@plaud-ai/mcp 0.1.32 → 0.2.0

package/dist/install-TU2Y3ARS.js

@@ -0,0 +1,370 @@
+import {
+  getClient
+} from "./chunk-7KGB7GSZ.js";
+import {
+  copyToClipboard,
+  getMcpEntry,
+  writeSkillsToClaudeCode
+} from "./chunk-UPEENHCG.js";
+import {
+  skillsCombined
+} from "./chunk-4QBEOJPX.js";
+import "./chunk-SNSGVRCU.js";
+
+// src/install.ts
+import { readFile, writeFile, mkdir } from "fs/promises";
+import { existsSync } from "fs";
+import { createInterface } from "readline/promises";
+import { createServer } from "http";
+import { join, dirname } from "path";
+import { homedir, platform } from "os";
+import { spawnSync } from "child_process";
+import open from "open";
+function claudeDesktopConfigPath() {
+  if (platform() === "darwin") {
+    return join(homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  }
+  if (platform() === "win32") {
+    return join(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json");
+  }
+  return null;
+}
+function claudeCodeDir() {
+  return join(homedir(), ".claude");
+}
+function codexConfigPath() {
+  return join(homedir(), ".codex", "config.toml");
+}
+function detectClients() {
+  const list = [];
+  const cdPath = claudeDesktopConfigPath();
+  list.push({
+    id: "claude-desktop",
+    label: "Claude Desktop",
+    detected: cdPath !== null && (existsSync(cdPath) || existsSync(dirname(cdPath))),
+    configPath: cdPath ?? "(unsupported on this OS)"
+  });
+  const ccDir = claudeCodeDir();
+  list.push({
+    id: "claude-code",
+    label: "Claude Code",
+    detected: existsSync(ccDir),
+    configPath: ccDir
+  });
+  const codexPath = codexConfigPath();
+  list.push({
+    id: "codex",
+    label: "Codex Desktop",
+    detected: existsSync(codexPath) || existsSync(dirname(codexPath)),
+    configPath: codexPath
+  });
+  return list;
+}
+async function prompt(question, defaultYes = true) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const hint = defaultYes ? "Y/n" : "y/N";
+  const answer = (await rl.question(`${question} [${hint}] `)).trim().toLowerCase();
+  rl.close();
+  if (answer === "") return defaultYes;
+  return answer.startsWith("y");
+}
+async function installClaudeDesktop() {
+  const configPath = claudeDesktopConfigPath();
+  if (!configPath) return "skipped (OS not supported)";
+  let config = {};
+  try {
+    const raw = await readFile(configPath, "utf-8");
+    config = JSON.parse(raw);
+  } catch {
+  }
+  const mcpServers = config.mcpServers ?? {};
+  if (mcpServers.plaud) return "already configured";
+  config.mcpServers = { ...mcpServers, plaud: getMcpEntry() };
+  await mkdir(dirname(configPath), { recursive: true });
+  await writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
+  return "configured. Restart Claude Desktop to load the Plaud MCP.";
+}
+async function installClaudeCode() {
+  await writeSkillsToClaudeCode();
+  const { command, args } = getMcpEntry();
+  const manualCmd = `claude mcp add --scope user plaud ${command} ${args.join(" ")}`;
+  const cliCheck = spawnSync("which", ["claude"], { encoding: "utf-8" });
+  if (cliCheck.status !== 0) {
+    return `skills written to ~/.claude/CLAUDE.md. Claude Code CLI not on PATH \u2014 once installed, run:
+  ${manualCmd}`;
+  }
+  const existing = spawnSync("claude", ["mcp", "get", "plaud"], { encoding: "utf-8" });
+  if (existing.status === 0) {
+    return "skills written to ~/.claude/CLAUDE.md. MCP already registered (scope: user).";
+  }
+  const register = spawnSync(
+    "claude",
+    ["mcp", "add", "--scope", "user", "plaud", command, ...args],
+    { encoding: "utf-8" }
+  );
+  if (register.status !== 0) {
+    const err = (register.stderr || register.stdout || "").trim();
+    return `skills written to ~/.claude/CLAUDE.md. Failed to auto-register MCP (${err || "unknown"}). Run manually:
+  ${manualCmd}`;
+  }
+  return "skills written to ~/.claude/CLAUDE.md and MCP registered at user scope.";
+}
+async function installCodex() {
+  const configPath = codexConfigPath();
