@peac/mcp-server 0.16.4 → 0.16.5

package/dist/cli.mjs

@@ -2,6 +2,7 @@
 import { randomUUID } from 'crypto';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { createServer } from 'http';
+import { SUPPORTED_PROTOCOL_VERSIONS as SUPPORTED_PROTOCOL_VERSIONS$1 } from '@modelcontextprotocol/sdk/types.js';
 import { stat, realpath, readFile, mkdir, writeFile, rm, mkdtemp, rename, lstat } from 'fs/promises';
 import { Command } from 'commander';
 import { z } from 'zod';
@@ -28,7 +29,7 @@ var SERVER_NAME, SERVER_VERSION, MCP_PROTOCOL_VERSION;
 var init_constants = __esm({
   "src/infra/constants.ts"() {
     SERVER_NAME = "peac-mcp-server";
-    SERVER_VERSION = "0.16.4";
+    SERVER_VERSION = "0.16.5";
     MCP_PROTOCOL_VERSION = "2025-11-25";
   }
 });
@@ -93,6 +94,11 @@ var init_session_manager = __esm({
         }
         return entry;
       }
+      /** Whether an unexpired session exists; unlike getSession(), does not refresh lastSeen. */
+      hasSession(sessionId) {
+        const entry = this.sessions.get(sessionId);
+        return entry !== void 0 && Date.now() - entry.lastSeen <= this.ttlMs;
+      }
       /** Terminate and clean up a specific session */
       async terminateSession(sessionId) {
         const entry = this.sessions.get(sessionId);
@@ -159,8 +165,17 @@ var init_session_manager = __esm({
 // src/http-transport.ts
 var http_transport_exports = {};
 __export(http_transport_exports, {
-  createHttpTransport: () => createHttpTransport
+  MAX_RATE_LIMIT_KEYS: () => MAX_RATE_LIMIT_KEYS,
+  createHttpTransport: () => createHttpTransport,
+  rateLimitKeyFor: () => rateLimitKeyFor
 });
+function checkProtocolVersion(req) {
+  const protocolVersion = req.headers["mcp-protocol-version"];
+  if (protocolVersion && !SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
+    return `Unsupported MCP protocol version: ${protocolVersion} (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`;
+  }
+  return null;
+}
 function isValidSessionId(id) {
   if (id.length === 0 || id.length > MAX_SESSION_ID_LENGTH) return false;
   for (let i = 0; i < id.length; i++) {
@@ -169,6 +184,9 @@ function isValidSessionId(id) {
   }
   return true;
 }
+function rateLimitKeyFor(sessionId, clientIp, isLiveSession) {
+  return sessionId !== void 0 && isValidSessionId(sessionId) && isLiveSession(sessionId) ? `session:${sessionId}` : `ip:${clientIp}`;
+}
 function isLoopbackAddr(addr) {
   return addr.startsWith("127.") || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -223,7 +241,12 @@ async function createHttpTransport(options) {
     const now = Date.now();
     let entry = rateLimits.get(key);
     if (!entry || now - entry.windowStart > ONE_MINUTE_MS) {
+      if (!entry && rateLimits.size >= MAX_RATE_LIMIT_KEYS) {
+        const oldest = rateLimits.keys().next().value;
+        if (oldest !== void 0) rateLimits.delete(oldest);
+      }
       entry = { count: 0, windowStart: now };
+      rateLimits.delete(key);
       rateLimits.set(key, entry);
     }
     entry.count++;
@@ -402,7 +425,11 @@ async function createHttpTransport(options) {
       }
       if (req.method === "POST") {
         const sessionId = req.headers["mcp-session-id"];
-        const rateLimitKey = sessionId ?? `ip:${getClientIp(req)}`;
+        const rateLimitKey = rateLimitKeyFor(
+          sessionId,
+          getClientIp(req),
+          (id) => sessionManager.hasSession(id)
+        );
         if (!checkRateLimit(rateLimitKey)) {
           res.writeHead(429, { "Content-Type": "application/json", "Retry-After": "60" });
           res.end(JSON.stringify({ error: "Rate limit exceeded" }));
