@opencx/mcp 1.11.88 → 1.12.0

package/dist/api-client.d.ts

@@ -19,7 +19,9 @@ export type OpenCXClient = Client<paths> & {
     readonly coworkerSessionId: string | undefined;
     postMultipart(path: string, formData: FormData): Promise<JsonValue>;
 };
-export declare function createOpenCXClient(apiKey: string, baseUrl: string): OpenCXClient;
+export declare function createOpenCXClient(apiKey: string, baseUrl: string, options?: {
+    coworkerSessionId?: string;
+}): OpenCXClient;
 /**
  * Wraps a value as an MCP text-content result. Handles `undefined` from 204
  * responses by falling back to `{}` so `JSON.stringify` always produces a string.

package/dist/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAqB,EAAE,KAAK,MAAM,EAAmB,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAElE,qBAAa,QAAS,SAAQ,KAAK;aAEf,MAAM,EAAE,MAAM;aACd,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;gBAFZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM;CAK/B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAchD;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACrE,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CA4ChF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,GAAG;IAAE,OAAO,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAEjG"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAqB,EAAE,KAAK,MAAM,EAAmB,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAElE,qBAAa,QAAS,SAAQ,KAAK;aAEf,MAAM,EAAE,MAAM;aACd,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;gBAFZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM;CAK/B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAchD;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACrE,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3C,YAAY,CA4Cd;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,GAAG;IAAE,OAAO,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAEjG"}

package/dist/api-client.js

@@ -35,12 +35,12 @@ export function safePath(segment) {
     }
     return encodeURIComponent(decoded);
 }
-export function createOpenCXClient(apiKey, baseUrl) {
+export function createOpenCXClient(apiKey, baseUrl, options = {}) {
     const normalizedBase = baseUrl.replace(/\/$/, '');
     const headers = {
         Authorization: `Bearer ${apiKey}`,
     };
-    const coworkerSessionId = process.env.OPENCX_COWORKER_SESSION_ID;
+    const { coworkerSessionId } = options;
     if (coworkerSessionId) {
         headers['x-opencx-coworker-session-id'] = coworkerSessionId;
     }

package/dist/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,YAA8C,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEf;IACA;IACA;IAHlB,YACkB,MAAc,EACd,UAAkB,EAClB,IAAY;QAE5B,KAAK,CAAC,oBAAoB,MAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC;QAJ3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAe;IAChE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IAEF,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,8BAA8B,CAAC,GAAG,iBAAiB,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAQ;QACjC,OAAO,EAAE,cAAc;QACvB,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,eAAe,GAAe;QAClC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;YAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5B,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;QAC3D,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,IAAmB;IAChD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,YAA8C,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEf;IACA;IACA;IAHlB,YACkB,MAAc,EACd,UAAkB,EAClB,IAAY;QAE5B,KAAK,CAAC,oBAAoB,MAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC;QAJ3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,OAAe,EACf,UAA0C,EAAE;IAE5C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IAEF,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IACtC,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,8BAA8B,CAAC,GAAG,iBAAiB,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAQ;QACjC,OAAO,EAAE,cAAc;QACvB,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,eAAe,GAAe;QAClC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;YAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5B,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;QAC3D,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,IAAmB;IAChD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/create-server-options.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=create-server-options.spec.d.ts.map

package/dist/create-server-options.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server-options.spec.d.ts","sourceRoot":"","sources":["../src/create-server-options.spec.ts"],"names":[],"mappings":""}

