@mcpmake/core 0.2.4 → 0.3.0

package/dist/emitter/templates/server-main-http.ts.hbs

@@ -27,6 +27,11 @@ function log(level: 'info' | 'error', msg: string, extra?: Record<string, unknow
   process.stderr.write(JSON.stringify(entry) + '\n');
 }
 
+/* Local/dev escape hatch: when MCP_AUTH_TOKEN is unset, authenticated routes
+ * stay closed (401) UNLESS the operator explicitly sets this to `true`. Matches
+ * the worker server's MCP_ALLOW_UNAUTHENTICATED so both targets behave alike. */
+const ALLOW_UNAUTHENTICATED = process.env.MCP_ALLOW_UNAUTHENTICATED === 'true';
+
 /* ── MCP 2026-07-28 ─────────────────────────────────────────────────────
  * This server is being migrated toward the 2026-07-28 spec revision (RC).
  * Implemented here (additive, works against the current SDK):
@@ -42,11 +47,14 @@ const PROTOCOL_REVISION = '2026-07-28'; // VERIFY against the final spec
 
 /* ── Bearer authentication ──────────────────────────────────────────────
  * Constant-time check that the request presents the expected bearer token via
- * the `Authorization: Bearer <token>` header. Returns true when no token is
- * configured (auth disabled). The token is never accepted from the query
- * string — URLs leak through logs, history, and referrers. */
+ * the `Authorization: Bearer <token>` header. The token is never accepted from
+ * the query string — URLs leak through logs, history, and referrers.
+ *
+ * Fails CLOSED: when MCP_AUTH_TOKEN is unset, every authenticated route is
+ * denied unless the operator explicitly opts in with MCP_ALLOW_UNAUTHENTICATED=
+ * true (a local/dev escape hatch — see ALLOW_UNAUTHENTICATED below). */
 function isAuthorized(req: http.IncomingMessage, expected: string | undefined): boolean {
-  if (!expected) return true; // auth disabled when MCP_AUTH_TOKEN is unset
+  if (!expected) return ALLOW_UNAUTHENTICATED; // fail closed unless explicitly opted in
 
