@nocobase/plugin-mcp-server 2.4.0-alpha.7 → 2.4.0-alpha.9

package/dist/node_modules/light-my-request/node_modules/cookie/dist/index.js

@@ -0,0 +1,350 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCookie = parseCookie;
+exports.parse = parseCookie;
+exports.stringifyCookie = stringifyCookie;
+exports.stringifySetCookie = stringifySetCookie;
+exports.serialize = stringifySetCookie;
+exports.parseSetCookie = parseSetCookie;
+exports.stringifySetCookie = stringifySetCookie;
+exports.serialize = stringifySetCookie;
+/**
+ * RegExp to match cookie-name in RFC 6265 sec 4.1.1
+ * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
+ * which has been replaced by the token definition in RFC 7230 appendix B.
+ *
+ * cookie-name       = token
+ * token             = 1*tchar
+ * tchar             = "!" / "#" / "$" / "%" / "&" / "'" /
+ *                     "*" / "+" / "-" / "." / "^" / "_" /
+ *                     "`" / "|" / "~" / DIGIT / ALPHA
+ *
+ * Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191
+ * Allow same range as cookie value, except `=`, which delimits end of name.
+ */
+const cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
+/**
+ * RegExp to match cookie-value in RFC 6265 sec 4.1.1
+ *
+ * cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+ * cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+ *                     ; US-ASCII characters excluding CTLs,
+ *                     ; whitespace DQUOTE, comma, semicolon,
+ *                     ; and backslash
+ *
+ * Allowing more characters: https://github.com/jshttp/cookie/issues/191
+ * Comma, backslash, and DQUOTE are not part of the parsing algorithm.
+ */
+const cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
+/**
+ * RegExp to match domain-value in RFC 6265 sec 4.1.1
+ *
+ * domain-value      = <subdomain>
+ *                     ; defined in [RFC1034], Section 3.5, as
+ *                     ; enhanced by [RFC1123], Section 2.1
+ * <subdomain>       = <label> | <subdomain> "." <label>
+ * <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]
+ *                     Labels must be 63 characters or less.
+ *                     'let-dig' not 'letter' in the first char, per RFC1123
+ * <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+ * <let-dig-hyp>     = <let-dig> | "-"
+ * <let-dig>         = <letter> | <digit>
+ * <letter>          = any one of the 52 alphabetic characters A through Z in
+ *                     upper case and a through z in lower case
+ * <digit>           = any one of the ten digits 0 through 9
+ *
+ * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
+ *
+ * > (Note that a leading %x2E ("."), if present, is ignored even though that
+ * character is not permitted, but a trailing %x2E ("."), if present, will
+ * cause the user agent to ignore the attribute.)
+ */
+const domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+/**
+ * RegExp to match path-value in RFC 6265 sec 4.1.1
+ *
+ * path-value        = <any CHAR except CTLs or ";">
+ * CHAR              = %x01-7F
+ *                     ; defined in RFC 5234 appendix B.1
+ */
+const pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+/**
+ * RegExp to match max-age-value in RFC 6265 sec 5.6.2
+ */
+const maxAgeRegExp = /^-?\d+$/;
+const __toString = Object.prototype.toString;
+const NullObject = /* @__PURE__ */ (() => {
+    const C = function () { };
+    C.prototype = Object.create(null);
+    return C;
+})();
+/**
+ * Parse a `Cookie` header.
+ *
+ * Parse the given cookie header string into an object
+ * The object has the various cookies as keys(names) => values
+ */
+function parseCookie(str, options) {
+    const obj = new NullObject();
+    const len = str.length;
+    // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.
+    if (len < 2)
+        return obj;
+    const dec = options?.decode || decode;
+    let index = 0;
+    do {
+        const eqIdx = eqIndex(str, index, len);
+        if (eqIdx === -1)
+            break; // No more cookie pairs.
+        const endIdx = endIndex(str, index, len);