package/dist/create-server-options.spec.js

@@ -0,0 +1,67 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { connectInMemory, fetchCallHeaders, fetchCallUrl, toolTextResultSchema, } from './spec-helpers.js';
+function jsonResponse(body) {
+    return new Response(body, { status: 200, headers: { 'Content-Type': 'application/json' } });
+}
+function stubFetch(body = '{}') {
+    const fetchSpy = vi.fn().mockResolvedValue(jsonResponse(body));
+    vi.stubGlobal('fetch', fetchSpy);
+    return fetchSpy;
+}
+describe('createServer options', () => {
+    afterEach(() => {
+        vi.unstubAllEnvs();
+        vi.restoreAllMocks();
+    });
+    it('never reads FIRECRAWL_API_KEY from ambient process env (multi-tenant leak guard)', async () => {
+        vi.stubEnv('FIRECRAWL_API_KEY', 'ambient-env-key-must-not-leak');
+        const fetchSpy = stubFetch();
+        const { client, cleanup } = await connectInMemory();
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'web_search', arguments: { query: 'anything' } }));
+        expect(result.isError).toBe(true);
+        expect(result.content[0].text).toBe('FIRECRAWL_API_KEY not configured');
+        expect(fetchSpy).not.toHaveBeenCalled();
+        await cleanup();
+    });
+    it('uses an explicitly granted Firecrawl key', async () => {
+        const fetchSpy = stubFetch(JSON.stringify({ success: true, data: [] }));
+        const { client, cleanup } = await connectInMemory({ firecrawlApiKey: 'granted-key' });
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'web_search', arguments: { query: 'opencx' } }));
+        expect(result.isError).toBeFalsy();
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+        const call = fetchSpy.mock.calls[0];
+        expect(fetchCallUrl(call)).toContain('api.firecrawl.dev');
+        expect(fetchCallHeaders(call).get('authorization')).toBe('Bearer granted-key');
+        await cleanup();
+    });
+    it('returns an empty-result string when Firecrawl succeeds without a data field', async () => {
+        stubFetch(JSON.stringify({ success: true }));
+        const { client, cleanup } = await connectInMemory({ firecrawlApiKey: 'granted-key' });
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'web_search', arguments: { query: 'nothing' } }));
+        // `text` must stay a string — JSON.stringify(undefined) would produce a
+        // non-string value and fail MCP output validation at the protocol layer.
+        expect(result.isError).toBeFalsy();
+        expect(result.content[0].text).toBe('[]');
+        await cleanup();
+    });
+    it('sends the coworker session id header when explicitly provided', async () => {
+        const fetchSpy = stubFetch(JSON.stringify({ name: 'org', created_at: null, updated_at: null }));
+        const { client, cleanup } = await connectInMemory({ coworkerSessionId: 'session-42' });
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+        const headers = fetchCallHeaders(fetchSpy.mock.calls[0]);
+        expect(headers.get('x-opencx-coworker-session-id')).toBe('session-42');
+        await cleanup();
+    });
+    it('never reads OPENCX_COWORKER_SESSION_ID from ambient process env', async () => {
+        vi.stubEnv('OPENCX_COWORKER_SESSION_ID', 'ambient-session-must-not-leak');
+        const fetchSpy = stubFetch(JSON.stringify({ name: 'org', created_at: null, updated_at: null }));
+        const { client, cleanup } = await connectInMemory();
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+        const headers = fetchCallHeaders(fetchSpy.mock.calls[0]);
+        expect(headers.get('x-opencx-coworker-session-id')).toBeNull();
+        await cleanup();
+    });
+});
+//# sourceMappingURL=create-server-options.spec.js.map

package/dist/create-server-options.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server-options.spec.js","sourceRoot":"","sources":["../src/create-server-options.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,SAAS,CAAC,IAAI,GAAG,IAAI;IAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAgB,CAAC,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;QAE7B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAChF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAExC,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAC9E,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAE/E,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE7C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAC/E,CAAC;QAEF,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,QAAQ,GAAG,SAAS,CACxB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CACpE,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEvE,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,EAAE,CAAC,OAAO,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,SAAS,CACxB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CACpE,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAE/D,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,40 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { JsonValue } from './utils/json.js';
+export declare const COWORKER_SESSION_HEADER = "x-opencx-coworker-session-id";
+/** Extract the token from an `Authorization: Bearer <token>` header value. */
+export declare function extractBearer(header: string | string[] | undefined): string | undefined;
+/**
+ * Handle a single stateless Streamable HTTP MCP request.
+ *
+ * Creates a fresh server + transport per request (no session state), so it can
+ * be mounted behind any Node HTTP server. Both the standalone CLI (`--http`)
+ * and the hosted backend endpoint (`api.open.cx/mcp`) route through here.
+ *
+ * The caller is responsible for authentication — extract and validate the
+ * bearer token before calling this, then pass it as `apiKey` so tools call the
+ * public API on the caller's behalf. Everything else that is per-request
+ * (coworker attribution header, error envelope, teardown) is owned here so
+ * hosts cannot drift.
+ */
+export declare function handleStreamableHttp(options: {
+    apiKey: string;
+    baseUrl: string;
+    req: IncomingMessage;
+    res: ServerResponse;
+    /**
+     * Body already parsed by the host framework (e.g. Fastify). Omit when the
+     * body is still unread on the request stream.
+     */
+    parsedBody?: JsonValue;
+    /**
+     * Fallback companion attribution when the request carries no
+     * `x-opencx-coworker-session-id` header. The header always wins.
+     */
+    coworkerSessionId?: string;
+    /**
+     * Enables the Firecrawl tools for this request. The host decides per caller
+     * — never resolved from ambient process env (multi-tenant leak).
+     */
+    firecrawlApiKey?: string;
+}): Promise<void>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDhB"}

