@nooticr/mcp 1.26.48 → 1.26.49

package/dist/index.js

@@ -15,7 +15,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { getBaseUrl, getPublicUrl, getPort, getCredentialsFile, getTransportMode, DEFAULT_PORT, } from "./config.js";
 import { AuthManager, NooticrAuthError, createApiKeyTokenProvider, createHttpTokenProvider, createManagementTokenProvider, createStdioTokenProvider, } from "./auth.js";
-import { looksLikeApiKey } from "./shared/api-key.js";
+import { forwardedHeaders, forwardedSession, looksLikeApiKey } from "./shared/api-key.js";
 import { NooticrClient, NooticrError } from "./nooticr.js";
 import { OAuthManager, SCOPES } from "./oauth.js";
 import { createMcpServer } from "./shared/tools.js";
@@ -95,6 +95,9 @@ function validMcpToken(token, oauth) {
         return true;
     if (looksLikeApiKey(token))
         return true;
+    // Same reasoning as a key: the backend verifies the session on every call.
+    if (forwardedSession(token))
+        return true;
     const envToken = process.env.NOOTICR_ACCESS_TOKEN;
     return typeof envToken === "string" && envToken.length > 0 && token === envToken;
 }
@@ -242,6 +245,11 @@ export async function runHttp(port, publicUrl) {
             if (looksLikeApiKey(bearer)) {
                 return new NooticrClient(baseUrl, createApiKeyTokenProvider(bearer));
             }
+            // nooticr-server's chat, calling as the user signed in to it.
+            const forwarded = forwardedSession(bearer);
+            if (forwarded) {
+                return new NooticrClient(baseUrl, createApiKeyTokenProvider(forwarded.token), undefined, forwardedHeaders(forwarded));
+            }
             const session = bearer
                 ? oauth.verifyToken(bearer)
                 : undefined;

package/dist/shared/api-key.js

@@ -18,3 +18,41 @@ export const API_KEY_PREFIX = "nk_";
 export function looksLikeApiKey(token) {
     return typeof token === "string" && token.startsWith(API_KEY_PREFIX);
 }
+/**
+ * A nooticr session forwarded by nooticr-server's own agent — the dashboard's
+ * chat, calling these tools on behalf of the user who is signed in there.
+ *
+ * The chat used to call a second, Rust copy of 28 of these tools, so it had
+ * none of the others and none of their guidance. It now calls this server,
+ * and needs a way to say "as this user" that is not an OAuth grant (there is
+ * no browser in the loop) and not an API key (the user never minted one).
+ *
+ * Shape: `nooticr-session.<conversation id or ->.<nooticr access token>`. The
+ * token is the user's own, forwarded to the backend exactly as a key is, and
+ * the backend checks it on every call. The conversation rides along so the
+ * backend's run ledger files each call under the chat thread that made it,
+ * rather than as an anonymous connector call. The prefix keeps it from ever
+ * being read as an OAuth token this process issued, which a bare JWT would be.
+ */
+export const SESSION_TOKEN_PREFIX = "nooticr-session.";
+/** The session inside a forwarded bearer, or undefined for anything else. */
+export function forwardedSession(bearer) {
+    if (typeof bearer !== "string" || !bearer.startsWith(SESSION_TOKEN_PREFIX))
+        return undefined;
+    const rest = bearer.slice(SESSION_TOKEN_PREFIX.length);
+    const dot = rest.indexOf(".");
+    if (dot < 0)
+        return undefined;
+    const conversation = rest.slice(0, dot);
+    const token = rest.slice(dot + 1).trim();
+    if (!token)
+        return undefined;
+    return /^[0-9a-f-]{36}$/i.test(conversation) ? { token, conversationId: conversation } : { token };
+}
+/** Headers that attribute a forwarded call to the chat thread that made it. */
+export function forwardedHeaders(session) {
+    return {
+        "x-nooticr-surface": "chat",
+        ...(session.conversationId ? { "x-nooticr-conversation": session.conversationId } : {}),
+    };
+}

package/dist/shared/nooticr.js

@@ -45,14 +45,17 @@ export class NooticrClient {
     tokenProvider;
     /** Stable per-call key so a retried tool call is billed once. */
     idempotencyKey;
-    constructor(baseUrl, tokenProvider, idempotencyKey) {
+    /** Sent on every request — how a forwarded chat call is attributed. */
+    extraHeaders;
+    constructor(baseUrl, tokenProvider, idempotencyKey, extraHeaders = {}) {
         this.baseUrl = baseUrl.replace(/\/+$/, "");
         this.tokenProvider = tokenProvider;
         this.idempotencyKey = idempotencyKey;
+        this.extraHeaders = extraHeaders;
     }
     async request(method, path, opts = {}) {
         const doRequest = async (accessToken) => {
-            const headers = {};
+            const headers = { ...this.extraHeaders };
             if (opts.body !== undefined) {
                 headers["content-type"] = "application/json";
             }

package/dist/shared/tools.js

@@ -30,7 +30,7 @@ import { registerCollabTools } from "./collab.js";
 import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.48";
+export const MCP_SERVER_VERSION = "1.26.49";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.48",
+  "version": "1.26.49",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {