@mcpmake/core 0.2.4 → 0.2.5

package/dist/emitter/project-scaffolder.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-scaffolder.js","sourceRoot":"","sources":["../../src/emitter/project-scaffolder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;GAGG;AACH,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,MAAM,UAAU,oBAAoB,CAAC,QAAyB;IAC5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAe;QACxB;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC;SAClD;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE;gBACrC,GAAG,QAAQ;gBACX,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gEAAgE;gBAChE,oEAAoE;gBACpE,gBAAgB,EACd,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;oBACpE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACvC,CAAC,CAAC,SAAS;aAChB,CAAC;SACH;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;gBACnC,GAAG,QAAQ;gBACX,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gBAAgB;gBAChB,kBAAkB,EAChB,CAAC,gBAAgB,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,6BAA6B;aAC9E,CAAC;SACH;KACF,CAAC;IAEF,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC/D,MAAM,cAAc,GAAG,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,YAAY,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC/C,QAAQ;QACR,mBAAmB;QACnB,cAAc;QACd,aAAa;KACd,CAAC;IACF,OAAO;QACL;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CACrB,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,EACxE,YAAY,CACb;SACF;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC;SAC1D;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACtD;QACD;YACE,0EAA0E;YAC1E,sCAAsC;YACtC,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,cAAc,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SACxD;QACD;YACE,sEAAsE;YACtE,uEAAuE;YACvE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"project-scaffolder.js","sourceRoot":"","sources":["../../src/emitter/project-scaffolder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;GAGG;AACH,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,yEAAyE;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC;IAC3F,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAyB;IAC5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAe;QACxB;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC;SAClD;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE;gBACrC,GAAG,QAAQ;gBACX,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;oBAC7C,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;oBAChD,CAAC,CAAC,QAAQ,CAAC,kBAAkB;gBAC/B,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gEAAgE;gBAChE,oEAAoE;gBACpE,sEAAsE;gBACtE,gBAAgB,EACd,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;oBACpE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACvC,CAAC,CAAC,SAAS;aAChB,CAAC;SACH;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;gBACnC,GAAG,QAAQ;gBACX,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gBAAgB;gBAChB,kBAAkB,EAChB,CAAC,gBAAgB,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,6BAA6B;aAC9E,CAAC;SACH;KACF,CAAC;IAEF,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC/D,MAAM,cAAc,GAAG,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,YAAY,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC/C,QAAQ;QACR,mBAAmB;QACnB,cAAc;QACd,aAAa;KACd,CAAC;IACF,OAAO;QACL;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CACrB,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,EACxE,YAAY,CACb;SACF;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC;SAC1D;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACtD;QACD;YACE,0EAA0E;YAC1E,sCAAsC;YACtC,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,cAAc,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SACxD;QACD;YACE,sEAAsE;YACtE,uEAAuE;YACvE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;KACF,CAAC;AACJ,CAAC"}

package/dist/emitter/python-template-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"python-template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsBH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAUpE"}
+{"version":3,"file":"python-template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAkCH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAUpE"}

package/dist/emitter/python-template-loader.js

@@ -5,17 +5,27 @@ import { readFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import Handlebars from 'handlebars';
+import { escapePyString } from '../utils/sanitize.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PYTHON_TEMPLATE_DIR = resolve(__dirname, 'python-templates');
 const pythonTemplateCache = new Map();
 Handlebars.registerHelper('eq', function (a, b) {
     return a === b;
 });
+// Logical OR for block conditionals (e.g. emit a section when either of two
+// param lists is non-empty). Handlebars has no built-in `or`.
+Handlebars.registerHelper('or', function (a, b) {
+    return a || b;
+});
 Handlebars.registerHelper('pyDocstring', function (str) {
     if (!str)
         return '';
     return str.replace(/"""/g, '\\"\\"\\"').replace(/\\/g, '\\\\');
 });
+// Escape a value for embedding in a double-quoted Python string literal.
+Handlebars.registerHelper('pyStr', function (str) {
+    return escapePyString(String(str ?? ''));
+});
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function renderPythonTemplate(name, data) {
     if (!pythonTemplateCache.has(name)) {

package/dist/emitter/python-template-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"python-template-loader.js","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEnE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAE3E,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE,UAAU,GAAW;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAS;IAC1D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"python-template-loader.js","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEnE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAE3E,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,8DAA8D;AAC9D,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE,UAAU,GAAW;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,yEAAyE;AACzE,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,GAAY;IACvD,OAAO,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAS;IAC1D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/dist/emitter/python-templates/server.py.hbs

