@mcphero/vercel 1.1.6 → 1.3.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @mcphero/vercel@1.1.6 build /Users/atomic/projects/ai/mcphero/packages/vercel
+> @mcphero/vercel@1.2.0 build /Users/atomic/projects/ai/mcphero/packages/vercel
 > tsup
 
 CLI Building entry: src/index.ts
@@ -9,9 +9,9 @@ CLI Using tsup config: /Users/atomic/projects/ai/mcphero/packages/vercel/tsup.co
 CLI Target: es2022
 CLI Cleaning output folder
 ESM Build start
-ESM build/index.js     2.92 KB
-ESM build/index.js.map 5.42 KB
-ESM ⚡️ Build success in 5ms
+ESM build/index.js     6.62 KB
+ESM build/index.js.map 12.29 KB
+ESM ⚡️ Build success in 9ms
 DTS Build start
-DTS ⚡️ Build success in 569ms
-DTS build/index.d.ts 526.00 B
+DTS ⚡️ Build success in 666ms
+DTS build/index.d.ts 612.00 B

package/.turbo/turbo-check.log

@@ -1,14 +1,12 @@
 
-> @mcphero/vercel@1.1.6 check /Users/atomic/projects/ai/mcphero/packages/vercel
+> @mcphero/vercel@1.2.0 check /Users/atomic/projects/ai/mcphero/packages/vercel
 > pnpm lint && pnpm typecheck
 
 
-> @mcphero/vercel@1.1.6 lint /Users/atomic/projects/ai/mcphero/packages/vercel
+> @mcphero/vercel@1.2.0 lint /Users/atomic/projects/ai/mcphero/packages/vercel
 > eslint
 
 
-> @mcphero/vercel@1.1.6 typecheck /Users/atomic/projects/ai/mcphero/packages/vercel
+> @mcphero/vercel@1.2.0 typecheck /Users/atomic/projects/ai/mcphero/packages/vercel
 > tsc --noEmit
 
- ELIFECYCLE  Command failed.
- ELIFECYCLE  Command failed.

package/.turbo/turbo-lint.log

@@ -0,0 +1,5 @@
+
+
+> @mcphero/vercel@1.2.0 lint /Users/atomic/projects/ai/mcphero/packages/vercel
+> eslint
+

package/.turbo/turbo-prepack.log

@@ -1,14 +1,14 @@
 
 
-> @mcphero/vercel@1.1.6 prepack /Users/atomic/projects/ai/mcphero/packages/vercel
+> @mcphero/vercel@1.2.0 prepack /Users/atomic/projects/ai/mcphero/packages/vercel
 > pnpm clean && pnpm build
 
 
-> @mcphero/vercel@1.1.6 clean /Users/atomic/projects/ai/mcphero/packages/vercel
+> @mcphero/vercel@1.2.0 clean /Users/atomic/projects/ai/mcphero/packages/vercel
 > rimraf build
 
 
-> @mcphero/vercel@1.1.6 build /Users/atomic/projects/ai/mcphero/packages/vercel
+> @mcphero/vercel@1.2.0 build /Users/atomic/projects/ai/mcphero/packages/vercel
 > tsup
 
 CLI Building entry: src/index.ts
@@ -18,9 +18,9 @@
 CLI Target: es2022
 CLI Cleaning output folder
 ESM Build start
-ESM build/index.js     2.92 KB
-ESM build/index.js.map 5.42 KB
-ESM ⚡️ Build success in 9ms
+ESM build/index.js     6.46 KB
+ESM build/index.js.map 11.48 KB
+ESM ⚡️ Build success in 12ms
 DTS Build start
-DTS ⚡️ Build success in 773ms
-DTS build/index.d.ts 526.00 B
+DTS ⚡️ Build success in 868ms
+DTS build/index.d.ts 593.00 B

