@mcp-abap-adt/proxy 0.1.9 → 1.0.0

package/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-04-07
+
+### Breaking Changes
+- **Header renamed: `x-btp-destination` → `x-sap-destination`**
+  - The proxy now uses `x-sap-destination` header (same as MCP server) instead of the proxy-specific `x-btp-destination`
+  - The `--btp` CLI parameter is unchanged
+  - Clients sending `x-btp-destination` header must update to `x-sap-destination`
+
+### Added
+- **Transparent reverse proxy for BTP request forwarding**
+  - Replaced buffered axios-based proxy with Node.js native HTTP streaming reverse proxy
+  - Supports any HTTP API including OpenAI-compatible streaming endpoints
+  - `targetUrl` parameter for explicit target URL override (`--target-url`/`--url` or `x-target-url` header)
+- **Interactive configuration wizard (TUI)**
+  - `npx @mcp-abap-adt/proxy --tui` launches interactive setup wizard
+  - Service key existence checker validates BTP destination before configuration
+  - Generates YAML config files with inline comments
+  - Supports BTP and Direct URL scenarios with advanced settings
+- **Dependencies updated**
+  - `@mcp-abap-adt/interfaces` bumped to v5
+  - `@mcp-abap-adt/auth-stores` bumped to v1.0.4
+  - Added `@inquirer/prompts` for TUI wizard
+
+### Fixed
+- **Header validation skipped in reverse proxy mode** when config provides destination
+- **YAML config file now correctly loads transport/port settings** (`--config` flag)
+- **targetUrl loading from YAML config** now works correctly
+
 ## [0.1.9] - 2026-02-12
 
 ### Changed
@@ -45,7 +73,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - **Separate AuthBroker instances for BTP and ABAP destinations**
-  - `btpAuthBroker` with `XsuaaTokenProvider` for BTP destinations (`--btp` or `x-btp-destination`)
+  - `btpAuthBroker` with `XsuaaTokenProvider` for BTP destinations (`--btp` or `x-sap-destination`)
   - `abapAuthBroker` with `BtpTokenProvider` for ABAP destinations (`--mcp` or `x-mcp-destination`)
   - Proper separation ensures correct token provider is used for each destination type
 - **Client Setup Guide** (`docs/CLIENT_SETUP.md`)
@@ -89,7 +117,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Documentation for BTP-Only authentication mode**
   - Added "Scenario 2: BTP Authentication Only (No SAP Configuration)" in `docs/USAGE.md`
   - Documented use case for connecting to any BTP service without SAP ABAP configuration
-  - Explained that `x-mcp-destination` is optional when using `x-btp-destination` or `--btp`
+  - Explained that `x-mcp-destination` is optional when using `x-sap-destination` or `--btp`
   - Updated README.md with "BTP-Only Mode" section explaining behavior when only `--btp` is provided
 - **Enhanced help text in `bin/mcp-abap-adt-proxy.js`**
   - Added detailed "Usage Modes" section with three modes:
@@ -111,7 +139,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - **Unit tests updated to match new routing logic**
   - Fixed tests that expected `UNKNOWN` strategy when only `x-mcp-destination` or `x-mcp-url` is provided
-  - Updated test expectations to reflect that `x-btp-destination` is now optional
+  - Updated test expectations to reflect that `x-sap-destination` is now optional
   - Added tests for `x-mcp-url` header support
   - Updated `shouldProxy` function tests to cover all routing scenarios (BTP, MCP destination, MCP URL)
   - All 51 unit tests now pass successfully
@@ -134,7 +162,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - **Local testing mode without BTP authentication**
-  - Proxy can now run with only `--mcp` or `x-mcp-destination` (without `--btp` or `x-btp-destination`)
+  - Proxy can now run with only `--mcp` or `x-mcp-destination` (without `--btp` or `x-sap-destination`)
   - Enables local integration testing without BTP authentication
   - MCP server URL can be obtained from MCP destination service key or specified directly via `--mcp-url`
 - **`--mcp-url` parameter support**
@@ -149,16 +177,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Default configuration: ADT on port 3000 (HTTP), Proxy on port 3001 (HTTP)
   - Available via `npm run test:servers`
 - **Flexible routing requirements**
-  - Proxy accepts either `x-btp-destination/--btp`, `x-mcp-destination/--mcp`, or `x-mcp-url/--mcp-url`
+  - Proxy accepts either `x-sap-destination/--btp`, `x-mcp-destination/--mcp`, or `x-mcp-url/--mcp-url`
   - Removed strict requirement for BTP destination when using MCP destination or URL
 
 ### Changed
 - **Routing logic updated**
-  - `x-btp-destination` is now optional (was required)
