@open-mercato/ai-assistant 0.6.5-develop.5382.1.f542de69af → 0.6.5

package/src/modules/ai_assistant/lib/__tests__/mcp-dev-key-resolution.test.ts

@@ -0,0 +1,92 @@
+import { resolve } from 'node:path'
+import { findProjectRoot, checkMcpConfigPermissions } from '../mcp-dev-key-resolution'
+
+describe('mcp:dev API key resolution (#2671)', () => {
+  describe('findProjectRoot', () => {
+    const projectRoot = resolve('/home/dev/project')
+    const launchDir = resolve('/home/dev/project/packages/ai-assistant')
+
+    it('returns the nearest ancestor containing a root marker', () => {
+      const exists = (path: string) => path === resolve(projectRoot, '.git')
+      expect(findProjectRoot(launchDir, exists)).toBe(projectRoot)
+    })
+
+    it('stops at the nearest marker and never picks a marker higher up the tree', () => {
+      // A marker exists both at the real project root and at a higher ancestor.
+      // Walking up from the launch dir must stop at the closest one, so an
+      // attacker planting a marker (and a sibling .mcp.json) higher up cannot
+      // shadow the real project root.
+      const higherAncestor = resolve('/home/dev')
+      const exists = (path: string) =>
+        path === resolve(projectRoot, '.git') || path === resolve(higherAncestor, '.git')
+      expect(findProjectRoot(launchDir, exists)).toBe(projectRoot)
+      expect(findProjectRoot(launchDir, exists)).not.toBe(higherAncestor)
+    })
+
+    it('falls back to the start directory (never the filesystem root) when no marker is found', () => {
+      const exists = () => false
+      expect(findProjectRoot(launchDir, exists)).toBe(launchDir)
+      expect(findProjectRoot(launchDir, exists)).not.toBe(resolve('/'))
+    })
+
+    it('recognises any of the supported root markers', () => {
+      const exists = (path: string) => path === resolve(projectRoot, 'yarn.lock')
+      expect(findProjectRoot(launchDir, exists)).toBe(projectRoot)
+    })
+  })
+
+  describe('checkMcpConfigPermissions', () => {
+    const configPath = '/home/dev/project/.mcp.json'
+
+    it('refuses to read a config owned by another user', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 4242, mode: 0o600 },
+        1000,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(false)
+      expect(result.reason).toContain('owned by uid 4242')
+      expect(warnings).toHaveLength(0)
+    })
+
+    it('warns loudly but allows when the config is group/world accessible', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 1000, mode: 0o644 },
+        1000,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(true)
+      expect(warnings).toHaveLength(1)
+      expect(warnings[0]).toContain('accessible to group/other')
+      expect(warnings[0]).toContain('chmod 600')
+    })
+
+    it('accepts an owner-only config without warning', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 1000, mode: 0o600 },
+        1000,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(true)
+      expect(warnings).toHaveLength(0)
+    })
+
+    it('skips ownership/permission checks when uid is unavailable (non-POSIX)', () => {
+      const warnings: string[] = []
+      const result = checkMcpConfigPermissions(
+        configPath,
+        { uid: 4242, mode: 0o644 },
+        null,
+        (message) => warnings.push(message),
+      )
+      expect(result.ok).toBe(true)
+      expect(warnings).toHaveLength(0)
+    })
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/mcp-server-auth-fail-closed.test.ts