+  const { command, args } = getMcpEntry();
+  const argsStr = args.map((a) => `"${a}"`).join(", ");
+  const entry = `
+[mcp_servers.plaud]
+command = "${command}"
+args = [${argsStr}]
+`;
+  let content = "";
+  try {
+    content = await readFile(configPath, "utf-8");
+  } catch {
+  }
+  if (content.includes("[mcp_servers.plaud]")) return "already configured";
+  await mkdir(dirname(configPath), { recursive: true });
+  await writeFile(configPath, content + entry, "utf-8");
+  await writeSkillsToClaudeCode();
+  const combined = await skillsCombined();
+  const copied = copyToClipboard(combined);
+  return copied ? "configured. Skills copied to clipboard \u2014 paste into Codex custom instructions, then restart." : "configured. Paste the Plaud skills into Codex custom instructions manually (see docs).";
+}
+var CALLBACK_PORT = 8199;
+var LOGIN_TIMEOUT_MS = 12e4;
+function pickIdentity(user) {
+  for (const k of ["email", "username", "name", "id"]) {
+    const v = user[k];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+async function runLogin() {
+  const client = getClient();
+  try {
+    const existing = await client.auth.getAccessToken();
+    if (existing) {
+      try {
+        const user = await client.getCurrentUser();
+        return { status: "already-authed", who: pickIdentity(user) };
+      } catch {
+        return { status: "already-authed" };
+      }
+    }
+  } catch {
+    await client.auth.logout().catch(() => void 0);
+  }
+  const { url, codeVerifier, state } = client.auth.createAuthorizationRequest();
+  return new Promise((resolve) => {
+    const httpServer = createServer(async (req, res) => {
+      const reqUrl = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
+      if (reqUrl.pathname !== "/auth/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const code = reqUrl.searchParams.get("code");
+      if (!code) {
+        res.writeHead(400);
+        res.end("Missing code");
+        cleanup();
+        resolve({ status: "failed", message: "missing authorization code in callback" });
+        return;
+      }
+      try {
+        await client.auth.exchangeCode(code, codeVerifier, state);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end("<h1>Authentication successful!</h1><p>You can close this tab.</p>");
+        cleanup();
+        let who;
+        try {
+          const user = await client.getCurrentUser();
+          who = pickIdentity(user);
+        } catch {
+        }
+        resolve({ status: "success", who });
+      } catch (err) {
+        res.writeHead(500, { "Content-Type": "text/html" });
+        res.end("<h1>Token exchange failed</h1>");
+        cleanup();
+        resolve({ status: "failed", message: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    let timeoutId;
+    function cleanup() {
+      clearTimeout(timeoutId);
+      httpServer.closeAllConnections?.();
+      httpServer.close();
+    }
+    timeoutId = setTimeout(() => {
+      cleanup();
+      resolve({ status: "timeout" });
+    }, LOGIN_TIMEOUT_MS);
+    httpServer.listen(CALLBACK_PORT, () => {
+      open(url).catch(() => {
+        cleanup();
+        resolve({ status: "failed", message: `could not open browser. Visit manually: ${url}` });
+      });
+    });
+    httpServer.on("error", (err) => {
+      cleanup();
+      resolve({ status: "failed", message: `callback server error: ${err.message}` });
+    });
+  });
+}
+async function runInstall(opts = {}) {
+  console.log("Plaud MCP installer\n");
+  const clients = detectClients();
+  console.log("Detected AI clients:");
+  for (const c of clients) {
+    const mark = c.detected ? "\u2713" : "\xB7";
+    console.log(`  ${mark} ${c.label.padEnd(16)} ${c.detected ? c.configPath : "(not detected)"}`);
+  }
+  console.log();
+  const selected = [];
+  if (opts.yes) {
+    for (const c of clients) {
+      if (c.detected) selected.push(c);
+    }
+    if (selected.length > 0) {
+      console.log(`--yes: configuring ${selected.map((c) => c.label).join(", ")} without prompting.