   const header = req.headers.authorization;
   if (typeof header !== 'string' || !header.startsWith('Bearer ')) return false;
@@ -166,6 +174,22 @@ if (transportMode === 'http') {
   }
   const allowedOrigin = process.env.ALLOWED_ORIGIN;
   const authToken = process.env.MCP_AUTH_TOKEN;
+  /* Fail closed: with no MCP_AUTH_TOKEN the server denies every authenticated
+   * route (401) unless the operator opted in via MCP_ALLOW_UNAUTHENTICATED=true.
+   * Warn loudly, once, when running wide open so it is never a silent default. */
+  if (!authToken) {
+    if (ALLOW_UNAUTHENTICATED) {
+      console.error(
+        'WARNING: MCP_AUTH_TOKEN is not set and MCP_ALLOW_UNAUTHENTICATED=true — ' +
+          'the server is running UNAUTHENTICATED. Do not use this in production.',
+      );
+    } else {
+      console.error(
+        'MCP_AUTH_TOKEN is not set — authenticated routes will return 401. ' +
+          'Set MCP_AUTH_TOKEN, or MCP_ALLOW_UNAUTHENTICATED=true for local/dev only.',
+      );
+    }
+  }
   /* Stateless by default (2026-07-28). MCP_STATEFUL=true keeps Mcp-Session-Id
    * sessions during the migration / for clients that need resumable streams. */
   const stateful = process.env.MCP_STATEFUL === 'true';
@@ -174,8 +198,50 @@ if (transportMode === 'http') {
   /* Stateful mode keeps one McpServer + transport PER SESSION, keyed by the
    * Mcp-Session-Id the SDK assigns on `initialize`, so concurrent clients get
    * independent, isolated sessions (a single shared transport cannot multiplex
-   * them). Stateless mode builds a fresh server + transport per request. */
-  const sessions = new Map<string, { server: McpServer; transport: StreamableHTTPServerTransport }>();
+   * them). Stateless mode builds a fresh server + transport per request.
+   *
+   * Sessions are bounded: a client that abandons a session without sending the
+   * SDK's close (so `transport.onclose` never fires) would otherwise retain its
+   * server/transport graph forever. We cap the live count, stamp a last-access
+   * time on every request, evict idle sessions on access and via a periodic
+   * reaper, and reject new sessions once at capacity. The limits are overridable
+   * via env so an operator can tune them without editing the generated source. */
+  interface Session {
+    server: McpServer;
+    transport: StreamableHTTPServerTransport;
+    lastAccess: number;
+  }
+  const sessions = new Map<string, Session>();
+
+  function envInt(name: string, fallback: number): number {
+    const n = parseInt(process.env[name] ?? '', 10);
+    return Number.isInteger(n) && n > 0 ? n : fallback;
+  }
+  const MAX_SESSIONS = envInt('MCP_MAX_SESSIONS', 1000);
+  const SESSION_IDLE_MS = envInt('MCP_SESSION_IDLE_MS', 5 * 60 * 1000);
+  const SESSION_REAP_MS = envInt('MCP_SESSION_REAP_MS', 60 * 1000);
+
+  /* Close + drop a single session (best-effort; never throws). */
+  function destroySession(sid: string, session: Session): void {
+    sessions.delete(sid);
+    void session.transport.close().catch(() => {});
+    void session.server.close().catch(() => {});
+  }
+
+  /* Evict every session whose last access is older than the idle window. */
+  function evictIdleSessions(now: number): void {
+    for (const [sid, session] of sessions) {
+      if (now - session.lastAccess > SESSION_IDLE_MS) {
+        log('info', 'Evicting idle session', { sid });
+        destroySession(sid, session);
+      }
+    }
+  }
+
+  /* Periodic reaper — sweeps idle sessions even when no traffic arrives.
+   * `unref()` so it never keeps the process alive on its own. */
+  const reaper = setInterval(() => evictIdleSessions(Date.now()), SESSION_REAP_MS);
+  reaper.unref();
 
   function isInitializeRequest(body: unknown): boolean {
     return (
@@ -200,26 +266,39 @@ if (transportMode === 'http') {
     );
     await runWithTrace(trace, async () => {
       if (stateful) {
+        const now = Date.now();
+        // Sweep idle sessions on every access so an idle map is reclaimed even
+        // between reaper ticks (and before a capacity check can spuriously fail).
+        evictIdleSessions(now);
         const sessionId = headerValue(req.headers['mcp-session-id']);
         const existing = sessionId ? sessions.get(sessionId) : undefined;
         if (existing) {
+          existing.lastAccess = now;
           await existing.transport.handleRequest(req, res, parsedBody);
           return;
         }
         if (!sessionId && isInitializeRequest(parsedBody)) {
+          // Reject new sessions once at capacity rather than growing unbounded.
+          if (sessions.size >= MAX_SESSIONS) {
+            log('error', 'Session capacity reached, rejecting initialize', {
+              maxSessions: MAX_SESSIONS,
+            });
+            rpcError(res, null, -32000, 'Server at session capacity — retry later');
+            return;
+          }
           // New session: create a dedicated server + transport and register it
           // under the session id the SDK generates during initialize.
           const server = createMcpServer(config);
           const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: () => crypto.randomUUID(),
             onsessioninitialized: (sid: string) => {
-              sessions.set(sid, { server, transport });
+              sessions.set(sid, { server, transport, lastAccess: Date.now() });
             },
           });
           transport.onclose = () => {
             const sid = transport.sessionId;
             if (sid) sessions.delete(sid);
-            void server.close();
+            void server.close().catch(() => {});
           };
           await server.connect(transport);
           await transport.handleRequest(req, res, parsedBody);
@@ -247,9 +326,10 @@ if (transportMode === 'http') {
 
