@productbrain/mcp 0.0.1-beta.11641 → 0.0.1-beta.11653

package/dist/http.js

@@ -2,7 +2,7 @@ import {
   PRODUCT_NAME,
   SERVER_VERSION,
   createProductBrainServer
-} from "./chunk-AHEM4ZWQ.js";
+} from "./chunk-MYUOYKYA.js";
 import {
   DEFAULT_CLOUD_URL,
   PASTE_NOW,
@@ -14,14 +14,14 @@ import {
   hashKey,
   parseFallbackUrls,
   runWithAuth
-} from "./chunk-OVT3HPIV.js";
+} from "./chunk-VX3MF2N3.js";
 
 // src/http.ts
 import { createHash, randomUUID } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import rateLimit from "express-rate-limit";
+import rateLimit2 from "express-rate-limit";
 
 // src/brand/logo-markup.ts
 var SIZE_CLASSES = {
@@ -163,6 +163,9 @@ function send429(res, built) {
   res.status(built.status).json(built.body);
 }
 
+// src/mcpRateLimit.ts
+import rateLimit from "express-rate-limit";
+
 // src/authLockout.ts
 var AUTH_FAILURE_MAX = 10;
 var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
@@ -238,6 +241,41 @@ function keyVerdictGate(verdict, failures, credentialId, now) {
   return "unavailable";
 }
 
+// src/mcpRateLimit.ts
+var MCP_KEY_LIMIT = 120;
+var MCP_IP_CEILING = 1200;
+function mcpRateKey(req) {
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  return auth.status === "absent" ? `ip:${req.ip ?? ""}` : `key:${auth.credentialId}`;
+}
+function limiter(max, windowMs, keyGenerator) {
+  return rateLimit({
+    windowMs,
+    max,
+    standardHeaders: true,
+    legacyHeaders: false,
+    ...keyGenerator ? { keyGenerator } : {},
+    handler: (req, res) => {
+      const r = req.rateLimit;
+      const reset = r?.resetTime?.getTime?.() ?? Date.now() + windowMs;
+      send429(res, buildRateLimitError({
+        retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+        limit: r?.limit ?? max,
+        current: r?.used ?? 0,
+        id: req.body?.id ?? null
+        // mirror the JSON-RPC id when a POST body is present
+      }));
+    }
+  });
+}
+function mcpLimiters(opts = {}) {
+  const windowMs = opts.windowMs ?? 6e4;
+  return [
+    limiter(opts.ipCeiling ?? MCP_IP_CEILING, windowMs),
+    limiter(opts.keyLimit ?? MCP_KEY_LIMIT, windowMs, mcpRateKey)
+  ];
+}
+
 // src/lib/oauthRedirectAllowlist.ts
 var DEFAULT_OAUTH_REDIRECT_URIS = [
   "https://claude.ai/api/mcp/auth_callback",
@@ -412,7 +450,7 @@ function logOAuthDoor(door, status, reason, uris) {
   process.stderr.write(`[oauth] door=${door} status=${status} reason=${JSON.stringify(reason)}${list}
 `);
 }
-var authLimiter = rateLimit({
+var authLimiter = rateLimit2({
   windowMs: 6e4,
   max: 20,
   standardHeaders: true,
@@ -1155,23 +1193,7 @@ app.post(
     res.json(tokenResponse(pending.apiKey));
   }
 );
-var mcpLimiter = rateLimit({
-  windowMs: 6e4,
-  max: 120,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (req, res) => {
-    const r = req.rateLimit;
-    const reset = r?.resetTime?.getTime?.() ?? Date.now() + 6e4;
-    send429(res, buildRateLimitError({
-      retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
-      limit: r?.limit ?? 120,
-      current: r?.used ?? 0,
-      id: req.body?.id ?? null
-      // mirror the JSON-RPC id when a POST body is present
-    }));
-  }
-});
+var mcpLimit = mcpLimiters();
 var authFailures = /* @__PURE__ */ new Map();
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
@@ -1237,7 +1259,7 @@ function logSessionLifecycle(event, sessionId, reason) {
   process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}
 `);
 }
-app.post("/mcp", mcpLimiter, async (req, res) => {
+app.post("/mcp", ...mcpLimit, async (req, res) => {
   const nowTs = Date.now();
   const auth = resolveBearerAuth(req.headers?.authorization);
   const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
@@ -1391,7 +1413,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
     }
   }
 });
-app.get("/mcp", mcpLimiter, async (req, res) => {
+app.get("/mcp", ...mcpLimit, async (req, res) => {
   const nowTs = Date.now();
   const auth = resolveBearerAuth(req.headers?.authorization);
   const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
@@ -1438,7 +1460,7 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     logRequest("GET", "error", sessionId);
   }
 });
-app.delete("/mcp", mcpLimiter, async (req, res) => {
+app.delete("/mcp", ...mcpLimit, async (req, res) => {
   const nowTs = Date.now();
   const auth = resolveBearerAuth(req.headers?.authorization);
   const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);