+`);
+    }
+  } else {
+    for (const c of clients) {
+      if (!c.detected) continue;
+      const yes = await prompt(`Configure ${c.label}?`, true);
+      if (yes) selected.push(c);
+    }
+  }
+  if (selected.length === 0) {
+    console.log("\nNothing to configure. Exiting.");
+    process.exit(0);
+  }
+  console.log();
+  const succeeded = [];
+  for (const c of selected) {
+    process.stdout.write(`\u2192 ${c.label}... `);
+    try {
+      let result = "";
+      if (c.id === "claude-desktop") result = await installClaudeDesktop();
+      else if (c.id === "claude-code") result = await installClaudeCode();
+      else if (c.id === "codex") result = await installCodex();
+      console.log(result);
+      if (!/^(skipped|failed)/i.test(result)) succeeded.push(c);
+    } catch (err) {
+      console.log(`failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const loginOutcome = opts.noLogin ? null : await doLoginStep(Boolean(opts.yes));
+  printNextSteps(succeeded, loginOutcome);
+  process.exit(0);
+}
+async function doLoginStep(nonInteractive) {
+  console.log();
+  console.log("\u2192 Authenticating with Plaud...");
+  const client = getClient();
+  try {
+    const existing = await client.auth.getAccessToken();
+    if (existing) {
+      try {
+        const user = await client.getCurrentUser();
+        const who = pickIdentity(user);
+        console.log(`  already signed in${who ? ` as ${who}` : ""} \u2014 skipping OAuth.`);
+        return { status: "already-authed", who };
+      } catch {
+        console.log("  token present but user lookup failed \u2014 will re-auth.");
+      }
+    }
+  } catch {
+  }
+  if (!nonInteractive) {
+    const yes = await prompt("Log in to Plaud now? (opens browser)", true);
+    if (!yes) {
+      console.log("  skipped \u2014 you'll be prompted on first tool call after restart.");
+      return null;
+    }
+  }
+  console.log("  opening browser \u2014 click Authorize to finish.");
+  const outcome = await runLogin();
+  switch (outcome.status) {
+    case "already-authed":
+      console.log(`  already signed in${outcome.who ? ` as ${outcome.who}` : ""}.`);
+      break;
+    case "success":
+      console.log(`  \u2713 authenticated${outcome.who ? ` as ${outcome.who}` : ""}.`);
+      break;
+    case "timeout":
+      console.log("  \u2717 timed out after 2 minutes \u2014 you can retry with `plaud-mcp install --yes` or run `login` from your AI client.");
+      break;
+    case "failed":
+      console.log(`  \u2717 failed: ${outcome.message}`);
+      break;
+  }
+  return outcome;
+}
+function restartLine(id) {
+  switch (id) {
+    case "claude-desktop":
+      return "Fully quit Claude Desktop (\u2318Q on macOS) and reopen it \u2014 closing the window is not enough.";
+    case "claude-code":
+      return "Exit any running Claude Code session and start a new `claude` session.";
+    case "codex":
+      return "Quit Codex Desktop and reopen it.";
+  }
+}
+function printNextSteps(clients, login) {
+  console.log();
+  if (clients.length === 0) {
+    console.log("No clients were configured. Nothing to do.");
+    return;
+  }
+  const authed = login?.status === "already-authed" || login?.status === "success";
+  const bar = "\u2500".repeat(60);
+  console.log(bar);
+  console.log(`\u2713 Plaud MCP installed for: ${clients.map((c) => c.label).join(", ")}`);
+  if (authed) {
+    console.log(`\u2713 Authenticated${login?.who ? ` as ${login.who}` : ""}`);
+  }
+  console.log(bar);
+  console.log();
+  if (authed) {
+    console.log("NEXT \u2014 one thing left:");
+    console.log();
+    if (clients.length === 1) {
+      console.log(`  ${restartLine(clients[0].id)}`);
+    } else {
+      console.log("  Restart each configured client:");
+      for (const c of clients) {
+        console.log(`    \u2022 ${c.label}: ${restartLine(c.id)}`);
+      }
+    }
+    console.log();
+    console.log("  After restart, Plaud tools are live \u2014 just ask your AI client");
+    console.log('  about your recordings (e.g. "list my recent Plaud recordings").');
+  } else {
+    console.log("NEXT \u2014 do these two things:");
+    console.log();
+    if (clients.length === 1) {
+      console.log(`  1. ${restartLine(clients[0].id)}`);