@@ -3,6 +3,7 @@
 import os
 import json
 import httpx
+from urllib.parse import quote
 from dotenv import load_dotenv
 from mcp.server import Server
 from mcp.server.stdio import stdio_server
@@ -37,7 +38,12 @@ API_KEY = os.environ.get("{{envVarName}}", "")
 {{/each}}
 
 server = Server("{{serverName}}")
-client = httpx.AsyncClient(timeout=30.0)
+
+# Hard per-request deadline (seconds) and response-size cap (bytes). A stalled or
+# runaway upstream otherwise keeps tool calls alive indefinitely or exhausts memory.
+_REQUEST_TIMEOUT_S = float(os.environ.get("MCP_REQUEST_TIMEOUT_MS", "30000")) / 1000.0
+_MAX_RESPONSE_BYTES = int(os.environ.get("MCP_MAX_RESPONSE_BYTES", str(10 * 1024 * 1024)))
+client = httpx.AsyncClient(timeout=_REQUEST_TIMEOUT_S)
 
 
 def _headers() -> dict[str, str]:
@@ -48,34 +54,98 @@ def _headers() -> dict[str, str]:
         headers["Authorization"] = f"Bearer {BEARER_TOKEN}"
 {{/if}}
 {{#if (eq type "apiKey")}}
+{{#if (eq in "header")}}
+    if API_KEY:
+        headers["{{pyStr headerName}}"] = API_KEY
+{{/if}}
+{{#if (eq in "cookie")}}
+    # API key sent as a cookie — appended to the Cookie header.
     if API_KEY:
-        headers["{{headerName}}"] = API_KEY
+        _existing = headers.get("Cookie")
+        _pair = "{{pyStr headerName}}=" + quote(str(API_KEY), safe="")
+        headers["Cookie"] = (_existing + "; " + _pair) if _existing else _pair
+{{/if}}
 {{/if}}
 {{/each}}
     return headers
 
