@nifrajs/cli 1.0.0-beta.4 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/cli",
-  "version": "1.0.0-beta.4",
+  "version": "1.1.0",
   "description": "The nifra CLI — zero-config dev/build/start for a nifra app (`nifra dev`, `nifra build`, `nifra start`).",
   "keywords": [
     "bun",
@@ -41,11 +41,12 @@
     "access": "public"
   },
   "dependencies": {
-    "@nifrajs/client": "1.0.0-beta.4",
-    "@nifrajs/runner": "1.0.0-beta.4",
-    "@nifrajs/schema": "1.0.0-beta.4",
-    "@nifrajs/web": "1.0.0-beta.4",
-    "create-nifra": "1.0.0-beta.4"
+    "@nifrajs/client": "1.1.0",
+    "@nifrajs/mcp": "1.1.0",
+    "@nifrajs/runner": "1.1.0",
+    "@nifrajs/schema": "1.1.0",
+    "@nifrajs/web": "1.1.0",
+    "create-nifra": "1.1.0"
   },
   "repository": {
     "type": "git",

package/src/cli.ts

@@ -82,7 +82,7 @@ Port: \`dev\` and \`start\` share the default ${DEFAULT_DEV_PORT}. Override with
 \`PORT\` env var (\`--port\` wins over \`PORT\`, which wins over the default).`
 
 // Kept in lockstep with packages/cli/package.json by check:publish's version-consistency gate.
-const CLI_VERSION = "1.0.0-beta.4"
+const CLI_VERSION = "1.1.0"
 
 // A render adapter + nifra server are opaque to the CLI (it just forwards them); cast at the seam.
 const asAdapter = (v: unknown): RenderAdapter => v as RenderAdapter

package/src/introspect.ts

@@ -197,6 +197,11 @@ const CONVENTIONS = `## Conventions (summary)
 - **Backend:** \`server()\` from \`@nifrajs/core\`; returning a value sends JSON. Validate untrusted input with
   a route schema (\`{ body, query, params }\` using \`t\` from \`@nifrajs/schema\` or any Standard Schema) and read
   the typed \`c.body\` / \`c.query\` / \`c.params\` — never hand-parse.
+- **Cross-cutting concerns** (rate limit / \`429\`, CORS, auth, CSRF, caching, security headers, body limits)
+  → \`@nifrajs/middleware\`, applied with \`app.use(...)\`. Don't hand-roll them; call \`nifra_docs("middleware")\`
+  for the full list + usage.
+- **Need the exact TypeScript of a \`@nifrajs/*\` symbol?** Call \`nifra_types({ name })\` (e.g. \`RateLimitStore\`,
+  \`RouteSchema\`) — the authoritative, complete declaration. Never read \`@nifrajs\` \`.d.ts\` files.
 - **Response contract (no drift):** declare \`{ response: t.object({...}) }\` on a route to lock its output
   shape — the handler is type-checked against it and the client sees exactly that shape. The contract above
   is the single source of truth for both sides.

package/src/mcp-docs-tools.ts

@@ -10,20 +10,22 @@
 import { renderDocsResult } from "./docs-search.ts"
 import { type Example, renderExamplesResult } from "./examples.ts"
 import type { McpTool } from "./mcp-protocol.ts"
+import { renderTypesResult, type TypeEntry } from "./types-search.ts"
 
 const clamp = (n: number | undefined, lo: number, hi: number, dflt: number): number =>
   Math.min(Math.max(typeof n === "number" ? n : dflt, lo), hi)
 
