@nocobase/plugin-mcp-server 2.2.16 → 2.2.18

package/dist/node_modules/openapi-mcp-generator/dist/utils/parser-security.js

@@ -0,0 +1,121 @@
+/**
+ * Parser-level security utilities.
+ *
+ * Guards against SSRF via uncontrolled external `$ref` resolution. By default
+ * `@apidevtools/swagger-parser`'s `dereference()` will follow `http://` and
+ * `https://` `$ref` URLs, issuing live outbound requests during parsing. A
+ * malicious or compromised spec can use this to reach internal services
+ * (cloud metadata endpoints, internal APIs) from the host running the
+ * generator. See GitHub issue #68.
+ */
+import SwaggerParser from '@apidevtools/swagger-parser';
+/** Error thrown when an external `$ref` is encountered but not allowed. */
+export class ExternalRefError extends Error {
+    ref;
+    constructor(ref) {
+        super(`External $ref resolution is disabled for security (SSRF protection): "${ref}". ` +
+            `Re-run with --allow-external-refs / { allowExternalRefs: true } to permit it.`);
+        this.ref = ref;
+        this.name = 'ExternalRefError';
+    }
+}
+/** Returns true if a `$ref` string points at an http(s) URL. */
+export function isExternalHttpRef(ref) {
+    return typeof ref === 'string' && /^https?:\/\//i.test(ref.trim());
+}
+/**
+ * Recursively scan an already-loaded spec object for external http(s) `$ref`
+ * values. Throws {@link ExternalRefError} on the first one found.
+ *
+ * This runs before dereferencing so no outbound request is ever made.
+ */
+/**
+ * Keys whose values are literal user data (example payloads, defaults), where a
+ * string property named `$ref` is content — not an OpenAPI reference. We don't
+ * scan into these to avoid false positives on otherwise-valid specs.
+ */
+const DATA_BEARING_KEYS = new Set(['example', 'examples', 'default']);
+/**
+ * An OpenAPI Reference Object is `{ $ref: string }`, optionally accompanied by
+ * `summary`/`description` (OpenAPI 3.1). If an object carries a `$ref` string
+ * alongside other arbitrary properties, it's user data (e.g. an example body),
+ * not a reference SwaggerParser would resolve.
+ */
+function isReferenceObject(obj) {
+    if (typeof obj.$ref !== 'string')
+        return false;
+    return Object.keys(obj).every((k) => k === '$ref' || k === 'summary' || k === 'description');
+}
+export function assertNoExternalRefs(node, seen = new WeakSet()) {
+    if (node === null || typeof node !== 'object')
+        return;
+    if (seen.has(node))
+        return;
+    seen.add(node);
+    if (Array.isArray(node)) {
+        for (const item of node)
+            assertNoExternalRefs(item, seen);
+        return;
+    }
+    const obj = node;
+    // Only treat a structurally-valid Reference Object's $ref as a resolvable ref.
+    if (isReferenceObject(obj) && isExternalHttpRef(obj.$ref)) {
+        throw new ExternalRefError(obj.$ref);
+    }
+    for (const [key, value] of Object.entries(obj)) {
+        // Skip literal-data subtrees where `$ref` would be content, not a reference.
+        if (DATA_BEARING_KEYS.has(key))
+            continue;
+        assertNoExternalRefs(value, seen);
+    }
+}
+/** True if the input is an http(s) URL string. */
+function isHttpUrlInput(input) {
+    return typeof input === 'string' && /^https?:\/\//i.test(input.trim());
+}
+/**
+ * Parse and dereference an OpenAPI spec with optional SSRF protection.
+ *
+ * The SSRF protection targets external `$ref`s embedded *inside* the spec, not
+ * the user-supplied input itself: a URL/path passed as the input is trusted
+ * (the user typed it) and must still load. When `allowExternalRefs` is false
+ * (the default) we:
+ *   1. Parse the entry document (http allowed so a URL input is fetched).
+ *   2. Scan the parsed tree and reject any external http(s) `$ref`.
+ *   3. Dereference with the http resolver disabled — safe because step 2
+ *      guaranteed no external refs remain to follow.
+ *
+ * Step 3 dereferences from the ORIGINAL local-path/object input (not the parsed
+ * object) so relative file `$ref`s (e.g. `./schemas.json#/MyType`) resolve
+ * against the spec's directory rather than the process cwd. For URL inputs,
+ * which can't be re-fetched once http is disabled, it dereferences the parsed
+ * object instead (URL specs are single-file or use absolute refs already
+ * rejected in step 2).
+ *
+ * @param input Path, URL, or pre-parsed document
+ * @param allowExternalRefs Permit external http(s) `$ref` resolution
+ * @returns Fully dereferenced OpenAPI v3 document
+ */
+export async function parseSpecSecurely(input, allowExternalRefs) {
+    // SwaggerParser accepts a path/URL string OR a pre-parsed API object.
+    const apiInput = input;
+    if (allowExternalRefs) {
+        return (await SwaggerParser.dereference(apiInput));
+    }
+    // 1. Parse/fetch the entry document (http allowed so a URL input still loads),
+    //    without dereferencing, so we can inspect raw $ref values first.
+    const parsed = (await SwaggerParser.parse(apiInput));
+    // 2. Reject any external http(s) $ref embedded in the spec (SSRF guard).
+    assertNoExternalRefs(parsed);
+    // 3. Dereference with http disabled. For local-path/object inputs, pass the
+    //    ORIGINAL input so relative file refs resolve against the spec directory;
+    //    for URL inputs (which can't be re-fetched with http off) dereference the
+    //    already-parsed object.
+    const dereferenceInput = isHttpUrlInput(input)
+        ? parsed
+        : apiInput;
+    return (await SwaggerParser.dereference(dereferenceInput, {
+        resolve: { http: false },
+    }));
+}
+//# sourceMappingURL=parser-security.js.map

