@peac/mcp-server 0.16.4 → 0.16.5

package/README.md

@@ -102,7 +102,7 @@ const result = await handleVerify({
   input: { jws: 'eyJ...', public_key_base64url: '...' },
   policy,
   context: {
-    version: '0.15.0',
+    version: '0.16.5',
     policyHash,
     protocolVersion: '2025-11-25',
   },

package/dist/cli.cjs

@@ -4,6 +4,7 @@
 var crypto$1 = require('crypto');
 var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
 var http = require('http');
+var types_js = require('@modelcontextprotocol/sdk/types.js');
 var promises = require('fs/promises');
 var commander = require('commander');
 var zod = require('zod');
@@ -49,7 +50,7 @@ var SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION;
 var init_constants = __esm({
   "src/infra/constants.ts"() {
     SERVER_NAME = "peac-mcp-server";
-    SERVER_VERSION = "0.16.4";
+    SERVER_VERSION = "0.16.5";
     MCP_PROTOCOL_VERSION = "2025-11-25";
   }
 });
@@ -114,6 +115,11 @@ var init_session_manager = __esm({
         }
         return entry;
       }
+      /** Whether an unexpired session exists; unlike getSession(), does not refresh lastSeen. */
+      hasSession(sessionId) {
+        const entry = this.sessions.get(sessionId);
+        return entry !== void 0 && Date.now() - entry.lastSeen <= this.ttlMs;
+      }
       /** Terminate and clean up a specific session */
       async terminateSession(sessionId) {
         const entry = this.sessions.get(sessionId);
@@ -180,8 +186,17 @@ var init_session_manager = __esm({
 // src/http-transport.ts
 var http_transport_exports = {};
 __export(http_transport_exports, {
-  createHttpTransport: () => createHttpTransport
+  MAX_RATE_LIMIT_KEYS: () => MAX_RATE_LIMIT_KEYS,
+  createHttpTransport: () => createHttpTransport,
+  rateLimitKeyFor: () => rateLimitKeyFor
 });
+function checkProtocolVersion(req) {
+  const protocolVersion = req.headers["mcp-protocol-version"];
+  if (protocolVersion && !SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
+    return `Unsupported MCP protocol version: ${protocolVersion} (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`;
+  }
+  return null;
+}
 function isValidSessionId(id) {
   if (id.length === 0 || id.length > MAX_SESSION_ID_LENGTH) return false;
   for (let i = 0; i < id.length; i++) {
@@ -190,6 +205,9 @@ function isValidSessionId(id) {
   }
   return true;
 }
+function rateLimitKeyFor(sessionId, clientIp, isLiveSession) {
+  return sessionId !== void 0 && isValidSessionId(sessionId) && isLiveSession(sessionId) ? `session:${sessionId}` : `ip:${clientIp}`;
+}
 function isLoopbackAddr(addr) {
   return addr.startsWith("127.") || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -244,7 +262,12 @@ async function createHttpTransport(options) {
     const now = Date.now();
     let entry = rateLimits.get(key);
     if (!entry || now - entry.windowStart > ONE_MINUTE_MS) {
+      if (!entry && rateLimits.size >= MAX_RATE_LIMIT_KEYS) {
+        const oldest = rateLimits.keys().next().value;
+        if (oldest !== void 0) rateLimits.delete(oldest);
+      }
       entry = { count: 0, windowStart: now };
+      rateLimits.delete(key);
       rateLimits.set(key, entry);
     }
     entry.count++;
@@ -423,7 +446,11 @@ async function createHttpTransport(options) {
       }
       if (req.method === "POST") {
         const sessionId = req.headers["mcp-session-id"];
-        const rateLimitKey = sessionId ?? `ip:${getClientIp(req)}`;
+        const rateLimitKey = rateLimitKeyFor(
+          sessionId,
+          getClientIp(req),
+          (id) => sessionManager.hasSession(id)
+        );
         if (!checkRateLimit(rateLimitKey)) {
           res.writeHead(429, { "Content-Type": "application/json", "Retry-After": "60" });
