@mcpmake/core 0.3.3 → 0.3.5

package/dist/emitter/templates/config.ts.hbs

@@ -2,20 +2,29 @@ export interface AppConfig {
   baseUrl: string;
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
+{{#unless (eq emitApiKeyValue false)}}
   apiKey?: string;
+{{/unless}}
 {{#if (eq in "query")}}
+{{#unless (eq emitApiKeyQueryName false)}}
   /** Query-parameter name the API key is appended under (apiKey-in-query auth). */
   apiKeyQueryName?: string;
+{{/unless}}
 {{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
+{{#unless (eq emitBearer false)}}
   bearerToken?: string;
+{{/unless}}
 {{/if}}
 {{#if (eq type "http-basic")}}
+{{#unless (eq emitBasic false)}}
   basicUsername?: string;
   basicPassword?: string;
+{{/unless}}
 {{/if}}
 {{#if (eq type "oauth2")}}
+{{#unless (eq emitOAuth2 false)}}
   oauth2Token?: string;
   oauth2ClientId?: string;
   oauth2ClientSecret?: string;
@@ -25,6 +34,7 @@ export interface AppConfig {
   /** OAuth scopes requested on token grants. Defaults to the spec-declared
    * scopes; override at runtime with OAUTH2_SCOPES (space-separated). */
   oauth2Scopes: string[];
+{{/unless}}
 {{/if}}
 {{/each}}
   maxRetries: number;
@@ -81,6 +91,7 @@ function loadDefaultHeaders(): Record<string, string> {
 
 {{#each authSchemes}}
 {{#if (eq type "oauth2")}}
+{{#unless (eq emitOAuth2 false)}}
 /**
  * Resolve the OAuth scopes requested on token grants. Defaults to the
  * spec-declared scopes baked in at generation time; `OAUTH2_SCOPES`
@@ -95,16 +106,32 @@ function resolveOAuthScopes(): string[] {
   return {{#if scopes}}{{{json scopes}}}{{else}}[]{{/if}};
 }
 
+{{/unless}}
 {{/if}}
 {{/each}}
+const posInt = (v: string | undefined, d: number): number => {
+  const n = parseInt(v ?? '', 10);
+  return Number.isInteger(n) && n > 0 ? n : d;
+};
+
+/** Like posInt but accepts 0 — useful where 0 is a meaningful "disable" value. */
+const nonNegInt = (v: string | undefined, d: number): number => {
+  const n = parseInt(v ?? '', 10);
+  return Number.isInteger(n) && n >= 0 ? n : d;
+};
+
 export function loadConfig(): AppConfig {
   return {
     baseUrl: resolveBaseUrl(),
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
+{{#unless (eq emitApiKeyValue false)}}
     apiKey: process.env.{{envVarName}},
+{{/unless}}
 {{#if (eq in "query")}}
+{{#unless (eq emitApiKeyQueryName false)}}
     apiKeyQueryName: {{{json headerName}}},
+{{/unless}}
 {{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
@@ -124,8 +151,8 @@ export function loadConfig(): AppConfig {
     oauth2Scopes: resolveOAuthScopes(),
 {{/if}}
 {{/each}}
-    maxRetries: parseInt(process.env.MAX_RETRIES ?? '3', 10),
-    requestIntervalMs: parseInt(process.env.REQUEST_INTERVAL_MS ?? '100', 10),
+    maxRetries: nonNegInt(process.env.MAX_RETRIES, 3),
+    requestIntervalMs: nonNegInt(process.env.REQUEST_INTERVAL_MS, 100),
     defaultHeaders: loadDefaultHeaders(),
   };
 }

package/dist/emitter/templates/discovery.ts.hbs

@@ -10,8 +10,16 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { executeRequest } from './http.js';
 import { applyJqFilter } from './response-filter.js';
 import type { AppConfig } from './config.js';
+import type { AuthRequirement } from './auth.js';
 import catalogData from './tool-catalog.json' with { type: 'json' };
 