+  - `x-sap-destination` is now optional (was required)
   - Proxy can work with only `x-mcp-destination` or `x-mcp-url` for local testing
   - MCP URL can be obtained from multiple sources (priority order):
     1. `x-mcp-url` header or `--mcp-url` parameter (direct URL)
-    2. Service key for `x-btp-destination` (if provided)
+    2. Service key for `x-sap-destination` (if provided)
     3. Service key for `x-mcp-destination` (if only MCP destination is provided)
 - **Token retrieval made optional for MCP destination**
   - Token retrieval for `mcpDestination` is now optional (won't fail if token unavailable)

package/README.md

@@ -76,7 +76,7 @@ For detailed setup instructions for Cline and GitHub Copilot, see the **[Client
       "type": "streamableHttp",
       "url": "http://localhost:3001/mcp/stream/http",
       "headers": {
-        "x-btp-destination": "btp-cloud"
+        "x-sap-destination": "btp-cloud"
       }
     }
   }
@@ -84,10 +84,10 @@ For detailed setup instructions for Cline and GitHub Copilot, see the **[Client
 ```
 
 **Required Headers:**
-- `x-btp-destination` - Destination name for BTP Cloud authorization token and MCP server URL
+- `x-sap-destination` - Destination name for BTP Cloud authorization token and MCP server URL
 
 **Command Line Overrides:**
-- `--btp=<destination>` - Overrides `x-btp-destination` header (takes precedence)
+- `--btp=<destination>` - Overrides `x-sap-destination` header (takes precedence)
 - `--url=<url>` - Overrides MCP server URL (required if service key lacks URL)
 - `--browser=<browser>` - Browser to use: `system` (default), `chrome`, `edge`, `firefox`, `headless`
 - `--browser-auth-port=<port>` - Port for OAuth2 callback (default: 3333)
@@ -97,7 +97,7 @@ For detailed setup instructions for Cline and GitHub Copilot, see the **[Client
 
 The proxy uses BTP/XSUAA authentication:
 
-1. **BTP Authentication** (if `--btp` or `x-btp-destination` is present):
+1. **BTP Authentication** (if `--btp` or `x-sap-destination` is present):
    - Uses `AuthorizationCodeProvider` (browser-based OAuth2 flow)
    - **Eager Authentication**: Opens browser immediately on startup to get token
    - Injects/overwrites `Authorization: Bearer <token>` header
@@ -106,7 +106,7 @@ The proxy uses BTP/XSUAA authentication:
 
 **BTP Authentication Mode** (with `--btp`):
 1. Proxy starts → Opens browser for login (Eager Auth) → Gets/Refreshes JWT token
-2. `x-btp-destination` (or `--btp`) → Adds `Authorization: Bearer <token>` header
+2. `x-sap-destination` (or `--btp`) → Adds `Authorization: Bearer <token>` header
 3. MCP server URL obtained from service key OR `--url` parameter
 
 ## Documentation
@@ -126,16 +126,16 @@ The proxy uses BTP/XSUAA authentication:
 
 The proxy performs the following steps for each request:
 
-1. **Extract Headers**: Reads `x-btp-destination` header
+1. **Extract Headers**: Reads `x-sap-destination` header
 2. **Apply Command Line Overrides**: `--btp` parameter overrides header (if provided)
-3. **Validate Routing Requirements**: Requires `x-btp-destination/--btp`
-4. **BTP Authentication** (if `x-btp-destination` or `--btp` is provided):
+3. **Validate Routing Requirements**: Requires `x-sap-destination/--btp`
+4. **BTP Authentication** (if `x-sap-destination` or `--btp` is provided):
    - Uses `AuthorizationCodeProvider` (browser-based login)
    - **Eagerly** obtains token on startup (if configured via `--btp`)
    - Retrieves JWT token using cached refresh token or opens browser
    - Injects/overwrites `Authorization: Bearer <token>` header
 5. **Get MCP Server URL**:
-   - From service key for `x-btp-destination`
+   - From service key for `x-sap-destination`
 6. **Forward Request**: Sends request to MCP server URL with all injected headers
 7. **Return Response**: Forwards the response back to the client
 

package/bin/mcp-abap-adt-proxy.js

@@ -7,6 +7,7 @@
  *
  * Usage:
  *   mcp-abap-adt-proxy [options]
+ *   mcp-abap-adt-proxy tui
  *   mcp-abap-adt-proxy --transport=stdio
  *   mcp-abap-adt-proxy --transport=http
  */
@@ -43,6 +44,10 @@ MCP ABAP ADT Proxy Server v${pkg.version}
 
 Usage:
   mcp-abap-adt-proxy [options]
+  mcp-abap-adt-proxy tui
+
+Commands:
+  tui                       Interactive configuration wizard (generates YAML config)
 
 Options:
   --transport=<type>       Transport type: stdio, http, streamable-http, sse
@@ -50,7 +55,7 @@ Options:
   --sse-port=<port>       SSE server port (default: 3002)
   --http-host=<host>      HTTP server host (default: 0.0.0.0)
   --sse-host=<host>       SSE server host (default: 0.0.0.0)