-/** Build `nifra_docs` + `nifra_example` over injected corpus loaders. */
+/** Build `nifra_docs` + `nifra_example` + `nifra_types` over injected corpus loaders. */
 export function docsTools(
   loadDocs: () => Promise<string | undefined>,
   loadExamples: () => Promise<Example[] | undefined>,
+  loadTypes: () => Promise<TypeEntry[] | undefined>,
 ): McpTool[] {
   return [
     {
       name: "nifra_docs",
       description:
-        'Search nifra\'s framework documentation and get back ONLY the matching sections — auth, uploads, ISR, WebSockets, loaders, deployment, anything. Call with no query for the cheap section index; pass query (e.g. "isr revalidate") for the top matching sections. Use this instead of reading llms-full.txt (~150 KB) whole.',
+        "Search nifra's framework documentation and get back ONLY the matching sections — auth, uploads, ISR, WebSockets, loaders, deployment, anything. Call with no query for the cheap section index; pass query (e.g. \"isr revalidate\") for the top matching sections. Use this instead of reading llms-full.txt (~150 KB) whole. For the EXACT TypeScript of a type/interface/function, call nifra_types instead (don't read .d.ts files).",
       inputSchema: {
         type: "object",
         properties: {
@@ -68,5 +70,38 @@ export function docsTools(
         return renderExamplesResult(corpus, query, clamp(limit, 1, 5, 3))
       },
     },
+    {
+      name: "nifra_types",
+      description:
+        'Get the EXACT TypeScript declaration of any exported @nifrajs/* symbol — interface, type, class, function, const. Each signature is generated from the package\'s built .d.ts, so it is the LITERAL declaration: complete, authoritative, never prose and never truncated. THIS IS THE SOURCE OF TRUTH for nifra\'s types — do NOT read node_modules/@nifrajs/**/*.d.ts; call this instead. Pass `name` for an exact symbol (e.g. "RateLimitStore", "RouteSchema", "Context", "rateLimit"); pass `query` to search by keyword; omit both for the per-package index of names.',
+      inputSchema: {
+        type: "object",
+        properties: {
+          name: {
+            type: "string",
+            description:
+              "Exact symbol name — returns its literal declaration (e.g. RateLimitStore).",
+          },
+          query: {
+            type: "string",
+            description:
+              "Keyword search over names + signatures (when you don't know the exact name).",
+          },
+          limit: {
+            type: "number",
+            description: "Max results for a query/search (default 5, max 8).",
+          },
+        },
+        additionalProperties: false,
+      },
+      handler: async (args) => {
+        const corpus = await loadTypes()
+        if (corpus === undefined) {
+          return "types corpus missing — run `bun run build && bun run gen:llms` in the nifra repo (published builds ship it)."
+        }
+        const { name, query, limit } = args as { name?: string; query?: string; limit?: number }
+        return renderTypesResult(corpus, name, query, clamp(limit, 1, 8, 5))
+      },
+    },
   ]
 }

package/src/mcp-http.ts

@@ -4,139 +4,49 @@
  * Both tools read the bundled corpus (llms-full.txt / examples.json shipped in this package) and ignore
  * `cwd`, so they reuse the exact definitions from {@link projectTools} — one source, no drift.
  *
- * {@link handleMcpHttp} is a plain Web `fetch` handler, so it self-hosts ANYWHERE Bun runs — the
- * simplest path is `nifra docs-mcp` on a VPS behind a reverse proxy (Caddy/nginx + TLS), where the
- * bundled corpus reads straight from disk (`Bun.file`). `export default { port, fetch }` also lets
- * `bun run mcp-http.ts` serve it directly, and the same handler runs on Cloudflare/Vercel edge — only
- * there must you inline the two corpus files as string imports (a Worker has no filesystem). The
- * dispatch is the shared, transport-agnostic {@link handleRpc}.
+ * The transport itself (body cap, CORS, JSON-RPC dispatch) lives in `@nifrajs/mcp/http`; this module is
+ * the docs-specific layer over it: it supplies the bundled corpus tools and the `nifra-docs` server info.
+ * {@link handleMcpHttp} self-hosts ANYWHERE Bun runs — the simplest path is `nifra docs-mcp` on a VPS; the
+ * same handler runs on Cloudflare/Vercel edge (there inline the corpus as string imports — a Worker has no
+ * filesystem). `export default { port, fetch }` also lets `bun run mcp-http.ts` serve it directly.
  */
 
+import { type McpHttpOptions, respondMcpHttp as respondMcpHttpCore } from "@nifrajs/mcp/http"
+import type { McpTool } from "@nifrajs/mcp/protocol"
 import { loadDocsCorpus } from "./docs-search.ts"
 import { loadExamplesCorpus } from "./examples.ts"
 import { docsTools } from "./mcp-docs-tools.ts"
-import { handleRpc, type JsonRpcRequest, type McpTool, rpcError } from "./mcp-protocol.ts"
+import { loadTypesCorpus } from "./types-search.ts"
 
+export type { McpHttpOptions } from "@nifrajs/mcp/http"
 export type { Example } from "./examples.ts"
 // Re-exported so a self-host (e.g. a Cloudflare-Pages `/mcp` worker route) gets the corpus-injectable
 // tool factory + the transport core from one entry: `import { respondMcpHttp, docsTools } from "@nifrajs/cli/mcp"`.
 export { docsTools } from "./mcp-docs-tools.ts"
+export type { TypeEntry } from "./types-search.ts"
 