package/dist/node_modules/openapi-mcp-generator/dist/utils/parser-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser-security.js","sourceRoot":"","sources":["../../src/utils/parser-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,aAAa,MAAM,6BAA6B,CAAC;AAGxD,2EAA2E;AAC3E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAA5B,YAA4B,GAAW;QACrC,KAAK,CACH,yEAAyE,GAAG,KAAK;YAC/E,+EAA+E,CAClF,CAAC;QAJwB,QAAG,GAAH,GAAG,CAAQ;QAKrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAA4B;IACrD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa,EAAE,OAAwB,IAAI,OAAO,EAAE;IACvF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC;QAAE,OAAO;IACrC,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;IAEzB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,+EAA+E;IAC/E,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,6EAA6E;QAC7E,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,SAAS,cAAc,CAAC,KAAkC;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAkC,EAClC,iBAA0B;IAE1B,sEAAsE;IACtE,MAAM,QAAQ,GAAG,KAAwD,CAAC;IAE1E,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAuB,CAAC;IAC3E,CAAC;IAED,+EAA+E;IAC/E,qEAAqE;IACrE,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAuB,CAAC;IAE3E,yEAAyE;IACzE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE7B,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4BAA4B;IAC5B,MAAM,gBAAgB,GAAoD,cAAc,CAAC,KAAK,CAAC;QAC7F,CAAC,CAAE,MAAqE;QACxE,CAAC,CAAC,QAAQ,CAAC;IACb,OAAO,CAAC,MAAM,aAAa,CAAC,WAAW,CAAC,gBAAgB,EAAE;QACxD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;KACzB,CAAC,CAAuB,CAAC;AAC5B,CAAC"}

