KAAK,IAAI;CACV;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAqCD,eAAO,MAAM,MAAM,EAAE,MAIpB,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,oBAAY,QAAQ;IAClB,KAAK,IAAI;IACT,IAAI,IAAI;IACR,IAAI,IAAI;IACR,KAAK,IAAI;CACV;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAiDD,eAAO,MAAM,MAAM,EAAE,MAIpB,CAAC"}

package/dist/lib/logger.js

@@ -13,10 +13,21 @@ var LogLevel;
 })(LogLevel || (exports.LogLevel = LogLevel = {}));
 class SimpleLogger {
     level;
+    verbose;
     constructor(level = LogLevel.INFO) {
         this.level = level;
+        // Enable logging only if MCP_PROXY_VERBOSE or DEBUG environment variable is set
+        // In default mode (without env vars), no logs are output
+        this.verbose = process.env.MCP_PROXY_VERBOSE === "true" ||
+            process.env.DEBUG === "true" ||
+            process.env.DEBUG?.includes("mcp-proxy") === true;
     }
     log(level, prefix, message, meta) {
+        // In non-verbose mode, don't output any logs
+        if (!this.verbose) {
+            return;
+        }
+        // In verbose mode, respect the log level
         if (level < this.level) {
             return;
         }

package/dist/lib/stores.d.ts

@@ -1,15 +1,16 @@
 /**
  * Platform-specific stores for proxy
- * Uses FileServiceKeyStore and either FileSessionStore or SafeSessionStore
+ * Uses AbapServiceKeyStore/XsuaaServiceKeyStore and either AbapSessionStore or SafeAbapSessionStore
  * depending on the unsafe configuration parameter
  */
-import { IServiceKeyStore, ISessionStore } from "@mcp-abap-adt/auth-broker";
+import type { IServiceKeyStore, ISessionStore } from "@mcp-abap-adt/auth-broker";
 /**
  * Get platform-specific stores
  * Returns stores based on configuration:
- * - If unsafe=true: uses FileSessionStore (persists to disk)
- * - If unsafe=false: uses SafeSessionStore (in-memory, secure)
- * @param unsafe If true, use FileSessionStore. If false, use SafeSessionStore (default).
+ * - If unsafe=true: uses AbapSessionStore (persists to disk)
+ * - If unsafe=false: uses SafeAbapSessionStore (in-memory, secure)
+ * - Service key store: Combined store that tries both standard and XSUAA loaders
+ * @param unsafe If true, use AbapSessionStore. If false, use SafeAbapSessionStore (default).
  */
 export declare function getPlatformStores(unsafe?: boolean): Promise<{
     serviceKeyStore: IServiceKeyStore;

package/dist/lib/stores.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stores.d.ts","sourceRoot":"","sources":["../../src/lib/stores.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIL,gBAAgB,EAChB,aAAa,EACd,MAAM,2BAA2B,CAAC;AAEnC;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,GAAE,OAAe,GAAG,OAAO,CAAC;IACxE,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,EAAE,aAAa,CAAC;CAC7B,CAAC,CAKD"}
+{"version":3,"file":"stores.d.ts","sourceRoot":"","sources":["../../src/lib/stores.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EAId,MAAM,2BAA2B,CAAC;AAuHnC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,GAAE,OAAe,GAAG,OAAO,CAAC;IACxE,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,EAAE,aAAa,CAAC;CAC7B,CAAC,CAeD"}