+    } else {
+      console.log("  1. Restart each configured client:");
+      for (const c of clients) {
+        console.log(`       \u2022 ${c.label}: ${restartLine(c.id)}`);
+      }
+    }
+    console.log();
+    console.log("  2. In any chat with your AI client, type:");
+    console.log();
+    console.log("       list my recent Plaud recordings");
+    console.log();
+    console.log("     This triggers OAuth in your browser (once). Tokens are then");
+    console.log("     stored in ~/.plaud/tokens.json and refreshed automatically.");
+  }
+  console.log();
+  console.log(bar);
+}
+export {
+  runInstall
+};

package/dist/server-3256GMAD.js

@@ -0,0 +1,294 @@
+import {
+  logger,
+  registerTools
+} from "./chunk-MPCF6HMK.js";
+import {
+  PlaudClient
+} from "./chunk-SNSGVRCU.js";
+
+// src/http/server.ts
+import express from "express";
+import { createServer } from "http";
+import { randomUUID as randomUUID2 } from "crypto";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+
+// src/http/oauth-provider.ts
+import { randomUUID } from "crypto";
+import { ProxyOAuthServerProvider } from "@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js";
+var PlaudOAuthProvider = class extends ProxyOAuthServerProvider {
+  _plaudClientId;
+  _plaudClientSecret;
+  _plaudTokenUrl;
+  _plaudApiBase;
+  _callbackUrl;
+  _registeredClients = /* @__PURE__ */ new Map();
+  // internalState → { clientRedirectUri, originalState }
+  // We generate our own state to track the pending flow regardless of whether the client sent one.
+  _pendingStates = /* @__PURE__ */ new Map();
+  // code → internalState: lets exchangeAuthorizationCode include state in the Plaud token request
+  _pendingCodes = /* @__PURE__ */ new Map();
+  constructor(options) {
+    const authUrl = options.authUrl ?? "https://web.plaud.ai/platform/oauth";
+    const tokenUrl = options.tokenUrl ?? "https://platform.plaud.ai/developer/api/oauth/third-party/access-token";
+    const apiBase = options.apiBase ?? "https://platform.plaud.ai/developer/api";
+    super({
+      endpoints: {
+        authorizationUrl: authUrl,
+        tokenUrl
+      },
+      verifyAccessToken: async (token) => {
+        const client = new PlaudClient({
+          clientId: options.clientId,
+          clientSecret: options.clientSecret,
+          redirectUri: "",
+          apiBase,
+          staticToken: token
+        });
+        try {
+          const user = await client.getCurrentUser();
+          let expiresAt;
+          try {
+            const payload = JSON.parse(
+              Buffer.from(token.split(".")[1], "base64url").toString()
+            );
+            expiresAt = typeof payload.exp === "number" ? payload.exp : Math.floor(Date.now() / 1e3) + 3600;
+          } catch {
+            expiresAt = Math.floor(Date.now() / 1e3) + 3600;
+          }
+          const authInfo = {
+            token,
+            clientId: String(user.id ?? "unknown"),
+            scopes: [],
+            expiresAt
+          };
+          logger.info({ event: "token_verified", client_id: authInfo.clientId, expires_at: expiresAt });
+          return authInfo;
+        } catch (err) {
+          logger.warn({ event: "token_verify_failed", error: String(err) });
+          throw new Error("Invalid or expired token");
+        }
+      },
+      getClient: async (id) => this._registeredClients.get(id)
+    });
+    this._plaudClientId = options.clientId;
+    this._plaudClientSecret = options.clientSecret;
+    this._plaudTokenUrl = tokenUrl;
+    this._plaudApiBase = apiBase;
+    this._callbackUrl = options.callbackUrl;
+    this.skipLocalPkceValidation = true;
+  }
+  // Override clientsStore to add in-memory dynamic client registration
+  get clientsStore() {
+    return {
+      getClient: async (id) => this._registeredClients.get(id),
+      registerClient: async (client) => {
+        const full = {
+          ...client,
+          client_id: randomUUID(),
+          client_id_issued_at: Math.floor(Date.now() / 1e3)
+        };
+        this._registeredClients.set(full.client_id, full);
+        return full;
+      }
+    };
+  }
+  /**
+   * Redirect to Plaud using our own registered callback URL.
