@peac/mcp-server 0.16.3 → 0.16.5

package/dist/http-transport.d.ts

@@ -1,7 +1,7 @@
 /**
  * MCP Streamable HTTP transport
  *
- * Adds HTTP transport alongside stdio. Unprotected mode only (v0.11.0).
+ * Adds HTTP transport alongside stdio. Unprotected mode only.
  * Each session gets its own McpServer + transport (CVE-2026-25536 defense).
  *
  * Endpoints:
@@ -55,11 +55,17 @@ export interface HttpTransportOptions {
     /** Factory to create new McpServer instances (one per session) */
     serverFactory: () => McpServer;
 }
+/** Upper bound on tracked rate-limit windows; the oldest window is evicted first. */
+export declare const MAX_RATE_LIMIT_KEYS = 10000;
+/** Rate-limit key: a valid id of a live session, otherwise the client address. */
+export declare function rateLimitKeyFor(sessionId: string | undefined, clientIp: string, isLiveSession: (id: string) => boolean): string;
 /**
  * Create and start an HTTP server for MCP Streamable HTTP transport.
  * Returns a cleanup function to shut everything down.
  */
 export declare function createHttpTransport(options: HttpTransportOptions): Promise<{
     cleanup: () => Promise<void>;
+    /** Number of tracked rate-limit windows (test seam). */
+    rateLimitKeyCount: () => number;
 }>;
 //# sourceMappingURL=http-transport.d.ts.map

package/dist/http-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-transport.d.ts","sourceRoot":"","sources":["../src/http-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5F,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,aAAa,EAAE,MAAM,SAAS,CAAC;CAChC;AA0FD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CA+X3C"}
+{"version":3,"file":"http-transport.d.ts","sourceRoot":"","sources":["../src/http-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5F,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,aAAa,EAAE,MAAM,SAAS,CAAC;CAChC;AAYD,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAkC1C,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GACrC,MAAM,CAIR;AAmED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAChF,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,MAAM,CAAC;CACjC,CAAC,CA0YD"}

package/dist/index.cjs

@@ -34,7 +34,7 @@ var nodePath__namespace = /*#__PURE__*/_interopNamespace(nodePath);
 
 // src/infra/constants.ts
 var SERVER_NAME = "peac-mcp-server";
-var SERVER_VERSION = "0.16.3";
+var SERVER_VERSION = "0.16.5";
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var DEFAULT_MAX_JWS_BYTES = 16384;
 var DEFAULT_MAX_RESPONSE_BYTES = 65536;
@@ -1249,6 +1249,7 @@ var BUNDLE_TOOL_ANNOTATIONS = {
   openWorldHint: true
 };
 var MAX_INPUT_DEPTH = 10;
+var MAX_TOOL_INPUT_ELEMENTS = 1024;
 function errorCallToolResult(meta, code, message) {
   const errorDef = kernel.ERRORS[code];
   return {
@@ -1357,7 +1358,10 @@ function createPeacMcpServer(options) {
     { name: SERVER_NAME, version },
     // listChanged: false -- tool set is static per server instance (determined
     // at startup from CLI flags). The server never emits notifications/tools/list_changed.
-    { capabilities: { tools: { listChanged: false } } }
+    {
+      capabilities: { tools: { listChanged: false } },
+      maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS
+    }
   );
   const register = server.registerTool.bind(server);
   register(