package/dist/http.js

@@ -0,0 +1,70 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createServer } from './server.js';
+export const COWORKER_SESSION_HEADER = 'x-opencx-coworker-session-id';
+/** Extract the token from an `Authorization: Bearer <token>` header value. */
+export function extractBearer(header) {
+    if (typeof header !== 'string')
+        return undefined;
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    return match?.[1];
+}
+/**
+ * Handle a single stateless Streamable HTTP MCP request.
+ *
+ * Creates a fresh server + transport per request (no session state), so it can
+ * be mounted behind any Node HTTP server. Both the standalone CLI (`--http`)
+ * and the hosted backend endpoint (`api.open.cx/mcp`) route through here.
+ *
+ * The caller is responsible for authentication — extract and validate the
+ * bearer token before calling this, then pass it as `apiKey` so tools call the
+ * public API on the caller's behalf. Everything else that is per-request
+ * (coworker attribution header, error envelope, teardown) is owned here so
+ * hosts cannot drift.
+ */
+export async function handleStreamableHttp(options) {
+    const { apiKey, baseUrl, req, res, parsedBody, firecrawlApiKey } = options;
+    // Stateless mode has no session to push server-initiated messages from, yet
+    // the SDK would answer GET with a 200 SSE stream that idles forever — each
+    // connected client would pin a full per-request server in memory. 405 is the
+    // spec-sanctioned "no SSE stream here"; SDK clients fall back to POST-only.
+    if (req.method === 'GET') {
+        res.writeHead(405, { Allow: 'POST, DELETE' });
+        res.end();
+        return;
+    }
+    const coworkerHeader = req.headers[COWORKER_SESSION_HEADER];
+    const coworkerSessionId = typeof coworkerHeader === 'string' && coworkerHeader !== ''
+        ? coworkerHeader
+        : options.coworkerSessionId;
+    try {
+        const server = createServer(apiKey, baseUrl, { coworkerSessionId, firecrawlApiKey });
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+        });
+        res.on('close', () => {
+            transport.close().catch((_e) => {
+                console.error('Failed to close MCP HTTP transport', { _e });
+            });
+            server.close().catch((_e) => {
+                console.error('Failed to close MCP server', { _e });
+            });
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, parsedBody);
+    }
+    catch (_e) {
+        console.error('MCP HTTP request failed', { _e });
+        if (!res.headersSent && !res.destroyed) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                error: { code: -32603, message: 'Internal server error' },
+                id: null,
+            }));
+        }
+        else if (!res.writableEnded) {
+            res.end();
+        }
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,MAAqC;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAoB1C;IACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAE3E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GACrB,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,EAAE;QACzD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAW,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAW,EAAE,EAAE;gBACnC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,EAAW,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;gBACzD,EAAE,EAAE,IAAI;aACT,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/http.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=http.spec.d.ts.map

package/dist/http.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.spec.d.ts","sourceRoot":"","sources":["../src/http.spec.ts"],"names":[],"mappings":""}