@@ -419,9 +446,9 @@ async function createHttpTransport(options) {
         }
         const isInit = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
         if (isInit) {
-          const protocolVersion = req.headers["mcp-protocol-version"];
-          if (protocolVersion && protocolVersion !== MCP_PROTOCOL_VERSION && protocolVersion !== "2025-03-26") {
-            sendJson(res, 400, { error: `Unsupported MCP protocol version: ${protocolVersion}` });
+          const versionError2 = checkProtocolVersion(req);
+          if (versionError2) {
+            sendJson(res, 400, { error: versionError2 });
             return;
           }
           const accept = req.headers.accept;
@@ -442,6 +469,11 @@ async function createHttpTransport(options) {
           await entry2.transport.handleRequest(req, res, body);
           return;
         }
+        const versionError = checkProtocolVersion(req);
+        if (versionError) {
+          sendJson(res, 400, { error: versionError });
+          return;
+        }
         if (!sessionId) {
           sendJson(res, 400, { error: "Missing Mcp-Session-Id header" });
           return;
@@ -495,26 +527,27 @@ async function createHttpTransport(options) {
         `  Sessions: max ${options.maxSessions ?? 100} (${options.maxSessionsPerIp ?? 10}/IP), TTL ${(options.sessionTtlMs ?? 18e5) / 1e3}s
 `
       );
-      process.stderr.write(`  Rate limit: ${rateLimitRpm} req/min per session
+      process.stderr.write(`  Rate limit: ${rateLimitRpm} req/min per session or client address
 `);
       process.stderr.write(
         `  CORS: ${corsOrigins.size > 0 ? [...corsOrigins].join(", ") : "deny all"}
 `
       );
       process.stderr.write(
-        `  Mode: unprotected (token validation deferred to v0.11.x+; deployer auth via reverse proxy)
+        `  Mode: unprotected (no token validation; deploy behind an authenticating reverse proxy)
 `
       );
       resolve2({
         cleanup: async () => {
           await sessionManager.cleanup();
           await new Promise((res) => server.close(() => res()));
-        }
+        },
+        rateLimitKeyCount: () => rateLimits.size
       });
     });
   });
 }
-var ONE_MINUTE_MS, DEFAULT_MAX_REQUEST_BYTES, DEFAULT_RATE_LIMIT_RPM, MAX_SESSION_ID_LENGTH;
+var ONE_MINUTE_MS, DEFAULT_MAX_REQUEST_BYTES, DEFAULT_RATE_LIMIT_RPM, MAX_SESSION_ID_LENGTH, MAX_RATE_LIMIT_KEYS, SUPPORTED_PROTOCOL_VERSIONS;
 var init_http_transport = __esm({
   "src/http-transport.ts"() {
     init_session_manager();
@@ -523,6 +556,8 @@ var init_http_transport = __esm({
     DEFAULT_MAX_REQUEST_BYTES = 1048576;
     DEFAULT_RATE_LIMIT_RPM = 100;
     MAX_SESSION_ID_LENGTH = 128;
+    MAX_RATE_LIMIT_KEYS = 1e4;
+    SUPPORTED_PROTOCOL_VERSIONS = SUPPORTED_PROTOCOL_VERSIONS$1;
   }
 });
 
@@ -1969,6 +2004,7 @@ var BUNDLE_TOOL_ANNOTATIONS = {
   openWorldHint: true
 };
 var MAX_INPUT_DEPTH = 10;
+var MAX_TOOL_INPUT_ELEMENTS = 1024;
 function errorCallToolResult(meta, code, message) {
   const errorDef = ERRORS[code];
   return {
@@ -2077,7 +2113,10 @@ function createPeacMcpServer(options) {
     { name: SERVER_NAME, version },
     // listChanged: false -- tool set is static per server instance (determined
     // at startup from CLI flags). The server never emits notifications/tools/list_changed.
-    { capabilities: { tools: { listChanged: false } } }
+    {
+      capabilities: { tools: { listChanged: false } },
+      maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS
+    }
   );
   const register = server.registerTool.bind(server);
   register(