 // Kept in lockstep with packages/cli/package.json by check:publish's version-consistency gate.
-const VERSION = "1.0.0-beta.4"
+const VERSION = "1.1.0"
 const SERVER_INFO = { name: "nifra-docs", version: VERSION }
-
-const CORS: Record<string, string> = {
-  "access-control-allow-origin": "*",
-  "access-control-allow-methods": "POST, GET, OPTIONS",
-  "access-control-allow-headers": "content-type",
-}
-
-const DEFAULT_MAX_BODY_BYTES = 1_000_000
-const TEXT_DECODER = new TextDecoder()
-
-export interface McpHttpOptions {
-  /** Maximum JSON-RPC request body size in bytes. Default 1 MB. */
-  readonly maxBodyBytes?: number
-}
-
-function parseContentLength(value: string): number | undefined {
-  if (value.length === 0) return undefined
-  let length = 0
-  for (let i = 0; i < value.length; i++) {
-    const digit = value.charCodeAt(i) - 48
-    if (digit < 0 || digit > 9) return undefined
-    length = length * 10 + digit
-    if (length > Number.MAX_SAFE_INTEGER) return Number.POSITIVE_INFINITY
-  }
-  return length
-}
-
-async function readJsonBounded(
-  request: Request,
-  maxBytes: number,
-): Promise<{ ok: true; value: unknown } | { ok: false; status: 400 | 413 }> {
-  const declared = request.headers.get("content-length")
-  if (declared !== null) {
-    const length = parseContentLength(declared)
-    if (length === undefined) return { ok: false, status: 400 }
-    if (length > maxBytes) return { ok: false, status: 413 }
-  }
-
-  const body = request.body
-  if (body === null) return { ok: false, status: 400 }
-
-  const reader = body.getReader()
-  const chunks: Uint8Array[] = []
-  let total = 0
-  for (;;) {
-    const { done, value } = await reader.read()
-    if (done) break
-    total += value.byteLength
-    if (total > maxBytes) {
-      await reader.cancel()
-      return { ok: false, status: 413 }
-    }
-    chunks.push(value)
-  }
-
-  const bytes = new Uint8Array(total)
-  let offset = 0
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset)
-    offset += chunk.byteLength
-  }
-  try {
-    return { ok: true, value: JSON.parse(TEXT_DECODER.decode(bytes)) as unknown }
-  } catch {
-    return { ok: false, status: 400 }
-  }
-}
+const DOCS_HEALTH =
+  "nifra docs MCP — POST JSON-RPC 2.0 here (methods: initialize, tools/list, tools/call). Tools: nifra_docs, nifra_example."
 
 /** The two project-independent tools, reading the package's bundled corpus from disk (CLI use). */
 export function publicDocsTools(): McpTool[] {
-  return docsTools(loadDocsCorpus, loadExamplesCorpus)
+  return docsTools(loadDocsCorpus, loadExamplesCorpus, loadTypesCorpus)
 }
 
 /**
- * The transport core, shared by every HTTP host (CLI `docs-mcp`, the site's edge worker): handle one
- * MCP request against the given `tools`. POST a JSON-RPC body → JSON-RPC response; GET is a health page;
- * OPTIONS is the CORS preflight. Never throws — a bad body becomes a JSON-RPC parse error. Pass the
- * tools so each host supplies its own corpus source (disk vs cached fetch) behind identical defs.
+ * Handle one MCP request against the given `tools` with the docs server identity. A thin docs-flavored
+ * wrapper over the shared {@link respondMcpHttpCore} so the `@nifrajs/cli/mcp` self-host surface keeps its
+ * `(request, tools, options?)` shape (the site's edge worker calls it with two args).
  */
-export async function respondMcpHttp(
+export function respondMcpHttp(
   request: Request,
   tools: McpTool[],
   options: McpHttpOptions = {},
 ): Promise<Response> {
-  if (request.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS })
-  if (request.method === "GET") {
-    return new Response(
-      "nifra docs MCP — POST JSON-RPC 2.0 here (methods: initialize, tools/list, tools/call). Tools: nifra_docs, nifra_example.",
-      { headers: { "content-type": "text/plain; charset=utf-8", ...CORS } },
-    )
-  }
-  if (request.method !== "POST") {
-    return new Response("method not allowed", {
-      status: 405,
-      headers: { allow: "POST, GET", ...CORS },
-    })
-  }
-  const parsed = await readJsonBounded(request, options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES)
-  if (!parsed.ok) {
-    if (parsed.status === 413) {
-      return Response.json(rpcError(null, -32000, "payload too large"), {
-        status: 413,
-        headers: CORS,
-      })
-    }
-    return Response.json(rpcError(null, -32700, "parse error"), { status: 400, headers: CORS })
-  }
-  const message = parsed.value as JsonRpcRequest
-  const response = await handleRpc(message, tools, SERVER_INFO, {}, { signal: request.signal })
-  // A notification (no id) yields null — acknowledge with 204, no body.
-  if (response === null) return new Response(null, { status: 204, headers: CORS })
-  return Response.json(response, { headers: CORS })
+  return respondMcpHttpCore(request, tools, SERVER_INFO, { health: DOCS_HEALTH, ...options })
 }
 