     /* ── Authentication ─────────────────────────────────────────────
      * Every endpoint except /health, /ready{{#if hasOAuth}}, and the public
-     * OAuth metadata{{/if}} requires a valid bearer token when MCP_AUTH_TOKEN
-     * is set. This is the in-container line of defense; the hosting backend
-     * also validates before proxying. */
+     * OAuth metadata{{/if}} requires a valid bearer token. With MCP_AUTH_TOKEN
+     * unset the server fails closed (401) unless MCP_ALLOW_UNAUTHENTICATED=true.
+     * This is the in-container line of defense; the hosting backend also
+     * validates before proxying. */
     const isPublicPath =
       url.pathname === '/health' ||
       url.pathname === '/ready'{{#if hasOAuth}} ||
@@ -298,7 +378,7 @@ if (transportMode === 'http') {
             clientSecret: config.oauth2ClientSecret,
             authorizationUrl,
             tokenUrl,
-            scopes: [],
+            scopes: config.oauth2Scopes,
             redirectUri: config.oauth2RedirectUri ?? '',
           },
           issuer,
@@ -412,6 +492,7 @@ if (transportMode === 'http') {
   process.on('SIGTERM', () => {
     log('info', 'SIGTERM received, shutting down');
     isReady = false;
+    clearInterval(reaper);
 
     httpServer.close(async () => {
       try {

package/dist/emitter/templates/task-handlers.ts.hbs

@@ -18,6 +18,15 @@ const VALID_STATUSES = new Set<string>([
   'working', 'input_required', 'completed', 'failed', 'cancelled',
 ]);
 
+const TERMINAL_STATUSES = new Set<string>(['completed', 'failed', 'cancelled']);
+
+/* Trust model: this server is sessionless and authenticates every caller with a
+ * single shared bearer token, so all authorized callers are one principal — there
+ * is no per-user task ownership. Cross-tenant ownership would require sessions and
+ * is out of scope here. Task IDs are unguessable UUIDv4, so with enumeration
+ * disabled a task ID acts as an effective capability; we therefore (a) gate
+ * list-all behind explicit opt-in and (b) refuse to mutate terminal tasks. */
+
 /* ── MCP Tasks extension (2026-07-28) — JSON-RPC over /mcp ────────────────
  * The 2026-07-28 RC moves Tasks to an extension driven by tasks/get,
  * tasks/update, and tasks/cancel; tasks/list is removed (it can't be scoped
@@ -64,6 +73,12 @@ export function handleTaskRpc(
       return task ? rpcResult(id, taskToWire(task)) : rpcError(id, -32001, `Task ${taskId} not found`);
     }
     case 'tasks/update': {
+      // Refuse to overwrite a finished task: its result/error/status is final.
+      const existing = getTask(taskId);
+      if (!existing) return rpcError(id, -32001, `Task ${taskId} not found`);
+      if (TERMINAL_STATUSES.has(existing.status)) {
+        return rpcError(id, -32002, 'Task is in a terminal state');
+      }
       const status =
         typeof p.status === 'string' && VALID_STATUSES.has(p.status)
           ? (p.status as TaskStatus)
@@ -76,6 +91,11 @@ export function handleTaskRpc(
       return task ? rpcResult(id, taskToWire(task)) : rpcError(id, -32001, `Task ${taskId} not found`);
     }
     case 'tasks/cancel': {
+      const existing = getTask(taskId);
+      if (!existing) return rpcError(id, -32001, `Task ${taskId} not found`);
+      if (TERMINAL_STATUSES.has(existing.status)) {
+        return rpcError(id, -32002, 'Task is in a terminal state');
+      }
       const task = cancelTask(taskId);
       return task ? rpcResult(id, taskToWire(task)) : rpcError(id, -32001, `Task ${taskId} not found`);
     }
@@ -98,8 +118,17 @@ export function handleTaskRoutes(
   const method = req.method ?? 'GET';
   const path = url.pathname;
 