package/dist/node_modules/openapi-mcp-generator/dist/utils/security.d.ts

@@ -24,18 +24,56 @@ export declare function generateApiKeySecurityCode(scheme: OpenAPIV3.ApiKeySecur
  */
 export declare function generateHttpSecurityCode(): string;
 /**
- * Generates code for OAuth2 token acquisition
+ * Options controlling generated security/execution code.
+ */
+export interface SecurityCodeOptions {
+    /** Skip TLS verification for generated requests (issue #46). */
+    insecure?: boolean;
+    /** Send OAuth2 client credentials in the request body, not Basic header (issue #8). */
+    oauthCredsInBody?: boolean;
+    /** Inbound header names to forward to the upstream API (issue #55). */
+    headerPassthrough?: string[];
+    /** Generate and invoke a custom auth hook before built-in auth (issue #9). */
+    customAuth?: boolean;
+}
+/**
+ * Generates code for OAuth2 token acquisition.
+ *
+ * The env-var lookups are computed from the *runtime* `schemeName` argument
+ * (not a literal placeholder) so per-scheme credentials resolve correctly
+ * (issue #56).
  *
+ * @param options Generation options affecting the emitted code
  * @returns Generated code for OAuth2 token acquisition
  */
-export declare function generateOAuth2TokenAcquisitionCode(): string;
+export declare function generateOAuth2TokenAcquisitionCode(options?: SecurityCodeOptions): string;
+/**
+ * Returns the top-of-module import statements the generated security/execution
+ * code requires, given the active options. These must be emitted at the top of
+ * the generated module (ES module imports cannot appear mid-file).
+ *
+ * @param options Generation options
+ * @returns Import statements (possibly empty), newline-terminated
+ */
+export declare function getSecurityModuleImports(options?: SecurityCodeOptions): string;
+/**
+ * Declaration for the request-scoped inbound-header store used by header
+ * passthrough (issue #55). Exported so the web/streamable-http transports can
+ * run each request inside `inboundHeaderStore.run(headers, ...)`, giving
+ * concurrency-safe, per-request header forwarding (no shared global state).
+ *
+ * @param options Generation options
+ * @returns Declaration source (empty unless header passthrough is enabled)
+ */
+export declare function getInboundHeaderStoreDeclaration(options?: SecurityCodeOptions): string;
 /**
  * Generates code for executing API tools with security handling
  *
  * @param securitySchemes Security schemes from OpenAPI spec
+ * @param options Generation options affecting the emitted code
  * @returns Generated code for the execute API tool function
  */
-export declare function generateExecuteApiToolFunction(securitySchemes?: OpenAPIV3.ComponentsObject['securitySchemes']): string;
+export declare function generateExecuteApiToolFunction(securitySchemes?: OpenAPIV3.ComponentsObject['securitySchemes'], options?: SecurityCodeOptions): string;
 /**
  * Gets security scheme documentation for README
  *

package/dist/node_modules/openapi-mcp-generator/dist/utils/security.js

@@ -51,18 +51,42 @@ export function generateHttpSecurityCode() {
         else if (scheme.scheme?.toLowerCase() === 'basic') {
             const username = process.env[\`${getEnvVarName(schemeName, 'BASIC_USERNAME')}\`];
             const password = process.env[\`${getEnvVarName(schemeName, 'BASIC_PASSWORD')}\`];
-            if (username && password) {
-                headers['authorization'] = \`Basic \${Buffer.from(\`\${username}:\${password}\`).toString('base64')}\`;
+            // Empty password is valid per RFC 7617 (issue #66); only username is required.
+            if (username != null) {
+                headers['authorization'] = \`Basic \${Buffer.from(\`\${username}:\${password ?? ''}\`).toString('base64')}\`;
             }
         }
     }`;
 }
 /**
- * Generates code for OAuth2 token acquisition
+ * Generates code for OAuth2 token acquisition.
  *
+ * The env-var lookups are computed from the *runtime* `schemeName` argument
+ * (not a literal placeholder) so per-scheme credentials resolve correctly
+ * (issue #56).
+ *
+ * @param options Generation options affecting the emitted code
  * @returns Generated code for OAuth2 token acquisition
  */
-export function generateOAuth2TokenAcquisitionCode() {
+export function generateOAuth2TokenAcquisitionCode(options = {}) {
+    // Runtime env-var expression for a given credential prefix.
+    const env = (prefix) => `process.env[\`${prefix}_\${schemeName.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase()}\`]`;
+    // Token request: credentials in body (issue #8) or Basic header (default).
+    const bodyCreds = options.oauthCredsInBody
+        ? `
+        // Send client credentials in the request body
+        formData.append('client_id', clientId);
+        formData.append('client_secret', clientSecret);`
+        : '';
+    const tokenRequestHeaders = options.oauthCredsInBody
+        ? `'Content-Type': 'application/x-www-form-urlencoded'`
+        : `'Content-Type': 'application/x-www-form-urlencoded',
+                'Authorization': \`Basic \${Buffer.from(\`\${clientId}:\${clientSecret}\`).toString('base64')}\``;
+    // Insecure HTTPS agent (issue #46).
+    const insecureAgent = options.insecure
+        ? `,
+            httpsAgent: insecureHttpsAgent`
+        : '';
     return `
 /**
  * Type definition for cached OAuth tokens
@@ -88,11 +112,11 @@ declare global {
  */
 async function acquireOAuth2Token(schemeName: string, scheme: any): Promise<string | null | undefined> {
     try {
-        // Check if we have the necessary credentials
-        const clientId = process.env[\`${getEnvVarName('schemeName', 'OAUTH_CLIENT_ID')}\`];
-        const clientSecret = process.env[\`${getEnvVarName('schemeName', 'OAUTH_CLIENT_SECRET')}\`];
-        const scopes = process.env[\`${getEnvVarName('schemeName', 'OAUTH_SCOPES')}\`];
-        
+        // Check if we have the necessary credentials (resolved per-scheme at runtime)
+        const clientId = ${env('OAUTH_CLIENT_ID')};
+        const clientSecret = ${env('OAUTH_CLIENT_SECRET')};
+        const scopes = ${env('OAUTH_SCOPES')};
+
         if (!clientId || !clientSecret) {
             console.error(\`Missing client credentials for OAuth2 scheme '\${schemeName}'\`);
             return null;
@@ -133,19 +157,18 @@ async function acquireOAuth2Token(schemeName: string, scheme: any): Promise<stri
         // Add scopes if specified
         if (scopes) {
             formData.append('scope', scopes);
-        }
-        
+        }${bodyCreds}
+
         console.error(\`Requesting OAuth2 token from \${tokenUrl}\`);
-        
+
         // Make the token request
         const response = await axios({
             method: 'POST',
             url: tokenUrl,
             headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-                'Authorization': \`Basic \${Buffer.from(\`\${clientId}:\${clientSecret}\`).toString('base64')}\`
+                ${tokenRequestHeaders}
             },
-            data: formData.toString()
+            data: formData.toString()${insecureAgent}
         });
         