package/dist/http.spec.js

@@ -0,0 +1,178 @@
+import { createServer as createHttpServer } from 'node:http';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { z } from 'zod';
+import { extractBearer, handleStreamableHttp } from './http.js';
+import { toolTextResultSchema } from './spec-helpers.js';
+import { jsonValueSchema } from './utils/json.js';
+const addressSchema = z.object({ port: z.number() });
+const ORG_BODY = { name: 'http-test-org', created_at: null, updated_at: null };
+function listenPort(server) {
+    return addressSchema.parse(server.address()).port;
+}
+async function connectClient(url, bearer, extraHeaders = {}) {
+    const client = new Client({ name: 'http-spec-client', version: '0.0.0' });
+    const transport = new StreamableHTTPClientTransport(new URL(url), {
+        requestInit: { headers: { Authorization: `Bearer ${bearer}`, ...extraHeaders } },
+    });
+    await client.connect(transport);
+    return client;
+}
+describe('handleStreamableHttp', () => {
+    /** Stub OpenCX public API — records auth + coworker headers of every call. */
+    let apiStub;
+    let apiBaseUrl;
+    const seenApiCalls = [];
+    const hosts = [];
+    /**
+     * Host wiring mirrors index.ts's `--http` mode. The one axis under test per
+     * host: whether the body is pre-parsed by the framework (Fastify path) or
+     * left on the stream (raw CLI path), plus an optional coworker fallback.
+     */
+    async function startHost(options) {
+        const host = createHttpServer(async (req, res) => {
+            const bearer = extractBearer(req.headers.authorization);
+            if (!bearer) {
+                res.writeHead(401);
+                res.end();
+                return;
+            }
+            let parsedBody;
+            if (options.parseBody) {
+                const chunks = [];
+                for await (const chunk of req) {
+                    chunks.push(Buffer.from(chunk));
+                }
+                const raw = Buffer.concat(chunks).toString('utf8');
+                parsedBody = raw ? jsonValueSchema.parse(JSON.parse(raw)) : undefined;
+            }
+            await handleStreamableHttp({
+                apiKey: bearer,
+                baseUrl: apiBaseUrl,
+                req,
+                res,
+                parsedBody,
+                coworkerSessionId: options.coworkerSessionId,
+            });
+        });
+        await new Promise((resolve) => host.listen(0, '127.0.0.1', resolve));
+        hosts.push(host);
+        return `http://127.0.0.1:${listenPort(host)}/`;
+    }
+    /** Raw request stream host (CLI `--http` path). */
+    let streamedUrl;
+    /** Framework-parsed body host (backend/Fastify path). */
+    let parsedUrl;
+    beforeAll(async () => {
+        apiStub = createHttpServer((req, res) => {
+            const coworkerHeader = req.headers['x-opencx-coworker-session-id'];
+            seenApiCalls.push({
+                auth: typeof req.headers.authorization === 'string' ? req.headers.authorization : undefined,
+                coworkerSessionId: typeof coworkerHeader === 'string' ? coworkerHeader : undefined,
+            });
+            if (req.method === 'GET' && req.url === '/org') {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(ORG_BODY));
+                return;
+            }
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'not found' }));
+        });
+        await new Promise((resolve) => apiStub.listen(0, '127.0.0.1', resolve));
+        apiBaseUrl = `http://127.0.0.1:${listenPort(apiStub)}`;
+        streamedUrl = await startHost({});
+        parsedUrl = await startHost({ parseBody: true });
+    });
+    afterAll(async () => {
+        for (const server of [...hosts, apiStub]) {
+            await new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
+        }
+    });
+    function apiCallsFor(bearer) {
+        return seenApiCalls.filter((c) => c.auth === `Bearer ${bearer}`);
+    }
+    it('serves initialize + tools/list over a raw request stream', async () => {
+        const client = await connectClient(streamedUrl, 'stream-key');
+        const { tools } = await client.listTools();
+        expect(tools.length).toBeGreaterThan(100);
+        expect(tools.map((t) => t.name)).toContain('get_organization');
+        await client.close();
+    });
+    it('serves tool calls and forwards the caller bearer to the API', async () => {
+        const client = await connectClient(streamedUrl, 'stream-key');
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'get_organization', arguments: {} }));
+        expect(JSON.parse(result.content[0].text)).toEqual(ORG_BODY);
+        expect(apiCallsFor('stream-key').length).toBeGreaterThan(0);
+        await client.close();
+    });
+    it('serves the same protocol when the host framework pre-parses the body', async () => {
+        const client = await connectClient(parsedUrl, 'parsed-key');
+        const { tools } = await client.listTools();
+        expect(tools.length).toBeGreaterThan(100);
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'get_organization', arguments: {} }));
+        expect(JSON.parse(result.content[0].text)).toEqual(ORG_BODY);
+        expect(apiCallsFor('parsed-key').length).toBeGreaterThan(0);
+        await client.close();
+    });
+    it('isolates concurrent callers — each request uses its own bearer', async () => {
+        const [clientA, clientB] = await Promise.all([
+            connectClient(streamedUrl, 'key-a'),
+            connectClient(streamedUrl, 'key-b'),
+        ]);
+        const before = seenApiCalls.length;
+        await Promise.all([
+            clientA.callTool({ name: 'get_organization', arguments: {} }),
+            clientB.callTool({ name: 'get_organization', arguments: {} }),
+        ]);
+        const newAuths = seenApiCalls.slice(before).map((c) => c.auth);
+        expect(newAuths).toHaveLength(2);
+        expect(new Set(newAuths)).toEqual(new Set(['Bearer key-a', 'Bearer key-b']));
+        await Promise.all([clientA.close(), clientB.close()]);
+    });
+    it('forwards the coworker session id header to API calls', async () => {
+        const client = await connectClient(streamedUrl, 'coworker-key', {
+            'x-opencx-coworker-session-id': 'coworker-session-42',
+        });
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(apiCallsFor('coworker-key')[0]?.coworkerSessionId).toBe('coworker-session-42');
+        await client.close();
+    });
+    it('sends no coworker header when neither caller nor host provides one', async () => {
+        const client = await connectClient(streamedUrl, 'no-coworker-key');
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        const calls = apiCallsFor('no-coworker-key');
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls[0]?.coworkerSessionId).toBeUndefined();
+        await client.close();
+    });
+    it('falls back to the host-provided coworker session id when the caller sends no header', async () => {
+        const fallbackUrl = await startHost({ coworkerSessionId: 'host-env-session' });
+        const client = await connectClient(fallbackUrl, 'fallback-key');
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(apiCallsFor('fallback-key')[0]?.coworkerSessionId).toBe('host-env-session');
+        await client.close();
+    });
+    it('lets a per-request coworker header win over the host fallback', async () => {
+        const fallbackUrl = await startHost({ coworkerSessionId: 'host-env-session' });
+        const client = await connectClient(fallbackUrl, 'override-key', {
+            'x-opencx-coworker-session-id': 'per-request-session',
+        });
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(apiCallsFor('override-key')[0]?.coworkerSessionId).toBe('per-request-session');
+        await client.close();
+    });
+    it('rejects GET with 405 — stateless mode offers no SSE stream to pin', async () => {
+        const response = await fetch(streamedUrl, {
+            method: 'GET',
+            headers: {
+                Authorization: 'Bearer stream-key',
+                Accept: 'text/event-stream',
+            },
+        });
+        expect(response.status).toBe(405);
+        expect(response.headers.get('allow')).toBe('POST, DELETE');
+        await response.body?.cancel();
+    });
+});
+//# sourceMappingURL=http.spec.js.map