 /** The CLI HTTP handler: serves the disk-backed corpus tools. (`nifra docs-mcp` / `bun run` this file.) */

package/src/mcp-protocol.ts

@@ -1,326 +1,7 @@
 /**
- * The pure MCP (Model Context Protocol) JSON-RPC dispatch — no I/O, no `Bun.*`, no side effects, so it
- * unit-tests cleanly. {@link runMcpServer} in `./mcp.ts` wires this to stdin/stdout; the tools are
- * injected, so the protocol logic is exercised without spawning or reading streams.
+ * The MCP JSON-RPC dispatch now lives in `@nifrajs/mcp` (shared with nifra apps that expose their own
+ * MCP server / MCP Apps widgets). This module is a thin re-export so the CLI's existing imports — and
+ * the `@nifrajs/cli/mcp` self-host surface — keep resolving here unchanged.
  */
 
-export const PROTOCOL_VERSION = "2024-11-05"
-
-type RequestId = string | number
-type JsonRpcId = RequestId | null
-type ProgressToken = string | number
-
-export interface McpToolContext {
-  readonly signal: AbortSignal
-  readonly requestId: JsonRpcId
-  readonly progressToken?: ProgressToken
-  readonly reportProgress: (progress: number, total?: number) => void
-}
-
-/** A tool the agent can call. `handler` returns the text shown to the agent. */
-export interface McpTool {
-  readonly name: string
-  readonly description: string
-  readonly inputSchema: Record<string, unknown>
-  readonly handler: (args: Record<string, unknown>, context: McpToolContext) => Promise<string>
-}
-
-export interface McpResource {
-  readonly uri: string
-  readonly name: string
-  readonly description?: string
-  readonly mimeType?: string
-  readonly read: () => Promise<{ readonly text: string; readonly mimeType?: string }>
-}
-
-export interface McpPromptMessage {
-  readonly role: "user" | "assistant"
-  readonly content: { readonly type: "text"; readonly text: string }
-}
-
-export interface McpPrompt {
-  readonly name: string
-  readonly description: string
-  readonly arguments?: readonly {
-    readonly name: string
-    readonly description?: string
-    readonly required?: boolean
-  }[]
-  readonly handler: (args: Record<string, unknown>) => Promise<readonly McpPromptMessage[]>
-}
-
-export interface McpServerFeatures {
-  readonly resources?: readonly McpResource[]
-  readonly prompts?: readonly McpPrompt[]
-}
-
-export interface JsonRpcRequest {
-  readonly jsonrpc?: string
-  readonly id?: JsonRpcId
-  readonly method?: string
-  readonly params?: Record<string, unknown>
-}
-
-export interface JsonRpcNotification {
-  readonly jsonrpc: "2.0"
-  readonly method: string
-  readonly params?: Record<string, unknown>
-}
-
-export type JsonRpcResponse =
-  | { jsonrpc: "2.0"; id: JsonRpcId; result: unknown }
-  | { jsonrpc: "2.0"; id: JsonRpcId; error: { code: number; message: string } }
-
-export const rpcResult = (id: JsonRpcId, value: unknown): JsonRpcResponse => ({
-  jsonrpc: "2.0",
-  id,
-  result: value,
-})
-export const rpcError = (id: JsonRpcId, code: number, message: string): JsonRpcResponse => ({
-  jsonrpc: "2.0",
-  id,
-  error: { code, message },
-})
-
-export interface McpProtocolState {
-  readonly activeRequests: Map<string, AbortController>
-}
-
-export interface McpProtocolOptions {
-  readonly state?: McpProtocolState
-  readonly signal?: AbortSignal
-  readonly sendNotification?: (notification: JsonRpcNotification) => void
-}
-
-export function createMcpProtocolState(): McpProtocolState {
-  return { activeRequests: new Map() }
-}
-
-function requestKey(id: unknown): string | undefined {
-  if (typeof id === "string") return `s:${id}`
-  return typeof id === "number" && Number.isFinite(id) ? `n:${id}` : undefined
-}
-
-function progressTokenOf(params: Record<string, unknown> | undefined): ProgressToken | undefined {
-  const meta = params?._meta
-  if (typeof meta !== "object" || meta === null || Array.isArray(meta)) return undefined
-  const token = (meta as Record<string, unknown>).progressToken
-  return typeof token === "string" || (typeof token === "number" && Number.isFinite(token))
-    ? token
-    : undefined
-}
-
-function cancellationReason(params: Record<string, unknown> | undefined): string | undefined {
-  const reason = params?.reason
-  return typeof reason === "string" && reason.length > 0 ? reason : undefined