         // Process the response
@@ -173,15 +196,107 @@ async function acquireOAuth2Token(schemeName: string, scheme: any): Promise<stri
 }
 `;
 }
+/**
+ * Returns the top-of-module import statements the generated security/execution
+ * code requires, given the active options. These must be emitted at the top of
+ * the generated module (ES module imports cannot appear mid-file).
+ *
+ * @param options Generation options
+ * @returns Import statements (possibly empty), newline-terminated
+ */
+export function getSecurityModuleImports(options = {}) {
+    let imports = '';
+    if (options.insecure) {
+        imports += `import * as https from 'https';\n`;
+    }
+    if (options.customAuth) {
+        imports += `import { applyCustomAuth } from './auth.js';\n`;
+    }
+    if (Array.isArray(options.headerPassthrough) &&
+        options.headerPassthrough.filter(Boolean).length) {
+        imports += `import { AsyncLocalStorage } from 'async_hooks';\n`;
+    }
+    return imports;
+}
+/**
+ * Declaration for the request-scoped inbound-header store used by header
+ * passthrough (issue #55). Exported so the web/streamable-http transports can
+ * run each request inside `inboundHeaderStore.run(headers, ...)`, giving
+ * concurrency-safe, per-request header forwarding (no shared global state).
+ *
+ * @param options Generation options
+ * @returns Declaration source (empty unless header passthrough is enabled)
+ */
+export function getInboundHeaderStoreDeclaration(options = {}) {
+    const enabled = Array.isArray(options.headerPassthrough) &&
+        options.headerPassthrough.filter(Boolean).length > 0;
+    if (!enabled)
+        return '';
+    return `
+/**
+ * Request-scoped storage for inbound headers eligible for passthrough.
+ * The transports populate this per request; executeApiTool reads it.
+ */
+export const inboundHeaderStore = new AsyncLocalStorage<Record<string, string>>();
+`;
+}
 /**
  * Generates code for executing API tools with security handling
  *
  * @param securitySchemes Security schemes from OpenAPI spec
+ * @param options Generation options affecting the emitted code
  * @returns Generated code for the execute API tool function
  */
-export function generateExecuteApiToolFunction(securitySchemes) {
+export function generateExecuteApiToolFunction(securitySchemes, options = {}) {
     // Generate OAuth2 token acquisition function
-    const oauth2TokenAcquisitionCode = generateOAuth2TokenAcquisitionCode();
+    const oauth2TokenAcquisitionCode = generateOAuth2TokenAcquisitionCode(options);
+    // Insecure HTTPS agent declaration (issue #46), shared by token + tool requests.
+    // Note: the `https` import is emitted at the top of the generated module by
+    // getSecurityModuleImports(); this only declares the shared agent constant.
+    const insecurePreamble = options.insecure
+        ? `
+/** Shared HTTPS agent that skips TLS verification (enabled via --insecure). */
+const insecureHttpsAgent = new https.Agent({ rejectUnauthorized: false });
+`
+        : '';
+    // Insecure agent applied to the per-tool axios request config (issue #46).
+    const insecureAgentToolConfig = options.insecure ? `\n      httpsAgent: insecureHttpsAgent,` : '';
+    // Custom auth hook invocation (issue #9). When the hook returns true, the
+    // built-in auth block below is skipped (guarded by !customAuthHandled).
+    const customAuthCall = options.customAuth
+        ? `
+    // Custom auth hook (see src/auth.ts). Returning true short-circuits built-in auth.
+    const customAuthHandled = await applyCustomAuth({ headers, queryParams, toolName, definition });
+    if (customAuthHandled) {
+        console.error(\`Custom auth applied for tool '\${toolName}', skipping built-in auth.\`);
+    }
+`
+        : '';
+    // Built-in auth is wrapped in this guard so a custom hook can fully own auth.
+    const builtinAuthGuardOpen = options.customAuth ? '    if (!customAuthHandled) {\n' : '';
+    const builtinAuthGuardClose = options.customAuth ? '\n    }' : '';
+    // Header passthrough (issue #55): forward selected inbound headers to the
+    // upstream API. Headers are read from request-scoped AsyncLocalStorage (set
+    // by the web/streamable-http transports), NOT a shared global, so concurrent
+    // requests cannot leak each other's credentials. No-op for stdio.
+    const headerPassthroughNames = Array.isArray(options.headerPassthrough)
+        ? options.headerPassthrough.filter(Boolean)
+        : [];
+    const headerPassthroughCode = headerPassthroughNames.length > 0
+        ? `
+    // Forward configured inbound headers to the upstream API (issue #55)
+    const __passthroughHeaderNames = ${JSON.stringify(headerPassthroughNames.map((h) => h.toLowerCase()))};
+    const __inboundHeaders = inboundHeaderStore.getStore();
+    if (__inboundHeaders) {
+        for (const __name of __passthroughHeaderNames) {
+            const __val = __inboundHeaders[__name];
+            if (typeof __val !== 'undefined') {
+                headers[__name] = __val;
+            }
+        }
+    }
+`
+        : '';
     // Generate security handling code for checking, applying security
     const securityCode = `
     // Apply security requirements if available
@@ -203,8 +318,8 @@ export function generateExecuteApiToolFunction(securitySchemes) {
                     return !!process.env[\`BEARER_TOKEN_\${schemeName.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase()}\`];
                 }
                 else if (scheme.scheme?.toLowerCase() === 'basic') {
-                    return !!process.env[\`BASIC_USERNAME_\${schemeName.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase()}\`] && 
-                           !!process.env[\`BASIC_PASSWORD_\${schemeName.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase()}\`];
+                    // Username is sufficient; an empty password is valid per RFC 7617 (issue #66)
+                    return process.env[\`BASIC_USERNAME_\${schemeName.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase()}\`] != null;
                 }
             }
             