-  --btp=<destination>     Override x-btp-destination header (for BTP Cloud authorization)
+  --btp=<destination>     Override x-sap-destination header (for BTP Cloud authorization)
                            Required for stdio/SSE transports unless provided in headers
   --target-url=<url>      Override target URL (separates Auth from Connection)
                            Useful for direct OData service testing or non-standard MCP URLs
@@ -77,6 +82,7 @@ Examples:
   mcp-abap-adt-proxy --transport=sse --sse-port=3002     # SSE mode on port 3002
   mcp-abap-adt-proxy --btp=ai                           # With BTP destination override
   mcp-abap-adt-proxy --btp=ai --unsafe                  # With file-based session storage
+  mcp-abap-adt-proxy tui                                 # Interactive configuration wizard
   mcp-abap-adt-proxy --config=proxy-config.yaml         # Load configuration from YAML file
   mcp-abap-adt-proxy -c proxy-config.yml                # Load configuration from YAML file (short form)
 
@@ -94,7 +100,7 @@ Usage Modes:
    Example: mcp-abap-adt-proxy --btp=ai
 
 Headers (for HTTP/SSE transports):
-  - x-btp-destination: Destination for BTP Cloud authorization (optional if --btp is used)
+  - x-sap-destination: Destination for BTP Cloud authorization (optional if --btp is used)
 
   At least one of the above headers (or corresponding --btp parameter) is required.
 
@@ -137,6 +143,30 @@ function main() {
     process.exit(0);
   }
 
+  // Handle 'tui' subcommand — interactive configuration wizard
+  if (process.argv[2] === 'tui') {
+    const wizardPath = path.resolve(__dirname, '../dist/tui/index.js');
+    if (!fs.existsSync(wizardPath)) {
+      process.stderr.write(`[MCP Proxy] ✗ Wizard not found at: ${wizardPath}\n`);
+      process.stderr.write(`[MCP Proxy]   Make sure to build the project with 'npm run build' first.\n`);
+      process.exit(1);
+      return;
+    }
+    import(wizardPath).then(({ runWizard }) => {
+      runWizard().catch((err) => {
+        if (err.name === 'ExitPromptError') {
+          process.exit(0);
+        }
+        process.stderr.write(`[MCP Proxy] ✗ Wizard error: ${err.message}\n`);
+        process.exit(1);
+      });
+    }).catch((err) => {
+      process.stderr.write(`[MCP Proxy] ✗ Failed to load wizard: ${err.message}\n`);
+      process.exit(1);
+    });
+    return;
+  }
+
   // Spawn the main server process
   const serverPath = path.resolve(__dirname, '../dist/index.js');
 

package/dist/index.d.ts

@@ -31,7 +31,7 @@ export declare class McpAbapAdtProxyServer {
      */
     private startHttpServer;
     /**
-     * Handle proxy request - add JWT token and forward to MCP server
+     * Handle proxy request - get JWT token and forward transparently via reverse proxy
      */
     private handleProxyRequest;
     /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiBH,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAsBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IA0ClE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IA4M7B;;OAEG;YACW,kBAAkB;IAyOhC;;OAEG;YACW,cAAc;IA0S5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA2T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}

package/dist/index.js

@@ -15,6 +15,7 @@ const interfaces_1 = require("@mcp-abap-adt/interfaces");
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const sse_js_1 = require("@modelcontextprotocol/sdk/server/sse.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const reverseProxy_js_1 = require("./proxy/reverseProxy.js");
 const config_js_1 = require("./lib/config.js");
 const logger_js_1 = require("./lib/logger.js");
 const transportConfig_js_1 = require("./lib/transportConfig.js");
@@ -40,7 +41,17 @@ class McpAbapAdtProxyServer {
     httpServer;
     btpProxy;
     constructor(transportConfig, configPath) {
-        this.transportConfig = transportConfig || (0, transportConfig_js_1.parseTransportConfig)();
+        // Load config first to extract transport overrides from YAML/JSON file
+        const resolvedConfigPath = configPath || (0, config_js_1.getConfigPath)();
+        let fileTransportOverrides;
+        if (resolvedConfigPath) {
+            const raw = (0, config_js_1.loadRawConfigFile)(resolvedConfigPath);
+            if (raw) {
+                fileTransportOverrides = (0, config_js_1.extractTransportFields)(raw);
+            }
+        }
+        this.transportConfig =
+            transportConfig || (0, transportConfig_js_1.parseTransportConfig)(fileTransportOverrides);