-}
-
-function linkAbortSignal(parent: AbortSignal | undefined, child: AbortController): () => void {
-  if (parent === undefined) return () => {}
-  if (parent.aborted) {
-    child.abort(parent.reason)
-    return () => {}
-  }
-  const abort = (): void => child.abort(parent.reason)
-  parent.addEventListener("abort", abort, { once: true })
-  return () => parent.removeEventListener("abort", abort)
-}
-
-function abortMessage(signal: AbortSignal): string {
-  const reason = signal.reason
-  if (typeof reason === "string" && reason.length > 0) return `Cancelled: ${reason}`
-  return "Cancelled"
-}
-
-function compactDescription(description: string): string {
-  const text = description.replace(/\s+/g, " ").trim()
-  const sentenceEnd = text.search(/[.!?](?:\s|$)/)
-  const sentence = sentenceEnd === -1 ? text : text.slice(0, sentenceEnd + 1)
-  if (sentence.length <= 120) return sentence
-  return `${sentence.slice(0, 117).trimEnd()}...`
-}
-
-/**
- * Dispatch one JSON-RPC message against the given tools. Returns the response, or `null` for a
- * notification (no reply). Tool errors are reported in-band (`isError`) so the agent can react to them.
- */
-export async function handleRpc(
-  message: JsonRpcRequest,
-  tools: readonly McpTool[],
-  serverInfo: { name: string; version: string },
-  features: McpServerFeatures = {},
-  options: McpProtocolOptions = {},
-): Promise<JsonRpcResponse | null> {
-  const { id, method, params } = message
-  const isNotification = id === undefined
-  const rid = id ?? null
-  const resources = features.resources ?? []
-  const prompts = features.prompts ?? []
-  const state = options.state ?? createMcpProtocolState()
-
-  switch (method) {
-    case "initialize":
-      return rpcResult(rid, {
-        protocolVersion: PROTOCOL_VERSION,
-        capabilities: {
-          tools: {},
-          ...(resources.length > 0 ? { resources: {} } : {}),
-          ...(prompts.length > 0 ? { prompts: {} } : {}),
-        },
-        serverInfo,
-      })
-    case "notifications/initialized":
-      return null
-    case "notifications/cancelled": {
-      const key = requestKey(params?.requestId)
-      if (key !== undefined) state.activeRequests.get(key)?.abort(cancellationReason(params))
-      return null
-    }
-    case "ping":
-      return rpcResult(rid, {})
-    case "tools/list":
-      return rpcResult(
-        rid,
-        params?.compact === true
-          ? {
-              tools: tools.map((t) => ({
-                name: t.name,
-                description: compactDescription(t.description),
-              })),
-            }
-          : {
-              tools: tools.map((t) => ({
-                name: t.name,
-                description: t.description,
-                inputSchema: t.inputSchema,
-              })),
-            },
-      )
-    case "tools/describe": {
-      const name = params?.name
-      const tool = tools.find((t) => t.name === name)
-      if (!tool) return rpcError(rid, -32602, `unknown tool: ${String(name)}`)
-      return rpcResult(rid, {
-        tool: {
-          name: tool.name,
-          description: tool.description,
-          inputSchema: tool.inputSchema,
-        },
-      })
-    }
-    case "tools/call": {
-      const name = params?.name
-      const tool = tools.find((t) => t.name === name)
-      if (!tool) return rpcError(rid, -32602, `unknown tool: ${String(name)}`)
-      const args = (params?.arguments as Record<string, unknown>) ?? {}
-      const controller = new AbortController()
-      const key = requestKey(id)
-      const cleanupAbort = linkAbortSignal(options.signal, controller)
-      if (key !== undefined) state.activeRequests.set(key, controller)
-      const progressToken = progressTokenOf(params)
-      let lastProgress = Number.NEGATIVE_INFINITY
-      const reportProgress = (progress: number, total?: number): void => {
-        if (
-          progressToken === undefined ||
-          !Number.isFinite(progress) ||
-          progress <= lastProgress ||
-          (total !== undefined && !Number.isFinite(total))
-        ) {
-          return
-        }
-        lastProgress = progress
-        options.sendNotification?.({