package/README.md

@@ -0,0 +1,126 @@
+# @mcphero/vercel
+
+Vercel serverless adapter for [MCPHero](https://github.com/atomicbi/mcphero) — deploy your actions as a stateless MCP server on Vercel.
+
+## Install
+
+```bash
+pnpm add @mcphero/core @mcphero/vercel
+```
+
+## Usage
+
+### Vanilla Vercel Functions
+
+```typescript
+// api/mcp.ts
+import { mcphero } from '@mcphero/core'
+import { vercel } from '@mcphero/vercel'
+import { MyAction } from '../actions/my-action.js'
+
+const { adapter, handler } = vercel()
+
+await mcphero({ name: 'my-tools', description: 'My MCP Server', version: '1.0.0' })
+  .adapter(adapter)
+  .action(MyAction)
+  .start()
+
+export default { fetch: handler }
+```
+
+### Next.js App Router
+
+```typescript
+// app/api/mcp/route.ts
+import { mcphero } from '@mcphero/core'
+import { vercel } from '@mcphero/vercel'
+import { MyAction } from '../../../actions/my-action.js'
+
+const { adapter, GET, POST, DELETE } = vercel()
+
+await mcphero({ name: 'my-tools', description: 'My MCP Server', version: '1.0.0' })
+  .adapter(adapter)
+  .action(MyAction)
+  .start()
+
+export { GET, POST, DELETE }
+```
+
+## How It Works
+
+- Uses `WebStandardStreamableHTTPServerTransport` from the MCP SDK in **stateless mode** (`sessionIdGenerator: undefined`)
+- Each request creates a fresh `McpServer` + transport, registers tools, handles the request, and returns a Web Standard `Response`
+- Actions are registered as MCP tools using `PascalCase` names (same as the stdio and http adapters)
+- Logging goes to `process.stderr` (Vercel log drain) and MCP client notifications
+
+## Options
+
+```typescript
+const { adapter, handler } = vercel({
+  enableJsonResponse: true  // Return JSON instead of SSE streams
+})
+```
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `enableJsonResponse` | `boolean` | `false` | Return JSON responses instead of SSE streams |
+
+## Compound Return Pattern
+
+Unlike other MCPHero adapters that are simple `AdapterFactory` functions, `vercel()` returns a compound object:
+
+```typescript
+interface VercelAdapter {
+  adapter: AdapterGenerator                      // Pass to mcphero().adapter()
+  handler: (request: Request) => Promise<Response>  // The request handler
+  GET: (request: Request) => Promise<Response>      // Alias for handler
+  POST: (request: Request) => Promise<Response>     // Alias for handler
+  DELETE: (request: Request) => Promise<Response>    // Alias for handler
+}
+```
+
+This is because Vercel functions export request handlers rather than starting long-lived servers. The `adapter` property integrates with the MCPHero builder, while `handler`/`GET`/`POST`/`DELETE` are exported from your route file.
+
+## Deployment
+
+### Vercel Configuration
+
+```json
+{
+  "framework": null,
+  "functions": {
+    "api/mcp.ts": {
+      "memory": 1024,
+      "maxDuration": 60
+    }
+  },
+  "rewrites": [
+    { "source": "/mcp", "destination": "/api/mcp" }
+  ]
+}
+```
+
+### CORS
+
+CORS is not handled by the adapter. Use Next.js middleware or Vercel headers configuration:
+
+```json
+{
+  "headers": [
+    {
+      "source": "/api/mcp",
+      "headers": [
+        { "key": "Access-Control-Allow-Origin", "value": "*" },
+        { "key": "Access-Control-Allow-Methods", "value": "GET, POST, DELETE, OPTIONS" },
+        { "key": "Access-Control-Allow-Headers", "value": "Content-Type, Mcp-Session-Id" }
+      ]
+    }
+  ]
+}
+```
+
+## See Also
+
+- [MCPHero README](https://github.com/atomicbi/mcphero) — Full documentation
+- [`@mcphero/core`](https://www.npmjs.com/package/@mcphero/core) — Core library
+- [`@mcphero/mcp`](https://www.npmjs.com/package/@mcphero/mcp) — MCP stdio and HTTP adapters (stateful)

package/build/index.d.ts

@@ -1,7 +1,10 @@
+import { AuthConfig } from '@mcphero/auth';
 import { AdapterGenerator } from '@mcphero/core';
 
 interface VercelAdapterOptions {
     enableJsonResponse?: boolean;
+    auth?: AuthConfig;
+    path?: string;
 }
 interface VercelAdapter {
     adapter: AdapterGenerator;

package/build/index.js

@@ -1,10 +1,19 @@
 // src/adapter/vercel.ts
+import { generateProtectedResourceMetadata, validateToken } from "@mcphero/auth";
 import { toolResponse } from "@mcphero/core";
 import { createLogger } from "@mcphero/logger";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { capitalCase, pascalCase } from "change-case";
+var CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+  "Access-Control-Allow-Headers": "*",
+  "Access-Control-Max-Age": "86400"
+};
 function vercel(options = {}) {
+  const mcpPath = options.path ?? "/mcp";
+  const callbackPath = options.auth?.callbackPath ?? "/auth/callback";
   let _actions = [];
   let _options = null;
   let _context = null;
@@ -12,8 +21,61 @@ function vercel(options = {}) {
   const _ready = new Promise((resolve) => {
     _readyResolve = resolve;
   });
+  const validPaths = /* @__PURE__ */ new Set([mcpPath]);
+  if (options.auth?.authorizationServers?.length && options.auth.resourceUrl) {
+    validPaths.add("/.well-known/oauth-protected-resource");
+  }
+  if (options.auth?.provider) {
+    validPaths.add("/.well-known/oauth-authorization-server");
+    validPaths.add("/authorize");
+    validPaths.add(callbackPath);
+    validPaths.add("/token");
+    validPaths.add("/register");
+  }
+  const oauthPaths = options.auth?.provider ? {
+    "/.well-known/oauth-authorization-server": ["GET"],
+    "/authorize": ["GET"],
+    [callbackPath]: ["GET"],
+    "/token": ["POST"],
+    "/register": ["POST"]
+  } : null;
   const handleRequest = async (request) => {
+    const url = new URL(request.url);
+    if (!validPaths.has(url.pathname)) {
+      return new Response("Not Found", { status: 404 });
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 200, headers: CORS_HEADERS });
+    }
+    if (url.pathname === "/.well-known/oauth-protected-resource") {
+      const metadata = generateProtectedResourceMetadata(options.auth.resourceUrl, options.auth.authorizationServers);
+      return new Response(JSON.stringify(metadata), {
+        headers: { ...CORS_HEADERS, "Content-Type": "application/json", "Cache-Control": "max-age=3600" }
+      });
+    }
+    if (oauthPaths) {
+      const methods = oauthPaths[url.pathname];
+      if (methods) {
+        if (!methods.includes(request.method)) {
+          return new Response("Method not allowed", { status: 405 });
+        }
+        return handleOAuth(url, request, options.auth.provider);
+      }
+    }
     await _ready;
+    let requestContext = _context;
+    if (options.auth) {
+      const result = await validateToken(request.headers.get("authorization"), options.auth);
+      if (result.error) {
+        return new Response(JSON.stringify(result.error.body), {
+          status: result.error.statusCode,
+          headers: result.error.headers
+        });
+      }
+      if (result.auth) {
+        requestContext = _context.fork({ auth: result.auth });
+      }
+    }
     const transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: void 0,
       enableJsonResponse: options.enableJsonResponse
@@ -51,7 +113,7 @@ function vercel(options = {}) {
             });
           }
         });
-        return action.run(input, _context.fork({ logger, extra })).then((result) => {
+        return action.run(input, requestContext.fork({ logger, extra })).then((result) => {
           return toolResponse(result);
         }).catch((error) => {
           if (error instanceof Error) {
@@ -65,6 +127,41 @@ function vercel(options = {}) {
     await server.connect(transport);
     return transport.handleRequest(request);
   };
+  async function handleOAuth(url, request, provider) {
+    const toOAuthReq = async () => {
+      let body;
+      if (request.method === "POST") {
+        const contentType = request.headers.get("content-type") ?? "";
+        const text = await request.text();
+        if (contentType.includes("json")) {
+          body = JSON.parse(text);
+        } else {
+          body = Object.fromEntries(new URLSearchParams(text));
+        }
+      }
+      return {
+        method: request.method,
+        url,
+        headers: Object.fromEntries(request.headers.entries()),
+        body
+      };
+    };
+    const oauthReq = await toOAuthReq();
+    let oauthRes;
+    if (url.pathname === "/.well-known/oauth-authorization-server") {
+      oauthRes = provider.metadata();
+    } else if (url.pathname === "/authorize") {
+      oauthRes = await provider.authorize(oauthReq);
+    } else if (url.pathname === callbackPath) {
+      oauthRes = await provider.callback(oauthReq);
+    } else if (url.pathname === "/token") {
+      oauthRes = await provider.token(oauthReq);
+    } else {
+      oauthRes = await provider.register(oauthReq);
+    }
+    const responseBody = oauthRes.body ? typeof oauthRes.body === "string" ? oauthRes.body : JSON.stringify(oauthRes.body) : null;
+    return new Response(responseBody, { status: oauthRes.status, headers: oauthRes.headers });
+  }
   const adapter = (mcpHeroOptions, baseContext) => {
     _options = mcpHeroOptions;
     _context = baseContext.fork({ adapter: "vercel" });