package/dist/http.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.spec.js","sourceRoot":"","sources":["../src/http.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAe,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAErD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAO/E,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,MAAc,EACd,eAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;QAChE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE;KACjF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,8EAA8E;IAC9E,IAAI,OAAe,CAAC;IACpB,IAAI,UAAkB,CAAC;IACvB,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B;;;;OAIG;IACH,KAAK,UAAU,SAAS,CAAC,OAGxB;QACC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,UAAU,CAAC;YACf,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,CAAC;YACD,MAAM,oBAAoB,CAAC;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,UAAU;gBACnB,GAAG;gBACH,GAAG;gBACH,UAAU;gBACV,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,oBAAoB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;IACjD,CAAC;IAED,mDAAmD;IACnD,IAAI,WAAmB,CAAC;IACxB,yDAAyD;IACzD,IAAI,SAAiB,CAAC;IAEtB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACnE,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC3F,iBAAiB,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;aACnF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,UAAU,GAAG,oBAAoB,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAEvD,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC;QAClC,SAAS,GAAG,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,WAAW,CAAC,MAAc;QACjC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;YACnC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC7D,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,cAAc,EAAE;YAC9D,8BAA8B,EAAE,qBAAqB;SACtD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChE,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,cAAc,EAAE;YAC9D,8BAA8B,EAAE,qBAAqB;SACtD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,mBAAmB;gBAClC,MAAM,EAAE,mBAAmB;aAC5B;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -1,19 +1,12 @@
 #!/usr/bin/env node
 import { createServer as createHttpServer } from 'node:http';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { extractBearer, handleStreamableHttp } from './http.js';
 import { createServer } from './server.js';
 const DEFAULT_BASE_URL = 'https://api.open.cx';
 function isHttpMode() {
     return process.argv.includes('--http') || process.env.MCP_TRANSPORT === 'http';
 }
-function extractBearer(req) {
-    const auth = req.headers['authorization'];
-    if (typeof auth !== 'string')
-        return undefined;
-    const match = auth.match(/^Bearer\s+(.+)$/i);
-    return match?.[1];
-}
 function startHttpMode() {
     const baseUrl = resolveBaseUrl();
     const port = Number(process.env.MCP_HTTP_PORT) || 3100;
@@ -30,18 +23,25 @@ function startHttpMode() {
             res.end('Not found');
             return;
         }
-        const bearer = extractBearer(req);
+        const bearer = extractBearer(req.headers.authorization);
         if (!bearer) {
             res.writeHead(401, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Missing Authorization: Bearer <token>' }));
             return;
         }
-        const mcpServer = createServer(bearer, baseUrl);
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
+        // Standalone server = single-tenant: the operator's own env applies to
+        // every caller. Do NOT expose this server to untrusted bearer tokens with
+        // FIRECRAWL_API_KEY set — all callers would share (and bill) that key.
+        // The env coworker session id is a fallback; a per-request
+        // x-opencx-coworker-session-id header always wins (handled in http.ts).
+        await handleStreamableHttp({
+            apiKey: bearer,
+            baseUrl,
+            req,
+            res,
+            coworkerSessionId: process.env.OPENCX_COWORKER_SESSION_ID,
+            firecrawlApiKey: process.env.FIRECRAWL_API_KEY,
         });
-        await mcpServer.connect(transport);
-        await transport.handleRequest(req, res);
     });
     httpServer.listen(port, '0.0.0.0', () => {
         console.log(`OpenCX MCP HTTP server listening on http://0.0.0.0:${port}/mcp`);
@@ -66,7 +66,10 @@ function startStdioMode() {
         process.exit(1);
     }
     const baseUrl = resolveBaseUrl();
-    const server = createServer(apiKey, baseUrl);
+    const server = createServer(apiKey, baseUrl, {
+        coworkerSessionId: process.env.OPENCX_COWORKER_SESSION_ID,
+        firecrawlApiKey: process.env.FIRECRAWL_API_KEY,
+    });
     const transport = new StdioServerTransport();
     server.connect(transport).catch((err) => {
         console.error('Failed to start OpenCX MCP server:', err);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,GAEtB;IACC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IAEvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,eAAe;QACf,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,sDAAsD,IAAI,MAAM,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,6DAA6D;YAC3D,+CAA+C;YAC/C,4CAA4C;YAC5C,iDAAiD;YACjD,OAAO;YACP,uBAAuB;YACvB,qBAAqB;YACrB,6BAA6B;YAC7B,0CAA0C;YAC1C,wDAAwD;YACxD,WAAW;YACX,SAAS;YACT,KAAK,CACR,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC/C,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;QACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,CAAC,KAAK,CACX,qFAAqF,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,UAAU,EAAE,EAAE,CAAC;IACjB,aAAa,EAAE,CAAC;AAClB,CAAC;KAAM,CAAC;IACN,cAAc,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AACjF,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IAEvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,eAAe;QACf,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,2DAA2D;QAC3D,wEAAwE;QACxE,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,GAAG;YACH,GAAG;YACH,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACzD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,sDAAsD,IAAI,MAAM,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,6DAA6D;YAC3D,+CAA+C;YAC/C,4CAA4C;YAC5C,iDAAiD;YACjD,OAAO;YACP,uBAAuB;YACvB,qBAAqB;YACrB,6BAA6B;YAC7B,0CAA0C;YAC1C,wDAAwD;YACxD,WAAW;YACX,SAAS;YACT,KAAK,CACR,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE;QAC3C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACzD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;KAC/C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC/C,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;QACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,CAAC,KAAK,CACX,qFAAqF,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,UAAU,EAAE,EAAE,CAAC;IACjB,aAAa,EAAE,CAAC;AAClB,CAAC;KAAM,CAAC;IACN,cAAc,EAAE,CAAC;AACnB,CAAC"}