+interface CatalogParamMapping {
+  /** The key the agent supplies in the tool input. */
+  inputKey: string;
+  /** The original API parameter name sent upstream. */
+  wireName: string;
+}
+
 interface CatalogEntry {
   name: string;
   title: string;
@@ -19,10 +27,19 @@ interface CatalogEntry {
   method: string;
   path: string;
   inputSchema: Record<string, unknown>;
-  pathParams: string[];
-  queryParams: string[];
+  /** Path parameters with inputKey (agent-facing) and wireName (upstream API). */
+  pathParams: CatalogParamMapping[];
+  /** Query parameters with inputKey (agent-facing) and wireName (upstream API). */
+  queryParams: CatalogParamMapping[];
   hasRequestBody: boolean;
   requestBodyContentType: string;
+  /** The MCP input key for the request body (`body`, `requestBody`, etc.).
+   *  Only present when `hasRequestBody` is true. */
+  bodyInputKey?: string;
+  /** Per-operation outbound-auth requirement (D-H2). Forwarded to executeRequest
+   *  so a public operation (`security: []`) sends no auth and a scheme-scoped
+   *  operation sends only its scheme(s). Absent → every configured scheme. */
+  authRequirement?: AuthRequirement;
 }
 
 const catalog: CatalogEntry[] = catalogData as CatalogEntry[];
@@ -157,33 +174,69 @@ export function registerDiscoveryTools(server: McpServer, config: AppConfig): vo
       }
 
       try {
-        // Build URL from path template
-        let url = config.baseUrl + tool.path;
-        for (const param of tool.pathParams) {
-          if (args[param] !== undefined) {
-            url = url.replace(`{${param}}`, encodeURIComponent(String(args[param])));
+        // Build the path suffix from the template — read args by inputKey,
+        // substitute wireName into the path. Handles parameter name collisions
+        // (R14-A). The leftover-placeholder check (R5-F) runs on the PATH ONLY,
+        // not on config.baseUrl: a base URL may legitimately contain an
+        // unresolved OpenAPI server variable (e.g. `https://api.{region}.x.com`)
+        // that is not a tool path parameter, and scanning it would falsely fail
+        // every call.
+        let pathSuffix = tool.path;
+        for (const p of tool.pathParams) {
+          if (args[p.inputKey] !== undefined) {
+            pathSuffix = pathSuffix.replace(
+              `{${p.wireName}}`,
+              encodeURIComponent(String(args[p.inputKey])),
+            );
           }
         }
 
-        // Add query params
+        // R5-F: refuse to fire a request with unsubstituted path placeholders.
+        // A missing required path parameter leaves a literal `{name}` in the
+        // path, which would otherwise be sent verbatim upstream. Return an MCP
+        // error listing the unfilled parameter(s) instead.
+        const missing = pathSuffix.match(/\{[^}]+\}/g);
+        if (missing && missing.length > 0) {
+          return {
+            content: [
+              {
+                type: 'text' as const,
+                text: `Missing required path parameter(s): ${missing
+                  .map((s) => s.slice(1, -1))
+                  .join(', ')}. Use get_tool_schema to see required inputs.`,
+              },
+            ],
+            isError: true,
+          };
+        }
+
+        // Path is fully substituted — prepend the (possibly server-variable-
+        // bearing) base URL to form the request URL.
+        let url = config.baseUrl + pathSuffix;
+
+        // Add query params — read args by inputKey, send upstream under wireName (R14-A).
         const queryParams = new URLSearchParams();
-        for (const param of tool.queryParams) {
-          if (args[param] !== undefined) {
-            queryParams.set(param, String(args[param]));
+        for (const p of tool.queryParams) {
+          if (args[p.inputKey] !== undefined) {
+            queryParams.set(p.wireName, String(args[p.inputKey]));
           }
         }
         const qs = queryParams.toString();
         if (qs) url += `?${qs}`;
 