           res.end(JSON.stringify({ error: "Rate limit exceeded" }));
@@ -440,9 +467,9 @@ async function createHttpTransport(options) {
         }
         const isInit = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
         if (isInit) {
-          const protocolVersion = req.headers["mcp-protocol-version"];
-          if (protocolVersion && protocolVersion !== MCP_PROTOCOL_VERSION && protocolVersion !== "2025-03-26") {
-            sendJson(res, 400, { error: `Unsupported MCP protocol version: ${protocolVersion}` });
+          const versionError2 = checkProtocolVersion(req);
+          if (versionError2) {
+            sendJson(res, 400, { error: versionError2 });
             return;
           }
           const accept = req.headers.accept;
@@ -463,6 +490,11 @@ async function createHttpTransport(options) {
           await entry2.transport.handleRequest(req, res, body);
           return;
         }
+        const versionError = checkProtocolVersion(req);
+        if (versionError) {
+          sendJson(res, 400, { error: versionError });
+          return;
+        }
         if (!sessionId) {
           sendJson(res, 400, { error: "Missing Mcp-Session-Id header" });
           return;
@@ -516,26 +548,27 @@ async function createHttpTransport(options) {
         `  Sessions: max ${options.maxSessions ?? 100} (${options.maxSessionsPerIp ?? 10}/IP), TTL ${(options.sessionTtlMs ?? 18e5) / 1e3}s
 `
       );
-      process.stderr.write(`  Rate limit: ${rateLimitRpm} req/min per session
+      process.stderr.write(`  Rate limit: ${rateLimitRpm} req/min per session or client address
 `);
       process.stderr.write(
         `  CORS: ${corsOrigins.size > 0 ? [...corsOrigins].join(", ") : "deny all"}
 `
       );
       process.stderr.write(
-        `  Mode: unprotected (token validation deferred to v0.11.x+; deployer auth via reverse proxy)
+        `  Mode: unprotected (no token validation; deploy behind an authenticating reverse proxy)
 `
       );
       resolve2({
         cleanup: async () => {
           await sessionManager.cleanup();
           await new Promise((res) => server.close(() => res()));
-        }
+        },
+        rateLimitKeyCount: () => rateLimits.size
       });
     });
   });
 }
-var ONE_MINUTE_MS, DEFAULT_MAX_REQUEST_BYTES, DEFAULT_RATE_LIMIT_RPM, MAX_SESSION_ID_LENGTH;
+var ONE_MINUTE_MS, DEFAULT_MAX_REQUEST_BYTES, DEFAULT_RATE_LIMIT_RPM, MAX_SESSION_ID_LENGTH, MAX_RATE_LIMIT_KEYS, SUPPORTED_PROTOCOL_VERSIONS;
 var init_http_transport = __esm({
   "src/http-transport.ts"() {
     init_session_manager();
@@ -544,6 +577,8 @@ var init_http_transport = __esm({
     DEFAULT_MAX_REQUEST_BYTES = 1048576;
     DEFAULT_RATE_LIMIT_RPM = 100;
     MAX_SESSION_ID_LENGTH = 128;
+    MAX_RATE_LIMIT_KEYS = 1e4;
+    SUPPORTED_PROTOCOL_VERSIONS = types_js.SUPPORTED_PROTOCOL_VERSIONS;
   }
 });
 
@@ -1990,6 +2025,7 @@ var BUNDLE_TOOL_ANNOTATIONS = {
   openWorldHint: true
 };
 var MAX_INPUT_DEPTH = 10;
+var MAX_TOOL_INPUT_ELEMENTS = 1024;
 function errorCallToolResult(meta, code, message) {
   const errorDef = kernel.ERRORS[code];
   return {
@@ -2098,7 +2134,10 @@ function createPeacMcpServer(options) {
     { name: SERVER_NAME, version },
     // listChanged: false -- tool set is static per server instance (determined
     // at startup from CLI flags). The server never emits notifications/tools/list_changed.
-    { capabilities: { tools: { listChanged: false } } }
+    {
+      capabilities: { tools: { listChanged: false } },
+      maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS
+    }
   );
   const register = server.registerTool.bind(server);
   register(