 
+def _auth_query_params() -> dict[str, str]:
+    # apiKey-in-query auth: the key is sent as a query parameter, not a header.
+    params: dict[str, str] = {}
+{{#each authSchemes}}
+{{#if (eq type "apiKey")}}
+{{#if (eq in "query")}}
+    if API_KEY:
+        params["{{pyStr headerName}}"] = API_KEY
+{{/if}}
+{{/if}}
+{{/each}}
+    return params
+
+
 {{#each tools}}
 @server.tool()
-async def {{functionName}}({{#each pathParams}}{{this}}: str, {{/each}}{{#each queryParams}}{{this}}: str = "", {{/each}}{{#if hasRequestBody}}body: dict | None = None{{/if}}) -> list[TextContent]:
+async def {{functionName}}({{#each pyPathParams}}{{pyName}}: str, {{/each}}{{#each pyQueryParams}}{{pyName}}: str = "", {{/each}}{{#each pyHeaderParams}}{{pyName}}: str = "", {{/each}}{{#each pyCookieParams}}{{pyName}}: str = "", {{/each}}{{#if hasRequestBody}}body: dict | None = None{{/if}}) -> list[TextContent]:
     """{{pyDocstring description}}"""
-    url = f"{BASE_URL}{{{pathTemplate}}}"
-    {{#if queryParams.length}}
-    params = { {{#each queryParams}}"{{this}}": {{this}}, {{/each}} }
+    url = BASE_URL + "{{pyStr pathTemplate}}"
+    {{#each pyPathParams}}
+    url = url.replace("{{pyStr brace}}", quote(str({{pyName}}), safe=""))
+    {{/each}}
+    {{#if pyQueryParams.length}}
+    params = { {{#each pyQueryParams}}"{{pyStr apiName}}": {{pyName}}, {{/each}} }
     params = {k: v for k, v in params.items() if v}
+    {{#if @root.hasQueryApiKey}}
+    params.update(_auth_query_params())
+    {{/if}}
+    {{else}}
+    {{#if @root.hasQueryApiKey}}
+    params = _auth_query_params()
+    {{/if}}
+    {{/if}}
+    {{#if (or pyHeaderParams.length pyCookieParams.length)}}
+    # Per-request header/cookie params (D-H2): sent under their original wire
+    # names, merged over the auth headers. Empty values are omitted.
+    req_headers = dict(_headers())
+    {{#each pyHeaderParams}}
+    if {{pyName}}:
+        req_headers["{{pyStr wireName}}"] = {{pyName}}
+    {{/each}}
+    {{#if pyCookieParams.length}}
+    _cookie_parts = []
+    {{#each pyCookieParams}}
+    if {{pyName}}:
+        _cookie_parts.append("{{pyStr wireName}}=" + quote(str({{pyName}}), safe=""))
+    {{/each}}
+    if _cookie_parts:
+        _existing = req_headers.get("Cookie")
+        _joined = "; ".join(_cookie_parts)
+        req_headers["Cookie"] = (_existing + "; " + _joined) if _existing else _joined
+    {{/if}}
     {{/if}}
     try:
         resp = await client.request(
             "{{method}}",
             url,
-            headers=_headers(),
-            {{#if queryParams.length}}
+            headers={{#if (or pyHeaderParams.length pyCookieParams.length)}}req_headers{{else}}_headers(){{/if}},
+            {{#if (or queryParams.length @root.hasQueryApiKey)}}
             params=params,
             {{/if}}
             {{#if hasRequestBody}}
+            {{#if (eq bodyEncoding "form")}}
+            data=body,
+            {{else}}
+            {{#if (eq bodyEncoding "multipart")}}
+            files=body,
+            {{else}}
             json=body,
             {{/if}}
+            {{/if}}
+            {{/if}}
         )
+        # Cap the buffered response so a runaway upstream cannot exhaust memory.
+        if len(resp.content) > _MAX_RESPONSE_BYTES:
+            return [TextContent(type="text", text=f"Error: response exceeded {_MAX_RESPONSE_BYTES}-byte cap")]
         data = resp.json() if resp.headers.get("content-type", "").startswith("application/json") else resp.text
         return [TextContent(type="text", text=json.dumps(data, indent=2) if isinstance(data, (dict, list)) else str(data))]
     except Exception as e:

package/dist/emitter/site-templates/browser-manager.ts.hbs

@@ -18,6 +18,16 @@ const sessions = new Map<string, BrowserSession>();
 let idleTimer: ReturnType<typeof setInterval> | undefined;
 let config: BrowserConfig;
 
+// In-flight session creations, keyed by session id. Single-flighting per id
+// means concurrent no-ID calls (which all resolve to DEFAULT_SESSION) and
+// repeated calls with the same explicit id share one Chromium context instead
+// of racing to create several.
+const sessionCreations = new Map<string, Promise<{ page: Page; sessionId: string }>>();
+
+// Single-flight the browser launch so concurrent cold starts can't spawn
+// multiple Chromium processes.
+let browserLaunch: Promise<Browser> | undefined;
+
 const DEFAULT_SESSION = '__default__';
 
 /**
@@ -78,10 +88,37 @@ export async function resolveSelector(
   }
 }
 
+/**
+ * Launch the shared browser, single-flighting concurrent cold starts so two
+ * simultaneous requests can never spawn two Chromium processes.
+ */
+async function getBrowser(): Promise<Browser> {
+  if (browser && browser.isConnected()) return browser;
+  if (browserLaunch) return browserLaunch;
+
+  // Only disable sandbox when running as root in a container.
+  const isRoot = process.getuid?.() === 0;
+  browserLaunch = chromium
+    .launch({
+      headless: config.headless,
+      args: isRoot ? ['--no-sandbox', '--disable-setuid-sandbox'] : [],
+    })
+    .then((b) => {
+      browser = b;
+      return b;
+    })
+    .finally(() => {
+      browserLaunch = undefined;
+    });
+  return browserLaunch;
+}
+
 /**
  * Get or create a browser session.
  * If sessionId is provided, reuses an existing session or creates one with that ID.
- * If not, creates a new session with a generated ID.
+ * If not, reuses (or creates) a single shared default session under a fixed ID,
+ * so repeat no-ID calls and `take_screenshot` without an ID all hit the same
+ * context instead of leaking a new Chromium context per call.
  * Throws if the session pool is at capacity (maxSessions).
  */
 export async function getOrCreateSession(sessionId?: string): Promise<{ page: Page; sessionId: string }> {
@@ -95,7 +132,23 @@ export async function getOrCreateSession(sessionId?: string): Promise<{ page: Pa
     return { page: existing.page, sessionId: id };
   }
 