         this.config = (0, config_js_1.loadConfig)(configPath);
         // Validate configuration
         if (this.transportConfig.type === 'streamable-http' ||
@@ -145,9 +156,7 @@ Authorization source: BTP destination "${this.config.btpDestination}"`;
     async startHttpServer() {
         const httpConfig = this.transportConfig;
         this.httpServer = (0, node_http_1.createServer)(async (req, res) => {
-            // Log incoming HTTP request (always log in DEBUG mode)
-            const _debugEnabled = process.env.DEBUG === 'true' ||
-                process.env.DEBUG_HTTP_REQUESTS === 'true';
+            // Log incoming HTTP request
             const sanitizedHeaders = (0, requestInterceptor_js_1.sanitizeHeadersForLogging)(req.headers);
             logger_js_1.logger?.info('=== HTTP REQUEST RECEIVED ===', {
                 type: 'HTTP_REQUEST_RECEIVED',
@@ -156,92 +165,14 @@ Authorization source: BTP destination "${this.config.btpDestination}"`;
                 headers: sanitizedHeaders,
                 remoteAddress: req.socket.remoteAddress,
             });
-            // Allow all HTTP methods (GET, POST, PUT, DELETE, etc.)
-            // if (req.method !== 'POST') {
-            //   logger?.warn('Non-POST request rejected', { ... });
-            //   ...
-            // }
-            // Read request body
-            let body;
-            try {
-                const chunks = [];
-                for await (const chunk of req) {
-                    chunks.push(chunk);
-                }
-                const bodyString = Buffer.concat(chunks).toString('utf-8');
-                logger_js_1.logger?.info('=== PARSING REQUEST BODY ===', {
-                    type: 'REQUEST_BODY_PARSING',
-                    bodyLength: bodyString.length,
-                    bodyPreview: bodyString.substring(0, 200),
-                });
-                if (bodyString.trim().length > 0) {
-                    body = JSON.parse(bodyString);
-                }
-                else {
-                    body = undefined;
-                }
-                // Sanitize body for logging
-                const sanitizedBody = {};
-                if (body && typeof body === 'object' && body !== null) {
-                    const bodyObj = body;
-                    sanitizedBody.method = bodyObj.method;
-                    sanitizedBody.id = bodyObj.id;
-                    sanitizedBody.jsonrpc = bodyObj.jsonrpc;
-                    if (bodyObj.params &&
-                        typeof bodyObj.params === 'object' &&
-                        bodyObj.params !== null) {
-                        const params = bodyObj.params;
-                        sanitizedBody.params = {};
-                        const sanitizedParams = sanitizedBody.params;
-                        if (params.arguments &&
-                            typeof params.arguments === 'object' &&
-                            params.arguments !== null) {
-                            sanitizedParams.arguments = {};
-                            const sanitizedArgs = sanitizedParams.arguments;
-                            for (const [key, value] of Object.entries(params.arguments)) {
-                                const lowerKey = key.toLowerCase();
-                                if (lowerKey.includes('password') ||
-                                    lowerKey.includes('token') ||
-                                    lowerKey.includes('secret')) {
-                                    sanitizedArgs[key] = '[REDACTED]';
-                                }
-                                else {
-                                    sanitizedArgs[key] = value;
-                                }
-                            }
-                        }
-                        for (const [key, value] of Object.entries(params)) {
-                            if (key === 'arguments')
-                                continue;
-                            sanitizedParams[key] = value;
-                        }
-                    }
-                }
-                logger_js_1.logger?.info('=== REQUEST BODY PARSED ===', {
-                    type: 'REQUEST_BODY_PARSED',
-                    body: sanitizedBody,
-                });
-            }
-            catch (error) {
-                logger_js_1.logger?.error('=== FAILED TO PARSE REQUEST BODY ===', {
-                    type: 'REQUEST_PARSE_ERROR',
-                    error: error instanceof Error ? error.message : String(error),
-                    errorStack: error instanceof Error ? error.stack : undefined,
