@mcp-abap-adt/proxy 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.2] - 2026-04-07
+
+### Fixed
+- **Skip header validation in SSE transport path** — proxy no longer runs `validateProxyHeaders()` on SSE requests, matching HTTP transport behavior. Proxy should not validate client headers beyond authorization and defaults.
+- **Added debug-level header forwarding log** in reverse proxy for diagnostics (`LOG_LEVEL=debug`)
+
+## [1.0.1] - 2026-04-07
+
+### Added
+- **Default headers injection (`defaultHeaders` / `--header`)**
+  - Proxy can inject configurable headers into every forwarded request
+  - YAML config: `defaultHeaders` map (e.g., `x-sap-destination: S4HANA_E19`)
+  - CLI: repeatable `--header key=value` flag
+  - Client headers override defaults (low priority injection)
+  - Enables MCP clients (Cline, Claude Code) that cannot set custom headers to pass SAP headers to the MCP server on BTP
+
 ## [1.0.0] - 2026-04-07
 
 ### Breaking Changes

package/README.md

@@ -93,6 +93,28 @@ For detailed setup instructions for Cline and GitHub Copilot, see the **[Client
 - `--browser-auth-port=<port>` - Port for OAuth2 callback (default: 3333)
 - `--unsafe` - Enables file-based session storage (persists tokens to disk). By default, sessions are stored in-memory (secure, lost on restart)
 
+**Default Headers:**
+
+MCP clients like Cline and Claude Code cannot set arbitrary request headers. Use default headers to inject SAP-specific headers (e.g. `x-sap-destination`, `x-sap-client`) that the target MCP server requires.
+
+Client-supplied headers always take precedence over defaults.
+
+Via YAML config (`defaultHeaders` map):
+```yaml
+btpDestination: mcp
+targetUrl: https://example.com
+defaultHeaders:
+  x-sap-destination: S4HANA_E19
+  x-sap-client: "100"
+```
+
+Via CLI (`--header`, repeatable):
+```bash
+mcp-abap-adt-proxy --btp=mcp --url=https://example.com \
+  --header x-sap-destination=S4HANA_E19 \
+  --header x-sap-client=100
+```
+
 **How It Works:**
 
 The proxy uses BTP/XSUAA authentication:

package/bin/mcp-abap-adt-proxy.js

@@ -62,6 +62,8 @@ Options:
   --config=<file>, -c     Load configuration from YAML or JSON file
                            Alternative to command-line parameters
   --unsafe                 Enable file-based session storage (persists tokens to disk)
+  --header key=value       Add default header to every forwarded request (repeatable)
+                           Example: --header x-sap-destination=S4HANA
   --help, -h              Show this help message
   --version, -v           Show version number
 
@@ -82,6 +84,7 @@ Examples:
   mcp-abap-adt-proxy --transport=sse --sse-port=3002     # SSE mode on port 3002
   mcp-abap-adt-proxy --btp=ai                           # With BTP destination override
   mcp-abap-adt-proxy --btp=ai --unsafe                  # With file-based session storage
+  mcp-abap-adt-proxy --btp=ai --header x-sap-destination=S4HANA  # With default SAP headers
   mcp-abap-adt-proxy tui                                 # Interactive configuration wizard
   mcp-abap-adt-proxy --config=proxy-config.yaml         # Load configuration from YAML file
   mcp-abap-adt-proxy -c proxy-config.yml                # Load configuration from YAML file (short form)

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA2T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA6T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}

package/dist/index.js

@@ -252,8 +252,8 @@ Authorization source: ${authSourceObj}`;
             // Get target URL
             const targetUrl = intercepted.routingDecision.targetUrl ||
                 (await this.btpProxy.getTargetUrl(destination));
-            // Forward request transparently
-            await (0, reverseProxy_js_1.forwardRequest)(req, res, targetUrl, jwtToken);
+            // Forward request transparently (inject default headers from config)
+            await (0, reverseProxy_js_1.forwardRequest)(req, res, targetUrl, jwtToken, this.config.defaultHeaders);
         }
         catch (error) {
             logger_js_1.logger?.error('Proxy request failed', {
@@ -456,7 +456,9 @@ Authorization source: ${authSourceObj}`;
                     btpDestination: this.config.btpDestination,
                     targetUrl: this.config.targetUrl,
                 };
-                const intercepted = (0, requestInterceptor_js_1.interceptRequest)(req, body, configOverrides);
+                const intercepted = (0, requestInterceptor_js_1.interceptRequest)(req, body, configOverrides, {
+                    skipHeaderValidation: true,
+                });
                 // Check routing decision
                 if (intercepted.routingDecision.strategy === headerAnalyzer_js_1.RoutingStrategy.UNKNOWN) {
                     logger_js_1.logger?.error('Routing decision failed for SSE POST', {

package/dist/lib/config.d.ts

@@ -9,6 +9,7 @@ export interface ProxyConfig {
     logLevel: string;
     btpDestination?: string;
     targetUrl?: string;
+    defaultHeaders?: Record<string, string>;
     unsafe?: boolean;
     maxRetries?: number;
     retryDelay?: number;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAqC3D;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AA0GD;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGxC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAqC3D;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AA4ID;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}