-  // Check capacity before creating a new session
+  // Coalesce concurrent creations for the same id (notably the default
+  // session) onto one promise so we don't create duplicate contexts or
+  // double-count capacity.
+  const inFlight = sessionCreations.get(id);
+  if (inFlight) return inFlight;
+
+  const creation = createSession(id).finally(() => {
+    sessionCreations.delete(id);
+  });
+  sessionCreations.set(id, creation);
+  return creation;
+}
+
+async function createSession(id: string): Promise<{ page: Page; sessionId: string }> {
+  // Reserve the capacity slot BEFORE any await so concurrent creations of
+  // distinct ids can't all pass the gate and then blow past maxSessions. We
+  // insert a placeholder entry now and fill in the real handles below.
   const maxSessions = config.maxSessions ?? 10;
   if (sessions.size >= maxSessions) {
     throw new Error(
@@ -103,38 +156,33 @@ export async function getOrCreateSession(sessionId?: string): Promise<{ page: Pa
       'Close an existing session before creating a new one.'
     );
   }
+  const reserved: BrowserSession = {
+    context: undefined as unknown as BrowserContext,
+    page: undefined as unknown as Page,
+    lastAccessedAt: Date.now(),
+  };
+  sessions.set(id, reserved);
 
-  // Launch browser if not running
-  if (!browser || !browser.isConnected()) {
-    // Only disable sandbox when running as root in a container
-    const isRoot = process.getuid?.() === 0;
-    browser = await chromium.launch({
-      headless: config.headless,
-      args: isRoot ? ['--no-sandbox', '--disable-setuid-sandbox'] : [],
+  try {
+    const activeBrowser = await getBrowser();
+    const context = await activeBrowser.newContext({
+      viewport: config.viewport,
+      ...(config.userAgent ? { userAgent: config.userAgent } : {}),
     });
-  }
-
-  // Create new session
-  const context = await browser.newContext({
-    viewport: config.viewport,
-    ...(config.userAgent ? { userAgent: config.userAgent } : {}),
-  });
-  const page = await context.newPage();
+    const page = await context.newPage();
 
-  // Generate final session ID upfront to avoid race conditions
-  const finalId = id === DEFAULT_SESSION
-    ? `session_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`
-    : id;
+    reserved.context = context;
+    reserved.page = page;
+    reserved.lastAccessedAt = Date.now();
 
-  sessions.set(finalId, {
-    context,
-    page,
-    lastAccessedAt: Date.now(),
-  });
-
-  resetIdleTimer();
+    resetIdleTimer();
 
-  return { page, sessionId: finalId };
+    return { page, sessionId: id };
+  } catch (err) {
+    // Release the reserved slot if context creation failed.
+    sessions.delete(id);
+    throw err;
+  }
 }
 
 /**
@@ -145,7 +193,7 @@ export async function closeSession(sessionId?: string): Promise<void> {
   const session = sessions.get(id);
   if (!session) return;
 
-  await session.context.close().catch(() => {});
+  await session.context?.close().catch(() => {});
   sessions.delete(id);
 
   // If no sessions remain, close the browser
@@ -161,7 +209,7 @@ export async function closeBrowser(): Promise<void> {
   clearIdleTimer();
 
   for (const [id, session] of sessions) {
-    await session.context.close().catch(() => {});
+    await session.context?.close().catch(() => {});
     sessions.delete(id);
   }
 
@@ -207,8 +255,9 @@ function resetIdleTimer(): void {
   clearIdleTimer();
   idleTimer = setInterval(() => {
     const now = Date.now();
-    // Close idle sessions
+    // Close idle sessions. Skip slots still being created (no context yet).
     for (const [id, session] of sessions) {
+      if (!session.context) continue;
       if (now - session.lastAccessedAt > config.idleTimeoutMs) {
         session.context.close().catch(() => {});
         sessions.delete(id);

package/dist/emitter/site-templates/server-main-http.ts.hbs

@@ -14,12 +14,19 @@ function log(level: string, message: string, data?: Record<string, unknown>): vo
 const config = loadConfig();
 initBrowserManager(config.browser);
 