@@ -0,0 +1,133 @@
+import { createMcpServer } from '../mcp-server'
+import type { McpServerOptions } from '../types'
+
+jest.mock('@modelcontextprotocol/sdk/server/index.js', () => ({
+  Server: class {
+    setRequestHandler() {}
+  },
+}))
+jest.mock('@modelcontextprotocol/sdk/server/stdio.js', () => ({
+  StdioServerTransport: class {},
+}))
+jest.mock('@modelcontextprotocol/sdk/types.js', () => ({
+  ListToolsRequestSchema: {},
+  CallToolRequestSchema: {},
+}))
+jest.mock('../tool-registry', () => ({
+  getToolRegistry: () => ({
+    getTools: () => new Map(),
+    listToolNames: () => [],
+  }),
+}))
+jest.mock('../tool-executor', () => ({ executeTool: jest.fn() }))
+jest.mock('../tool-loader', () => ({
+  loadAllModuleTools: jest.fn(),
+  indexToolsForSearch: jest.fn(),
+}))
+
+const authenticateMcpRequest = jest.fn()
+jest.mock('../auth', () => ({
+  authenticateMcpRequest: (...args: unknown[]) => authenticateMcpRequest(...args),
+  hasRequiredFeatures: jest.fn(() => true),
+}))
+
+const loadAcl = jest.fn()
+
+function makeContainer() {
+  return {
+    resolve: (name: string) => {
+      if (name === 'rbacService') return { loadAcl }
+      return {}
+    },
+  } as unknown as McpServerOptions['container']
+}
+
+function baseOptions(overrides: Partial<McpServerOptions>): McpServerOptions {
+  return {
+    config: { name: 'test-mcp', version: '0.0.0', debug: false },
+    container: makeContainer(),
+    ...overrides,
+  } as McpServerOptions
+}
+
+describe('issue #2673 — MCP stdio server must fail closed without auth', () => {
+  beforeEach(() => {
+    authenticateMcpRequest.mockReset()
+    loadAcl.mockReset()
+    loadAcl.mockResolvedValue({ isSuperAdmin: false, features: ['ai_assistant.view'] })
+    jest.spyOn(console, 'error').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  it('throws when neither apiKeySecret nor context is supplied', async () => {
+    await expect(createMcpServer(baseOptions({}))).rejects.toThrow(
+      /refused to start: no authentication/i,
+    )
+    expect(loadAcl).not.toHaveBeenCalled()
+  })
+
+  it('throws when context lacks a userId (the mcp:serve --tenant-without-user path)', async () => {
+    await expect(
+      createMcpServer(
+        baseOptions({ context: { tenantId: 't1', organizationId: 'o1', userId: null } }),
+      ),
+    ).rejects.toThrow(/refused to start: no authentication/i)
+    expect(loadAcl).not.toHaveBeenCalled()
+  })
+
+  it('treats an empty-string apiKeySecret as missing and fails closed', async () => {
+    await expect(createMcpServer(baseOptions({ apiKeySecret: '' }))).rejects.toThrow(
+      /refused to start: no authentication/i,
+    )
+    expect(authenticateMcpRequest).not.toHaveBeenCalled()
+  })
+
+  it('treats a whitespace-only apiKeySecret as missing and fails closed', async () => {
+    await expect(createMcpServer(baseOptions({ apiKeySecret: '   ' }))).rejects.toThrow(
+      /refused to start: no authentication/i,
+    )
+    expect(authenticateMcpRequest).not.toHaveBeenCalled()
+  })
+
+  it('loads the real user ACL when context carries a non-empty userId', async () => {
+    const server = await createMcpServer(
+      baseOptions({ context: { tenantId: 't1', organizationId: 'o1', userId: 'u1' } }),
+    )
+    expect(server).toBeDefined()
+    expect(loadAcl).toHaveBeenCalledWith('u1', { tenantId: 't1', organizationId: 'o1' })
+  })
+
+  it('allows unauthenticated superadmin only behind the explicit opt-in, without loading an ACL', async () => {
+    const server = await createMcpServer(
+      baseOptions({
+        context: { tenantId: 't1', organizationId: 'o1', userId: null },
+        allowUnauthenticatedSuperadmin: true,
+      }),
+    )
+    expect(server).toBeDefined()
+    expect(loadAcl).not.toHaveBeenCalled()
+  })
+
+  it('allows fully unauthenticated superadmin behind the opt-in with no context', async () => {
+    const server = await createMcpServer(baseOptions({ allowUnauthenticatedSuperadmin: true }))
+    expect(server).toBeDefined()
+  })
+
+  it('still authenticates via a valid apiKeySecret', async () => {
+    authenticateMcpRequest.mockResolvedValue({
+      success: true,
+      tenantId: 't1',
+      organizationId: 'o1',
+      userId: 'u1',
+      features: ['ai_assistant.view'],
+      isSuperAdmin: false,
+      keyName: 'test-key',
+    })
+    const server = await createMcpServer(baseOptions({ apiKeySecret: 'omk_valid.secret' }))
+    expect(server).toBeDefined()
+    expect(authenticateMcpRequest).toHaveBeenCalledWith('omk_valid.secret', expect.anything())
+  })
+})