package/dist/lib/stores.js

@@ -1,22 +1,169 @@
 "use strict";
 /**
  * Platform-specific stores for proxy
- * Uses FileServiceKeyStore and either FileSessionStore or SafeSessionStore
+ * Uses AbapServiceKeyStore/XsuaaServiceKeyStore and either AbapSessionStore or SafeAbapSessionStore
  * depending on the unsafe configuration parameter
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPlatformStores = getPlatformStores;
-const auth_broker_1 = require("@mcp-abap-adt/auth-broker");
+const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+/**
+ * Get platform-specific default paths for service keys and sessions
+ *
+ * Priority:
+ * 1. AUTH_BROKER_PATH environment variable
+ * 2. Platform-specific standard paths:
+ *    - Unix: ~/.config/mcp-abap-adt/service-keys
+ *    - Windows: %USERPROFILE%\Documents\mcp-abap-adt\service-keys
+ * 3. Current working directory (process.cwd())
+ *
+ * @param subfolder Subfolder name ('service-keys' or 'sessions')
+ * @returns Array of resolved absolute paths
+ */
+function getPlatformPaths(subfolder) {
+    const paths = [];
+    const isWindows = process.platform === 'win32';
+    // Priority 1: AUTH_BROKER_PATH environment variable
+    const envPath = process.env.AUTH_BROKER_PATH;
+    if (envPath) {
+        // Support both colon (Unix) and semicolon (Windows) separators
+        const envPaths = envPath.split(/[:;]/).map(p => p.trim()).filter(p => p.length > 0);
+        paths.push(...envPaths.map(p => path.resolve(p)));
+    }
+    // Priority 2: Platform-specific standard paths (always added, unless AUTH_BROKER_PATH is set)
+    // If AUTH_BROKER_PATH is set, platform paths are still added but with lower priority
+    const homeDir = os.homedir();
+    if (isWindows) {
+        // Windows: %USERPROFILE%\Documents\mcp-abap-adt\{subfolder}
+        const basePath = path.join(homeDir, 'Documents', 'mcp-abap-adt');
+        if (subfolder) {
+            paths.push(path.join(basePath, subfolder));
+        }
+        else {
+            paths.push(basePath);
+        }
+    }
+    else {
+        // Unix (Linux/macOS): ~/.config/mcp-abap-adt/{subfolder}
+        const basePath = path.join(homeDir, '.config', 'mcp-abap-adt');
+        if (subfolder) {
+            paths.push(path.join(basePath, subfolder));
+        }
+        else {
+            paths.push(basePath);
+        }
+    }
+    // Priority 3: Current working directory (always added as fallback)
+    paths.push(process.cwd());
+    // Remove duplicates while preserving order
+    const uniquePaths = [];
+    const seen = new Set();
+    for (const p of paths) {
+        const normalized = path.normalize(p);
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            uniquePaths.push(normalized);
+        }
+    }
+    return uniquePaths;
+}
+/**
+ * Combined service key store that tries both standard and XSUAA loaders
+ * Tries standard ABAP service key loader first, then XSUAA loader if not found
+ *
+ * Note: Stores only support a single directory, so we use the first path from the array
+ */
+class CombinedServiceKeyStore {
+    abapStore;
+    xsuaaStore;
+    constructor(searchPaths) {
+        // Stores only support a single directory, use the first path
+        const firstPath = searchPaths[0] || process.cwd();
+        this.abapStore = new auth_stores_1.AbapServiceKeyStore(firstPath);
+        this.xsuaaStore = new auth_stores_1.XsuaaServiceKeyStore(firstPath);
+    }
+    async getServiceKey(destination) {
+        // Try ABAP service key store first
+        const abapKey = await this.abapStore.getServiceKey(destination);
+        if (abapKey) {
+            return abapKey;
+        }
+        // If not found, try XSUAA store (for BTP XSUAA service keys)
+        return await this.xsuaaStore.getServiceKey(destination);
+    }
+    async getAuthorizationConfig(destination) {
+        // Try ABAP service key store first
+        const abapConfig = await this.abapStore.getAuthorizationConfig(destination);
+        if (abapConfig) {
+            return abapConfig;
+        }
+        // If not found, try XSUAA store (for BTP XSUAA service keys)
+        return await this.xsuaaStore.getAuthorizationConfig(destination);
+    }
+    async getConnectionConfig(destination) {
+        // Try ABAP service key store first
+        const abapConfig = await this.abapStore.getConnectionConfig(destination);
+        if (abapConfig) {
+            return abapConfig;
+        }
+        // If not found, try XSUAA store (for BTP XSUAA service keys)
+        return await this.xsuaaStore.getConnectionConfig(destination);
+    }
+}
 /**
  * Get platform-specific stores
  * Returns stores based on configuration:
- * - If unsafe=true: uses FileSessionStore (persists to disk)
- * - If unsafe=false: uses SafeSessionStore (in-memory, secure)
- * @param unsafe If true, use FileSessionStore. If false, use SafeSessionStore (default).
+ * - If unsafe=true: uses AbapSessionStore (persists to disk)
+ * - If unsafe=false: uses SafeAbapSessionStore (in-memory, secure)
+ * - Service key store: Combined store that tries both standard and XSUAA loaders
+ * @param unsafe If true, use AbapSessionStore. If false, use SafeAbapSessionStore (default).
  */
 async function getPlatformStores(unsafe = false) {
+    // Get platform-specific paths for service keys and sessions
+    const serviceKeyPaths = getPlatformPaths('service-keys');
+    const sessionPaths = getPlatformPaths('sessions');
+    // Stores only support a single directory, use the first path
+    const firstServiceKeyPath = serviceKeyPaths[0] || process.cwd();
+    const firstSessionPath = sessionPaths[0] || process.cwd();
     return {
-        serviceKeyStore: new auth_broker_1.FileServiceKeyStore(),
-        sessionStore: unsafe ? new auth_broker_1.FileSessionStore() : new auth_broker_1.SafeSessionStore(),
+        serviceKeyStore: new CombinedServiceKeyStore(serviceKeyPaths),
+        sessionStore: unsafe
+            ? new auth_stores_1.AbapSessionStore(firstSessionPath)
+            : new auth_stores_1.SafeAbapSessionStore(),
     };
 }