package/dist/server.d.ts

@@ -1,3 +1,13 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function createServer(apiKey: string, baseUrl: string): McpServer;
+export interface CreateServerOptions {
+    /** Forwarded as `x-opencx-coworker-session-id` on every API call (companion attribution). */
+    coworkerSessionId?: string;
+    /**
+     * Enables the Firecrawl web_search/web_scrape tools. Threaded explicitly —
+     * never resolved from ambient process env, so a multi-tenant host can grant
+     * it per caller (see registerFirecrawlTools).
+     */
+    firecrawlApiKey?: string;
+}
+export declare function createServer(apiKey: string, baseUrl: string, options?: CreateServerOptions): McpServer;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0CpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAiDvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0CpE,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,mBAAwB,GAChC,SAAS,CAmDX"}

package/dist/server.js

@@ -39,12 +39,14 @@ import { registerAskQuestionsTools } from './tools/ask-questions.js';
 import { registerTodoTools } from './tools/todos.js';
 import { registerOnboardingTools } from './tools/onboarding.js';
 import { registerFirecrawlTools } from './tools/firecrawl.js';
-export function createServer(apiKey, baseUrl) {
+export function createServer(apiKey, baseUrl, options = {}) {
     const server = new McpServer({
         name: 'OpenCX',
         version: '0.1.0',
     });
-    const client = createOpenCXClient(apiKey, baseUrl);
+    const client = createOpenCXClient(apiKey, baseUrl, {
+        coworkerSessionId: options.coworkerSessionId,
+    });
     registerActionTools(server, client);
     registerAutopilotTools(server, client);
     registerBlocklistTools(server, client);
@@ -83,7 +85,7 @@ export function createServer(apiKey, baseUrl) {
     registerAskQuestionsTools(server, client);
     registerTodoTools(server, client);
     registerOnboardingTools(server, client);
-    registerFirecrawlTools(server);
+    registerFirecrawlTools(server, { apiKey: options.firecrawlApiKey });
     return server;
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe;IAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,+BAA+B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAE/B,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAa9D,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,OAAe,EACf,UAA+B,EAAE;IAEjC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE;QACjD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,+BAA+B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEpE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/spec-helpers.d.ts