-                });
-                res.writeHead(400, { 'Content-Type': 'text/plain' });
-                res.end('Invalid request body');
-                return;
-            }
-            // Intercept and analyze request
+            // Intercept and analyze request (headers only, body is piped through)
             const configOverrides = {
                 btpDestination: this.config.btpDestination,
                 targetUrl: this.config.targetUrl,
             };
-            logger_js_1.logger?.info('=== INTERCEPTING REQUEST ===', {
-                type: 'REQUEST_INTERCEPTING',
-                configOverrides,
+            const intercepted = (0, requestInterceptor_js_1.interceptRequest)(req, undefined, configOverrides, {
+                skipHeaderValidation: true,
             });
-            const intercepted = (0, requestInterceptor_js_1.interceptRequest)(req, body, configOverrides);
             // Check routing decision
             if (intercepted.routingDecision.strategy === headerAnalyzer_js_1.RoutingStrategy.UNKNOWN) {
                 logger_js_1.logger?.error('Routing decision failed', {
@@ -249,25 +180,16 @@ Authorization source: BTP destination "${this.config.btpDestination}"`;
                     reason: intercepted.routingDecision.reason,
                 });
                 res.writeHead(400, { 'Content-Type': 'application/json' });
-                const bodyId = body && typeof body === 'object' && body !== null && 'id' in body
-                    ? body.id
-                    : null;
                 res.end(JSON.stringify({
-                    jsonrpc: '2.0',
-                    id: bodyId || null,
-                    error: {
-                        code: -32602,
-                        message: intercepted.routingDecision.reason,
-                    },
+                    error: intercepted.routingDecision.reason,
                 }));
                 return;
             }
-            // Log proxy request
+            // Forward request via reverse proxy
             logger_js_1.logger?.info('=== PROXYING REQUEST ===', {
                 type: 'PROXY_REQUEST_START',
                 btpDestination: intercepted.routingDecision.btpDestination,
             });
-            // Handle proxy request - add JWT and forward to x-mcp-url
             try {
                 await this.handleProxyRequest(intercepted, req, res);
             }
@@ -278,8 +200,8 @@ Authorization source: BTP destination "${this.config.btpDestination}"`;
                     strategy: intercepted.routingDecision.strategy,
                 });
                 if (!res.headersSent) {
-                    res.writeHead(500, { 'Content-Type': 'text/plain' });
-                    res.end('Internal server error');
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Internal server error' }));
                 }
             }
         });
@@ -311,192 +233,38 @@ Authorization source: ${authSourceObj}`;
         });
     }
     /**
-     * Handle proxy request - add JWT token and forward to MCP server
+     * Handle proxy request - get JWT token and forward transparently via reverse proxy
      */
     async handleProxyRequest(intercepted, req, res) {
-        const btpDestination = intercepted.routingDecision.btpDestination;
-        // Log incoming request details
-        const incomingHeaders = {};
-        for (const [key, value] of Object.entries(intercepted.headers)) {
-            const lowerKey = key.toLowerCase();
-            if (lowerKey.includes('token') ||
-                lowerKey.includes('authorization') ||
-                lowerKey.includes('password') ||
-                lowerKey.includes('secret')) {
-                incomingHeaders[key] = '[REDACTED]';
-            }
-            else {
-                incomingHeaders[key] = Array.isArray(value)
-                    ? value.join(', ')
-                    : value || '';
-            }
+        const destination = intercepted.routingDecision.btpDestination;
+        if (!destination) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No BTP destination specified' }));
+            return;
         }
-        const sanitizedBody = {};
-        if (intercepted.body &&
-            typeof intercepted.body === 'object' &&
-            intercepted.body !== null) {
-            const bodyObj = intercepted.body;
-            if (bodyObj.params &&
-                typeof bodyObj.params === 'object' &&
-                bodyObj.params !== null) {
-                const params = bodyObj.params;