-const server = new McpServer({
-  name: '{{serverName}}',
-  version: '{{serverVersion}}',
-});
-
-registerAllTools(server, config);
+/* Build a fully-registered McpServer. A single McpServer connected to multiple
+ * transports concurrently races on its internal transport reference (the API
+ * HTTP template documents the same hazard), so HTTP requests get a fresh,
+ * stateless server + transport per request instead of sharing one global
+ * instance. */
+function createMcpServer(): McpServer {
+  const server = new McpServer({
+    name: '{{serverName}}',
+    version: '{{serverVersion}}',
+  });
+  registerAllTools(server, config);
+  return server;
+}
 
 let isReady = false;
 
@@ -72,8 +79,17 @@ if (process.env.TRANSPORT === 'http') {
         }
       }
 
+      // Fresh stateless server + transport per request. Both are closed when
+      // the response finishes or the connection aborts, so transports and
+      // their listeners are never leaked and concurrent requests can't
+      // misroute through a shared transport reference.
+      const reqServer = createMcpServer();
       const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
-      await server.connect(transport);
+      res.on('close', () => {
+        void transport.close();
+        void reqServer.close();
+      });
+      await reqServer.connect(transport);
       await transport.handleRequest(req, res);
       return;
     }
@@ -97,6 +113,8 @@ if (process.env.TRANSPORT === 'http') {
   process.on('SIGTERM', shutdown);
   process.on('SIGINT', shutdown);
 } else {
+  // Stdio is inherently single-connection, so one long-lived server is correct.
+  const server = createMcpServer();
   const transport = new StdioServerTransport();
   await server.connect(transport);
   isReady = true;

package/dist/emitter/site-templates/tool-handler-form.ts.hbs

@@ -45,8 +45,8 @@ export function register(server: McpServer, config: AppConfig): void {
 {{#each form.fields}}
 {{#unless (eq fieldType "hidden")}}
 {{#if (eq fieldType "checkbox")}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
-          const checked = Boolean((input as Record<string, unknown>)['{{jsString name}}']);
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
+          const checked = Boolean((input as Record<string, unknown>)['{{jsString inputKey}}']);
           const fieldSelector = await resolveSelector(page, ['{{jsString selector.primary}}'{{#each selector.fallbacks}}, '{{jsString this}}'{{/each}}]);
           if (checked) {
             await page.check(fieldSelector);
@@ -55,21 +55,23 @@ export function register(server: McpServer, config: AppConfig): void {
           }
         }
 {{else if (eq fieldType "select")}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
           const fieldSelector = await resolveSelector(page, ['{{jsString selector.primary}}'{{#each selector.fallbacks}}, '{{jsString this}}'{{/each}}]);
-          await page.selectOption(fieldSelector, String((input as Record<string, unknown>)['{{jsString name}}']));
+          // The schema enum is built from option VALUES, and selectOption
+          // matches by value, so pass the value through directly.
+          await page.selectOption(fieldSelector, String((input as Record<string, unknown>)['{{jsString inputKey}}']));
         }
 {{else if (eq fieldType "radio")}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
           const radioName = '{{jsString name}}';
-          const radioValue = String((input as Record<string, unknown>)['{{jsString name}}']).replace(/["\\[\]()]/g, '\\$&');
+          const radioValue = String((input as Record<string, unknown>)['{{jsString inputKey}}']).replace(/["\\[\]()]/g, '\\$&');
           const radioNameSel = radioName.replace(/["\\]/g, '\\$&');
           await page.check(`input[name="${radioNameSel}"][value="${radioValue}"]`);
         }
 {{else}}
-        if ((input as Record<string, unknown>)['{{jsString name}}'] !== undefined) {
+        if ((input as Record<string, unknown>)['{{jsString inputKey}}'] !== undefined) {
           const fieldSelector = await resolveSelector(page, ['{{jsString selector.primary}}'{{#each selector.fallbacks}}, '{{jsString this}}'{{/each}}]);
-          await page.fill(fieldSelector, String((input as Record<string, unknown>)['{{jsString name}}']));
+          await page.fill(fieldSelector, String((input as Record<string, unknown>)['{{jsString inputKey}}']));
         }
 {{/if}}
 {{/unless}}

