@miragon/mcp-toolkit-core 0.10.1 → 1.0.1

package/dist/tools/tool-call-name.d.ts

@@ -1,53 +0,0 @@
-import { type McpServerInstance } from "mcp-use/server";
-/**
- * Resolves the tool name of the in-flight `tools/call` request, or
- * `undefined` when called outside a tool-call request scope.
- *
- * Backs the role-filter's `tools/call` guard: mcp-use 1.28 passes only the
- * tool *arguments* to `mcp:tools/call` middleware as `ctx.params`, so the
- * `params.name` its typings declare is never populated at runtime. This
- * resolver recovers the real name from the JSON-RPC envelope captured at the
- * HTTP layer.
- */
-export type ToolNameResolver = () => string | undefined;
-/**
- * The resolver returned by {@link installToolCallNameCapture}: callable as a
- * plain {@link ToolNameResolver} (first `tools/call` name — the common case
- * and the logging-friendly one), with `.all()` exposing every name the
- * in-flight envelope carries. A JSON-RPC *batch* can contain several
- * `tools/call` requests, and a guard that only checks one of them can be
- * bypassed by the others — the role filter therefore consumes `.all()`.
- */
-export interface ToolNameCapture extends ToolNameResolver {
-    /** Every `tools/call` name in the in-flight envelope, or `undefined` outside a capture scope. */
-    all: () => string[] | undefined;
-}
-/**
- * Parse a JSON-RPC request body and return the `params.name` of every
- * `tools/call` request it carries: a single request yields zero or one entry,
- * a batch array yields one entry per `tools/call` it contains. Batches are a
- * real-world shape, not an edge case — Streamable-HTTP revision 2025-03-26
- * allows them, and claude.ai (via mcp-remote) frames single calls as
- * one-element batches.
- *
- * Pure and side-effect free so it can be unit-tested without an HTTP server.
- * Tolerates arbitrary `unknown` input: malformed bodies, malformed batch
- * entries, and non-`tools/call` methods contribute nothing rather than throw.
- */
-export declare function extractToolCallNames(body: unknown): string[];
-/**
- * First `tools/call` name of a JSON-RPC request body (single request or batch
- * array), or `undefined` when it carries none. Sufficient for logging; guards
- * must use {@link extractToolCallNames} — a batch can carry several calls.
- */
-export declare function extractToolCallName(body: unknown): string | undefined;
-/**
- * Whether `path` is one of the MCP transport endpoints mcp-use mounts the
- * Streamable-HTTP handler at. Both `/mcp` and `/sse` accept `tools/call`, so
- * the tool-name capture (and the role-filter guard that reads it) must cover
- * both — matching only `/mcp` leaves a `tools/call` over `/sse` unguarded.
- * Exported so the endpoint contract is pinned by a unit test.
- */
-export declare function isMcpTransportPath(path: string): boolean;
-export declare function installToolCallNameCapture(server: McpServerInstance<boolean>): ToolNameCapture;
-//# sourceMappingURL=tool-call-name.d.ts.map

package/dist/tools/tool-call-name.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool-call-name.d.ts","sourceRoot":"","sources":["../../src/tools/tool-call-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAS1E;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,MAAM,GAAG,SAAS,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,iGAAiG;IACjG,GAAG,EAAE,MAAM,MAAM,EAAE,GAAG,SAAS,CAAA;CAChC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAU5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAErE;AA0BD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,eAAe,CAuB9F"}