package/src/modules/ai_assistant/lib/attachment-parts.ts

@@ -128,10 +128,23 @@ async function loadAttachmentRow(
   // core package owns the MikroORM metadata and is the only place tests would
   // need to bootstrap for real DB access.
   const { Attachment } = await import('@open-mercato/core/modules/attachments/data/entities')
+  // Tenant isolation is enforced in the SQL WHERE clause, not just the JS
+  // post-filter below: the decryption scope (5th arg) only drives field
+  // decryption, so omitting tenant/org from `where` would let `em.findOne`
+  // return a row from another tenant. Super-admins bypass the scope. Org-scoped
+  // callers also constrain by org; tenant-wide callers (organizationId === null)
+  // may read any org within their tenant.
+  const where: Record<string, unknown> = { id: attachmentId }
+  if (!authContext.isSuperAdmin) {
+    where.tenantId = authContext.tenantId
+    if (authContext.organizationId != null) {
+      where.organizationId = authContext.organizationId
+    }
+  }
   const record = await findOneWithDecryption(
     em,
     Attachment as never,
-    { id: attachmentId } as never,
+    where as never,
     undefined,
     {
       tenantId: authContext.tenantId,
@@ -157,10 +170,18 @@ async function loadAttachmentRow(
 
 function rowBelongsToCaller(row: AttachmentRow, authContext: AiChatRequestContext): boolean {
   if (authContext.isSuperAdmin) return true
-  // Tenant scope: if the record is tenant-scoped, it MUST match the caller tenant.
-  if (row.tenantId && row.tenantId !== authContext.tenantId) return false
-  // Organization scope: if the record is org-scoped, it MUST match the caller org.
-  if (row.organizationId && row.organizationId !== authContext.organizationId) return false
+  // Tenant scope: fail closed. The record MUST carry the caller's tenant.
+  // A null `tenant_id` (a supported "global"/unscoped attachment state) is NOT
+  // accessible through the AI path: it has no `partition.isPublic` gate, so a
+  // truthiness short-circuit here would leak the bytes / extracted text into a
+  // different tenant's LLM context (cross-tenant IDOR, issue #2663). Requiring
+  // strict equality also rejects a non-super-admin caller with a null tenant.
+  if (authContext.tenantId == null || row.tenantId !== authContext.tenantId) return false
+  // Organization scope: when the caller is org-scoped, the record MUST match
+  // that organization (this also rejects null-org rows for an org-scoped
+  // caller). Tenant-wide callers (organizationId === null) may read any org
+  // within their tenant.
+  if (authContext.organizationId != null && row.organizationId !== authContext.organizationId) return false
   return true
 }
 

package/src/modules/ai_assistant/lib/client-factory.ts

@@ -93,16 +93,10 @@ export async function createMcpClient(options: CreateClientOptions): Promise<Mcp
 
       if (options.stdioArgs) {
         stdioOptions.args = options.stdioArgs
-      } else {
-        // Default args include the API key
-        stdioOptions.args = [
-          'mercato',
-          'ai_assistant',
-          'mcp:serve',
-          '--api-key',
-          apiKeySecret,
-        ]
       }
+      // Otherwise let McpClient.connectStdio apply its default args. The API key
+      // is delivered to the child via the OPEN_MERCATO_API_KEY env var, never on
+      // argv — command-line arguments are world-readable (ps / /proc/<pid>/cmdline).
 
       if (options.cwd) {
         stdioOptions.cwd = options.cwd

package/src/modules/ai_assistant/lib/codemode-tools.ts

@@ -883,6 +883,15 @@ export async function authorizeCodeModeApiRequest(
   path: string
 ): Promise<CodeModeApiAuthorization> {
   const normalizedMethod = method.toUpperCase()
+
+  if (isUnsafeApiRequestPath(path)) {
+    return {
+      allowed: false,
+      statusCode: 403,
+      error: `Code Mode rejected unsafe API path: ${normalizedMethod} ${path}`,
+    }
+  }
+
   const normalizedPath = normalizeApiRequestPath(path)
   const endpoint = await findCodeModeApiEndpoint(normalizedMethod, normalizedPath)
 
@@ -979,6 +988,46 @@ function normalizeApiRequestPath(path: string): string {
   return normalizedPath
 }
 