-  // GET /tasks — list tasks
+  // GET /tasks — list tasks. Enumerating every task leaks all in-flight work to
+  // any authorized caller and defeats the unguessable-ID capability model, so it
+  // is disabled unless an operator explicitly opts in.
   if (path === '/tasks' && method === 'GET') {
+    if (process.env.MCP_ENABLE_TASK_LIST !== 'true') {
+      sendJson(res, 403, {
+        error: 'Task listing is disabled. Set MCP_ENABLE_TASK_LIST=true to enable it.',
+      });
+      return true;
+    }
+
     const statusParam = url.searchParams.get('status') ?? undefined;
     const limitParam = url.searchParams.get('limit');
     const limit = limitParam ? parseInt(limitParam, 10) : 50;
@@ -171,6 +200,16 @@ export function handleTaskRoutes(
 
   // POST /tasks/:taskId/cancel — cancel a task
   if (subPath === '/cancel' && method === 'POST') {
+    const existing = getTask(taskId);
+    if (!existing) {
+      sendJson(res, 404, { error: `Task ${taskId} not found` });
+      return true;
+    }
+    // A finished task's outcome is final; don't let a late cancel overwrite it.
+    if (TERMINAL_STATUSES.has(existing.status)) {
+      sendJson(res, 409, { error: 'Task is in a terminal state' });
+      return true;
+    }
     const task = cancelTask(taskId);
     if (!task) {
       sendJson(res, 404, { error: `Task ${taskId} not found` });

package/dist/emitter/templates/tool-handler.ts.hbs

@@ -3,6 +3,9 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { executeRequest } from '../http.js';
 import { applyJqFilter } from '../response-filter.js';
 import type { AppConfig } from '../config.js';
+{{#if hasQueryApiKey}}
+import { getAuthQueryParams } from '../auth.js';
+{{/if}}
 {{#if isAsync}}
 import { createTask, updateTask } from '../task-manager.js';
 {{/if}}
@@ -36,18 +39,30 @@ const outputSchema = {{{outputSchemaCode}}};
 async function runRequest(rawInput: Record<string, unknown>, config: AppConfig): Promise<unknown> {
   // Pull off the per-call control args so they are never forwarded upstream.
   const { jq_filter: jqFilter, idempotency_key: idempotencyKey, ...input } = rawInput;
+{{#if hasQueryApiKey}}
+  let url = buildUrl(input, config.baseUrl);
+  // apiKey-in-query auth: append the key as a query parameter (it cannot be sent
+  // as a header). Respects the per-operation security requirement (D-H2).
+  url = appendQueryParams(url, getAuthQueryParams(config, {{#if authRequirement}}{{{json authRequirement}}}{{else}}undefined{{/if}}));
+{{else}}
   const url = buildUrl(input, config.baseUrl);
+{{/if}}
 
   const response = await executeRequest({
     method: '{{method}}',
     url,
 {{#if hasRequestBody}}
-    body: input.body,
+    body: input.{{bodyInputKey}},
     contentType: '{{requestBodyContentType}}',
+    bodyEncoding: '{{bodyEncoding}}',
 {{/if}}
-    headers: {},
+    headers: buildHeaders(input),
     config,
     idempotencyKey: typeof idempotencyKey === 'string' ? idempotencyKey : undefined,
+{{#if authRequirement}}
+    // Per-operation outbound-auth requirement derived from OpenAPI `security` (D-H2).
+    authRequirement: {{{json authRequirement}}},
+{{/if}}
   });
 