@@ -273,8 +388,9 @@ export function generateExecuteApiToolFunction(securitySchemes) {
                 else if (scheme.scheme?.toLowerCase() === 'basic') {
                     const username = process.env[\`BASIC_USERNAME_\${schemeName.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase()}\`];
                     const password = process.env[\`BASIC_PASSWORD_\${schemeName.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase()}\`];
-                    if (username && password) {
-                        headers['authorization'] = \`Basic \${Buffer.from(\`\${username}:\${password}\`).toString('base64')}\`;
+                    // Empty password is valid per RFC 7617 (issue #66); only username is required.
+                    if (username != null) {
+                        headers['authorization'] = \`Basic \${Buffer.from(\`\${username}:\${password ?? ''}\`).toString('base64')}\`;
                         console.error(\`Applied Basic authentication for '\${schemeName}'\`);
                     }
                 }
@@ -339,7 +455,7 @@ export function generateExecuteApiToolFunction(securitySchemes) {
     `;
     // Generate complete execute API tool function
     return `
-${oauth2TokenAcquisitionCode}
+${insecurePreamble}${oauth2TokenAcquisitionCode}
 
 /**
  * Executes an API tool with the provided arguments
@@ -408,27 +524,36 @@ async function executeApiTool(
         requestBodyData = validatedArgs['requestBody'];
         headers['content-type'] = definition.requestBodyContentType;
     }
-
-${securityCode}
-
+${customAuthCall}${builtinAuthGuardOpen}${securityCode}${builtinAuthGuardClose}
+${headerPassthroughCode}
     // Prepare the axios request configuration
     const config: AxiosRequestConfig = {
-      method: definition.method.toUpperCase(), 
-      url: requestUrl, 
-      params: queryParams, 
+      method: definition.method.toUpperCase(),
+      url: requestUrl,
+      params: queryParams,
       headers: headers,
+      // Serialize array query params as comma-separated values (issue #41)
+      paramsSerializer: (params: Record<string, any>) => {
+        const search = new URLSearchParams();
+        for (const [key, value] of Object.entries(params)) {
+          if (value === undefined || value === null) continue;
+          search.append(key, Array.isArray(value) ? value.join(',') : String(value));
+        }
+        return search.toString();
+      },${insecureAgentToolConfig}
       ...(requestBodyData !== undefined && { data: requestBodyData }),
     };
 
     // Log request info to stderr (doesn't affect MCP output)
     console.error(\`Executing tool "\${toolName}": \${config.method} \${config.url}\`);
-    
+
     // Execute the request
     const response = await axios(config);
 
     // Process and format the response
     let responseText = '';
-    const contentType = response.headers['content-type']?.toLowerCase() || '';
+    // Coerce header value to string before lowercasing (issue #65)
+    const contentType = String(response.headers['content-type'] ?? '').toLowerCase();
     
     // Handle JSON responses
     if (contentType.includes('application/json') && typeof response.data === 'object' && response.data !== null) {