-                sanitizedBody.params = {};
-                const sanitizedParams = sanitizedBody.params;
-                // For tools/call, log arguments
-                if (params.arguments &&
-                    typeof params.arguments === 'object' &&
-                    params.arguments !== null) {
-                    sanitizedParams.arguments = {};
-                    const sanitizedArgs = sanitizedParams.arguments;
-                    for (const [key, value] of Object.entries(params.arguments)) {
-                        const lowerKey = key.toLowerCase();
-                        if (lowerKey.includes('password') ||
-                            lowerKey.includes('token') ||
-                            lowerKey.includes('secret')) {
-                            sanitizedArgs[key] = '[REDACTED]';
-                        }
-                        else {
-                            sanitizedArgs[key] = value;
-                        }
-                    }
-                }
-                // Log other params
-                for (const [key, value] of Object.entries(params)) {
-                    if (key === 'arguments')
-                        continue;
-                    sanitizedParams[key] = value;
-                }
-            }
-            sanitizedBody.method = bodyObj.method;
-            sanitizedBody.id = bodyObj.id;
-            sanitizedBody.jsonrpc = bodyObj.jsonrpc;
+        // Ensure proxy is initialized
+        if (!this.btpProxy) {
+            this.btpProxy = await (0, btpProxy_js_1.createBtpProxy)(this.config);
         }
-        // Use original request body structure for proxying (generic support)
-        // We do NOT enforce JSON-RPC structure here anymore, to support REST/OData
-        const proxyRequestData = intercepted.body;
-        logger_js_1.logger?.info('=== INCOMING REQUEST ===', {
-            type: 'PROXY_REQUEST_INCOMING',
-            method: req.method,
-            url: req.url,
-            btpDestination,
-            sessionId: intercepted.sessionId,
-            headers: incomingHeaders,
-            body: sanitizedBody,
-            mode: 'BTP authentication',
-        });
         try {
-            // Ensure proxy is initialized (URL will be obtained from service key for btpDestination or mcpDestination)
-            if (!this.btpProxy) {
-                this.btpProxy = await (0, btpProxy_js_1.createBtpProxy)(this.config);
-            }
-            // Build MCP request from intercepted request
-            // Note: Use ?? instead of || to preserve falsy values like 0
-            const interceptedBodyId = getBodyId(intercepted.body);
-            const interceptedBodyIdType = typeof interceptedBodyId;
-            const interceptedBodyIdUndefined = interceptedBodyId === undefined;
-            logger_js_1.logger?.info('=== BEFORE BUILDING MCP REQUEST ===', {
-                type: 'BEFORE_BUILD_MCP_REQUEST',
-                interceptedBodyId,
-                interceptedBodyIdType,
-                interceptedBodyIdUndefined,
-                interceptedBodyIdNull: interceptedBodyId === null,
-                interceptedBodyIdZero: interceptedBodyId === 0,
-                interceptedBodyIdFalsy: !interceptedBodyId,
-                fullInterceptedBody: JSON.stringify(intercepted.body),
-            });
-            // Preserve id correctly - 0 is a valid id value
-            let mcpRequestId;
-            if (interceptedBodyId === undefined) {
-                mcpRequestId = null;
-            }
-            else if (typeof interceptedBodyId === 'string' ||
-                typeof interceptedBodyId === 'number') {
-                mcpRequestId = interceptedBodyId;
-            }
-            else {
-                mcpRequestId = null;
-            }
-            // Proxy request to BtpProxy
-            // Pass the original request data directly
-            const proxyRequest = {
-                method: intercepted.method, // Use original HTTP method (GET, POST, etc.)
-                url: intercepted.url, // Pass request URL (path)
-                data: proxyRequestData, // Use original body (or undefined)
-                id: mcpRequestId, // Keep ID for logging context if available
-            };
-            const proxyResponse = await this.btpProxy.proxyRequest(proxyRequest, intercepted.routingDecision, intercepted.headers);
-            // Fix: If backend returned null ID but we entered with a valid ID (e.g. 0), restore it.
-            // Cline/Zod schemas reject null ID for successful responses if request had an ID.