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapter/vercel.ts"],"sourcesContent":["import { Action, AdapterGenerator, MCPHeroContext, MCPHeroOptions, toolResponse } from '@mcphero/core'\nimport { createLogger } from '@mcphero/logger'\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js'\nimport { capitalCase, pascalCase } from 'change-case'\n\nexport interface VercelAdapterOptions {\n  enableJsonResponse?: boolean\n}\n\nexport interface VercelAdapter {\n  adapter: AdapterGenerator\n  handler: (request: Request) => Promise<Response>\n  GET: (request: Request) => Promise<Response>\n  POST: (request: Request) => Promise<Response>\n  DELETE: (request: Request) => Promise<Response>\n}\n\nexport function vercel(options: VercelAdapterOptions = {}): VercelAdapter {\n  let _actions: Action[] = []\n  let _options: MCPHeroOptions | null = null\n  let _context: MCPHeroContext | null = null\n  let _readyResolve: () => void\n  const _ready = new Promise<void>((resolve) => {\n    _readyResolve = resolve\n  })\n\n  const handleRequest = async (request: Request): Promise<Response> => {\n    await _ready\n\n    const transport = new WebStandardStreamableHTTPServerTransport({\n      sessionIdGenerator: undefined,\n      enableJsonResponse: options.enableJsonResponse\n    })\n\n    const server = new McpServer({\n      name: _options!.name,\n      description: _options!.description,\n      version: _options!.version\n    }, {\n      capabilities: { tools: {}, logging: {} }\n    })\n\n    for (const action of _actions) {\n      server.registerTool(pascalCase(action.name), {\n        title: capitalCase(action.name),\n        description: action.description,\n        inputSchema: action.input\n      }, async (input, extra) => {\n        const logger = createLogger({\n          stream: process.stderr,\n          onLog: (level, data) => {\n            extra.sendNotification({ method: 'notifications/message', params: { level, data } })\n          },\n          onProgress: ({ progress, total, message }) => {\n            if (!extra._meta?.progressToken) { return }\n            extra.sendNotification({\n              method: 'notifications/progress',\n              params: {\n                progress,\n                total,\n                message,\n                progressToken: extra._meta.progressToken\n              }\n            })\n          }\n        })\n        return action.run(input, _context!.fork({ logger, extra })).then((result) => {\n          return toolResponse(result)\n        }).catch((error) => {\n          if (error instanceof Error) {\n            return toolResponse({ success: false, name: error.name, message: error.message, stack: error.stack })\n          } else {\n            return toolResponse({ success: false, name: 'Unknown Error', message: 'An unknown error occured', error })\n          }\n        })\n      })\n    }\n\n    await server.connect(transport)\n    return transport.handleRequest(request)\n  }\n\n  const adapter: AdapterGenerator = (mcpHeroOptions: MCPHeroOptions, baseContext: MCPHeroContext) => {\n    _options = mcpHeroOptions\n    _context = baseContext.fork({ adapter: 'vercel' })\n    return {\n      context: _context,\n      start: async (actions) => {\n        _actions = actions\n        _readyResolve()\n      },\n      stop: async () => {\n        _actions = []\n      }\n    }\n  }\n\n  return {\n    adapter,\n    handler: handleRequest,\n    GET: handleRequest,\n    POST: handleRequest,\n    DELETE: handleRequest\n  }\n}\n"],"mappings":";AAAA,SAAmE,oBAAoB;AACvF,SAAS,oBAAoB;AAC7B,SAAS,iBAAiB;AAC1B,SAAS,gDAAgD;AACzD,SAAS,aAAa,kBAAkB;AAcjC,SAAS,OAAO,UAAgC,CAAC,GAAkB;AACxE,MAAI,WAAqB,CAAC;AAC1B,MAAI,WAAkC;AACtC,MAAI,WAAkC;AACtC,MAAI;AACJ,QAAM,SAAS,IAAI,QAAc,CAAC,YAAY;AAC5C,oBAAgB;AAAA,EAClB,CAAC;AAED,QAAM,gBAAgB,OAAO,YAAwC;AACnE,UAAM;AAEN,UAAM,YAAY,IAAI,yCAAyC;AAAA,MAC7D,oBAAoB;AAAA,MACpB,oBAAoB,QAAQ;AAAA,IAC9B,CAAC;AAED,UAAM,SAAS,IAAI,UAAU;AAAA,MAC3B,MAAM,SAAU;AAAA,MAChB,aAAa,SAAU;AAAA,MACvB,SAAS,SAAU;AAAA,IACrB,GAAG;AAAA,MACD,cAAc,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IACzC,CAAC;AAED,eAAW,UAAU,UAAU;AAC7B,aAAO,aAAa,WAAW,OAAO,IAAI,GAAG;AAAA,QAC3C,OAAO,YAAY,OAAO,IAAI;AAAA,QAC9B,aAAa,OAAO;AAAA,QACpB,aAAa,OAAO;AAAA,MACtB,GAAG,OAAO,OAAO,UAAU;AACzB,cAAM,SAAS,aAAa;AAAA,UAC1B,QAAQ,QAAQ;AAAA,UAChB,OAAO,CAAC,OAAO,SAAS;AACtB,kBAAM,iBAAiB,EAAE,QAAQ,yBAAyB,QAAQ,EAAE,OAAO,KAAK,EAAE,CAAC;AAAA,UACrF;AAAA,UACA,YAAY,CAAC,EAAE,UAAU,OAAO,QAAQ,MAAM;AAC5C,gBAAI,CAAC,MAAM,OAAO,eAAe;AAAE;AAAA,YAAO;AAC1C,kBAAM,iBAAiB;AAAA,cACrB,QAAQ;AAAA,cACR,QAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,eAAe,MAAM,MAAM;AAAA,cAC7B;