+        if (eqIdx > endIdx) {
+            // backtrack on prior semicolon
+            index = str.lastIndexOf(";", eqIdx - 1) + 1;
+            continue;
+        }
+        const key = valueSlice(str, index, eqIdx);
+        // only assign once
+        if (obj[key] === undefined) {
+            obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));
+        }
+        index = endIdx + 1;
+    } while (index < len);
+    return obj;
+}
+/**
+ * Stringifies an object into an HTTP `Cookie` header.
+ */
+function stringifyCookie(cookie, options) {
+    const enc = options?.encode || encodeURIComponent;
+    const cookieStrings = [];
+    for (const name of Object.keys(cookie)) {
+        const val = cookie[name];
+        if (val === undefined)
+            continue;
+        if (!cookieNameRegExp.test(name)) {
+            throw new TypeError(`cookie name is invalid: ${name}`);
+        }
+        const value = enc(val);
+        if (!cookieValueRegExp.test(value)) {
+            throw new TypeError(`cookie val is invalid: ${val}`);
+        }
+        cookieStrings.push(`${name}=${value}`);
+    }
+    return cookieStrings.join("; ");
+}
+function stringifySetCookie(_name, _val, _opts) {
+    const cookie = typeof _name === "object"
+        ? _name
+        : { ..._opts, name: _name, value: String(_val) };
+    const options = typeof _val === "object" ? _val : _opts;
+    const enc = options?.encode || encodeURIComponent;
+    if (!cookieNameRegExp.test(cookie.name)) {
+        throw new TypeError(`argument name is invalid: ${cookie.name}`);
+    }
+    const value = cookie.value ? enc(cookie.value) : "";
+    if (!cookieValueRegExp.test(value)) {
+        throw new TypeError(`argument val is invalid: ${cookie.value}`);
+    }
+    let str = cookie.name + "=" + value;
+    if (cookie.maxAge !== undefined) {
+        if (!Number.isInteger(cookie.maxAge)) {
+            throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
+        }
+        str += "; Max-Age=" + cookie.maxAge;
+    }
+    if (cookie.domain) {
+        if (!domainValueRegExp.test(cookie.domain)) {
+            throw new TypeError(`option domain is invalid: ${cookie.domain}`);
+        }
+        str += "; Domain=" + cookie.domain;
+    }
+    if (cookie.path) {
+        if (!pathValueRegExp.test(cookie.path)) {
+            throw new TypeError(`option path is invalid: ${cookie.path}`);
+        }
+        str += "; Path=" + cookie.path;
+    }
+    if (cookie.expires) {
+        if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) {
+            throw new TypeError(`option expires is invalid: ${cookie.expires}`);
+        }
+        str += "; Expires=" + cookie.expires.toUTCString();
+    }
+    if (cookie.httpOnly) {
+        str += "; HttpOnly";
+    }
+    if (cookie.secure) {
+        str += "; Secure";
+    }
+    if (cookie.partitioned) {
+        str += "; Partitioned";
+    }
+    if (cookie.priority) {
+        const priority = typeof cookie.priority === "string"
+            ? cookie.priority.toLowerCase()
+            : undefined;
+        switch (priority) {
+            case "low":
+                str += "; Priority=Low";
+                break;
+            case "medium":
+                str += "; Priority=Medium";
+                break;
+            case "high":
+                str += "; Priority=High";
+                break;
+            default:
+                throw new TypeError(`option priority is invalid: ${cookie.priority}`);
+        }
+    }
+    if (cookie.sameSite) {
+        const sameSite = typeof cookie.sameSite === "string"
+            ? cookie.sameSite.toLowerCase()
+            : cookie.sameSite;
+        switch (sameSite) {
+            case true:
+            case "strict":
+                str += "; SameSite=Strict";
+                break;
+            case "lax":
+                str += "; SameSite=Lax";
+                break;
+            case "none":
+                str += "; SameSite=None";
+                break;
+            default:
+                throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