   let result: unknown = response.data;
@@ -140,3 +155,23 @@ function buildUrl(
 ): string {
 {{{buildUrlBody}}}
 }
+
+// Build the upstream header/cookie set from the tool input. Header and cookie
+// parameters are sent under their original API names (see paramMappings).
+function buildHeaders(params: Record<string, unknown>): Record<string, string> {
+{{{buildHeadersBody}}}
+}
+{{#if hasQueryApiKey}}
+
+// Append extra query parameters (apiKey-in-query auth) onto an already-built URL,
+// preserving any existing query string and URL-encoding name and value.
+function appendQueryParams(url: string, extra: Record<string, string>): string {
+  const keys = Object.keys(extra);
+  if (keys.length === 0) return url;
+  const sep = url.includes('?') ? '&' : '?';
+  const qs = keys
+    .map((k) => encodeURIComponent(k) + '=' + encodeURIComponent(extra[k]))
+    .join('&');
+  return url + sep + qs;
+}
+{{/if}}

package/dist/emitter/templates/tool-test.ts.hbs

@@ -25,7 +25,15 @@ function capture(): { name: string; def: Record<string, unknown>; handler: unkno
 }
 
 describe('{{name}}', () => {
-  // Tool: {{name}} — {{method}} {{pathTemplate}}
+  // Source operation metadata. Serialized via JSON.stringify on the builder side
+  // so an untrusted OpenAPI path (which can contain newlines/quotes) can never
+  // escape a comment or string literal into module-level code.
+  const operation = {{{operationMeta}}};
+
+  it('targets the source operation', () => {
+    expect(operation.method).toBe('{{method}}');
+    expect(typeof operation.path).toBe('string');
+  });
 
   it('registers exactly one tool under its name', () => {
     const calls = capture();

package/dist/emitter/worker-templates/config.ts.hbs

@@ -8,6 +8,10 @@ export interface AppConfig {
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
   apiKey?: string;
+{{#if (eq in "query")}}
+  /** Query-parameter name the API key is appended under (apiKey-in-query auth). */
+  apiKeyQueryName?: string;
+{{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
   bearerToken?: string;
@@ -69,6 +73,9 @@ export function loadConfig(env: EnvLike): AppConfig {
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
     apiKey: env.{{envVarName}},
+{{#if (eq in "query")}}
+    apiKeyQueryName: {{{json headerName}}},
+{{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
     bearerToken: env.{{envVarName}},

package/dist/emitter/worker-templates/tool-handler.ts.hbs

@@ -2,6 +2,9 @@ import { z } from 'zod';
 import { executeRequest } from '../http.js';
 import { applyJqFilter } from '../response-filter.js';
 import type { AppConfig } from '../config.js';
+{{#if hasQueryApiKey}}
+import { getAuthQueryParams } from '../auth.js';
+{{/if}}
 
 // Per-call control arguments shared by every generated tool. Optional and
 // stripped before the upstream request, so omitting them is a no-op.
@@ -70,18 +73,30 @@ export async function handler(
 async function runRequest(rawInput: Record<string, unknown>, config: AppConfig): Promise<unknown> {
   // Pull off the per-call control args so they are never forwarded upstream.
   const { jq_filter: jqFilter, idempotency_key: idempotencyKey, ...input } = rawInput;
+{{#if hasQueryApiKey}}
+  let url = buildUrl(input, config.baseUrl);
+  // apiKey-in-query auth: append the key as a query parameter (it cannot be sent
+  // as a header). Respects the per-operation security requirement (D-H2).
+  url = appendQueryParams(url, getAuthQueryParams(config, {{#if authRequirement}}{{{json authRequirement}}}{{else}}undefined{{/if}}));
+{{else}}
   const url = buildUrl(input, config.baseUrl);
+{{/if}}
 
   const response = await executeRequest({
     method: '{{method}}',
     url,
 {{#if hasRequestBody}}
-    body: input.body,
+    body: input.{{bodyInputKey}},
     contentType: '{{requestBodyContentType}}',
+    bodyEncoding: '{{bodyEncoding}}',
 {{/if}}
-    headers: {},
+    headers: buildHeaders(input),
     config,
     idempotencyKey: typeof idempotencyKey === 'string' ? idempotencyKey : undefined,
+{{#if authRequirement}}
+    // Per-operation outbound-auth requirement derived from OpenAPI `security` (D-H2).
+    authRequirement: {{{json authRequirement}}},
+{{/if}}
   });
 