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF,CAAC;AACD,eAAO,OAAO,IAAI,OAAO,SAAU,KAAK,EAAE,QAAQ,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW;AAC3E,iBAAO,aAAa,MAAM;AAAA,QAC5B,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,cAAI,iBAAiB,OAAO;AAC1B,mBAAO,aAAa,EAAE,SAAS,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM,CAAC;AAAA,UACtG,OAAO;AACL,mBAAO,aAAa,EAAE,SAAS,OAAO,MAAM,iBAAiB,SAAS,4BAA4B,MAAM,CAAC;AAAA,UAC3G;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,QAAQ,SAAS;AAC9B,WAAO,UAAU,cAAc,OAAO;AAAA,EACxC;AAEA,QAAM,UAA4B,CAAC,gBAAgC,gBAAgC;AACjG,eAAW;AACX,eAAW,YAAY,KAAK,EAAE,SAAS,SAAS,CAAC;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,OAAO,YAAY;AACxB,mBAAW;AACX,sBAAc;AAAA,MAChB;AAAA,MACA,MAAM,YAAY;AAChB,mBAAW,CAAC;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AACF;","names":[]}
+{"version":3,"sources":["../src/adapter/vercel.ts"],"sourcesContent":["import { AuthConfig, generateProtectedResourceMetadata, OAuthRequest, validateToken } from '@mcphero/auth'\nimport { Action, AdapterGenerator, MCPHeroContext, MCPHeroOptions, toolResponse } from '@mcphero/core'\nimport { createLogger } from '@mcphero/logger'\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js'\nimport { capitalCase, pascalCase } from 'change-case'\n\nexport interface VercelAdapterOptions {\n  enableJsonResponse?: boolean\n  auth?: AuthConfig\n  path?: string\n}\n\nexport interface VercelAdapter {\n  adapter: AdapterGenerator\n  handler: (request: Request) => Promise<Response>\n  GET: (request: Request) => Promise<Response>\n  POST: (request: Request) => Promise<Response>\n  DELETE: (request: Request) => Promise<Response>\n}\n\nconst CORS_HEADERS: Record<string, string> = {\n  'Access-Control-Allow-Origin': '*',\n  'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',\n  'Access-Control-Allow-Headers': '*',\n  'Access-Control-Max-Age': '86400'\n}\n\nexport function vercel(options: VercelAdapterOptions = {}): VercelAdapter {\n  const mcpPath = options.path ?? '/mcp'\n  const callbackPath = options.auth?.callbackPath ?? '/auth/callback'\n\n  let _actions: Action[] = []\n  let _options: MCPHeroOptions | null = null\n  let _context: MCPHeroContext | null = null\n  let _readyResolve: () => void\n  const _ready = new Promise<void>((resolve) => {\n    _readyResolve = resolve\n  })\n\n  // Pre-compute valid paths for fast rejection of bogus requests\n  const validPaths = new Set<string>([mcpPath])\n  if (options.auth?.authorizationServers?.length && options.auth.resourceUrl) {\n    validPaths.add('/.well-known/oauth-protected-resource')\n  }\n  if (options.auth?.provider) {\n    validPaths.add('/.well-known/oauth-authorization-server')\n    validPaths.add('/authorize')\n    validPaths.add(callbackPath)\n    validPaths.add('/token')\n    validPaths.add('/register')\n  }\n\n  // OAuth path → allowed methods (built once, not per-request)\n  const oauthPaths: Record<string, string[]> | null = options.auth?.provider\n    ? {\n      '/.well-known/oauth-authorization-server': ['GET'],\n      '/authorize': ['GET'],\n      [callbackPath]: ['GET'],\n      '/token': ['POST'],\n      '/register': ['POST']\n    }\n    : null\n\n  const handleRequest = async (request: Request): Promise<Response> => {\n    const url = new URL(request.url)\n\n    // Fast rejection — no async work, no allocations for unknown paths\n    if (!validPaths.has(url.pathname)) {\n      return new Response('Not Found', { status: 404 })\n    }\n\n    // CORS preflight\n    if (request.method === 'OPTIONS') {\n      return new Response(null, { status: 200, headers: CORS_HEADERS })\n    }\n\n    // Protected resource metadata (RFC 9728)\n    if (url.pathname === '/.well-known/oauth-protected-resource') {\n      const metadata = generateProtectedResourceMetadata(options.auth!.resourceUrl!, options.auth!.authorizationServers!)\n      return new Response(JSON.stringify(metadata), {\n        headers: { ...CORS_HEADERS, 'Content-Type': 'application/json', 'Cache-Control': 'max-age=3600' }\n      })\n    }\n\n    // OAuth provider routes\n    if (oauthPaths) {\n      const methods = oauthPaths[url.pathname]\n      if (methods) {\n        if (!methods.includes(request.method)) {\n          return new Response('Method not allowed', { status: 405 })\n        }\n        return handleOAuth(url, request, options.auth!.provider!)\n      }\n    }\n\n    // MCP transport — wait for mcphero().start() to complete\n    await _ready\n\n    let requestContext = _context!\n    if (options.auth) {\n      const result = await validateToken(request.headers.get('authorization'), options.auth)\n      if (result.error) {\n        return new Response(JSON.stringify(result.error.body), {\n          status: result.error.statusCode,\n          headers: result.error.headers\n        })\n      }\n      if (result.auth) {\n        requestContext = _context!.fork({ auth: result.auth })\n      }\n    }\n\n    const transport = new WebStandardStreamableHTTPServerTransport({\n      sessionIdGenerator: undefined,\n      enableJsonResponse: options.enableJsonResponse\n    })\n\n    const server = new McpServer({\n      name: _options!.name,\n      description: _options!.description,\n      version: _options!.version\n    }, {\n      capabilities: { tools: {}, logging: {} }\n    })\n\n    for (const action of _actions) {\n      server.registerTool(pascalCase(action.name), {\n        title: capitalCase(action.name),\n        description: action.description,\n        inputSchema: action.input\n      }, async (input, extra) => {\n        const logger = createLogger({\n          stream: process.stderr,\n          onLog: (level, data) => {\n            extra.sendNotification({ method: 'notifications/message', params: { level, data } })\n          },\n          onProgress: ({ progress, total, message }) => {\n            if (!extra._meta?.progressToken) { return }\n            extra.sendNotification({\n              method: 'notifications/progress',\n              params: {\n                progress,\n                total,\n                message,\n                progressToken: extra._meta.progressToken\n              }\n            })\n          }\n        })\n        return action.run(input, requestContext.fork({ logger, extra })).then((result) => {\n          return toolResponse(result)\n        }).catch((error) => {\n          if (error instanceof Error) {\n            return toolResponse({ success: false, name: error.name, message: error.message, stack: error.stack })\n          } else {\n            return toolResponse({ success: false, name: 'Unknown Error', message: 'An unknown error occured', error })\n          }\n        })\n      })\n    }\n\n    await server.connect(transport)\n    return transport.handleRequest(request)\n  }\n\n  async function handleOAuth(url: URL, request: Request, provider: NonNullable<AuthConfig['provider']>): Promise<Response> {\n    const toOAuthReq = async (): Promise<OAuthRequest> => {\n      let body: Record<string, string> | undefined\n      if (request.method === 'POST') {\n        const contentType = request.headers.get('content-type') ?? ''\n        const text = await request.text()\n        if (contentType.includes('json')) {\n          body = JSON.parse(text)\n        } else {\n          body = Object.fromEntries(new URLSearchParams(text))\n        }\n      }\n      return {\n        method: request.method,\n        url,\n        headers: Object.fromEntries(request.headers.entries()),\n        body\n      }\n    }\n\n    const oauthReq = await toOAuthReq()\n    let oauthRes\n    if (url.pathname === '/.well-known/oauth-authorization-server') {\n      oauthRes = provider.metadata()\n    } else if (url.pathname === '/authorize') {\n      oauthRes = await provider.authorize(oauthReq)\n    } else if (url.pathname === callbackPath) {\n      oauthRes = await provider.callback(oauthReq)\n    } else if (url.pathname === '/token') {\n      oauthRes = await provider.token(oauthReq)\n    } else {\n      oauthRes = await provider.register(oauthReq)\n    }\n\n    const responseBody = oauthRes.body ? (typeof oauthRes.body === 'string' ? oauthRes.body : JSON.stringify(oauthRes.body)) : null\n    return new Response(responseBody, { status: oauthRes.status, headers: oauthRes.headers })\n  }\n\n  const adapter: AdapterGenerator = (mcpHeroOptions: MCPHeroOptions, baseContext: MCPHeroContext) => {\n    _options = mcpHeroOptions\n    _context = baseContext.fork({ adapter: 'vercel' })\n    return {\n      context: _context,\n      start: async (actions) => {\n        _actions = actions\n        _readyResolve()\n      },\n      stop: async () => {\n        _actions = []\n      }\n    }\n  }\n\n  return {\n    adapter,\n    handler: handleRequest,\n    GET: handleRequest,\n    POST: handleRequest,\n    DELETE: handleRequest\n  }\n}\n"],"mappings":";AAAA,SAAqB,mCAAiD,qBAAqB;AAC3F,SAAmE,oBAAoB;AACvF,SAAS,oBAAoB;AAC7B,SAAS,iBAAiB;AAC1B,SAAS,gDAAgD;AACzD,SAAS,aAAa,kBAAkB;AAgBxC,IAAM,eAAuC;AAAA,EAC3C,+BAA+B;AAAA,EAC/B,gCAAgC;AAAA,EAChC,gCAAgC;AAAA,EAChC,0BAA0B;AAC5B;AAEO,SAAS,OAAO,UAAgC,CAAC,GAAkB;AACxE,QAAM,UAAU,QAAQ,QAAQ;AAChC,QAAM,eAAe,QAAQ,MAAM,gBAAgB;AAEnD,MAAI,WAAqB,CAAC;AAC1B,MAAI,WAAkC;AACtC,MAAI,WAAkC;AACtC,MAAI;AACJ,QAAM,SAAS,IAAI,QAAc,CAAC,YAAY;AAC5C,oBAAgB;AAAA,EAClB,CAAC;AAGD,QAAM,aAAa,oBAAI,IAAY,CAAC,OAAO,CAAC;AAC5C,MAAI,QAAQ,MAAM,sBAAsB,UAAU,QAAQ,KAAK,aAAa;AAC1E,eAAW,IAAI,uCAAuC;AAAA,EACxD;AACA,MAAI,QAAQ,MAAM,UAAU;AAC1B,eAAW,IAAI,yCAAyC;AACxD,eAAW,IAAI,YAAY;AAC3B,eAAW,IAAI,YAAY;AAC3B,eAAW,IAAI,QAAQ;AACvB,eAAW,IAAI,WAAW;AAAA,EAC5B;AAGA,QAAM,aAA8C,QAAQ,MAAM,WAC9D;AAAA,IACA,2CAA2C,CAAC,KAAK;AAAA,IACjD,cAAc,CAAC,KAAK;AAAA,IACpB,CAAC,YAAY,GAAG,CAAC,KAAK;AAAA,IACtB,UAAU,CAAC,MAAM;AAAA,IACjB,aAAa,CAAC,MAAM;AAAA,EACtB,IACE;AAEJ,QAAM,gBAAgB,OAAO,YAAwC;AACnE,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAG/B,QAAI,CAAC,WAAW,IAAI,IAAI,QAAQ,GAAG;AACjC,aAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClD;AAGA,QAAI,QAAQ,WAAW,WAAW;AAChC,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,aAAa,CAAC;AAAA,IAClE;AAGA,QAAI,IAAI,aAAa,yCAAyC;AAC5D,YAAM,WAAW,kCAAkC,QAAQ,KAAM,aAAc,QAAQ,KAAM,oBAAqB;AAClH,aAAO,IAAI,SAAS,KAAK,UAAU,QAAQ,GAAG;AAAA,QAC5C,SAAS,EAAE,GAAG,cAAc,gBAAgB,oBAAoB,iBAAiB,eAAe;AAAA,MAClG,CAAC;AAAA,IACH;AAGA,QAAI,YAAY;AACd,YAAM,UAAU,WAAW,IAAI,QAAQ;AACvC,UAAI,SAAS;AACX,YAAI,CAAC,QAAQ,SAAS,QAAQ,MAAM,GAAG;AACrC,iBAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC3D;AACA,eAAO,YAAY,KAAK,SAAS,QAAQ,KAAM,QAAS;AAAA,MAC1D;AAAA,IACF;AAGA,UAAM;AAEN,QAAI,iBAAiB;AACrB,QAAI,QAAQ,MAAM;AAChB,YAAM,SAAS,MAAM,cAAc,QAAQ,QAAQ,IAAI,eAAe,GAAG,QAAQ,IAAI;AACrF,UAAI,OAAO,OAAO;AAChB,eAAO,IAAI,SAAS,KAAK,UAAU,OAAO,MAAM,IAAI,GAAG;AAAA,UACrD,QAAQ,OAAO,MAAM;AAAA,UACrB,SAAS,OAAO,MAAM;AAAA,QACxB,CAAC;AAAA,MACH;AACA,UAAI,OAAO,MAAM;AACf,yBAAiB,SAAU,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,YAAY,IAAI,yCAAyC;AAAA,MAC7D,oBAAoB;AAAA,MACpB,oBAAoB,QAAQ;AAAA,IAC9B,CAAC;AAED,UAAM,SAAS,IAAI,UAAU;AAAA,MAC3B,MAAM,SAAU;AAAA,MAChB,aAAa,SAAU;AAAA,MACvB,SAAS,SAAU;AAAA,IACrB,GAAG;AAAA,MACD,cAAc,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IACzC,CAAC;AAED,eAAW,UAAU,UAAU;AAC7B,aAAO,aAAa,WAAW,OAAO,IAAI,GAAG;AAAA,QAC3C,OAAO,YAAY,OAAO,IAAI;AAAA,QAC9B,aAAa,OAAO;AAAA,QACpB,aAAa,OAAO;AAAA,MACtB,GAAG,OAAO,OAAO,UAAU;AACzB,cAAM,SAAS,aAAa;AAAA,UAC1B,QAAQ,QAAQ;AAAA,UAChB,OAAO,CAAC,OAAO,SAAS;AACtB,kBAAM,iBAAiB,EAAE,QAAQ,yBAAyB,QAAQ,EAAE,OAAO,KAAK,EAAE,CAAC;AAAA,UACrF;AAAA,UACA,YAAY,CAAC,EAAE,UAAU,OAAO,QAAQ,MAAM;AAC5C,gBAAI,CAAC,MAAM,OAAO,eAAe;AAAE;AAAA,YAAO;AAC1C,kBAAM,iBAAiB;AAAA,cACrB,QAAQ;AAAA,cACR,QAAQ;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA,eAAe,MAAM,MAAM;AAAA,cAC7B;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF,CAAC;AACD,eAAO,OAAO,IAAI,OAAO,eAAe,KAAK,EAAE,QAAQ,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW;AAChF,iBAAO,aAAa,MAAM;AAAA,QAC5B,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,cAAI,iBAAiB,OAAO;AAC1B,mBAAO,aAAa,EAAE,SAAS,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM,CAAC;AAAA,UACtG,OAAO;AACL,mBAAO,aAAa,EAAE,SAAS,OAAO,MAAM,iBAAiB,SAAS,4BAA4B,MAAM,CAAC;AAAA,UAC3G;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,QAAQ,SAAS;AAC9B,WAAO,UAAU,cAAc,OAAO;AAAA,EACxC;AAEA,iBAAe,YAAY,KAAU,SAAkB,UAAkE;AACvH,UAAM,aAAa,YAAmC;AACpD,UAAI;AACJ,UAAI,QAAQ,WAAW,QAAQ;AAC7B,cAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,cAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,YAAI,YAAY,SAAS,MAAM,GAAG;AAChC,iBAAO,KAAK,MAAM,IAAI;AAAA,QACxB,OAAO;AACL,iBAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC;AAAA,QACrD;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,CAAC;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,WAAW;AAClC,QAAI;AACJ,QAAI,IAAI,aAAa,2CAA2C;AAC9D,iBAAW,SAAS,SAAS;AAAA,IAC/B,WAAW,IAAI,aAAa,cAAc;AACxC,iBAAW,MAAM,SAAS,UAAU,QAAQ;AAAA,IAC9C,WAAW,IAAI,aAAa,cAAc;AACxC,iBAAW,MAAM,SAAS,SAAS,QAAQ;AAAA,IAC7C,WAAW,IAAI,aAAa,UAAU;AACpC,iBAAW,MAAM,SAAS,MAAM,QAAQ;AAAA,IAC1C,OAAO;AACL,iBAAW,MAAM,SAAS,SAAS,QAAQ;AAAA,IAC7C;AAEA,UAAM,eAAe,SAAS,OAAQ,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO,KAAK,UAAU,SAAS,IAAI,IAAK;AAC3H,WAAO,IAAI,SAAS,cAAc,EAAE,QAAQ,SAAS,QAAQ,SAAS,SAAS,QAAQ,CAAC;AAAA,EAC1F;AAEA,QAAM,UAA4B,CAAC,gBAAgC,gBAAgC;AACjG,eAAW;AACX,eAAW,YAAY,KAAK,EAAE,SAAS,SAAS,CAAC;AACjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,OAAO,YAAY;AACxB,mBAAW;AACX,sBAAc;AAAA,MAChB;AAAA,MACA,MAAM,YAAY;AAChB,mBAAW,CAAC;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcphero/vercel",
-  "version": "1.1.6",
+  "version": "1.3.0",
   "description": "MCP Hero Vercel Serverless Adapter",
   "repository": {
     "type": "git",
@@ -14,8 +14,9 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "change-case": "^5.4.4",
     "zod": "^4.3.6",
-    "@mcphero/core": "1.1.6",
-    "@mcphero/logger": "1.1.6"
+    "@mcphero/auth": "1.3.0",
+    "@mcphero/logger": "1.3.0",
+    "@mcphero/core": "1.3.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/src/adapter/vercel.ts

@@ -1,3 +1,4 @@
+import { AuthConfig, generateProtectedResourceMetadata, OAuthRequest, validateToken } from '@mcphero/auth'
 import { Action, AdapterGenerator, MCPHeroContext, MCPHeroOptions, toolResponse } from '@mcphero/core'
 import { createLogger } from '@mcphero/logger'
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
@@ -6,6 +7,8 @@ import { capitalCase, pascalCase } from 'change-case'
 
 export interface VercelAdapterOptions {
   enableJsonResponse?: boolean
+  auth?: AuthConfig
+  path?: string
 }
 
 export interface VercelAdapter {
@@ -16,7 +19,17 @@ export interface VercelAdapter {
   DELETE: (request: Request) => Promise<Response>
 }
 
+const CORS_HEADERS: Record<string, string> = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
+  'Access-Control-Allow-Headers': '*',
+  'Access-Control-Max-Age': '86400'
+}
+
 export function vercel(options: VercelAdapterOptions = {}): VercelAdapter {
+  const mcpPath = options.path ?? '/mcp'
+  const callbackPath = options.auth?.callbackPath ?? '/auth/callback'
+
   let _actions: Action[] = []
   let _options: MCPHeroOptions | null = null
   let _context: MCPHeroContext | null = null
@@ -25,9 +38,79 @@ export function vercel(options: VercelAdapterOptions = {}): VercelAdapter {
     _readyResolve = resolve
   })
 