+        }
+    }
+    return str;
+}
+/**
+ * Deserialize a `Set-Cookie` header into an object.
+ *
+ * deserialize('foo=bar; httpOnly')
+ *   => { name: 'foo', value: 'bar', httpOnly: true }
+ */
+function parseSetCookie(str, options) {
+    const dec = options?.decode || decode;
+    const len = str.length;
+    const endIdx = endIndex(str, 0, len);
+    const eqIdx = eqIndex(str, 0, endIdx);
+    const setCookie = eqIdx === -1
+        ? { name: "", value: dec(valueSlice(str, 0, endIdx)) }
+        : {
+            name: valueSlice(str, 0, eqIdx),
+            value: dec(valueSlice(str, eqIdx + 1, endIdx)),
+        };
+    let index = endIdx + 1;
+    while (index < len) {
+        const endIdx = endIndex(str, index, len);
+        const eqIdx = eqIndex(str, index, endIdx);
+        const attr = eqIdx === -1
+            ? valueSlice(str, index, endIdx)
+            : valueSlice(str, index, eqIdx);
+        const val = eqIdx === -1 ? undefined : valueSlice(str, eqIdx + 1, endIdx);
+        switch (attr.toLowerCase()) {
+            case "httponly":
+                setCookie.httpOnly = true;
+                break;
+            case "secure":
+                setCookie.secure = true;
+                break;
+            case "partitioned":
+                setCookie.partitioned = true;
+                break;
+            case "domain":
+                setCookie.domain = val;
+                break;
+            case "path":
+                setCookie.path = val;
+                break;
+            case "max-age":
+                if (val && maxAgeRegExp.test(val))
+                    setCookie.maxAge = Number(val);
+                break;
+            case "expires":
+                if (!val)
+                    break;
+                const date = new Date(val);
+                if (Number.isFinite(date.valueOf()))
+                    setCookie.expires = date;
+                break;
+            case "priority":
+                if (!val)
+                    break;
+                const priority = val.toLowerCase();
+                if (priority === "low" ||
+                    priority === "medium" ||
+                    priority === "high") {
+                    setCookie.priority = priority;
+                }
+                break;
+            case "samesite":
+                if (!val)
+                    break;
+                const sameSite = val.toLowerCase();
+                if (sameSite === "lax" ||
+                    sameSite === "strict" ||
+                    sameSite === "none") {
+                    setCookie.sameSite = sameSite;
+                }
+                break;
+        }
+        index = endIdx + 1;
+    }
+    return setCookie;
+}
+/**
+ * Find the `;` character between `min` and `len` in str.
+ */
+function endIndex(str, min, len) {
+    const index = str.indexOf(";", min);
+    return index === -1 ? len : index;
+}
+/**
+ * Find the `=` character between `min` and `max` in str.
+ */
+function eqIndex(str, min, max) {
+    const index = str.indexOf("=", min);
+    return index < max ? index : -1;
+}
+/**
+ * Slice out a value between startPod to max.
+ */
+function valueSlice(str, min, max) {
+    let start = min;
+    let end = max;
+    do {
+        const code = str.charCodeAt(start);
+        if (code !== 0x20 /*   */ && code !== 0x09 /* \t */)
+            break;
+    } while (++start < end);
+    while (end > start) {
+        const code = str.charCodeAt(end - 1);
+        if (code !== 0x20 /*   */ && code !== 0x09 /* \t */)
+            break;
+        end--;
+    }
+    return str.slice(start, end);
+}
+/**
+ * URL-decode string value. Optimized to skip native call when no %.
+ */
+function decode(str) {
+    if (str.indexOf("%") === -1)
+        return str;
+    try {
+        return decodeURIComponent(str);
+    }
+    catch (e) {
+        return str;
+    }
+}
+/**
+ * Determine if value is a Date.
+ */
+function isDate(val) {
+    return __toString.call(val) === "[object Date]";
+}
+//# sourceMappingURL=index.js.map