package/dist/emitter/template-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AAoBA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAU9D"}
+{"version":3,"file":"template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AA8BA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAU9D"}

package/dist/emitter/template-loader.js

@@ -13,6 +13,15 @@ Handlebars.registerHelper('capitalize', function (str) {
         return str;
     return str.charAt(0).toUpperCase() + str.slice(1);
 });
+// Emit a value as a valid JS/TS literal via JSON.stringify. Safe for embedding
+// untrusted spec-derived strings (e.g. OpenAPI security-scheme names) into
+// generated code: JSON.stringify produces a double-quoted literal with all
+// special characters escaped, so the value can never break out of the literal.
+// Registered on the shared Handlebars singleton, so worker templates (which
+// import the same instance) can use it too.
+Handlebars.registerHelper('json', function (value) {
+    return JSON.stringify(value === undefined ? null : value);
+});
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function renderTemplate(name, data) {
     if (!templateCache.has(name)) {

package/dist/emitter/template-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"template-loader.js","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAErD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;AAErE,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU,GAAW;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAS;IACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"template-loader.js","sourceRoot":"","sources":["../../src/emitter/template-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAErD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;AAErE,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU,GAAW;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,4CAA4C;AAC5C,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,KAAc;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAS;IACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/emitter/templates/auth-provider.ts.hbs

@@ -3,51 +3,88 @@ import type { AppConfig } from './config.js';
 import { getAccessToken } from './oauth.js';
 {{/if}}
 
+/**
+ * Per-operation outbound-auth requirement (D-H2), forwarded from the tool
+ * handler. Mirrors the generator's ToolAuthRequirement:
+ *   - undefined            → apply every configured scheme (global default).
+ *   - { mode: 'public' }   → apply NO auth (operation declared `security: []`).
+ *   - { mode: 'schemes' }  → apply ONLY the listed OpenAPI scheme names.
+ */
+export type AuthRequirement =
+  | { mode: 'public' }
+  | { mode: 'schemes'; schemeNames: string[] };
+
+/** Whether the scheme named `name` should be applied for this requirement. */
+function schemeApplies(req: AuthRequirement | undefined, name: string): boolean {
+  if (!req) return true; // no per-op requirement → legacy global behavior
+  if (req.mode === 'public') return false; // explicit `security: []`
+  return req.schemeNames.includes(name);
+}
+
 {{#if hasOAuth}}
-export async function getAuthHeaders(config: AppConfig): Promise<Record<string, string>> {
+export async function getAuthHeaders(
+  config: AppConfig,
+  requirement?: AuthRequirement,
+): Promise<Record<string, string>> {
 {{else}}
-export function getAuthHeaders(config: AppConfig): Record<string, string> {
+export function getAuthHeaders(
+  config: AppConfig,
+  requirement?: AuthRequirement,
+): Record<string, string> {
 {{/if}}
   const headers: Record<string, string> = {};
 