package/dist/node_modules/openapi-mcp-generator/dist/utils/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IASkB;IAElB,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAsC;IAC/E,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,4CAA4C;IAC7E,OAAO;;uCAE8B,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC;;;;;;;;;;;;MAYrE,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,4CAA4C;IAC7E,OAAO;;;0CAGiC,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC;;;;;;6CAMtC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;6CAC3C,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;;;;;MAKlF,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC;IAChD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;yCA0BgC,aAAa,CAAC,YAAY,EAAE,iBAAiB,CAAC;6CAC1C,aAAa,CAAC,YAAY,EAAE,qBAAqB,CAAC;uCACxD,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgFjF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,eAA+D;IAE/D,6CAA6C;IAC7C,MAAM,0BAA0B,GAAG,kCAAkC,EAAE,CAAC;IAExE,kEAAkE;IAClE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAyJlB,CAAC;IAEJ,8CAA8C;IAC9C,OAAO;EACP,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsE1B,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Eb,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAA+D;IAE/D,IAAI,CAAC,eAAe;QAAE,OAAO,kDAAkD,CAAC;IAEhF,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAClE,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;YAC1B,IAAI,IAAI,OAAO,IAAI,2DAA2D,CAAC;YAC/E,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC;QAE3B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC9C,IAAI,IAAI,OAAO,MAAM,mBAAmB,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,EAAE,KAAK,CAAC;QAC5E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnD,IAAI,IAAI,OAAO,MAAM,uCAAuC,CAAC;YAC/D,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAC7D,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAC7D,IAAI,IAAI,OAAO,cAAc,yCAAyC,CAAC;gBACvE,IAAI,IAAI,OAAO,cAAc,yCAAyC,CAAC;YACzE,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAEzE,oCAAoC;YACpC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC3D,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACnE,IAAI,IAAI,OAAO,WAAW,4CAA4C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACrG,IAAI,IAAI,OAAO,eAAe,+CAA+C,CAAC;YAE9E,qCAAqC;YACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACpD,IAAI,IAAI,OAAO,QAAQ,+DAA+D,CAAC;YAEvF,qBAAqB;YACrB,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACtD,IAAI,IAAI,OAAO,SAAS,wDAAwD,CAAC;YAEjF,2CAA2C;YAC3C,IAAI,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC;gBACpC,IAAI,IAAI,wCAAwC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,IAAI,CAAC;gBAE5F,mCAAmC;gBACnC,IACE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAC7D,CAAC;oBACD,IAAI,IAAI,uBAAuB,CAAC;oBAChC,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAC/C,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CACtC,EAAE,CAAC;wBACF,IAAI,IAAI,SAAS,KAAK,OAAO,WAAW,IAAI,CAAC;oBAC/C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACrD,IAAI,IAAI,OAAO,QAAQ,4BAA4B,CAAC;YACpD,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC5B,IAAI,IAAI,mCAAmC,MAAM,CAAC,gBAAgB,IAAI,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IASkB;IAElB,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAsC;IAC/E,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,4CAA4C;IAC7E,OAAO;;uCAE8B,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC;;;;;;;;;;;;MAYrE,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,4CAA4C;IAC7E,OAAO;;;0CAGiC,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC;;;;;;6CAMtC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;6CAC3C,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC;;;;;;MAMlF,CAAC;AACP,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAAC,UAA+B,EAAE;IAClF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAC7B,iBAAiB,MAAM,gEAAgE,CAAC;IAE1F,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB;QACxC,CAAC,CAAC;;;wDAGkD;QACpD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,mBAAmB,GAAG,OAAO,CAAC,gBAAgB;QAClD,CAAC,CAAC,qDAAqD;QACvD,CAAC,CAAC;iHAC2G,CAAC;IAEhH,oCAAoC;IACpC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ;QACpC,CAAC,CAAC;2CACqC;QACvC,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;2BA0BkB,GAAG,CAAC,iBAAiB,CAAC;+BAClB,GAAG,CAAC,qBAAqB,CAAC;yBAChC,GAAG,CAAC,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA0CjC,SAAS;;;;;;;;;kBASF,mBAAmB;;uCAEE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