   let result: unknown = response.data;
@@ -101,3 +116,23 @@ async function runRequest(rawInput: Record<string, unknown>, config: AppConfig):
 function buildUrl(params: Record<string, unknown>, baseUrl: string): string {
 {{{buildUrlBody}}}
 }
+
+// Build the upstream header/cookie set from the tool input. Header and cookie
+// parameters are sent under their original API names (see paramMappings).
+function buildHeaders(params: Record<string, unknown>): Record<string, string> {
+{{{buildHeadersBody}}}
+}
+{{#if hasQueryApiKey}}
+
+// Append extra query parameters (apiKey-in-query auth) onto an already-built URL,
+// preserving any existing query string and URL-encoding name and value.
+function appendQueryParams(url: string, extra: Record<string, string>): string {
+  const keys = Object.keys(extra);
+  if (keys.length === 0) return url;
+  const sep = url.includes('?') ? '&' : '?';
+  const qs = keys
+    .map((k) => encodeURIComponent(k) + '=' + encodeURIComponent(extra[k]))
+    .join('&');
+  return url + sep + qs;
+}
+{{/if}}

package/dist/emitter/worker-templates/worker.ts.hbs

@@ -30,6 +30,11 @@ const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26'];
 const PROTOCOL_REVISION = '2026-07-28'; // server/discover preflight only (SEP-2575); NOT the negotiated initialize version
 const SERVER_INFO = { name: '{{serverName}}', version: '{{serverVersion}}' } as const;
 const MAX_BODY = 4 * 1024 * 1024; // 4 MB
+// A 4 MB body can carry a huge JSON-RPC batch; dispatching every element at once
+// (Promise.all) lets one request fan out into thousands of simultaneous upstream
+// calls. Cap the batch length and process it through a bounded-concurrency pool.
+const MAX_BATCH = 50;
+const BATCH_CONCURRENCY = 5;
 
 const toolByName = new Map<string, ToolEntry>(tools.map((t) => [t.definition.name, t]));
 
@@ -85,8 +90,34 @@ async function safeEqual(a: string, b: string): Promise<boolean> {
   for (let i = 0; i < da.length; i++) diff |= da[i] ^ db[i];
   return diff === 0;
 }
-async function isAuthorized(request: Request, expected: string | undefined): Promise<boolean> {
-  if (!expected) return true; // auth disabled when MCP_AUTH_TOKEN is unset (local/dev only)
+// Fail CLOSED: when MCP_AUTH_TOKEN is unset every authenticated route is denied
+// unless the operator opts in with MCP_ALLOW_UNAUTHENTICATED === 'true' (a
+// local/dev escape hatch). We warn once per isolate so the open posture is loud.
+let unauthWarned = false;
+async function isAuthorized(request: Request, env: Env): Promise<boolean> {
+  const expected = env.MCP_AUTH_TOKEN;
+  if (!expected) {
+    if (env.MCP_ALLOW_UNAUTHENTICATED === 'true') {
+      if (!unauthWarned) {
+        unauthWarned = true;
+        console.warn(
+          'SECURITY: MCP_AUTH_TOKEN is unset and MCP_ALLOW_UNAUTHENTICATED=true — ' +
+            'this Worker is serving authenticated routes WITHOUT a bearer token. ' +
+            'Set MCP_AUTH_TOKEN before exposing this endpoint.',
+        );
+      }
+      return true;
+    }
+    if (!unauthWarned) {
+      unauthWarned = true;
+      console.error(
+        'SECURITY: MCP_AUTH_TOKEN is unset — denying all authenticated routes. ' +
+          'Set MCP_AUTH_TOKEN (wrangler secret put MCP_AUTH_TOKEN), or set ' +
+          'MCP_ALLOW_UNAUTHENTICATED=true for local/dev only.',
+      );
+    }
+    return false;
+  }
   const header = request.headers.get('authorization');
   if (!header || !header.startsWith('Bearer ')) return false;
   const presented = header.slice(7).trim();
@@ -94,19 +125,41 @@ async function isAuthorized(request: Request, expected: string | undefined): Pro
   return safeEqual(presented, expected);
 }
 