package/dist/proxy/cloudLlmHubProxy.d.ts

@@ -7,6 +7,11 @@
 import { AuthBroker } from "@mcp-abap-adt/auth-broker";
 import { RoutingDecision } from "../router/headerAnalyzer.js";
 import { ProxyConfig } from "../lib/config.js";
+/**
+ * Check if error messages should be written to stderr
+ * Only output in verbose mode and not in test environment
+ */
+export declare function shouldWriteStderr(): boolean;
 export interface ProxyRequest {
     method: string;
     params?: any;

package/dist/proxy/cloudLlmHubProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudLlmHubProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/cloudLlmHubProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAc,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAU3D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,GAAG,CAAC;KACZ,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAgE;IAClF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;gBAEhB,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAmEzF;;OAEG;YACW,WAAW;IAwDzB;;;;;;;;OAQG;YACW,iBAAiB;IA4J/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;CA2G1B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAY3B"}
+{"version":3,"file":"cloudLlmHubProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/cloudLlmHubProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAc,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAU3D;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAQ3C;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,GAAG,CAAC;KACZ,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAgE;IAClF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;gBAEhB,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IA2EzF;;OAEG;YACW,WAAW;IA6DzB;;;;;;;;OAQG;YACW,iBAAiB;IAkL/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;CAuH1B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAc3B"}