@@ -0,0 +1,39 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { z } from 'zod';
+import { type CreateServerOptions } from './server.js';
+/** The MCP text-content envelope produced by `jsonContent()` and `error()`. */
+export declare const toolTextResultSchema: z.ZodObject<{
+    content: z.ZodTuple<[z.ZodObject<{
+        type: z.ZodLiteral<"text">;
+        text: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        text: string;
+        type: "text";
+    }, {
+        text: string;
+        type: "text";
+    }>], null>;
+    isError: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    content: [{
+        text: string;
+        type: "text";
+    }];
+    isError?: boolean | undefined;
+}, {
+    content: [{
+        text: string;
+        type: "text";
+    }];
+    isError?: boolean | undefined;
+}>;
+/** One recorded call of a `fetch`-typed mock: `[input, init?]`. */
+export type FetchCall = [input: RequestInfo | URL, init?: RequestInit];
+export declare function fetchCallUrl(call: FetchCall): string;
+export declare function fetchCallHeaders(call: FetchCall): Headers;
+/** Connect an in-memory MCP client to a fresh `createServer` instance. */
+export declare function connectInMemory(options?: CreateServerOptions): Promise<{
+    client: Client;
+    cleanup: () => Promise<void>;
+}>;
+//# sourceMappingURL=spec-helpers.d.ts.map

package/dist/spec-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-helpers.d.ts","sourceRoot":"","sources":["../src/spec-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAErE,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;EAG/B,CAAC;AAEH,mEAAmE;AACnE,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AAEvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAIpD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAIzD;AAED,0EAA0E;AAC1E,wBAAsB,eAAe,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAaD"}

package/dist/spec-helpers.js

@@ -0,0 +1,37 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { z } from 'zod';
+import { createServer } from './server.js';
+/** The MCP text-content envelope produced by `jsonContent()` and `error()`. */
+export const toolTextResultSchema = z.object({
+    content: z.tuple([z.object({ type: z.literal('text'), text: z.string() })]),
+    isError: z.boolean().optional(),
+});
+export function fetchCallUrl(call) {
+    const [input] = call;
+    if (input instanceof Request)
+        return input.url;
+    return input instanceof URL ? input.href : input;
+}
+export function fetchCallHeaders(call) {
+    const [input, init] = call;
+    if (input instanceof Request)
+        return input.headers;
+    return new Headers(init?.headers);
+}
+/** Connect an in-memory MCP client to a fresh `createServer` instance. */
+export async function connectInMemory(options = {}) {
+    const server = createServer('test-api-key', 'https://api.test.com', options);
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    await server.connect(serverTransport);
+    const client = new Client({ name: 'spec-client', version: '0.0.0' });
+    await client.connect(clientTransport);
+    return {
+        client,
+        cleanup: async () => {
+            await client.close();
+            await server.close();
+        },
+    };
+}
+//# sourceMappingURL=spec-helpers.js.map

package/dist/spec-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-helpers.js","sourceRoot":"","sources":["../src/spec-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAErE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAKH,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,IAAI,KAAK,YAAY,OAAO;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAC/C,OAAO,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAe;IAC9C,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B,IAAI,KAAK,YAAY,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAA+B,EAAE;IAIrE,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IAChF,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO;QACL,MAAM;QACN,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/firecrawl.d.ts

@@ -1,3 +1,5 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function registerFirecrawlTools(server: McpServer): void;
+export declare function registerFirecrawlTools(server: McpServer, options?: {
+    apiKey?: string;
+}): void;
 //# sourceMappingURL=firecrawl.d.ts.map

package/dist/tools/firecrawl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firecrawl.d.ts","sourceRoot":"","sources":["../../src/tools/firecrawl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAyDzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,QAkEvD"}
+{"version":3,"file":"firecrawl.d.ts","sourceRoot":"","sources":["../../src/tools/firecrawl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA8DzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,QAmE1F"}

package/dist/tools/firecrawl.js

@@ -53,7 +53,13 @@ function formatScrapeResult(data) {
         parts.push(data.markdown);
     return parts.join('\n\n') || 'No content extracted';
 }
-export function registerFirecrawlTools(server) {
+// The key is threaded explicitly (never read from ambient process env here):
+// in a multi-tenant host like the backend /mcp endpoint, the process env holds
+// OUR paid key — reading it ambiently would hand Firecrawl to every caller.
+// Entrypoints decide: the CLI passes its own env, the backend passes the key
+// only for companion (coworker ephemeral token) callers.
+export function registerFirecrawlTools(server, options = {}) {
+    const firecrawlApiKey = options.apiKey;
     server.registerTool('web_search', {
         description: `Search the web and get full page content in one call. Returns titles, URLs, descriptions, and optionally full markdown of each result. This is your PRIMARY tool for website research — use it instead of WebFetch. Supports site-scoped queries like "site:example.com FAQ".
 