package/dist/node_modules/light-my-request/node_modules/cookie/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "cookie",
+  "version": "1.1.1",
+  "description": "HTTP server cookie parsing and serialization",
+  "keywords": [
+    "cookie",
+    "cookies"
+  ],
+  "repository": "jshttp/cookie",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
+  "license": "MIT",
+  "author": "Roman Shtylman <shtylman@gmail.com>",
+  "contributors": [
+    "Douglas Christopher Wilson <doug@somethingdoug.com>"
+  ],
+  "sideEffects": false,
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/"
+  ],
+  "scripts": {
+    "bench": "vitest bench",
+    "build": "ts-scripts build",
+    "format": "ts-scripts format",
+    "prepare": "ts-scripts install",
+    "prepublishOnly": "npm run build",
+    "specs": "ts-scripts specs",
+    "test": "ts-scripts test"
+  },
+  "devDependencies": {
+    "@borderless/ts-scripts": "^0.15.0",
+    "@vitest/coverage-v8": "^3.2.4",
+    "top-sites": "1.1.194",
+    "typescript": "^5.6.2",
+    "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "ts-scripts": {
+    "project": "tsconfig.build.json"
+  }
+}

package/dist/node_modules/light-my-request/package.json

@@ -1 +1 @@
-{"name":"light-my-request","version":"6.6.0","description":"Fake HTTP injection library","main":"index.js","type":"commonjs","types":"types/index.d.ts","dependencies":{"cookie":"^1.0.1","process-warning":"^4.0.0","set-cookie-parser":"^2.6.0"},"devDependencies":{"@fastify/ajv-compiler":"^4.0.0","@fastify/pre-commit":"^2.1.0","@types/node":"^22.7.7","c8":"^10.1.2","end-of-stream":"^1.4.4","eslint":"^9.17.0","express":"^4.19.2","form-auto-content":"^3.2.1","form-data":"^4.0.0","formdata-node":"^6.0.3","multer":"^1.4.5-lts.1","neostandard":"^0.12.0","tinybench":"^3.0.0","tsd":"^0.31.0","undici":"^7.0.0"},"scripts":{"benchmark":"node benchmark/benchmark.js","coverage":"npm run unit -- --cov --coverage-report=html","lint":"eslint","lint:fix":"eslint --fix","test":"npm run lint && npm run test:unit && npm run test:typescript","test:typescript":"tsd","test:unit":"c8 --100 node --test"},"repository":{"type":"git","url":"git+https://github.com/fastify/light-my-request.git"},"keywords":["http","inject","fake","request","server"],"author":"Tomas Della Vedova - @delvedor (http://delved.org)","contributors":[{"name":"Matteo