+const SINGLE_DOT_SEGMENTS = new Set(['.', '%2e'])
+const DOUBLE_DOT_SEGMENTS = new Set(['..', '.%2e', '%2e.', '%2e%2e'])
+
+/**
+ * Rejects request paths that the WHATWG URL parser would rewrite before the
+ * actual fetch (`..`/`.` path segments — including their percent-encoded forms
+ * — backslashes, and percent-encoded separators). Code Mode authorizes the
+ * literal path it was given, but `new URL()` collapses dot segments and
+ * normalizes backslashes for http(s) URLs, so without this guard the wire
+ * request can resolve to a different endpoint than the one that was authorized.
+ */
+export function isUnsafeApiRequestPath(path: string): boolean {
+  const [rawPath] = String(path ?? '').split('?')
+
+  // The WHATWG URL parser strips ASCII tab/newline/carriage-return from the URL
+  // before parsing, so a smuggled `.<TAB>.` segment collapses to `..` on the
+  // wire even though the literal segment never equals a dot segment here. Raw
+  // control characters never appear in legitimate REST paths, so reject them.
+  if (/[\u0000-\u001f]/.test(rawPath)) {
+    return true
+  }
+
+  // http(s) URLs treat backslashes as path separators, so they can smuggle
+  // separators past the segment-based authorizer.
+  if (rawPath.includes('\\')) {
+    return true
+  }
+
+  // Percent-encoded separators never appear in legitimate REST paths and let
+  // the literal-'/' segment split desync from the parsed request URL.
+  if (/%2f/i.test(rawPath) || /%5c/i.test(rawPath)) {
+    return true
+  }
+
+  return rawPath.split('/').some((segment) => {
+    const lowered = segment.toLowerCase()
+    return SINGLE_DOT_SEGMENTS.has(lowered) || DOUBLE_DOT_SEGMENTS.has(lowered)
+  })
+}
+
 function isPathParameterSegment(segment: string): boolean {
   return (
     (segment.startsWith('{') && segment.endsWith('}')) ||

package/src/modules/ai_assistant/lib/generated-registry-loader.ts

@@ -95,6 +95,38 @@ export async function compileAndImportGenerated(tsPath: string): Promise<Record<
   return (await import(pathToFileURL(jsPath).href)) as Record<string, unknown>
 }
 
+const UNSAFE_JS_STRING_CHAR_ESCAPES: Record<number, string> = {
+  0x3c: '\\u003C', // <  — HTML/script-tag breakout
+  0x3e: '\\u003E', // >  — HTML/script-tag breakout
+  0x2028: '\\u2028', // line separator — string content but a statement terminator pre-ES2019
+  0x2029: '\\u2029', // paragraph separator — same
+}
+
+/**
+ * Escape characters that `JSON.stringify` leaves intact but which can still
+ * break out of (or alter the meaning of) the JavaScript string literal that the
+ * stringified value is embedded into — notably `<`/`>` (HTML/script-tag
+ * breakout) and the U+2028 / U+2029 line separators (valid string content but
+ * statement terminators in pre-ES2019 parsers). Apply this on top of
+ * `JSON.stringify` so the emitted import source stays well-formed regardless of
+ * the resolved path. Exported for unit testing.
+ */
+export function escapeUnsafeJsStringChars(value: string): string {
+  return value.replace(
+    /[<>\u2028\u2029]/g,
+    (char) => UNSAFE_JS_STRING_CHAR_ESCAPES[char.charCodeAt(0)],
+  )
+}
+
+/**
+ * Stringify a resolved path into a JavaScript string literal that is safe to
+ * embed in generated source: `JSON.stringify` handles quoting/standard escapes,
+ * and `escapeUnsafeJsStringChars` neutralizes the characters it leaves intact.
+ */
+function toSafeJsStringLiteral(value: string): string {
+  return escapeUnsafeJsStringChars(JSON.stringify(value))
+}
+
 /**
  * Rewrite `@/...` path-alias imports (both `from "@/x"` and dynamic
  * `import("@/x")`) in generated-registry source to absolute `file://` URLs
@@ -110,14 +142,14 @@ export function rewriteGeneratedAliasImports(source: string, appRoot: string): s
       : fs.existsSync(target + '.ts')
         ? target + '.ts'
         : target
-    return pathToFileURL(candidate).href
+    return toSafeJsStringLiteral(pathToFileURL(candidate).href)
   }
   return source
     .replace(/from\s+["']@\/([^"']+)["']/g, (_match, relativePath: string) => {
-      return `from ${JSON.stringify(resolveAlias(relativePath))}`
+      return `from ${resolveAlias(relativePath)}`
     })
     .replace(/import\s*\(\s*["']@\/([^"']+)["']\s*\)/g, (_match, relativePath: string) => {
-      return `import(${JSON.stringify(resolveAlias(relativePath))})`
+      return `import(${resolveAlias(relativePath)})`
     })
 }
 