@@ -75,19 +81,20 @@ Use when: researching a business during onboarding, finding FAQ/pricing/policy p
                 .describe('Fetch full markdown content of each result (default: true)'),
         },
     }, async ({ query, limit, scrape }) => {
-        const apiKey = process.env.FIRECRAWL_API_KEY;
-        if (!apiKey)
+        if (!firecrawlApiKey)
             return error('FIRECRAWL_API_KEY not configured');
         const body = { query, limit };
         if (scrape)
             body.scrapeOptions = { formats: ['markdown'] };
-        const res = await firecrawlFetch('/search', apiKey, body);
+        const res = await firecrawlFetch('/search', firecrawlApiKey, body);
         if (!res.ok)
             return error(`Firecrawl API error: ${res.status} ${res.statusText}`);
         const data = firecrawlResponseSchema.parse(await res.json());
         if (!data.success)
             return error(data.error ?? 'Search failed');
-        return { content: [{ type: 'text', text: JSON.stringify(data.data, null, 2) }] };
+        // `data` is optional in the response schema — stringify(undefined) would
+        // yield a non-string `text` and fail MCP output validation.
+        return { content: [{ type: 'text', text: JSON.stringify(data.data ?? [], null, 2) }] };
     });
     server.registerTool('web_scrape', {
         description: 'Scrape a single webpage and return clean markdown. Handles JavaScript-rendered pages. Use when you already have the exact URL (e.g. user gave you their homepage). For discovering pages, use web_search instead.',
@@ -100,10 +107,9 @@ Use when: researching a business during onboarding, finding FAQ/pricing/policy p
                 .describe('Extract only main content, excluding nav/footer/sidebar'),
         },
     }, async ({ url, only_main_content }) => {
-        const apiKey = process.env.FIRECRAWL_API_KEY;
-        if (!apiKey)
+        if (!firecrawlApiKey)
             return error('FIRECRAWL_API_KEY not configured');
-        const res = await firecrawlFetch('/scrape', apiKey, {
+        const res = await firecrawlFetch('/scrape', firecrawlApiKey, {
             url,
             formats: ['markdown'],
             onlyMainContent: only_main_content,

package/dist/tools/firecrawl.js.map

@@ -1 +1 @@
-{"version":3,"file":"firecrawl.js","sourceRoot":"","sources":["../../src/tools/firecrawl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAmB,MAAM,kBAAkB,CAAC;AAEpE,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,IAAgB;IAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA+C;IACzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAiB;IACtD,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE;;iJAE8H;QAC3I,WAAW,EAAE;YACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;YAC3F,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,EAAE,CAAC;iBACP,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,CAAC;iBACV,QAAQ,CAAC,0BAA0B,CAAC;YACvC,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CAAC,4DAA4D,CAAC;SACxE;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1C,IAAI,MAAM;YAAE,IAAI,CAAC,aAAa,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EACT,mNAAmN;QACrN,WAAW,EAAE;YACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACnD,iBAAiB,EAAE,CAAC;iBACjB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CAAC,yDAAyD,CAAC;SACrE;KACF,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE;YAClD,GAAG;YACH,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,eAAe,EAAE,iBAAiB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"firecrawl.js","sourceRoot":"","sources":["../../src/tools/firecrawl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAmB,MAAM,kBAAkB,CAAC;AAEpE,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,IAAgB;IAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA+C;IACzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC;AACtD,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,UAA+B,EAAE;IACzF,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IACvC,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE;;iJAE8H;QAC3I,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;YAC3F,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,EAAE,CAAC;iBACP,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,CAAC;iBACV,QAAQ,CAAC,0BAA0B,CAAC;YACvC,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CAAC,4DAA4D,CAAC;SAC1E;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACvE,MAAM,IAAI,GAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1C,IAAI,MAAM;YAAE,IAAI,CAAC,aAAa,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;QAC/D,yEAAyE;QACzE,4DAA4D;QAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EACT,mNAAmN;QACrN,WAAW,EAAE;YACX,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACnD,iBAAiB,EAAE,CAAC;iBACjB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CAAC,yDAAyD,CAAC;SACvE;KACF,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE;YAC3D,GAAG;YACH,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,eAAe,EAAE,iBAAiB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencx/mcp",
-  "version": "1.11.88",
+  "version": "1.12.0",
   "private": false,
   "description": "MCP server for OpenCX — manage contacts, sessions, training, and more from Claude Desktop, Cursor, or any MCP client.",
   "type": "module",
@@ -8,6 +8,21 @@
     "opencx-mcp": "./dist/index.js"
   },
   "main": "./dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "default": "./dist/http.js"
+    },
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist"
   ],