Collina","email":"hello@matteocollina.com"},{"name":"Manuel Spigolon","email":"behemoth89@gmail.com"},{"name":"Aras Abbasi","email":"aras.abbasi@gmail.com"},{"name":"Frazer Smith","email":"frazer.dev@icloud.com","url":"https://github.com/fdawgs"}],"license":"BSD-3-Clause","bugs":{"url":"https://github.com/fastify/light-my-request/issues"},"homepage":"https://github.com/fastify/light-my-request#readme","funding":[{"type":"github","url":"https://github.com/sponsors/fastify"},{"type":"opencollective","url":"https://opencollective.com/fastify"}],"_lastModified":"2026-09-20T07:41:36.116Z"}
+{"name":"light-my-request","version":"6.6.0","description":"Fake HTTP injection library","main":"index.js","type":"commonjs","types":"types/index.d.ts","dependencies":{"cookie":"^1.0.1","process-warning":"^4.0.0","set-cookie-parser":"^2.6.0"},"devDependencies":{"@fastify/ajv-compiler":"^4.0.0","@fastify/pre-commit":"^2.1.0","@types/node":"^22.7.7","c8":"^10.1.2","end-of-stream":"^1.4.4","eslint":"^9.17.0","express":"^4.19.2","form-auto-content":"^3.2.1","form-data":"^4.0.0","formdata-node":"^6.0.3","multer":"^1.4.5-lts.1","neostandard":"^0.12.0","tinybench":"^3.0.0","tsd":"^0.31.0","undici":"^7.0.0"},"scripts":{"benchmark":"node benchmark/benchmark.js","coverage":"npm run unit -- --cov --coverage-report=html","lint":"eslint","lint:fix":"eslint --fix","test":"npm run lint && npm run test:unit && npm run test:typescript","test:typescript":"tsd","test:unit":"c8 --100 node --test"},"repository":{"type":"git","url":"git+https://github.com/fastify/light-my-request.git"},"keywords":["http","inject","fake","request","server"],"author":"Tomas Della Vedova - @delvedor (http://delved.org)","contributors":[{"name":"Matteo Collina","email":"hello@matteocollina.com"},{"name":"Manuel Spigolon","email":"behemoth89@gmail.com"},{"name":"Aras Abbasi","email":"aras.abbasi@gmail.com"},{"name":"Frazer Smith","email":"frazer.dev@icloud.com","url":"https://github.com/fdawgs"}],"license":"BSD-3-Clause","bugs":{"url":"https://github.com/fastify/light-my-request/issues"},"homepage":"https://github.com/fastify/light-my-request#readme","funding":[{"type":"github","url":"https://github.com/sponsors/fastify"},{"type":"opencollective","url":"https://opencollective.com/fastify"}],"_lastModified":"2026-09-30T16:04:02.506Z"}