-          jsonrpc: "2.0",
-          method: "notifications/progress",
-          params: {
-            progressToken,
-            progress,
-            ...(total !== undefined ? { total } : {}),
-          },
-        })
-      }
-      try {
-        reportProgress(0, 1)
-        if (controller.signal.aborted) throw new DOMException("cancelled", "AbortError")
-        const text = await tool.handler(args, {
-          signal: controller.signal,
-          requestId: rid,
-          ...(progressToken !== undefined ? { progressToken } : {}),
-          reportProgress,
-        })
-        if (controller.signal.aborted) throw new DOMException("cancelled", "AbortError")
-        reportProgress(1, 1)
-        return rpcResult(rid, { content: [{ type: "text", text }] })
-      } catch (err) {
-        if (controller.signal.aborted) {
-          return rpcResult(rid, {
-            content: [{ type: "text", text: abortMessage(controller.signal) }],
-            isError: true,
-          })
-        }
-        const msg = err instanceof Error ? err.message : String(err)
-        return rpcResult(rid, { content: [{ type: "text", text: `Error: ${msg}` }], isError: true })
-      } finally {
-        cleanupAbort()
-        if (key !== undefined && state.activeRequests.get(key) === controller) {
-          state.activeRequests.delete(key)
-        }
-      }
-    }
-    case "resources/list":
-      return rpcResult(rid, {
-        resources: resources.map((r) => ({
-          uri: r.uri,
-          name: r.name,
-          ...(r.description !== undefined ? { description: r.description } : {}),
-          ...(r.mimeType !== undefined ? { mimeType: r.mimeType } : {}),
-        })),
-      })
-    case "resources/read": {
-      const uri = params?.uri
-      const resource = resources.find((r) => r.uri === uri)
-      if (!resource) return rpcError(rid, -32602, `unknown resource: ${String(uri)}`)
-      try {
-        const content = await resource.read()
-        return rpcResult(rid, {
-          contents: [
-            {
-              uri: resource.uri,
-              mimeType: content.mimeType ?? resource.mimeType ?? "text/plain",
-              text: content.text,
-            },
-          ],
-        })
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err)
-        return rpcError(rid, -32000, msg)
-      }
-    }
-    case "prompts/list":
-      return rpcResult(rid, {
-        prompts: prompts.map((p) => ({
-          name: p.name,
-          description: p.description,
-          ...(p.arguments !== undefined ? { arguments: p.arguments } : {}),
-        })),
-      })
-    case "prompts/get": {
-      const name = params?.name
-      const prompt = prompts.find((p) => p.name === name)
-      if (!prompt) return rpcError(rid, -32602, `unknown prompt: ${String(name)}`)
-      const args = (params?.arguments as Record<string, unknown>) ?? {}
-      try {
-        return rpcResult(rid, {
-          description: prompt.description,
-          messages: await prompt.handler(args),
-        })
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err)
-        return rpcError(rid, -32000, msg)
-      }
-    }
-    default:
-      if (isNotification) return null
-      return rpcError(rid, -32601, `method not found: ${String(method)}`)
-  }
-}
+export * from "@nifrajs/mcp/protocol"

package/src/mcp-run.ts

@@ -6,7 +6,7 @@
  */
 
 import { existsSync } from "node:fs"
-import { resolve } from "node:path"
+import { resolve, sep } from "node:path"
 import { pathToFileURL } from "node:url"
 import { type AppLike, runApp } from "@nifrajs/runner"
 
@@ -24,6 +24,12 @@ export async function loadBackend(
   if (!found) {
     return { error: `no backend entry found in ${cwd} (looked for ${candidates.join(", ")})` }
   }
+  // The `entry` arg comes from MCP args; importing it executes it. Keep it inside the project root so a
+  // crafted `entry` (`../../x`, an absolute path) can't run arbitrary modules outside the project.
+  const root = resolve(cwd)
+  if (found !== root && !found.startsWith(root + sep)) {
+    return { error: `refusing to load a backend entry outside the project root: ${entry}` }
+  }
 
   let mod: Record<string, unknown>
   try {