-/* ── HTTP / CORS helpers ─────────────────────────────────────────────── */
-function corsHeaders(origin?: string | null): Record<string, string> {
-  return {
-    'access-control-allow-origin': origin || '*',
+/* ── HTTP / CORS helpers ───────────────────────────────────────────────
+ * These responses are credentialed (gated by a bearer token), so we never
+ * emit a blanket `Access-Control-Allow-Origin: *`. CORS headers are reflected
+ * only when the request Origin is in the MCP_ALLOWED_ORIGINS allowlist
+ * (comma-separated); otherwise the response carries no ACAO header at all. */
+function originAllowed(origin: string | null | undefined, env: Env): boolean {
+  if (!origin) return false;
+  const raw = env.MCP_ALLOWED_ORIGINS;
+  if (!raw) return false;
+  return raw
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .includes(origin);
+}
+function corsHeaders(origin: string | null | undefined, env: Env): Record<string, string> {
+  const headers: Record<string, string> = {
     'access-control-allow-methods': 'POST, GET, OPTIONS',
     'access-control-allow-headers':
       'authorization, content-type, mcp-method, mcp-name, mcp-protocol-version, traceparent, tracestate',
   };
+  if (originAllowed(origin, env)) {
+    headers['access-control-allow-origin'] = origin as string;
+    headers['vary'] = 'Origin';
+  }
+  return headers;
 }
-function json(body: unknown, status = 200, extra?: Record<string, string>): Response {
+function json(
+  body: unknown,
+  status = 200,
+  extra?: Record<string, string>,
+): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { 'content-type': 'application/json', ...corsHeaders(), ...extra },
+    headers: { 'content-type': 'application/json', ...extra },
   });
 }
 function ok(id: unknown, result: unknown): object {
@@ -115,8 +168,13 @@ function ok(id: unknown, result: unknown): object {
 function err(id: unknown, code: number, message: string): object {
   return { jsonrpc: '2.0', id: id ?? null, error: { code, message } };
 }
-function rpcErrorResponse(id: unknown, code: number, message: string): Response {
-  return json(err(id, code, message));
+function rpcErrorResponse(
+  id: unknown,
+  code: number,
+  message: string,
+  cors?: Record<string, string>,
+): Response {
+  return json(err(id, code, message), 200, cors);
 }
 
 /* ── server/discover (SEP-2575) — VERIFY result shape against the final spec ── */
@@ -162,6 +220,26 @@ async function handleToolCall(
   return ok(id, result);
 }
 
+/* Map `items` through `fn` with at most `limit` in flight at once, preserving
+ * input order in the result. Bounds the upstream fan-out of a JSON-RPC batch so
+ * one request cannot launch an unbounded burst of concurrent tool calls. */
+async function mapWithConcurrency<T, R>(
+  items: T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length);
+  let next = 0;
+  const workers = new Array(Math.min(limit, items.length)).fill(0).map(async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await fn(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+
 /** Dispatch one JSON-RPC message. Returns null for notifications (no reply). */
 async function handleRpc(
   msg: { id?: unknown; method?: unknown; params?: unknown } | null,
@@ -210,16 +288,19 @@ export default {
   async fetch(request: Request, env: Env): Promise<Response> {
     const url = new URL(request.url);
     const origin = request.headers.get('origin');
+    // Computed once: empty unless the request Origin is in MCP_ALLOWED_ORIGINS.
+    const cors = corsHeaders(origin, env);
 
     if (request.method === 'OPTIONS') {
-      return new Response(null, { status: 204, headers: corsHeaders(origin) });
+      return new Response(null, { status: 204, headers: cors });
     }
     if (url.pathname === '/health') return json({ status: 'ok' });
     if (url.pathname === '/ready') return json({ status: 'ready' });
 