package/dist/proxy/cloudLlmHubProxy.js

@@ -10,13 +10,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CloudLlmHubProxy = void 0;
+exports.shouldWriteStderr = shouldWriteStderr;
 exports.createCloudLlmHubProxy = createCloudLlmHubProxy;
 const axios_1 = __importDefault(require("axios"));
 const auth_broker_1 = require("@mcp-abap-adt/auth-broker");
+const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const logger_js_1 = require("../lib/logger.js");
 const config_js_1 = require("../lib/config.js");
 const stores_js_1 = require("../lib/stores.js");
 const errorHandler_js_1 = require("../lib/errorHandler.js");
+/**
+ * Check if error messages should be written to stderr
+ * Only output in verbose mode and not in test environment
+ */
+function shouldWriteStderr() {
+    const verboseMode = process.env.MCP_PROXY_VERBOSE === "true" ||
+        process.env.DEBUG === "true" ||
+        process.env.DEBUG?.includes("mcp-proxy") === true;
+    const isTestEnv = process.env.NODE_ENV === "test" ||
+        process.env.JEST_WORKER_ID !== undefined ||
+        typeof globalThis.jest !== "undefined";
+    return verboseMode && !isTestEnv;
+}
 /**
  * Cloud LLM Hub Proxy Client
  */
@@ -40,11 +55,19 @@ class CloudLlmHubProxy {
         // Initialize circuit breaker
         this.circuitBreaker = new errorHandler_js_1.CircuitBreaker(this.config.circuitBreakerThreshold || 5, this.config.circuitBreakerTimeout || 60000);
         // Create axios instance without baseURL - we'll use full URLs from x-mcp-url
+        // Configure HTTPS agent for proper SSL/TLS handling
+        const https = require('https');
         this.axiosInstance = axios_1.default.create({
             timeout: this.config.requestTimeout || 60000,
             headers: {
                 "Content-Type": "application/json",
             },
+            httpsAgent: new https.Agent({
+                // Allow self-signed certificates if needed (for development)
+                rejectUnauthorized: process.env.NODE_TLS_REJECT_UNAUTHORIZED !== '0',
+                // Keep connections alive for better performance
+                keepAlive: true,
+            }),
         });
         // Add request interceptor for logging
         this.axiosInstance.interceptors.request.use((config) => {
@@ -124,11 +147,16 @@ class CloudLlmHubProxy {
             return token;
         }
         catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
             logger_js_1.logger.error("Failed to get JWT token from auth-broker after retries", {
                 type: "JWT_TOKEN_ERROR",
                 destination,
-                error: error instanceof Error ? error.message : String(error),
+                error: errorMessage,
             });
+            // Output error to stderr for user visibility (only if verbose mode is enabled)
+            if (shouldWriteStderr()) {
+                process.stderr.write(`[MCP Proxy] ✗ Failed to get token for destination "${destination}": ${errorMessage}\n`);
+            }
             throw error;
         }
     }
@@ -167,7 +195,8 @@ class CloudLlmHubProxy {
         // Only used if x-mcp-destination or --mcp is provided
         // For local testing (without BTP), token retrieval is optional - URL is still needed
         if (routingDecision.mcpDestination) {
-            const sapUrl = await this.authBroker.getSapUrl(routingDecision.mcpDestination);
+            const connConfig = await this.authBroker.getConnectionConfig(routingDecision.mcpDestination);
+            const sapUrl = connConfig?.serviceUrl;
             // Try to get token, but don't fail if it's not available (for local testing)
             try {
                 const sapToken = await this.getJwtToken(routingDecision.mcpDestination, forceTokenRefresh);
@@ -225,9 +254,14 @@ class CloudLlmHubProxy {
         }
         else if (routingDecision.btpDestination) {
             // Get URL from BTP destination service key
-            baseUrl = await this.authBroker.getSapUrl(routingDecision.btpDestination);
+            const connConfig = await this.authBroker.getConnectionConfig(routingDecision.btpDestination);
+            baseUrl = connConfig?.serviceUrl;
             if (!baseUrl) {
-                throw new Error(`Failed to get MCP server URL from BTP destination "${routingDecision.btpDestination}". Check service key file.`);
+                const errorMsg = `Failed to get MCP server URL from BTP destination "${routingDecision.btpDestination}". Check service key file.`;
+                if (shouldWriteStderr()) {
+                    process.stderr.write(`[MCP Proxy] ✗ ${errorMsg}\n`);
+                }
+                throw new Error(errorMsg);
             }
             logger_js_1.logger.debug("Using MCP URL from BTP destination service key", {
                 type: "MCP_URL_FROM_BTP",
@@ -237,9 +271,14 @@ class CloudLlmHubProxy {
         }
         else if (routingDecision.mcpDestination) {