BnD,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAA+B,EAAE;IACxE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,IAAI,mCAAmC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,IAAI,gDAAgD,CAAC;IAC9D,CAAC;IACD,IACE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACxC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAChD,CAAC;QACD,OAAO,IAAI,oDAAoD,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAAC,UAA+B,EAAE;IAChF,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACxC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO;;;;;;CAMR,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,eAA+D,EAC/D,UAA+B,EAAE;IAEjC,6CAA6C;IAC7C,MAAM,0BAA0B,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAE/E,iFAAiF;IACjF,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ;QACvC,CAAC,CAAC;;;CAGL;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,2EAA2E;IAC3E,MAAM,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElG,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU;QACvC,CAAC,CAAC;;;;;;CAML;QACG,CAAC,CAAC,EAAE,CAAC;IACP,8EAA8E;IAC9E,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,qBAAqB,GACzB,sBAAsB,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC;;uCAE+B,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;;;;;;;;;;CAUxG;QACK,CAAC,CAAC,EAAE,CAAC;IAET,kEAAkE;IAClE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0JlB,CAAC;IAEJ,8CAA8C;IAC9C,OAAO;EACP,gBAAgB,GAAG,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqE7C,cAAc,GAAG,oBAAoB,GAAG,YAAY,GAAG,qBAAqB;EAC5E,qBAAqB;;;;;;;;;;;;;;;UAeb,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEhC,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAA+D;IAE/D,IAAI,CAAC,eAAe;QAAE,OAAO,kDAAkD,CAAC;IAEhF,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAClE,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;YAC1B,IAAI,IAAI,OAAO,IAAI,2DAA2D,CAAC;YAC/E,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC;QAE3B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC9C,IAAI,IAAI,OAAO,MAAM,mBAAmB,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,EAAE,KAAK,CAAC;QAC5E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnD,IAAI,IAAI,OAAO,MAAM,uCAAuC,CAAC;YAC/D,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAC7D,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAC7D,IAAI,IAAI,OAAO,cAAc,yCAAyC,CAAC;gBACvE,IAAI,IAAI,OAAO,cAAc,yCAAyC,CAAC;YACzE,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAEzE,oCAAoC;YACpC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC3D,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACnE,IAAI,IAAI,OAAO,WAAW,4CAA4C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACrG,IAAI,IAAI,OAAO,eAAe,+CAA+C,CAAC;YAE9E,qCAAqC;YACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACpD,IAAI,IAAI,OAAO,QAAQ,+DAA+D,CAAC;YAEvF,qBAAqB;YACrB,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACtD,IAAI,IAAI,OAAO,SAAS,wDAAwD,CAAC;YAEjF,2CAA2C;YAC3C,IAAI,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC;gBACpC,IAAI,IAAI,wCAAwC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,IAAI,CAAC;gBAE5F,mCAAmC;gBACnC,IACE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAC7D,CAAC;oBACD,IAAI,IAAI,uBAAuB,CAAC;oBAChC,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAC/C,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CACtC,EAAE,CAAC;wBACF,IAAI,IAAI,SAAS,KAAK,OAAO,WAAW,IAAI,CAAC;oBAC/C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACrD,IAAI,IAAI,OAAO,QAAQ,4BAA4B,CAAC;YACpD,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC5B,IAAI,IAAI,mCAAmC,MAAM,CAAC,gBAAgB,IAAI,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/node_modules/openapi-mcp-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openapi-mcp-generator",
-  "version": "3.3.0",
+  "version": "4.0.1",
   "description": "Generates MCP server code from OpenAPI specifications",
   "license": "MIT",
   "author": "Harsha",
@@ -25,6 +25,8 @@
     "format.check": "prettier --check .",
     "format.write": "prettier --write .",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "build": "tsc && chmod 755 dist/index.js bin/openapi-mcp-generator.js",
     "version:patch": "npm version patch",
     "version:minor": "npm version minor",
@@ -59,7 +61,8 @@
     "eslint": "^9.33.0",
     "prettier": "^3.6.2",
     "rimraf": "^6.0.1",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "vitest": "^2.1.9"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.10.2",