package/dist/node_modules/openapi-mcp-generator/README.md

@@ -48,17 +48,29 @@ openapi-mcp-generator --input path/to/openapi.json --output path/to/output/dir -
 
 ### CLI Options
 
-| Option              | Alias | Description                                                                                                                                    | Default                           |
-| ------------------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
-| `--input`           | `-i`  | Path or URL to OpenAPI specification (YAML or JSON)                                                                                            | **Required**                      |
-| `--output`          | `-o`  | Directory to output the generated MCP project                                                                                                  | **Required**                      |
-| `--server-name`     | `-n`  | Name of the MCP server (`package.json:name`)                                                                                                   | OpenAPI title or `mcp-api-server` |
-| `--server-version`  | `-v`  | Version of the MCP server (`package.json:version`)                                                                                             | OpenAPI version or `1.0.0`        |
-| `--base-url`        | `-b`  | Base URL for API requests. Required if OpenAPI `servers` missing or ambiguous.                                                                 | Auto-detected if possible         |
-| `--transport`       | `-t`  | Transport mode: `"stdio"` (default), `"web"`, or `"streamable-http"`                                                                           | `"stdio"`                         |
-| `--port`            | `-p`  | Port for web-based transports                                                                                                                  | `3000`                            |
-| `--default-include` |       | Default behavior for x-mcp filtering. Accepts `true` or `false` (case-insensitive). `true` = include by default, `false` = exclude by default. | `true`                            |
-| `--force`           |       | Overwrite existing files in the output directory without confirmation                                                                          | `false`                           |
+| Option                   | Alias | Description                                                                                                                                    | Default                           |
+| ------------------------ | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
+| `--input`                | `-i`  | Path or URL to OpenAPI specification (YAML or JSON)                                                                                            | **Required**                      |
+| `--output`               | `-o`  | Directory to output the generated MCP project                                                                                                  | **Required**                      |
+| `--server-name`          | `-n`  | Name of the MCP server (`package.json:name`)                                                                                                   | OpenAPI title or `mcp-api-server` |
+| `--server-version`       | `-v`  | Version of the MCP server (`package.json:version`)                                                                                             | OpenAPI version or `1.0.0`        |
+| `--base-url`             | `-b`  | Base URL for API requests. Required if OpenAPI `servers` missing or ambiguous.                                                                 | Auto-detected if possible         |
+| `--transport`            | `-t`  | Transport mode: `"stdio"` (default), `"web"`, or `"streamable-http"`                                                                           | `"stdio"`                         |
+| `--port`                 | `-p`  | Port for web-based transports                                                                                                                  | `3000`                            |
+| `--default-include`      |       | Default behavior for x-mcp filtering. Accepts `true` or `false` (case-insensitive). `true` = include by default, `false` = exclude by default. | `true`                            |
+| `--allow-external-refs`  |       | Allow resolving external `http(s)` `$ref` references in the spec. Disabled by default to prevent SSRF during parsing.                          | `false`                           |
+| `--max-tool-name-length` |       | Maximum length for generated tool names (Claude Desktop caps at 64). Longer names are truncated with a hash suffix.                            | `64`                              |
+| `--header-passthrough`   |       | Comma-separated inbound header names to forward to the upstream API (web/streamable-http). Enables per-user API keys via MCP client headers.   | _(none)_                          |
+| `--insecure`             | `-k`  | Allow insecure HTTPS connections (skip TLS certificate verification) in the generated server.                                                  | `false`                           |
+| `--generate-lib`         |       | Generate library-style output: export `main()` instead of auto-invoking it, omitting signal/cleanup wiring.                                    | `false`                           |
+| `--custom-auth`          |       | Generate an editable `src/auth.ts` hook (`applyCustomAuth`) called before built-in auth; return `true` to skip built-in auth.                  | `false`                           |
+| `--oauth-creds-in-body`  |       | Send OAuth2 client credentials in the token request body instead of the Basic `Authorization` header.                                          | `false`                           |
+| `--force`                |       | Overwrite existing files in the output directory without confirmation                                                                          | `false`                           |
+
+> **Configuring the API base URL at runtime:** the generated server reads
+> `API_BASE_URL` from the environment (`.env`), overriding the value baked in
+> from the OpenAPI `servers` list. The port resolves from `--port`, then the
+> `PORT` env var, then `3000`.
 
 ## 📦 Programmatic API
 

package/dist/node_modules/openapi-mcp-generator/dist/api.d.ts

@@ -18,6 +18,16 @@ export interface GetToolsOptions {
     filterFn?: (tool: McpToolDefinition) => boolean;
     /** Default behavior for x-mcp filtering (default: true = include by default) */
     defaultInclude?: boolean;
+    /**
+     * Allow resolving external http(s) `$ref` references in the spec.
+     * Default false: external refs are rejected to prevent SSRF during parsing.
+     */
+    allowExternalRefs?: boolean;
+    /**
+     * Maximum length for generated tool names (Claude Desktop limit is 64).
+     * Default 64.
+     */
+    maxToolNameLength?: number;
 }
 /**
  * Get a list of tools from an OpenAPI specification