             // Get URL from MCP destination service key (for local testing without BTP)
-            baseUrl = await this.authBroker.getSapUrl(routingDecision.mcpDestination);
+            const connConfig = await this.authBroker.getConnectionConfig(routingDecision.mcpDestination);
+            baseUrl = connConfig?.serviceUrl;
             if (!baseUrl) {
-                throw new Error(`Failed to get MCP server URL from MCP destination "${routingDecision.mcpDestination}". Check service key file.`);
+                const errorMsg = `Failed to get MCP server URL from MCP destination "${routingDecision.mcpDestination}". Check service key file.`;
+                if (shouldWriteStderr()) {
+                    process.stderr.write(`[MCP Proxy] ✗ ${errorMsg}\n`);
+                }
+                throw new Error(errorMsg);
             }
             logger_js_1.logger.debug("Using MCP URL from MCP destination service key (local testing mode)", {
                 type: "MCP_URL_FROM_MCP",
@@ -254,9 +293,15 @@ class CloudLlmHubProxy {
         // If baseUrl already contains the path, use it as-is
         // Otherwise, append default endpoint /mcp/stream/http
         let fullUrl;
-        if (baseUrl.includes("/mcp/") || baseUrl.endsWith("/mcp")) {
-            // URL already contains MCP path
+        // Check if URL already contains MCP path (more flexible check)
+        if (baseUrl.includes("/mcp/") || baseUrl.endsWith("/mcp") || baseUrl.includes("/mcp/stream/")) {
+            // URL already contains MCP path - use as-is (but remove trailing slash if present)
             fullUrl = baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+            logger_js_1.logger.debug("Using MCP URL as-is (already contains path)", {
+                type: "MCP_URL_AS_IS",
+                original: baseUrl,
+                final: fullUrl,
+            });
         }
         else {
             // Append default endpoint
@@ -264,6 +309,11 @@ class CloudLlmHubProxy {
             fullUrl = baseUrl.endsWith("/")
                 ? `${baseUrl.slice(0, -1)}${mcpPath}`
                 : `${baseUrl}${mcpPath}`;
+            logger_js_1.logger.debug("Appended MCP path to base URL", {
+                type: "MCP_URL_APPENDED",
+                original: baseUrl,
+                final: fullUrl,
+            });
         }
         logger_js_1.logger.debug("Built proxy request", {
             type: "PROXY_REQUEST_BUILT",
@@ -347,16 +397,27 @@ class CloudLlmHubProxy {
                     });
                 }
             }
+            const errorMessage = error instanceof Error ? error.message : "Unknown error";
+            const statusCode = axios_1.default.isAxiosError(error) && error.response?.status
+                ? error.response.status
+                : undefined;
             logger_js_1.logger.error("Failed to proxy request to cloud-llm-hub", {
                 type: "PROXY_REQUEST_ERROR",
-                error: error instanceof Error ? error.message : String(error),
-                status: axios_1.default.isAxiosError(error) ? error.response?.status : undefined,
+                error: errorMessage,
+                status: statusCode,
                 circuitBreakerState: this.circuitBreaker.getState(),
             });
+            // Output error to stderr for user visibility (only if verbose mode is enabled)
+            if (shouldWriteStderr()) {
+                if (statusCode) {
+                    process.stderr.write(`[MCP Proxy] ✗ Connection failed: ${errorMessage} (HTTP ${statusCode})\n`);
+                }
+                else {
+                    process.stderr.write(`[MCP Proxy] ✗ Connection failed: ${errorMessage}\n`);
+                }
+            }
             // Return error response in MCP format
-            return (0, errorHandler_js_1.createErrorResponse)(originalRequest.id || null, axios_1.default.isAxiosError(error) && error.response?.status
-                ? error.response.status
-                : -32000, error instanceof Error ? error.message : "Unknown error", {
+            return (0, errorHandler_js_1.createErrorResponse)(originalRequest.id || null, statusCode || -32000, errorMessage, {
                 circuitBreakerState: this.circuitBreaker.getState(),
                 originalError: axios_1.default.isAxiosError(error) && error.response?.data
                     ? error.response.data
@@ -372,9 +433,11 @@ exports.CloudLlmHubProxy = CloudLlmHubProxy;
 async function createCloudLlmHubProxy(cloudLlmHubUrl, config) {
     const unsafe = config?.unsafe ?? false;
     const { serviceKeyStore, sessionStore } = await (0, stores_js_1.getPlatformStores)(unsafe);
+    const tokenProvider = new auth_providers_1.BtpTokenProvider();
     const authBroker = new auth_broker_1.AuthBroker({
         serviceKeyStore,
         sessionStore,
+        tokenProvider,
     }, "system");
     return new CloudLlmHubProxy(cloudLlmHubUrl, authBroker, config);
 }