package/dist/node_modules/openapi-types/package.json

@@ -1 +1 @@
-{"name":"openapi-types","version":"12.1.3","description":"Types for OpenAPI documents.","main":"./dist/index.js","types":"./dist/index.d.ts","scripts":{"prepare":"../../bin/tsc","test-watch":"../../bin/tsc"},"keywords":["openapi","swagger","types","typescript"],"author":"Joseph Spencer","bugs":{"url":"https://github.com/kogosoftwarellc/open-api/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+label%3Aopenapi-types"},"repository":"https://github.com/kogosoftwarellc/open-api/tree/master/packages/openapi-types","homepage":"https://github.com/kogosoftwarellc/open-api/tree/master/packages/openapi-types#readme","license":"MIT","gitHead":"09fed6d77536b3d7d1d38a2630a096041da773ee","_lastModified":"2026-09-21T01:34:06.489Z"}
+{"name":"openapi-types","version":"12.1.3","description":"Types for OpenAPI documents.","main":"./dist/index.js","types":"./dist/index.d.ts","scripts":{"prepare":"../../bin/tsc","test-watch":"../../bin/tsc"},"keywords":["openapi","swagger","types","typescript"],"author":"Joseph Spencer","bugs":{"url":"https://github.com/kogosoftwarellc/open-api/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+label%3Aopenapi-types"},"repository":"https://github.com/kogosoftwarellc/open-api/tree/master/packages/openapi-types","homepage":"https://github.com/kogosoftwarellc/open-api/tree/master/packages/openapi-types#readme","license":"MIT","gitHead":"09fed6d77536b3d7d1d38a2630a096041da773ee","_lastModified":"2026-09-25T14:52:59.777Z"}

package/package.json

@@ -1,19 +1,19 @@
 {
   "name": "@nocobase/plugin-mcp-server",
   "main": "dist/server/index.js",
-  "version": "2.2.16",
+  "version": "2.2.18",
   "displayName": "AI: MCP server",
   "displayName.zh-CN": "AI: MCP 服务器",
   "description": "An MCP server for building NocoBase systems and supporting business workflows.",
   "description.zh-CN": "用于构建 NocoBase 系统并支持业务流程的 MCP 服务器。",
   "license": "Apache-2.0",
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "light-my-request": "^6.6.0",
-    "openapi-mcp-generator": "^3.3.0"
+    "openapi-mcp-generator": "^4.0.1"
   },
   "peerDependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@nocobase/ai": "2.x",
     "@nocobase/client": "2.x",
     "@nocobase/plugin-idp-oauth": "2.x",
@@ -23,5 +23,5 @@
   "keywords": [
     "AI"
   ],
-  "gitHead": "228d1d3cff60d1ef4c91cf5023b20252b7baa0bd"
+  "gitHead": "0c464cd27b2c1ccdf10b00d339bf6599b18bee22"
 }

package/dist/node_modules/@apidevtools/swagger-parser/node_modules/ajv-draft-04/node_modules/ajv/.runkit_example.js

@@ -1,23 +0,0 @@
-const Ajv = require("ajv")
-const ajv = new Ajv({allErrors: true})
-
-const schema = {
-  type: "object",
-  properties: {
-    foo: {type: "string"},
-    bar: {type: "number", maximum: 3},
-  },
-  required: ["foo", "bar"],
-  additionalProperties: false,
-}
-
-const validate = ajv.compile(schema)
-
-test({foo: "abc", bar: 2})
-test({foo: 2, bar: 4})
-
-function test(data) {
-  const valid = validate(data)
-  if (valid) console.log("Valid!")
-  else console.log("Invalid: " + ajv.errorsText(validate.errors))
-}

package/dist/node_modules/@apidevtools/swagger-parser/node_modules/ajv-draft-04/node_modules/ajv/LICENSE

@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015-2021 Evgeny Poberezkin
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-