+        const bodyKey = tool.bodyInputKey ?? 'body';
         const response = await executeRequest({
           method: tool.method,
           url,
-          ...(tool.hasRequestBody && args.body
-            ? { body: args.body, contentType: tool.requestBodyContentType }
+          ...(tool.hasRequestBody && args[bodyKey] !== undefined
+            ? { body: args[bodyKey], contentType: tool.requestBodyContentType }
             : {}),
           headers: {},
           config,
           idempotencyKey,
+          // R5-E: scope outbound auth per operation exactly like the static
+          // per-tool handlers. Absent → executeRequest applies every scheme.
+          authRequirement: tool.authRequirement,
         });
 
         const result =

package/dist/emitter/templates/http-executor.ts.hbs

@@ -194,9 +194,10 @@ export async function executeRequest(options: RequestOptions): Promise<ApiRespon
       });
 
       if (RETRYABLE_STATUS_CODES.includes(response.status) && attempt < config.maxRetries) {
-        const retryAfter = response.headers.get('Retry-After');
-        const delay = retryAfter
-          ? parseInt(retryAfter, 10) * 1000
+        const retryAfterRaw = response.headers.get('Retry-After');
+        const retryAfterMs = retryAfterRaw ? parseInt(retryAfterRaw, 10) * 1000 : NaN;
+        const delay = Number.isFinite(retryAfterMs)
+          ? Math.min(retryAfterMs, 60_000)
           : 1000 * Math.pow(2, attempt);
         await sleep(delay);
         continue;

package/dist/emitter/templates/oauth.ts.hbs

@@ -86,8 +86,7 @@ async function clientCredentialsGrant(config: OAuthConfig): Promise<TokenRespons
   });
 
   if (!response.ok) {
-    const body = await response.text();
-    throw new Error(`OAuth client credentials failed (${response.status}): ${body}`);
+    throw new Error(`OAuth client credentials failed (${response.status})`);
   }
 
   return response.json() as Promise<TokenResponse>;

package/dist/emitter/templates/readme.md.hbs

@@ -75,14 +75,15 @@ Copy `.env.example` to `.env` and fill in:
 {{#each authEnvVars}}
 | `{{name}}` | {{description}} | {{#if required}}Yes{{else}}No{{/if}} |
 {{/each}}
-| `MAX_RETRIES` | Max retry attempts (default: 3) | No |
-| `REQUEST_INTERVAL_MS` | Min ms between requests (default: 100) | No |
+| `MAX_RETRIES` | Max retry attempts (default: 3; `0` disables retries) | No |
+| `REQUEST_INTERVAL_MS` | Min ms between requests (default: 100; `0` disables throttling) | No |
 | `MCP_ENVIRONMENTS` | JSON map of environment name → base URL (e.g. `{"production":"…","sandbox":"…"}`) | No |
 | `API_ENVIRONMENT` | Selects a named environment from `MCP_ENVIRONMENTS` (falls back to `BASE_URL`) | No |
 | `MCP_TOOLS` | Comma-separated allowlist of tool names to register | No |
 | `MCP_EXCLUDE_TOOLS` | Comma-separated denylist of tool names to skip | No |
 | `MCP_DEFAULT_HEADERS` | JSON object of headers added to every upstream request | No |
 | `MCP_IDEMPOTENCY_AUTO` | `true` to auto-generate an `Idempotency-Key` for mutating requests | No |
+| `MCP_MAX_SSE_CONNECTIONS` | Max concurrent task-streaming SSE connections (default: 500; HTTP transport only) | No |
 
 ### Named environments
 

package/dist/emitter/templates/resources.ts.hbs

@@ -1,4 +1,5 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { executeRequest } from './http.js';
 import type { AppConfig } from './config.js';
 
@@ -7,12 +8,12 @@ export function registerAllResources(server: McpServer, config: AppConfig): void
 {{#if isTemplate}}
   server.resource(
     '{{name}}',
-    '{{uri}}',
+    new ResourceTemplate('{{uri}}', { list: undefined }),
     {
       description: `{{{description}}}`,
       mimeType: 'application/json',
     },
-    async (uri) => {
+    async (uri, variables) => {
 {{{urlBody}}}
       const response = await executeRequest({
         method: 'get',