package/dist/router/directCloudRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directCloudRouter.d.ts","sourceRoot":"","sources":["../../src/router/directCloudRouter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAwB,cAAc,EAAsB,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,GAAG,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,mBAAmB,GAC3B,iBAAiB,GAAG,IAAI,CAgD1B;AA4CD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,cAAc,CAAC,CA+FzB"}
+{"version":3,"file":"directCloudRouter.d.ts","sourceRoot":"","sources":["../../src/router/directCloudRouter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAwB,cAAc,EAAsB,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,GAAG,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,mBAAmB,GAC3B,iBAAiB,GAAG,IAAI,CAS1B;AA4CD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,cAAc,CAAC,CA+FzB"}

package/dist/router/directCloudRouter.js

@@ -14,47 +14,14 @@ const logger_js_1 = require("../lib/logger.js");
  * Convert validated auth config to direct cloud config
  */
 function createDirectCloudConfig(routingDecision, headers) {
-    const validatedConfig = routingDecision.validationResult?.config;
-    if (!validatedConfig) {
-        logger_js_1.logger.warn("No validated config available for direct cloud routing", {
-            type: "DIRECT_CLOUD_CONFIG_ERROR",
-            strategy: routingDecision.strategy,
-        });
-        return null;
-    }
-    // Extract SAP URL
-    let sapUrl = validatedConfig.sapUrl;
-    const destination = routingDecision.btpDestination || routingDecision.mcpDestination;
-    if (!sapUrl && destination) {
-        // For destination-based auth, URL comes from destination service key
-        // We'll need to load it from AuthBroker
-        // For now, return null and let the caller handle it
-        logger_js_1.logger.debug("SAP URL not in validated config, will load from destination", {
-            destination: destination,
-        });
-    }
-    // Convert xsuaa to jwt (they're the same for connection purposes)
-    const authType = validatedConfig.authType === "xsuaa" ? "jwt" : validatedConfig.authType;
-    const config = {
-        sapUrl: sapUrl || "", // Will be loaded from destination if needed
-        destination: validatedConfig.destination || destination,
-        authType: authType,
-        sapClient: validatedConfig.sapClient,
-    };
-    // Add JWT-specific fields
-    if (validatedConfig.authType === "jwt" || validatedConfig.authType === "xsuaa") {
-        config.jwtToken = validatedConfig.jwtToken;
-        config.refreshToken = validatedConfig.refreshToken;
-        config.uaaUrl = validatedConfig.uaaUrl;
-        config.uaaClientId = validatedConfig.uaaClientId;
-        config.uaaClientSecret = validatedConfig.uaaClientSecret;
-    }
-    // Add basic auth fields
-    if (validatedConfig.authType === "basic") {
-        config.username = validatedConfig.username;
-        config.password = validatedConfig.password;
-    }
-    return config;
+    // Proxy validates only x-btp-destination and x-mcp-destination headers
+    // This function is not used in the current proxy implementation
+    // as proxy passes all other headers directly to MCP server
+    logger_js_1.logger.warn("Direct cloud routing is not supported in proxy mode", {
+        type: "DIRECT_CLOUD_CONFIG_ERROR",
+        strategy: routingDecision.strategy,
+    });
+    return null;
 }
 /**
  * Connection cache for direct cloud connections

package/dist/router/headerAnalyzer.d.ts

@@ -19,22 +19,27 @@ export interface RoutingDecision {
 }
 /**
  * Analyze headers and extract routing information
- * Proxy needs either:
+ *
+ * Proxy validates only two headers:
  * - x-btp-destination (or --btp): destination for BTP Cloud authorization token (Authorization: Bearer) and MCP server URL
- * - x-mcp-destination (or --mcp): destination for SAP ABAP connection (SAP headers) - can be used without BTP for local testing
+ * - x-mcp-destination (or --mcp): destination for SAP ABAP connection (SAP headers)
  *
  * Also supports:
- * - x-mcp-url (or --mcp-url): direct MCP server URL (used when no BTP destination is provided, for local testing)
+ * - x-mcp-url (or --mcp-url): direct MCP server URL (optional, for local testing)
  *
- * Command-line overrides:
+ * Command-line overrides (take precedence over headers):
  * - --btp=<destination>: overrides x-btp-destination header
  * - --mcp=<destination>: overrides x-mcp-destination header
- * - --mcp-url=<url>: overrides x-mcp-url header (for local testing without BTP)
+ * - --mcp-url=<url>: overrides x-mcp-url header
+ *
+ * Other headers (x-sap-url, x-sap-jwt-token, etc.) are passed directly to MCP server without validation.
  *
  * MCP server URL is obtained from:
  * - x-mcp-url header or --mcp-url parameter (if provided) - takes precedence
  * - service key for x-btp-destination (via auth-broker) if BTP destination is present
  * - service key for x-mcp-destination (via auth-broker) if only MCP destination is present
+ *
+ * Note: Proxy does NOT use .env files for connection configuration. Only destinations via auth-broker (service key files) are used.
  */
 export declare function analyzeHeaders(headers: IncomingHttpHeaders, configOverrides?: {
     btpDestination?: string;

