@mrfentmen/httpbin-mcp 1.0.0 → 1.0.1

package/README.md

@@ -20,3 +20,23 @@ node dist/index.js
 ```
 
 Data comes from the public HTTPBin API.
+
+<!-- paywall -->
+## Premium tools
+
+These tools need a license key:
+
+* `base64_decode`
+* `echo_anything`
+* `status_check`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-httpbin-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.js

@@ -33,3 +33,66 @@ export async function headers(_args) {
     const h = d.headers ?? {};
     return 'Request headers:\n' + Object.entries(h).map(([k, v]) => `${k}: ${String(v)}`).join('\n');
 }
+// ---- muxC tools:
+const HB_UA = "mrfentmen-httpbin-mcp/1.0 (https://github.com/mrfentmen)";
+class HttpbinError extends Error {
+}
+const HB = "https://httpbin.org";
+async function hbText(path, ms = 25000) {
+    const res = await fetch(`${HB}${path}`, {
+        headers: { "User-Agent": HB_UA, Accept: "*/*" },
+        signal: AbortSignal.timeout(ms),
+    });
+    if (!res.ok)
+        throw new HttpbinError(`httpbin returned ${res.status} for ${path}`);
+    return await res.text();
+}
+/**
+ * httpbin.org only exposes /base64/<value>, which decodes; there is no encode
+ * route. On bad input it answers 200 with a "try: ..." correction, so that hint
+ * is passed through instead of being hidden.
+ */
+export async function base64Decode(args) {
+    const value = (args.value ?? "").trim();
+    if (!value)
+        throw new HttpbinError("Provide the base64 text to decode");
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {
+        throw new HttpbinError(`"${value}" is not valid base64: only the standard alphabet and trailing padding are allowed`);
+    }
+    const body = await hbText(`/base64/${encodeURIComponent(value)}`);
+    if (/^Incorrect Base64 data/i.test(body)) {
+        const hint = body.match(/try:\s*(\S+)/)?.[1];
+        throw new HttpbinError(`httpbin could not decode that value.${hint ? ` It suggested trying ${hint}.` : ""}`);
+    }
+    return `httpbin decoded ${value} to: ${body}`;
+}
+/** httpbin's /anything: the request it received, reflected back. */
+export async function echoAnything(args) {
+    const path = (args.path ?? "").trim();
+    if (path && !/^\/[a-z0-9/_.-]*$/i.test(path))
+        throw new HttpbinError("Give a simple path such as /probe/check, with letters, digits, slash, underscore, dot or hyphen");
+    const url = `${HB}/anything${path}`;
+    const res = await fetch(url, {
+        headers: { "User-Agent": HB_UA, Accept: "application/json", "X-Probe-Tag": "muxC" },
+        signal: AbortSignal.timeout(20000),
+    });
+    if (!res.ok)
+        throw new HttpbinError(`httpbin returned ${res.status}`);
+    const d = (await res.json());
+    return [
+        `httpbin reflected ${d.method ?? "GET"} ${d.url ?? url}`,
+        Object.keys(d.args ?? {}).length ? `query: ${Object.entries(d.args ?? {}).map(([k, v]) => `${k}=${v}`).join(" | ")}` : "query: none",
+        `content type: ${d.headers?.["Content-Type"] ?? "none"} | user agent: ${d.headers?.["User-Agent"] ?? "not reported"}`,
+        `probe header echoed: ${d.headers?.["X-Probe-Tag"] ?? "no"}`,
+        d.json ? `json body: ${JSON.stringify(d.json)}` : d.data ? `body: ${d.data}` : "body: empty",
+    ].join("\n");
+}
+/** httpbin's /status endpoint, which is the honest way to test non-2xx handling. */
+export async function statusCheck(args) {
+    const code = args.code ?? 200;
+    if (!Number.isInteger(code) || code < 100 || code > 599)
+        throw new HttpbinError("Give an HTTP status code between 100 and 599");
+    const res = await fetch(`${HB}/status/${code}`, { headers: { "User-Agent": HB_UA }, signal: AbortSignal.timeout(20000) });
+    const body = (await res.text()).trim();
+    return `httpbin /status/${code} answered ${res.status} ${res.statusText}${body ? ` with body: ${body}` : " with an empty body"}.`;
+}

package/dist/license.js

@@ -0,0 +1,80 @@
+// Premium tools on this server need a license key bought from MCP Marketplace.
+// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
+// that is not listed in PREMIUM keeps working without a key.
+const SLUG = "httpbin-mcp";
+// Tools that need a key. Everything else is free.
+const PREMIUM = new Set([
+    "base64_decode",
+    "echo_anything",
+    "status_check",
+]);
+const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
+// The license check calls the marketplace's verify endpoint directly instead of
+// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
+// check it makes is rejected by Supabase before it reaches the function. The
+// publishable key below is public by design - it ships in mcp-marketplace.io's
+// own JavaScript and only ever reaches their licence check.
+const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
+const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
+const OK_CACHE_MS = 60 * 60 * 1000;
+const BAD_CACHE_MS = 60 * 1000;
+const seen = new Map();
+const REASONS = {
+    missing_key: "no key is set",
+    invalid_format: "that key is not a valid MCP Marketplace key",
+    not_found: "that key was not found",
+    revoked: "that key has been revoked",
+    rotated: "that key was rotated, use your new one",
+    expired: "that key has expired, renew it",
+    rate_limited: "there were too many checks just now, try again shortly",
+    network_error: "the license server could not be reached",
+};
+function blocked(tool, reason) {
+    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
+    return `"${tool}" needs a license key, but ${why}. ` +
+        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
+}
+async function verify(key) {
+    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
+        method: "POST",
+        headers: {
+            apikey: PUBLISHABLE_KEY,
+            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ key, slug: SLUG }),
+        // an unusable key answers 400 with a JSON body, so read the body either way
+        signal: AbortSignal.timeout(15000),
+    });
+    const data = (await res.json());
+    if (typeof data?.valid !== "boolean")
+        return { valid: false, reason: "unexpected_response" };
+    return data;
+}
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export async function premiumRequired(tool) {
+    if (!PREMIUM.has(tool))
+        return null;
+    const key = process.env.MCP_LICENSE_KEY;
+    if (!key)
+        return blocked(tool, "missing_key");
+    const hit = seen.get(key);
+    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
+        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
+    }
+    let result;
+    try {
+        result = await verify(key);
+    }
+    catch {
+        result = { valid: false, reason: "network_error" };
+    }
+    seen.set(key, { ...result, at: Date.now() });
+    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
+}

package/dist/server.js

@@ -2,7 +2,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { get } from "./api.js";
 import { headers } from "./api.js";
-import { ip } from "./api.js";
+import { ip, base64Decode, echoAnything, statusCheck } from "./api.js";
+import { premiumRequired } from "./license.js";
 const text = (value) => ({ content: [{ type: "text", text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -48,5 +49,59 @@ export function createServer() {
             return textError(error(e));
         }
     });
+    server.registerTool("base64_decode", {
+        title: "Base64 decode",
+        description: "Decode base64 through httpbin, surfacing the server's own correction hint when the input is not decodable.",
+        inputSchema: z.object({ value: z.string().describe("Base64 text to decode."), }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: base64_decode ----
+        const paywallMessage = await premiumRequired("base64_decode");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await base64Decode(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("echo_anything", {
+        title: "Echo anything",
+        description: "Send a request to httpbin's /anything and get the full request reflected back, which shows exactly what your client put on the wire.",
+        inputSchema: z.object({ path: z.string().describe("Optional extra path, e.g. /probe/check.").optional() }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: echo_anything ----
+        const paywallMessage = await premiumRequired("echo_anything");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await echoAnything(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("status_check", {
+        title: "Status check",
+        description: "Ask httpbin for a specific HTTP status code, so a client's handling of errors and redirects can be tested deliberately.",
+        inputSchema: z.object({ code: z.number().describe("HTTP status code, 100-599.").optional() }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: status_check ----
+        const paywallMessage = await premiumRequired("status_check");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await statusCheck(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
     return server;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "repository": {
     "type": "git",