package/dist/node_modules/openapi-mcp-generator/dist/api.js

@@ -5,6 +5,7 @@
 import SwaggerParser from '@apidevtools/swagger-parser';
 import { extractToolsFromApi } from './parser/extract-tools.js';
 import { determineBaseUrl } from './utils/url.js';
+import { assertNoExternalRefs, parseSpecSecurely } from './utils/parser-security.js';
 function isOpenApiDocument(spec) {
     return typeof spec === 'object' && spec !== null && 'openapi' in spec;
 }
@@ -17,14 +18,28 @@ function isOpenApiDocument(spec) {
  */
 export async function getToolsFromOpenApi(specPathOrUrl, options = {}) {
     try {
-        // Parse the OpenAPI spec
-        const api = isOpenApiDocument(specPathOrUrl)
-            ? specPathOrUrl
-            : options.dereference
-                ? (await SwaggerParser.dereference(specPathOrUrl))
-                : (await SwaggerParser.parse(specPathOrUrl));
+        const allowExternalRefs = options.allowExternalRefs ?? false;
+        let api;
+        if (options.dereference) {
+            // Dereference path: parseSpecSecurely loads the (trusted) entry document —
+            // including http(s) URLs — then enforces the SSRF guard before resolving.
+            api = await parseSpecSecurely(specPathOrUrl, allowExternalRefs);
+        }
+        else if (isOpenApiDocument(specPathOrUrl)) {
+            // Pre-parsed document, no dereference requested: use as-is.
+            api = specPathOrUrl;
+            if (!allowExternalRefs)
+                assertNoExternalRefs(api);
+        }
+        else {
+            // Parse-only (no dereference): fetch/read the entry document (http allowed
+            // so a URL input loads), then enforce the SSRF guard on the raw tree.
+            api = (await SwaggerParser.parse(specPathOrUrl));
+            if (!allowExternalRefs)
+                assertNoExternalRefs(api);
+        }
         // Extract tools from the API
-        const allTools = extractToolsFromApi(api, options.defaultInclude ?? true);
+        const allTools = extractToolsFromApi(api, options.defaultInclude ?? true, options.maxToolNameLength ?? 64);
         // Add base URL to each tool
         const baseUrl = determineBaseUrl(api, options.baseUrl);
         // Apply filters to exclude specified operationIds and custom filter function

package/dist/node_modules/openapi-mcp-generator/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,aAAa,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAsBlD,SAAS,iBAAiB,CAAC,IAAiC;IAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAA0C,EAC1C,UAA2B,EAAE;IAE7B,IAAI,CAAC;QACH,yBAAyB;QACzB,MAAM,GAAG,GAAG,iBAAiB,CAAC,aAAa,CAAC;YAC1C,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,OAAO,CAAC,WAAW;gBACnB,CAAC,CAAE,CAAC,MAAM,aAAa,CAAC,WAAW,CAAC,aAAa,CAAC,CAAwB;gBAC1E,CAAC,CAAE,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAwB,CAAC;QAEzE,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;QAE1E,4BAA4B;QAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,6EAA6E;QAC7E,IAAI,aAAa,GAAG,QAAQ,CAAC;QAE7B,+CAA+C;QAC/C,IAAI,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACxD,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,2CAA2C;QAC3C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QAED,gDAAgD;QAChD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,OAAO,IAAI,EAAE;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qCAAqC;QACrC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,kCAAkC;YAClC,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,aAAa,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAkCrF,SAAS,iBAAiB,CAAC,IAAiC;IAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAA0C,EAC1C,UAA2B,EAAE;IAE7B,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAE7D,IAAI,GAAuB,CAAC;QAC5B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,2EAA2E;YAC3E,0EAA0E;YAC1E,GAAG,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,4DAA4D;YAC5D,GAAG,GAAG,aAAa,CAAC;YACpB,IAAI,CAAC,iBAAiB;gBAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,sEAAsE;YACtE,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAC9B,aAA0D,CAC3D,CAAuB,CAAC;YACzB,IAAI,CAAC,iBAAiB;gBAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,mBAAmB,CAClC,GAAG,EACH,OAAO,CAAC,cAAc,IAAI,IAAI,EAC9B,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAChC,CAAC;QAEF,4BAA4B;QAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,6EAA6E;QAC7E,IAAI,aAAa,GAAG,QAAQ,CAAC;QAE7B,+CAA+C;QAC/C,IAAI,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACxD,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,2CAA2C;QAC3C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QAED,gDAAgD;QAChD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,OAAO,IAAI,EAAE;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qCAAqC;QACrC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,kCAAkC;YAClC,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/node_modules/openapi-mcp-generator/dist/generator/env-file.js

@@ -10,10 +10,12 @@ export function generateEnvExample(securitySchemes) {
 # Copy this file to .env and fill in the values
 