package/dist/router/headerAnalyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headerAnalyzer.d.ts","sourceRoot":"","sources":["../../src/router/headerAnalyzer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAA2C,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAGjH,oBAAY,eAAe;IACzB,4CAA4C;IAC5C,KAAK,UAAU;IACf,6CAA6C;IAC7C,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,mBAAmB,EAC5B,eAAe,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,eAAe,CAyFjB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAGjE"}
+{"version":3,"file":"headerAnalyzer.d.ts","sourceRoot":"","sources":["../../src/router/headerAnalyzer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAA2C,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAGjH,oBAAY,eAAe;IACzB,4CAA4C;IAC5C,KAAK,UAAU;IACf,6CAA6C;IAC7C,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,mBAAmB,EAC5B,eAAe,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,eAAe,CAqFjB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAGjE"}

package/dist/router/headerAnalyzer.js

@@ -17,22 +17,27 @@ var RoutingStrategy;
 })(RoutingStrategy || (exports.RoutingStrategy = RoutingStrategy = {}));
 /**
  * Analyze headers and extract routing information
- * Proxy needs either:
+ *
+ * Proxy validates only two headers:
  * - x-btp-destination (or --btp): destination for BTP Cloud authorization token (Authorization: Bearer) and MCP server URL
- * - x-mcp-destination (or --mcp): destination for SAP ABAP connection (SAP headers) - can be used without BTP for local testing
+ * - x-mcp-destination (or --mcp): destination for SAP ABAP connection (SAP headers)
  *
  * Also supports:
- * - x-mcp-url (or --mcp-url): direct MCP server URL (used when no BTP destination is provided, for local testing)
+ * - x-mcp-url (or --mcp-url): direct MCP server URL (optional, for local testing)
  *
- * Command-line overrides:
+ * Command-line overrides (take precedence over headers):
  * - --btp=<destination>: overrides x-btp-destination header
  * - --mcp=<destination>: overrides x-mcp-destination header
- * - --mcp-url=<url>: overrides x-mcp-url header (for local testing without BTP)
+ * - --mcp-url=<url>: overrides x-mcp-url header
+ *
+ * Other headers (x-sap-url, x-sap-jwt-token, etc.) are passed directly to MCP server without validation.
  *
  * MCP server URL is obtained from:
  * - x-mcp-url header or --mcp-url parameter (if provided) - takes precedence
  * - service key for x-btp-destination (via auth-broker) if BTP destination is present
  * - service key for x-mcp-destination (via auth-broker) if only MCP destination is present
+ *
+ * Note: Proxy does NOT use .env files for connection configuration. Only destinations via auth-broker (service key files) are used.
  */
 function analyzeHeaders(headers, configOverrides) {
     // Validate headers using header-validator
@@ -65,13 +70,11 @@ function analyzeHeaders(headers, configOverrides) {
     const extractedMcpUrl = configOverrides?.mcpUrl
         ? configOverrides.mcpUrl
         : mcpUrlHeader;
-    // Allow proxying if either:
-    // 1. BTP destination is present, OR
-    // 2. MCP destination is present, OR
-    // 3. MCP URL is provided (for local testing without BTP)
-    // This enables local testing without BTP authentication
+    // Validate: at least one destination or MCP URL must be provided
+    // We validate only x-btp-destination and x-mcp-destination headers
+    // Other headers (x-sap-url, x-sap-jwt-token, etc.) are passed directly to MCP server
     if (!extractedBtpDestination && !extractedMcpDestination && !extractedMcpUrl) {
-        logger_js_1.logger.warn("Neither x-btp-destination/x-mcp-destination/x-mcp-url header nor --btp/--mcp/--mcp-url parameter is provided", {
+        logger_js_1.logger.warn("Neither x-btp-destination/x-mcp-destination header nor --btp/--mcp parameter is provided, and no x-mcp-url/--mcp-url", {
             headers: Object.keys(headers).filter(k => k.toLowerCase().startsWith("x-")),
             hasBtpConfigOverride: !!configOverrides?.btpDestination,
             hasMcpConfigOverride: !!configOverrides?.mcpDestination,
@@ -83,11 +86,9 @@ function analyzeHeaders(headers, configOverrides) {
             validationResult,
         };
     }
-    // If only MCP URL is provided without destination, we still need either mcpDestination or btpDestination
-    // unless mcpUrl is a full URL that can be used directly
+    // If only MCP URL is provided without destinations, that's OK - other headers will be passed directly
     if (!extractedBtpDestination && !extractedMcpDestination && extractedMcpUrl) {
-        // This is OK - we can use mcpUrl directly for local testing
-        logger_js_1.logger.debug("Using MCP URL directly for local testing (no destination required)", {
+        logger_js_1.logger.debug("Using MCP URL directly (no destinations - headers will be passed as-is)", {
             type: "MCP_URL_DIRECT",
             mcpUrl: extractedMcpUrl,
         });