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
 {{#if (eq in "header")}}
-  if (config.apiKey) {
+  if (config.apiKey && schemeApplies(requirement, {{{json schemeName}}})) {
     headers['{{headerName}}'] = config.apiKey;
   }
 {{/if}}
+{{#if (eq in "cookie")}}
+  // API key sent as a cookie — appended to the Cookie header so it survives
+  // alongside any per-operation cookie parameters set by the handler.
+  if (config.apiKey && schemeApplies(requirement, {{{json schemeName}}})) {
+    const existing = headers['Cookie'];
+    const pair = '{{headerName}}=' + encodeURIComponent(config.apiKey);
+    headers['Cookie'] = existing ? existing + '; ' + pair : pair;
+  }
+{{/if}}
 {{#if (eq in "query")}}
-  // API key sent as query parameter — handled in request URL construction
+  // API key is sent as a query parameter (`{{headerName}}`). Query-string auth is
+  // applied during URL construction (apiKeyQueryName/apiKeyQueryValue in config),
+  // not as a header, so there is nothing to add here.
 {{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
-  if (config.bearerToken) {
+  if (config.bearerToken && schemeApplies(requirement, {{{json schemeName}}})) {
     headers['Authorization'] = `Bearer ${config.bearerToken}`;
   }
 {{/if}}
 {{#if (eq type "http-basic")}}
-  if (config.basicUsername && config.basicPassword) {
+  if (config.basicUsername && config.basicPassword && schemeApplies(requirement, {{{json schemeName}}})) {
     const encoded = Buffer.from(`${config.basicUsername}:${config.basicPassword}`).toString('base64');
     headers['Authorization'] = `Basic ${encoded}`;
   }
 {{/if}}
 {{#if (eq type "oauth2")}}
   // OAuth2 — use token management with refresh
-  try {
-    const token = await getAccessToken({
-      clientId: config.oauth2ClientId ?? '',
-      clientSecret: config.oauth2ClientSecret,
-      authorizationUrl: config.oauth2AuthorizationUrl ?? '',
-      tokenUrl: config.oauth2TokenUrl ?? '',
-      scopes: [],
-      redirectUri: config.oauth2RedirectUri ?? 'http://localhost:3000/callback',
-    });
-    headers['Authorization'] = `Bearer ${token}`;
-  } catch {
-    // Fallback to pre-obtained token
-    if (config.oauth2Token) {
-      headers['Authorization'] = `Bearer ${config.oauth2Token}`;
+  if (schemeApplies(requirement, {{{json schemeName}}})) {
+    try {
+      const token = await getAccessToken({
+        clientId: config.oauth2ClientId ?? '',
+        clientSecret: config.oauth2ClientSecret,
+        authorizationUrl: config.oauth2AuthorizationUrl ?? '',
+        tokenUrl: config.oauth2TokenUrl ?? '',
+        scopes: [],
+        redirectUri: config.oauth2RedirectUri ?? 'http://localhost:3000/callback',
+      });
+      headers['Authorization'] = `Bearer ${token}`;
+    } catch {
+      // Fallback to pre-obtained token
+      if (config.oauth2Token) {
+        headers['Authorization'] = `Bearer ${config.oauth2Token}`;
+      }
     }
   }
 {{/if}}
@@ -55,3 +92,27 @@ export function getAuthHeaders(config: AppConfig): Record<string, string> {
 
   return headers;
 }
+
+/**
+ * Query-string auth parameters (apiKey-in-query schemes), keyed by query-param
+ * name. Applied by the tool handler during URL construction — a query parameter
+ * cannot be sent as a request header (D-H2). Respects the same per-operation
+ * requirement as the headers: a public operation gets none, a scheme-scoped one
+ * gets only its scheme(s).
+ */
+export function getAuthQueryParams(
+  config: AppConfig,
+  requirement?: AuthRequirement,
+): Record<string, string> {
+  const params: Record<string, string> = {};
+{{#each authSchemes}}
+{{#if (eq type "apiKey")}}
+{{#if (eq in "query")}}
+  if (config.apiKey && config.apiKeyQueryName && schemeApplies(requirement, {{{json schemeName}}})) {
+    params[config.apiKeyQueryName] = config.apiKey;
+  }
+{{/if}}
+{{/if}}
+{{/each}}
+  return params;
+}

package/dist/emitter/templates/config.ts.hbs

@@ -3,6 +3,10 @@ export interface AppConfig {
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
   apiKey?: string;
+{{#if (eq in "query")}}
+  /** Query-parameter name the API key is appended under (apiKey-in-query auth). */
+  apiKeyQueryName?: string;
+{{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
   bearerToken?: string;
@@ -78,6 +82,9 @@ export function loadConfig(): AppConfig {
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
     apiKey: process.env.{{envVarName}},
+{{#if (eq in "query")}}
+    apiKeyQueryName: {{{json headerName}}},
+{{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
     bearerToken: process.env.{{envVarName}},

package/dist/emitter/templates/env.example.hbs

@@ -49,4 +49,10 @@ MCP_AUTH_TOKEN=
 # — any request can hit any instance). Set to "true" for stateful per-session
 # (Mcp-Session-Id) mode if a client needs resumable streams.
 MCP_STATEFUL=
+# Stateful-session bounds (only used when MCP_STATEFUL=true). The server caps the
+# number of live sessions, evicts ones idle past MCP_SESSION_IDLE_MS, and sweeps
+# on a MCP_SESSION_REAP_MS timer so abandoned sessions can't exhaust memory.
+# MCP_MAX_SESSIONS=1000
+# MCP_SESSION_IDLE_MS=300000
+# MCP_SESSION_REAP_MS=60000
 {{/if}}