 # Server configuration
+# Port for web / streamable-http transports (also overridable via --port).
 PORT=3000
 LOG_LEVEL=info
-# If you have a server outside the servers list from OpenAPI, define it here.
-# Otherwise, omit this.
+# Override the target API base URL at runtime. Takes precedence over the value
+# baked in from the OpenAPI servers list, so you can switch environments
+# (staging/prod) without regenerating. Omit to use the spec-derived default.
 API_BASE_URL=your_api_base_url_here
 
 `;

package/dist/node_modules/openapi-mcp-generator/dist/generator/env-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/generator/env-file.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAA+D;IAE/D,IAAI,OAAO,GAAG;;;;;;;;;;CAUf,CAAC;IAEA,0DAA0D;IAC1D,IAAI,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,wBAAwB,CAAC;QAEpC,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAClE,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,KAAK,IAAI,0DAA0D,CAAC;gBAC/E,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,WAAW,CAAC;YAE3B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC/C,OAAO,IAAI,GAAG,OAAO,sBAAsB,CAAC;YAC9C,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClC,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBACpD,OAAO,IAAI,GAAG,OAAO,2BAA2B,CAAC;gBACnD,CAAC;qBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;oBACpD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;oBAC1D,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;oBAC1D,OAAO,IAAI,GAAG,WAAW,uBAAuB,CAAC;oBACjD,OAAO,IAAI,GAAG,WAAW,uBAAuB,CAAC;gBACnD,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,OAAO,IAAI,4BAA4B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC;gBACjH,MAAM,OAAO,GAAG,eAAe,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClF,OAAO,IAAI,GAAG,OAAO,0BAA0B,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,oCAAoC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,+DAA+D,CAAC;IAE3E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuBR,CAAC;AACF,CAAC"}
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/generator/env-file.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAA+D;IAE/D,IAAI,OAAO,GAAG;;;;;;;;;;;;CAYf,CAAC;IAEA,0DAA0D;IAC1D,IAAI,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,wBAAwB,CAAC;QAEpC,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAClE,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;gBAC1B,OAAO,IAAI,KAAK,IAAI,0DAA0D,CAAC;gBAC/E,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,WAAW,CAAC;YAE3B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC/C,OAAO,IAAI,GAAG,OAAO,sBAAsB,CAAC;YAC9C,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClC,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBACpD,OAAO,IAAI,GAAG,OAAO,2BAA2B,CAAC;gBACnD,CAAC;qBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;oBACpD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;oBAC1D,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;oBAC1D,OAAO,IAAI,GAAG,WAAW,uBAAuB,CAAC;oBACjD,OAAO,IAAI,GAAG,WAAW,uBAAuB,CAAC;gBACnD,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,OAAO,IAAI,4BAA4B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC;gBACjH,MAAM,OAAO,GAAG,eAAe,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClF,OAAO,IAAI,GAAG,OAAO,0BAA0B,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,oCAAoC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,+DAA+D,CAAC;IAE3E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuBR,CAAC;AACF,CAAC"}

package/dist/node_modules/openapi-mcp-generator/dist/generator/server-code.d.ts

@@ -10,3 +10,14 @@ import { CliOptions } from '../types/index.js';
  * @returns Generated TypeScript code
  */
 export declare function generateMcpServerCode(api: OpenAPIV3.Document, options: CliOptions, serverName: string, serverVersion: string): string;
+/**
+ * Generates the editable `src/auth.ts` custom auth hook stub (issue #9).
+ *
+ * The generated server calls `applyCustomAuth` before applying built-in
+ * (env-based) auth. Returning `true` signals that auth was fully handled and
+ * built-in auth should be skipped — useful for custom JWT/header schemes or
+ * excluding specific operations from automatic auth injection.
+ *
+ * @returns Generated TypeScript source for src/auth.ts
+ */
+export declare function generateCustomAuthStub(): string;