package/dist/router/localBasicRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"localBasicRouter.d.ts","sourceRoot":"","sources":["../../src/router/localBasicRouter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAwB,cAAc,EAAsB,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,mBAAmB,GAC3B,gBAAgB,GAAG,IAAI,CAkCzB;AA2CD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,cAAc,CAAC,CAoEzB"}
+{"version":3,"file":"localBasicRouter.d.ts","sourceRoot":"","sources":["../../src/router/localBasicRouter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAwB,cAAc,EAAsB,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,mBAAmB,GAC3B,gBAAgB,GAAG,IAAI,CASzB;AA2CD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,cAAc,CAAC,CAoEzB"}

package/dist/router/localBasicRouter.js

@@ -13,36 +13,14 @@ const logger_js_1 = require("../lib/logger.js");
  * Convert validated auth config to local basic config
  */
 function createLocalBasicConfig(routingDecision, headers) {
-    const validatedConfig = routingDecision.validationResult?.config;
-    if (!validatedConfig) {
-        logger_js_1.logger.warn("No validated config available for local basic routing", {
-            type: "LOCAL_BASIC_CONFIG_ERROR",
-            strategy: routingDecision.strategy,
-        });
-        return null;
-    }
-    if (validatedConfig.authType !== "basic") {
-        logger_js_1.logger.warn("Config is not basic auth type", {
-            type: "LOCAL_BASIC_CONFIG_TYPE_ERROR",
-            authType: validatedConfig.authType,
-        });
-        return null;
-    }
-    if (!validatedConfig.sapUrl || !validatedConfig.username || !validatedConfig.password) {
-        logger_js_1.logger.warn("Missing required fields for basic auth", {
-            type: "LOCAL_BASIC_CONFIG_MISSING",
-            hasUrl: !!validatedConfig.sapUrl,
-            hasUsername: !!validatedConfig.username,
-            hasPassword: !!validatedConfig.password,
-        });
-        return null;
-    }
-    return {
-        sapUrl: validatedConfig.sapUrl,
-        username: validatedConfig.username,
-        password: validatedConfig.password,
-        sapClient: validatedConfig.sapClient,
-    };
+    // Proxy validates only x-btp-destination and x-mcp-destination headers
+    // This function is not used in the current proxy implementation
+    // as proxy passes all other headers directly to MCP server
+    logger_js_1.logger.warn("Local basic routing is not supported in proxy mode", {
+        type: "LOCAL_BASIC_CONFIG_ERROR",
+        strategy: routingDecision.strategy,
+    });
+    return null;
 }
 /**
  * Connection cache for local basic connections

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -38,20 +38,21 @@
   },
   "devDependencies": {
     "@modelcontextprotocol/inspector": "^0.17.2",
-    "@types/jest": "^29.5.0",
+    "@types/jest": "^29.5.14",
     "@types/node": "^24.2.1",
     "commander": "^14.0.2",
     "cors": "^2.8.5",
-    "dotenv": "^17.2.1",
     "express": "^5.1.0",
     "jest": "^29.7.0",
     "ts-jest": "^29.2.0",
     "typescript": "^5.9.2"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-broker": "^0.1.5",
-    "@mcp-abap-adt/connection": "^0.1.13",
-    "@mcp-abap-adt/header-validator": "^0.1.3",
+    "@mcp-abap-adt/auth-broker": "^0.1.9",
+    "@mcp-abap-adt/auth-providers": "^0.1.2",
+    "@mcp-abap-adt/auth-stores": "^0.1.4",
+    "@mcp-abap-adt/connection": "^0.1.15",
+    "@mcp-abap-adt/header-validator": "^0.1.6",
     "@modelcontextprotocol/sdk": "^1.23.0",
     "axios": "^1.11.0",
     "zod": "^3.25.76"