package/src/modules/ai_assistant/lib/mcp-client.ts

@@ -8,11 +8,15 @@ import type { McpClientInterface, ToolInfo, ToolResult } from './types'
  */
 export type StdioClientOptions = {
   transport: 'stdio'
-  /** API key secret (passed to server via --api-key) */
+  /**
+   * API key secret. Delivered to the spawned server via the
+   * `OPEN_MERCATO_API_KEY` environment variable, never as a command-line
+   * argument (argv is world-readable via `ps`/`/proc/<pid>/cmdline`).
+   */
   apiKeySecret: string
   /** Command to run (default: 'yarn') */
   command?: string
-  /** Arguments for the command (default: mercato mcp:serve with api-key) */
+  /** Arguments for the command (default: mercato ai_assistant mcp:serve, no secret on argv) */
   args?: string[]
   /** Working directory (default: process.cwd()) */
   cwd?: string
@@ -72,12 +76,12 @@ export class McpClient implements McpClientInterface {
    */
   private static async connectStdio(options: StdioClientOptions): Promise<McpClient> {
     const command = options.command ?? 'yarn'
+    // The API key is passed via OPEN_MERCATO_API_KEY in the child env (below),
+    // never on argv — command-line arguments are readable by any local user.
     const args = options.args ?? [
       'mercato',
       'ai_assistant',
       'mcp:serve',
-      '--api-key',
-      options.apiKeySecret,
     ]
     const cwd = options.cwd ?? process.cwd()
 
@@ -85,7 +89,7 @@ export class McpClient implements McpClientInterface {
       command,
       args,
       cwd,
-      env: process.env as Record<string, string>,
+      env: { ...process.env, OPEN_MERCATO_API_KEY: options.apiKeySecret } as Record<string, string>,
       stderr: 'pipe',
     })
     transport.stderr?.on('data', (data) => {