     // Bearer authentication (every path except /health and /ready).
-    if (!(await isAuthorized(request, env.MCP_AUTH_TOKEN))) {
+    if (!(await isAuthorized(request, env))) {
       return json({ error: 'Unauthorized: missing or invalid bearer token' }, 401, {
+        ...cors,
         'www-authenticate': 'Bearer',
       });
     }
@@ -231,30 +312,37 @@ export default {
       console.log(JSON.stringify({ level: 'info', msg: 'mcp-meta-headers', mcpMethod, mcpName }));
     }
 
-    if (url.pathname !== '/mcp') return json({ error: 'Not found' }, 404);
+    if (url.pathname !== '/mcp') return json({ error: 'Not found' }, 404, cors);
     if (request.method !== 'POST') {
       // Stateless: no SSE stream to open (GET) or session to delete (DELETE).
-      return rpcErrorResponse(null, -32601, 'Only POST is supported on this stateless server');
+      return rpcErrorResponse(
+        null,
+        -32601,
+        'Only POST is supported on this stateless server',
+        cors,
+      );
     }
 
     // Origin guard (DNS-rebinding protection). Enforced only when configured —
     // a Workers endpoint is public and gated by the bearer token, not by origin.
     const allowedOrigin = env.ALLOWED_ORIGIN;
     if (allowedOrigin && origin && origin !== allowedOrigin) {
-      return json({ error: 'Forbidden: invalid origin' }, 403);
+      return json({ error: 'Forbidden: invalid origin' }, 403, cors);
     }
 
     const contentLength = Number(request.headers.get('content-length') ?? '0');
-    if (contentLength > MAX_BODY) return rpcErrorResponse(null, -32600, 'Request body too large');
+    if (contentLength > MAX_BODY)
+      return rpcErrorResponse(null, -32600, 'Request body too large', cors);
     const raw = await request.text();
-    if (raw.length > MAX_BODY) return rpcErrorResponse(null, -32600, 'Request body too large');
-    if (!raw) return rpcErrorResponse(null, -32600, 'Empty request body');
+    if (raw.length > MAX_BODY)
+      return rpcErrorResponse(null, -32600, 'Request body too large', cors);
+    if (!raw) return rpcErrorResponse(null, -32600, 'Empty request body', cors);
 
     let parsed: unknown;
     try {
       parsed = JSON.parse(raw);
     } catch {
-      return rpcErrorResponse(null, -32700, 'Parse error');
+      return rpcErrorResponse(null, -32700, 'Parse error', cors);
     }
 
     const config = loadConfig(env);
@@ -267,20 +355,26 @@ export default {
 
     return runWithTrace(trace, async () => {
       if (Array.isArray(parsed)) {
-        const settled = await Promise.all(
-          parsed.map((m) => handleRpc(m as { id?: unknown; method?: unknown }, config, env)),
+        if (parsed.length === 0) {
+          return rpcErrorResponse(null, -32600, 'Empty JSON-RPC batch', cors);
+        }
+        if (parsed.length > MAX_BATCH) {
+          return rpcErrorResponse(null, -32600, `Batch too large (max ${MAX_BATCH})`, cors);
+        }
+        const settled = await mapWithConcurrency(parsed, BATCH_CONCURRENCY, (m) =>
+          handleRpc(m as { id?: unknown; method?: unknown }, config, env),
         );
         const responses = settled.filter((r): r is object => r !== null);
         if (responses.length === 0) {
-          return new Response(null, { status: 202, headers: corsHeaders(origin) });
+          return new Response(null, { status: 202, headers: cors });
         }
-        return json(responses);
+        return json(responses, 200, cors);
       }
       const response = await handleRpc(parsed as { id?: unknown; method?: unknown }, config, env);
       if (response === null) {
-        return new Response(null, { status: 202, headers: corsHeaders(origin) });
+        return new Response(null, { status: 202, headers: cors });
       }
-      return json(response);
+      return json(response, 200, cors);
     });
   },
 };