package/dist/tools/tool-call-name.js

@@ -1,92 +0,0 @@
-import { getRequestContext } from "mcp-use/server";
-/**
- * Parse a JSON-RPC request body and return the `params.name` of every
- * `tools/call` request it carries: a single request yields zero or one entry,
- * a batch array yields one entry per `tools/call` it contains. Batches are a
- * real-world shape, not an edge case — Streamable-HTTP revision 2025-03-26
- * allows them, and claude.ai (via mcp-remote) frames single calls as
- * one-element batches.
- *
- * Pure and side-effect free so it can be unit-tested without an HTTP server.
- * Tolerates arbitrary `unknown` input: malformed bodies, malformed batch
- * entries, and non-`tools/call` methods contribute nothing rather than throw.
- */
-export function extractToolCallNames(body) {
-    if (Array.isArray(body)) {
-        return body.flatMap((entry) => extractToolCallNames(entry));
-    }
-    if (typeof body !== "object" || body === null)
-        return [];
-    const { method, params } = body;
-    if (method !== "tools/call")
-        return [];
-    if (typeof params !== "object" || params === null)
-        return [];
-    const { name } = params;
-    return typeof name === "string" ? [name] : [];
-}
-/**
- * First `tools/call` name of a JSON-RPC request body (single request or batch
- * array), or `undefined` when it carries none. Sufficient for logging; guards
- * must use {@link extractToolCallNames} — a batch can carry several calls.
- */
-export function extractToolCallName(body) {
-    return extractToolCallNames(body)[0];
-}
-/**
- * Capture the `tools/call` tool name at the HTTP layer and expose it to the
- * MCP middleware chain.
- *
- * Registers a Hono middleware on the server that, for `POST` requests to an
- * MCP transport endpoint, clones the request body (so the MCP transport can
- * still read it), parses the JSON-RPC envelope, and — when it's a
- * `tools/call` — stashes the tool name in a `WeakMap` keyed by the
- * request-scoped Hono context. The returned resolver reads that map back via
- * `getRequestContext()`, which yields the same context inside the MCP
- * middleware chain.
- *
- * mcp-use mounts the *same* Streamable-HTTP handler at both `/mcp` and `/sse`
- * (`for (const endpoint of ["/mcp", "/sse"])`), so the capture must match both
- * — otherwise a `tools/call` sent to `/sse` executes but its name is never
- * captured, and the role-filter guard that depends on this resolver silently
- * falls open. Matching both endpoints closes that bypass.
- *
- * The `WeakMap` keying keeps the capture request-isolated: entries are
- * garbage-collected with their context and never leak across concurrent
- * requests.
- */
-const MCP_TRANSPORT_PATHS = new Set(["/mcp", "/sse"]);
-/**
- * Whether `path` is one of the MCP transport endpoints mcp-use mounts the
- * Streamable-HTTP handler at. Both `/mcp` and `/sse` accept `tools/call`, so
- * the tool-name capture (and the role-filter guard that reads it) must cover
- * both — matching only `/mcp` leaves a `tools/call` over `/sse` unguarded.
- * Exported so the endpoint contract is pinned by a unit test.
- */
-export function isMcpTransportPath(path) {
-    return MCP_TRANSPORT_PATHS.has(path);
-}
-export function installToolCallNameCapture(server) {
-    const toolNamesByRequest = new WeakMap();
-    server.use(async (c, next) => {
-        if (c.req.method === "POST" && isMcpTransportPath(c.req.path)) {
-            const body = await c.req.raw
-                .clone()
-                .json()
-                .catch(() => undefined);
-            const toolNames = extractToolCallNames(body);
-            if (toolNames.length > 0) {
-                toolNamesByRequest.set(c, toolNames);
-            }
-        }
-        await next();
-    });
-    const all = () => {
-        const requestContext = getRequestContext();
-        if (!requestContext)
-            return undefined;
-        return toolNamesByRequest.get(requestContext);
-    };
-    return Object.assign(() => all()?.[0], { all });
-}
-//# sourceMappingURL=tool-call-name.js.map

package/dist/tools/tool-call-name.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool-call-name.js","sourceRoot":"","sources":["../../src/tools/tool-call-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA0B,MAAM,gBAAgB,CAAA;AAkC1E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAA8C,CAAA;IACzE,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,CAAA;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAA4B,CAAA;IAC7C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAkC;IAC3E,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAAyB,CAAA;IAE/D,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAY,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG;iBAClC,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACzB,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,GAAyB,EAAE;QACrC,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;QAC1C,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAA;QACrC,OAAO,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;AACjD,CAAC"}