package/dist/lib/config.js

@@ -137,6 +137,7 @@ function applyDefaults(fileConfig) {
         logLevel: fileConfig.logLevel || 'info',
         btpDestination: fileConfig.btpDestination,
         targetUrl: fileConfig.targetUrl,
+        defaultHeaders: fileConfig.defaultHeaders,
         unsafe: fileConfig.unsafe ?? false,
         maxRetries: fileConfig.maxRetries ?? 3,
         retryDelay: fileConfig.retryDelay ?? 1000,
@@ -161,6 +162,20 @@ function loadFromEnv() {
     const browserAuthPort = browserAuthPortStr
         ? parseInt(browserAuthPortStr, 10)
         : undefined;
+    // Parse repeatable --header key=value arguments
+    const headerArgs = getAllArgValues('--header');
+    let defaultHeaders;
+    if (headerArgs.length > 0) {
+        defaultHeaders = {};
+        for (const arg of headerArgs) {
+            const eqIndex = arg.indexOf('=');
+            if (eqIndex > 0) {
+                const key = arg.substring(0, eqIndex).toLowerCase();
+                const value = arg.substring(eqIndex + 1);
+                defaultHeaders[key] = value;
+            }
+        }
+    }
     return {
         httpPort: parseInt(process.env.MCP_HTTP_PORT || '3001', 10),
         ssePort: parseInt(process.env.MCP_SSE_PORT || '3002', 10),
@@ -169,6 +184,7 @@ function loadFromEnv() {
         logLevel: process.env.LOG_LEVEL || 'info',
         btpDestination,
         targetUrl,
+        defaultHeaders,
         unsafe,
         maxRetries: parseInt(process.env.MCP_PROXY_MAX_RETRIES || '3', 10),
         retryDelay: parseInt(process.env.MCP_PROXY_RETRY_DELAY || '1000', 10),
@@ -194,6 +210,22 @@ function getArgValue(argName) {
     }
     return undefined;
 }
+/**
+ * Get all values for a repeatable argument from command line
+ */
+function getAllArgValues(argName) {
+    const args = process.argv;
+    const values = [];
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === argName && i + 1 < args.length) {
+            values.push(args[i + 1]);
+        }
+        if (args[i].startsWith(`${argName}=`)) {
+            values.push(args[i].substring(argName.length + 1));
+        }
+    }
+    return values;
+}
 /**
  * Get config file path from command line (--config or -c)
  */

package/dist/proxy/reverseProxy.d.ts

@@ -3,5 +3,5 @@ import * as http from 'node:http';
  * Forward an HTTP request to a target URL with JWT injection.
  * Streams both request and response using pipe().
  */
-export declare function forwardRequest(clientReq: http.IncomingMessage, clientRes: http.ServerResponse, targetBaseUrl: string, jwtToken: string): Promise<void>;
+export declare function forwardRequest(clientReq: http.IncomingMessage, clientRes: http.ServerResponse, targetBaseUrl: string, jwtToken: string, defaultHeaders?: Record<string, string>): Promise<void>;
 //# sourceMappingURL=reverseProxy.d.ts.map

package/dist/proxy/reverseProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reverseProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/reverseProxy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAoBlC;;;GAGG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,IAAI,CAAC,eAAe,EAC/B,SAAS,EAAE,IAAI,CAAC,cAAc,EAC9B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA+Ef"}
+{"version":3,"file":"reverseProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/reverseProxy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAoBlC;;;GAGG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,IAAI,CAAC,eAAe,EAC/B,SAAS,EAAE,IAAI,CAAC,cAAc,EAC9B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAiGf"}

package/dist/proxy/reverseProxy.js

@@ -57,10 +57,17 @@ const HOP_BY_HOP_HEADERS = new Set([
  * Forward an HTTP request to a target URL with JWT injection.
  * Streams both request and response using pipe().
  */
-async function forwardRequest(clientReq, clientRes, targetBaseUrl, jwtToken) {
+async function forwardRequest(clientReq, clientRes, targetBaseUrl, jwtToken, defaultHeaders) {
     const targetUrl = new node_url_1.URL(clientReq.url || '/', targetBaseUrl);
-    // Build forwarded headers (skip hop-by-hop and replace auth)
+    // Build forwarded headers: defaults first, then client headers override
     const forwardedHeaders = {};
+    // 1. Inject default headers (low priority)
+    if (defaultHeaders) {
+        for (const [key, value] of Object.entries(defaultHeaders)) {
+            forwardedHeaders[key.toLowerCase()] = value;
+        }
+    }
+    // 2. Copy client headers (high priority — overrides defaults)
     for (const [key, value] of Object.entries(clientReq.headers)) {
         if (HOP_BY_HOP_HEADERS.has(key.toLowerCase()))
             continue;
@@ -76,6 +83,14 @@ async function forwardRequest(clientReq, clientRes, targetBaseUrl, jwtToken) {
     }
     // Set correct host for target
     forwardedHeaders.host = targetUrl.host;
+    // Debug: log incoming vs forwarded headers to diagnose header drops
+    logger_js_1.logger?.debug('Headers forwarding detail', {
+        type: 'REVERSE_PROXY_HEADERS',
+        incoming: Object.keys(clientReq.headers),
+        forwarded: Object.keys(forwardedHeaders),
+        hasAccept: !!forwardedHeaders.accept || !!forwardedHeaders.Accept,
+        defaultHeaderKeys: defaultHeaders ? Object.keys(defaultHeaders) : [],
+    });
     const isHttps = targetUrl.protocol === 'https:';
     const transport = isHttps ? https : http;
     const options = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",