@n24q02m/mcp-core 1.23.0 → 1.23.1-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +14 -2
  2. package/package.json +5 -5
package/README.md CHANGED
@@ -39,11 +39,10 @@
39
39
  - [Quick start (TypeScript)](#quick-start-typescript)
40
40
  - [CLI](#cli)
41
41
  - [Documentation](#documentation)
42
+ - [Design Philosophy](#design-philosophy)
42
43
  - [Development](#development)
43
44
  - [License](#license)
44
45
 
45
-
46
-
47
46
  mcp-core is the shared foundation for the n24q02m MCP servers: a Streamable
48
47
  HTTP transport, an OAuth 2.1 Authorization Server, lifecycle management,
49
48
  install automation, and a shared embedding daemon.
@@ -297,6 +296,19 @@ Full docs at **[mcp.n24q02m.com/servers/mcp-core/architecture/](https://mcp.n24q
297
296
 
298
297
  Source of truth lives in [`n24q02m/claude-plugins/plugins/mcp-core/`](https://github.com/n24q02m/claude-plugins/tree/main/plugins/mcp-core). Edit there; this repo's `docs/` directory is intentionally minimal post-migration.
299
298
 
299
+ ## Design Philosophy
300
+
301
+ These are the shared principles that mcp-core encodes for the MCP servers built on top of it. The credential-handling ones (1, 6, 8) apply to every server that talks to an upstream account; better-godot-mcp is the exception -- it runs locally with no credentials, so it skips the relay and auth layers entirely.
302
+
303
+ 1. **Zero-Knowledge Relay** -- E2E encryption (ECDH P-256 + AES-256-GCM). The relay server never sees plaintext credentials, and URL-fragment secrets stay client-side per RFC 3986.
304
+ 2. **Composite Tool Pattern** -- One tool per domain with action dispatch: 4-17 tools per server instead of dozens of thin endpoints, saving LLM context tokens.
305
+ 3. **3-Tier Token Optimization** -- Compact descriptions (always loaded), help docs (on demand), and MCP resources (deep reference) keep the always-on tool schema small.
306
+ 4. **Tool Annotations** -- `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint` metadata let the LLM understand tool behavior before calling.
307
+ 5. **Security Defense-in-Depth** -- SSRF prevention, path-traversal containment, prompt-injection (XPIA) boundary tags around untrusted content, and error sanitization.
308
+ 6. **Multi-User HTTP Mode** -- Stateless DCR (HMAC-SHA256), per-user session isolation keyed by JWT `sub`, AES-256-GCM credential encryption at rest, and OAuth 2.1 + PKCE S256.
309
+ 7. **Degraded Mode** -- Servers start even without credentials. Help and config tools work, while data tools return setup instructions instead of crashing.
310
+ 8. **Browser-Based Credential Setup** -- A browser form collects credentials, sends them through the protected setup flow, and stores them through mcp-core's encrypted credential backend; local and Cloudflare KV storage share the same contract.
311
+
300
312
  ## Development
301
313
 
302
314
  ```bash
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@n24q02m/mcp-core",
3
- "version": "1.23.0",
3
+ "version": "1.23.1-beta.2",
4
4
  "description": "Unified MCP Streamable HTTP 2025-11-25 transport, OAuth 2.1 AS, lifecycle, install",
5
5
  "keywords": [
6
6
  "mcp",
@@ -82,14 +82,14 @@
82
82
  },
83
83
  "dependencies": {
84
84
  "@modelcontextprotocol/sdk": "^1.30.0",
85
- "better-sqlite3": "^13.0.2",
85
+ "better-sqlite3": "^13.0.3",
86
86
  "env-paths": "^4.0.0",
87
- "jose": "^6.2.6"
87
+ "jose": "^6.2.9"
88
88
  },
89
89
  "devDependencies": {
90
- "@biomejs/biome": "^2.5.6",
90
+ "@biomejs/biome": "^2.5.8",
91
91
  "@types/better-sqlite3": "^9.6.0",
92
- "@types/node": "^26.1.2",
92
+ "@types/node": "^26.2.0",
93
93
  "@vitest/coverage-v8": "^4.1.10",
94
94
  "typescript": "^7.0.2",
95
95
  "vitest": "^4.1.10"