-            if ((proxyResponse.id === null || proxyResponse.id === undefined) &&
-                mcpRequestId !== null &&
-                mcpRequestId !== undefined) {
-                logger_js_1.logger?.debug('Restoring original request ID in response', {
-                    originalId: mcpRequestId,
-                    receivedId: proxyResponse.id,
-                });
-                proxyResponse.id = mcpRequestId;
-            }
-            logger_js_1.logger?.info('=== FORWARDING REQUEST ===', {
-                type: 'PROXY_REQUEST_FORWARDING',
-                interceptedBodyIdAtForward: getBodyId(intercepted.body),
-                proxyRequest,
-                routingDecision: intercepted.routingDecision,
-                headers: intercepted.headers,
-            });
-            // Log response
-            const sanitizedResponse = {
-                jsonrpc: proxyResponse.jsonrpc,
-                id: proxyResponse.id,
-            };
-            if (proxyResponse.result) {
-                sanitizedResponse.result = proxyResponse.result;
-            }
-            if (proxyResponse.error) {
-                sanitizedResponse.error = {
-                    code: proxyResponse.error.code,
-                    message: proxyResponse.error.message,
-                    data: proxyResponse.error.data,
-                };
-            }
-            logger_js_1.logger?.info('=== RESPONSE FROM TARGET SERVICE ===', {
-                type: 'PROXY_RESPONSE_RECEIVED',
-                response: sanitizedResponse,
-                hasResult: !!proxyResponse.result,
-                hasError: !!proxyResponse.error,
-            });
-            // Send response back to client
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify(proxyResponse));
-            logger_js_1.logger?.info('=== RESPONSE SENT TO CLIENT ===', {
-                type: 'PROXY_RESPONSE_SENT',
-                statusCode: 200,
-            });
-            logger_js_1.logger?.debug('BtpProxy request completed', {
-                type: 'BTP_PROXY_COMPLETED',
-                hasResult: !!proxyResponse.result,
-                hasError: !!proxyResponse.error,
-            });
+            // Get JWT token (cached, auto-refresh)
+            const jwtToken = await this.btpProxy.getJwtToken(destination);
+            // Get target URL
+            const targetUrl = intercepted.routingDecision.targetUrl ||
+                (await this.btpProxy.getTargetUrl(destination));
+            // Forward request transparently
+            await (0, reverseProxy_js_1.forwardRequest)(req, res, targetUrl, jwtToken);
         }
         catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger_js_1.logger?.error('Failed to handle BtpProxy request', {
-                type: 'BTP_PROXY_ERROR',
-                error: errorMessage,
-                stack: error instanceof Error ? error.stack : undefined,
+            logger_js_1.logger?.error('Proxy request failed', {
+                type: 'PROXY_REQUEST_ERROR',
+                destination,
+                error: error instanceof Error ? error.message : String(error),
             });
-            // Output error to stderr for user visibility (only if verbose mode is enabled)
-            if ((0, btpProxy_js_1.shouldWriteStderr)()) {
-                process.stderr.write(`[MCP Proxy] ✗ Connection error: ${errorMessage}\n`);
-            }
             if (!res.headersSent) {
-                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.writeHead(502, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({
-                    jsonrpc: '2.0',
-                    id: getBodyId(intercepted.body) || null,
-                    error: {
-                        code: -32000,
-                        message: errorMessage,
-                    },
+                    error: error instanceof Error ? error.message : 'Proxy error',
                 }));
             }
         }
@@ -686,6 +454,7 @@ Authorization source: ${authSourceObj}`;
                 // Intercept and analyze request with config overrides
                 const configOverrides = {
                     btpDestination: this.config.btpDestination,
+                    targetUrl: this.config.targetUrl,
                 };
                 const intercepted = (0, requestInterceptor_js_1.interceptRequest)(req, body, configOverrides);
                 // Check routing decision
@@ -704,9 +473,19 @@ Authorization source: ${authSourceObj}`;
                     }));
                     return;
                 }
-                // Handle proxy request
+                // Handle proxy request via BtpProxy (JSON-RPC mode for SSE)
                 try {
-                    await this.handleProxyRequest(intercepted, req, res);
+                    if (!this.btpProxy) {
+                        this.btpProxy = await (0, btpProxy_js_1.createBtpProxy)(this.config);
+                    }
+                    const proxyResponse = await this.btpProxy.proxyRequest({
+                        method: intercepted.method,
+                        url: intercepted.url,
+                        data: body,
+                        id: getBodyId(body),
+                    }, intercepted.routingDecision, intercepted.headers);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(proxyResponse));
                 }
                 catch (error) {
                     logger_js_1.logger?.error('Failed to process SSE POST request', {