+   * Store the client's original redirect_uri keyed by state so we can forward after Plaud calls back.
+   */
+  async authorize(_client, params, res) {
+    const internalState = randomUUID();
+    this._pendingStates.set(internalState, {
+      clientRedirectUri: params.redirectUri,
+      originalState: params.state
+    });
+    logger.info({ event: "oauth_authorize_start", internal_state: internalState, redirect_uri: params.redirectUri });
+    const targetUrl = new URL(this._endpoints.authorizationUrl);
+    const searchParams = new URLSearchParams({
+      client_id: this._plaudClientId,
+      response_type: "code",
+      redirect_uri: this._callbackUrl,
+      code_challenge: params.codeChallenge,
+      code_challenge_method: "S256",
+      state: internalState
+      // always send our internal state to Plaud
+    });
+    if (params.scopes?.length) searchParams.set("scope", params.scopes.join(" "));
+    targetUrl.search = searchParams.toString();
+    res.redirect(targetUrl.toString());
+  }
+  /**
+   * Called when Plaud redirects to our /oauth/callback.
+   * Looks up the original client redirect_uri and forwards the code+state to it.
+   */
+  handleCallback(code, state, res) {
+    const pending = this._pendingStates.get(state);
+    if (!pending) {
+      logger.warn({ event: "oauth_callback_unknown_state", state });
+      res.status(400).send("Unknown state \u2014 authorization request not found");
+      return;
+    }
+    this._pendingStates.delete(state);
+    this._pendingCodes.set(code, state);
+    logger.info({ event: "oauth_callback_received", internal_state: state });
+    const target = new URL(pending.clientRedirectUri);
+    target.searchParams.set("code", code);
+    if (pending.originalState) {
+      target.searchParams.set("state", pending.originalState);
+    }
+    res.redirect(target.toString());
+  }
+  // Override to use Plaud's Basic auth + our fixed callback URL for redirect_uri
+  async exchangeAuthorizationCode(_client, authorizationCode, codeVerifier, _redirectUri) {
+    const basicAuth = Buffer.from(
+      `${this._plaudClientId}:${this._plaudClientSecret}`
+    ).toString("base64");
+    const internalState = this._pendingCodes.get(authorizationCode);
+    this._pendingCodes.delete(authorizationCode);
+    const body = {
+      grant_type: "authorization_code",
+      code: authorizationCode,
+      redirect_uri: this._callbackUrl
+    };
+    if (codeVerifier) body.code_verifier = codeVerifier;
+    if (internalState) body.state = internalState;
+    const fetchRes = await fetch(this._plaudTokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        Authorization: `Basic ${basicAuth}`
+      },
+      body: new URLSearchParams(body)
+    });
+    if (!fetchRes.ok) {
+      const text = await fetchRes.text();
+      logger.error({ event: "oauth_token_exchange_failed", status: fetchRes.status, body: text });
+      throw new Error(`Token exchange failed: ${fetchRes.status} ${text}`);
+    }
+    const data = await fetchRes.json();
+    logger.info({ event: "oauth_token_exchange_ok", has_refresh_token: !!data.refresh_token });
+    return {
+      access_token: data.access_token,
+      token_type: data.token_type ?? "Bearer",
+      refresh_token: data.refresh_token,
+      expires_in: data.expires_in
+    };
+  }
+};
+
+// src/http/server.ts
+var HTTP_PORT = Number(process.env.PLAUD_HTTP_PORT ?? 3e3);
+var HTTP_HOST = process.env.PLAUD_HTTP_HOST ?? "0.0.0.0";
+var CALLBACK_PORT = 8199;
+var CALLBACK_PATH = "/auth/callback";
+var CALLBACK_URL = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+function startHttpServer() {
+  const clientId = process.env.PLAUD_MCP_CLIENT_ID ?? process.env.PLAUD_CLIENT_ID ?? "client_9c501dad-8a0d-40b2-a7b0-d1cb8787f674";
+  const clientSecret = process.env.PLAUD_CLIENT_SECRET ?? "";
+  const apiBase = process.env.PLAUD_API_BASE;
+  const serverUrl = process.env.PLAUD_SERVER_URL ?? `http://localhost:${HTTP_PORT}`;
+  const provider = new PlaudOAuthProvider({
+    clientId,
+    clientSecret,
+    callbackUrl: CALLBACK_URL,
+    authUrl: process.env.PLAUD_AUTH_URL,
+    tokenUrl: process.env.PLAUD_TOKEN_URL,
+    apiBase
+  });
+  const issuerUrl = new URL(serverUrl);
+  const app = createMcpExpressApp({ host: HTTP_HOST });
+  app.get("/health", (_req, res) => {
+    res.json({ status: "ok", uptime_s: Math.floor(process.uptime()) });
+  });
+  app.use((req, res, next) => {
+    const reqId = req.headers["x-request-id"] ?? randomUUID2();
+    res.locals["reqId"] = reqId;
+    logger.info({ event: "http_request", req_id: reqId, method: req.method, path: req.url, user_agent: req.headers["user-agent"] ?? null });
+    next();
+  });
+  app.post("/token", express.urlencoded({ extended: false }), (req, _res, next) => {
+    if (req.body?.resource && !URL.canParse(req.body.resource)) {
+      delete req.body.resource;
+    }
+    next();
+  });
+  app.use(
+    mcpAuthRouter({
+      provider,
+      issuerUrl,
+      baseUrl: issuerUrl,
+      resourceName: "Plaud MCP Server"
+    })
+  );
+  app.post(
+    "/mcp",
+    requireBearerAuth({ verifier: provider, resourceMetadataUrl: `${serverUrl}/.well-known/oauth-protected-resource` }),
+    async (req, res) => {
+      const token = req.auth.token;
+      const reqId = res.locals["reqId"] ?? randomUUID2();
+      const reqLog = logger.child({ req_id: reqId });
+      const startMs = Date.now();
+      reqLog.info({ event: "mcp_request_start", client_id: req.auth.clientId });
+      const client = new PlaudClient({
+        clientId,
+        clientSecret,
+        redirectUri: "",
+        apiBase,
+        staticToken: token
+      });
+      const mcpServer = new McpServer({ name: "plaud", version: "0.1.0" });
+      registerTools(mcpServer, client);
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: void 0
+        // stateless
+      });
+      try {
+        await mcpServer.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+        const clientVersion = mcpServer.server.getClientVersion();
+        if (clientVersion) {
+          reqLog.info({ event: "mcp_client_info", client_name: clientVersion.name, client_version: clientVersion.version });
+        }
+        reqLog.info({ event: "mcp_request_end", duration_ms: Date.now() - startMs });
+      } catch (err) {
+        reqLog.error({ event: "mcp_request_error", error: String(err), duration_ms: Date.now() - startMs });
+        if (!res.headersSent) {
+          res.status(500).json({ error: String(err) });
+        }
+      } finally {
+        await mcpServer.close();
+      }
+    }
+  );
+  const callbackApp = express();
+  callbackApp.get(CALLBACK_PATH, (req, res) => {
+    const code = req.query["code"];
+    const state = req.query["state"];
+    if (!code || !state) {
+      logger.warn({ event: "oauth_callback_invalid", code: !!code, state: !!state });
+      res.status(400).send("Missing code or state");
+      return;
+    }
+    provider.handleCallback(code, state, res);
+  });
+  createServer(callbackApp).listen(CALLBACK_PORT, "localhost", () => {
+    logger.info({ event: "server_start", role: "oauth_callback", url: CALLBACK_URL });
+  });
+  app.listen(HTTP_PORT, HTTP_HOST, () => {
+    logger.info({
+      event: "server_start",
+      role: "mcp_http",
+      url: serverUrl,
+      mcp_endpoint: `${serverUrl}/mcp`,
+      oauth_metadata: `${serverUrl}/.well-known/oauth-authorization-server`
+    });
+  });
+}
+export {
+  startHttpServer
+};