+  // Pre-compute valid paths for fast rejection of bogus requests
+  const validPaths = new Set<string>([mcpPath])
+  if (options.auth?.authorizationServers?.length && options.auth.resourceUrl) {
+    validPaths.add('/.well-known/oauth-protected-resource')
+  }
+  if (options.auth?.provider) {
+    validPaths.add('/.well-known/oauth-authorization-server')
+    validPaths.add('/authorize')
+    validPaths.add(callbackPath)
+    validPaths.add('/token')
+    validPaths.add('/register')
+  }
+
+  // OAuth path → allowed methods (built once, not per-request)
+  const oauthPaths: Record<string, string[]> | null = options.auth?.provider
+    ? {
+      '/.well-known/oauth-authorization-server': ['GET'],
+      '/authorize': ['GET'],
+      [callbackPath]: ['GET'],
+      '/token': ['POST'],
+      '/register': ['POST']
+    }
+    : null
+
   const handleRequest = async (request: Request): Promise<Response> => {
+    const url = new URL(request.url)
+
+    // Fast rejection — no async work, no allocations for unknown paths
+    if (!validPaths.has(url.pathname)) {
+      return new Response('Not Found', { status: 404 })
+    }
+
+    // CORS preflight
+    if (request.method === 'OPTIONS') {
+      return new Response(null, { status: 200, headers: CORS_HEADERS })
+    }
+
+    // Protected resource metadata (RFC 9728)
+    if (url.pathname === '/.well-known/oauth-protected-resource') {
+      const metadata = generateProtectedResourceMetadata(options.auth!.resourceUrl!, options.auth!.authorizationServers!)
+      return new Response(JSON.stringify(metadata), {
+        headers: { ...CORS_HEADERS, 'Content-Type': 'application/json', 'Cache-Control': 'max-age=3600' }
+      })
+    }
+
+    // OAuth provider routes
+    if (oauthPaths) {
+      const methods = oauthPaths[url.pathname]
+      if (methods) {
+        if (!methods.includes(request.method)) {
+          return new Response('Method not allowed', { status: 405 })
+        }
+        return handleOAuth(url, request, options.auth!.provider!)
+      }
+    }
+
+    // MCP transport — wait for mcphero().start() to complete
     await _ready
 
+    let requestContext = _context!
+    if (options.auth) {
+      const result = await validateToken(request.headers.get('authorization'), options.auth)
+      if (result.error) {
+        return new Response(JSON.stringify(result.error.body), {
+          status: result.error.statusCode,
+          headers: result.error.headers
+        })
+      }
+      if (result.auth) {
+        requestContext = _context!.fork({ auth: result.auth })
+      }
+    }
+
     const transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: undefined,
       enableJsonResponse: options.enableJsonResponse
@@ -65,7 +148,7 @@ export function vercel(options: VercelAdapterOptions = {}): VercelAdapter {
             })
           }
         })
-        return action.run(input, _context!.fork({ logger, extra })).then((result) => {
+        return action.run(input, requestContext.fork({ logger, extra })).then((result) => {
           return toolResponse(result)
         }).catch((error) => {
           if (error instanceof Error) {
@@ -81,6 +164,44 @@ export function vercel(options: VercelAdapterOptions = {}): VercelAdapter {
     return transport.handleRequest(request)
   }
 
+  async function handleOAuth(url: URL, request: Request, provider: NonNullable<AuthConfig['provider']>): Promise<Response> {
+    const toOAuthReq = async (): Promise<OAuthRequest> => {
+      let body: Record<string, string> | undefined
+      if (request.method === 'POST') {
+        const contentType = request.headers.get('content-type') ?? ''
+        const text = await request.text()
+        if (contentType.includes('json')) {
+          body = JSON.parse(text)
+        } else {
+          body = Object.fromEntries(new URLSearchParams(text))
+        }
+      }
+      return {
+        method: request.method,
+        url,
+        headers: Object.fromEntries(request.headers.entries()),
+        body
+      }
+    }
+
+    const oauthReq = await toOAuthReq()
+    let oauthRes
+    if (url.pathname === '/.well-known/oauth-authorization-server') {
+      oauthRes = provider.metadata()
+    } else if (url.pathname === '/authorize') {
+      oauthRes = await provider.authorize(oauthReq)
+    } else if (url.pathname === callbackPath) {
+      oauthRes = await provider.callback(oauthReq)
+    } else if (url.pathname === '/token') {
+      oauthRes = await provider.token(oauthReq)
+    } else {
+      oauthRes = await provider.register(oauthReq)
+    }
+
+    const responseBody = oauthRes.body ? (typeof oauthRes.body === 'string' ? oauthRes.body : JSON.stringify(oauthRes.body)) : null
+    return new Response(responseBody, { status: oauthRes.status, headers: oauthRes.headers })
+  }
+
   const adapter: AdapterGenerator = (mcpHeroOptions: MCPHeroOptions, baseContext: MCPHeroContext) => {
     _options = mcpHeroOptions
     _context = baseContext.fork({ adapter: 'vercel' })