package/src/modules/ai_assistant/lib/mcp-dev-key-resolution.ts

@@ -0,0 +1,107 @@
+import { resolve, dirname } from 'node:path'
+
+const MCP_CONFIG_FILENAME = '.mcp.json'
+
+// Markers that identify a project/repo root. The lookup stops at the first
+// ancestor that has one of these, so the secret is only ever read from the
+// project root — never from an unbounded walk up to the filesystem root.
+const PROJECT_ROOT_MARKERS = ['.git', 'yarn.lock', 'pnpm-lock.yaml', 'package-lock.json'] as const
+
+const log = (message: string, ...args: unknown[]) => {
+  console.error(`[MCP Dev] ${message}`, ...args)
+}
+
+type PermissionStat = { uid: number; mode: number }
+
+/**
+ * Resolve the project root by walking up from `startDir` to the nearest
+ * ancestor containing a project-root marker. Falls back to `startDir` (never
+ * the filesystem root) when no marker is found, so a planted `.mcp.json` in a
+ * writable ancestor such as `/tmp` can never be picked up.
+ */
+export function findProjectRoot(startDir: string, exists: (path: string) => boolean): string {
+  let dir = resolve(startDir)
+  while (true) {
+    for (const marker of PROJECT_ROOT_MARKERS) {
+      if (exists(resolve(dir, marker))) return dir
+    }
+    const parent = dirname(dir)
+    if (parent === dir) return resolve(startDir)
+    dir = parent
+  }
+}
+
+/**
+ * Validate the ownership and permissions of `.mcp.json` before its secret is
+ * read. Refuses when the file is owned by another user (a planted/shadowed
+ * config) and warns loudly when it is accessible to group/other (the key is a
+ * live secret). POSIX-only: when `currentUid` is null (e.g. Windows) the checks
+ * are skipped.
+ */
+export function checkMcpConfigPermissions(
+  configPath: string,
+  fileStat: PermissionStat,
+  currentUid: number | null,
+  warn: (message: string) => void,
+): { ok: boolean; reason?: string } {
+  if (currentUid === null) return { ok: true }
+  if (fileStat.uid !== currentUid) {
+    return {
+      ok: false,
+      reason: `refusing to read ${configPath}: it is owned by uid ${fileStat.uid}, not the current user (uid ${currentUid})`,
+    }
+  }
+  if ((fileStat.mode & 0o077) !== 0) {
+    warn(
+      `${configPath} is accessible to group/other (mode ${(fileStat.mode & 0o777).toString(8)}); it contains a live API key — restrict it with: chmod 600 ${configPath}`,
+    )
+  }
+  return { ok: true }
+}
+
+/**
+ * Resolve the dev MCP server's API key.
+ *
+ * Priority: `OPEN_MERCATO_API_KEY` env var, then `headers.x-api-key` from a
+ * single `.mcp.json` read from the detected project root. The lookup is bounded
+ * to the project root (it never walks up to the filesystem root), and the file
+ * is ownership/permission-checked before its secret is read.
+ */
+export async function getApiKeyFromMcpJson(): Promise<string | undefined> {
+  const envKey = process.env.OPEN_MERCATO_API_KEY
+  if (envKey && envKey.trim().length > 0) {
+    return envKey.trim()
+  }
+
+  const { readFile, stat } = await import('node:fs/promises')
+  const { existsSync } = await import('node:fs')
+
+  try {
+    const projectRoot = findProjectRoot(process.cwd(), existsSync)
+    const mcpJsonPath = resolve(projectRoot, MCP_CONFIG_FILENAME)
+    if (!existsSync(mcpJsonPath)) {
+      return undefined
+    }
+
+    const fileStat = await stat(mcpJsonPath)
+    const currentUid = typeof process.getuid === 'function' ? process.getuid() : null
+    const permissionCheck = checkMcpConfigPermissions(
+      mcpJsonPath,
+      { uid: fileStat.uid, mode: fileStat.mode },
+      currentUid,
+      (message) => log(`Warning: ${message}`),
+    )
+    if (!permissionCheck.ok) {
+      log(`Error: ${permissionCheck.reason}`)
+      return undefined
+    }
+
+    const content = await readFile(mcpJsonPath, 'utf-8')
+    const config = JSON.parse(content)
+    const serverConfig = config?.mcpServers?.['open-mercato']
+
+    return serverConfig?.headers?.['x-api-key']
+  } catch {
+    return undefined
+  }
+}

package/src/modules/ai_assistant/lib/mcp-dev-server.ts

@@ -7,6 +7,7 @@ import { executeTool } from './tool-executor'
 import { loadAllModuleTools, indexToolsForSearch } from './tool-loader'
 import { authenticateMcpRequest, extractApiKeyFromHeaders, hasRequiredFeatures } from './auth'
 import { jsonSchemaToZod } from './schema-utils'
+import { getApiKeyFromMcpJson } from './mcp-dev-key-resolution'
 import type { McpToolContext } from './types'
 import type { SearchService } from '@open-mercato/search/service'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
@@ -17,42 +18,6 @@ const log = (message: string, ...args: unknown[]) => {
   console.error(`[MCP Dev] ${message}`, ...args)
 }
 
-async function getApiKeyFromMcpJson(): Promise<string | undefined> {
-  const { readFile, access } = await import('node:fs/promises')
-  const { resolve, dirname } = await import('node:path')
-
-  // Search for .mcp.json starting from cwd and walking up to project root
-  const findMcpJson = async (startDir: string): Promise<string | null> => {
-    let dir = startDir
-    const root = resolve('/')
-    while (dir !== root) {
-      const candidate = resolve(dir, '.mcp.json')
-      try {
-        await access(candidate)
-        return candidate
-      } catch {
-        dir = dirname(dir)
-      }
-    }
-    return null
-  }
-
-  try {
-    const mcpJsonPath = await findMcpJson(process.cwd())
-    if (!mcpJsonPath) {
-      return undefined
-    }
-
-    const content = await readFile(mcpJsonPath, 'utf-8')
-    const config = JSON.parse(content)
-    const serverConfig = config?.mcpServers?.['open-mercato']
-
-    return serverConfig?.headers?.['x-api-key']
-  } catch {
-    return undefined
-  }
-}
-
 /**
  * Maximum request body size (1MB).
  */