@protobase/server 0.40.3 → 0.40.5

package/dist/admin-options.d.ts

@@ -55,10 +55,12 @@ export type AdminOptions = {
   /**
    * The MCP endpoint, on with `createAuth({ mcp })`. `sql: true` also offers admins and the `ai` role
    * `run_read_only_query`, which reads the whole database as the app's database role, outside the access rules.
+   * `false`: the host serves its own MCP endpoint at `auth.mcp.path`, in front of this app. This app then answers 404
+   * there and needs no `forAudience`, while the OAuth provider's discovery stays.
    */
   mcp?: {
     sql?: boolean;
-  };
+  } | false;
   /**
    * The websites whose browser code may call the API (`/api/*` but `/api/auth/*`) besides the app's own origins (see
    * `createAuth`'s `origins`): a list of origins, or `*` for any. Defaults to the one the platform passes in

package/dist/create-admin.js

@@ -26,7 +26,7 @@ import { mcpDiscovery } from "./better-auth/mcp/discovery-routes.js";
 import { mcpAuthenticator } from "./mcp/mcp-authenticator.js";
 import { mcpToolContext } from "./mcp/mcp-context.js";
 import { mcpHandler } from "./mcp/mcp-handler.js";
-import { mcpRoutes } from "./mcp/mcp-routes.js";
+import { closedMcpRoutes, mcpRoutes } from "./mcp/mcp-routes.js";
 import { mcpServer } from "./mcp/mcp-server.js";
 import { mcpTools } from "./mcp/mcp-tools.js";
 import { withoutSessionTokens } from "./better-auth/without-session-tokens.js";
@@ -294,10 +294,11 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		}));
 	}
 	const report = options.onUnhandledError ?? ((error) => console.error(error));
-	if (auth?.mcp && mcpAuthenticate) {
+	if (auth?.mcp && options.mcp === false) closedMcpRoutes(app, auth.mcp.path);
+	else if (auth?.mcp && mcpAuthenticate) {
 		const tools = mcpTools({
 			db,
-			sql: options.mcp?.sql === true
+			sql: options.mcp !== false && options.mcp?.sql === true
 		});
 		const server = (session) => mcpServer({
 			info: {

package/dist/mcp/mcp-authenticator.js

@@ -1,10 +1,14 @@
 //#region src/mcp/mcp-authenticator.ts
 const hasAudiences = (authenticate) => typeof authenticate.forAudience === "function";
+const isMcpOptions = (options) => options === void 0 || options === false || typeof options === "object" && options !== null && !Array.isArray(options) && Object.entries(options).every(([name, value]) => name === "sql" && (value === void 0 || typeof value === "boolean"));
 /**
-* The authenticator of the MCP endpoint's tokens, when MCP is on (`createAuth({ mcp })`). Stops the server at startup
-* when `options.mcp` is set without MCP, or when `authenticate` cannot verify tokens for another audience.
+* The authenticator of the MCP endpoint's tokens, when MCP is on (`createAuth({ mcp })`); none when the host serves its
+* own (`options.mcp: false`). Stops the server at startup when `options.mcp` is neither `false` nor `{ sql?: boolean }`,
+* when it is set without MCP, or when `authenticate` cannot verify tokens for another audience.
 */
 const mcpAuthenticator = (authenticate, mcp, options) => {
+	if (!isMcpOptions(options)) throw new Error("options.mcp takes false or { sql?: boolean }");
+	if (options === false) return void 0;
 	if (options && !mcp) throw new Error("options.mcp needs createAuth({ mcp }) passed as auth");
 	if (!mcp) return void 0;
 	if (!hasAudiences(authenticate)) throw new Error("MCP needs authenticate from betterAuthAuthenticator, whose forAudience verifies the MCP tokens");

package/dist/mcp/mcp-routes.js

@@ -11,5 +11,14 @@ const mcpRoutes = (app, { path, handler }) => {
 	}));
 	app.all(path, (c) => handler(c.req.raw));
 };
+/**
+* Answers 404 at `path` and under it, to every method and before any token check, where the host serves its own MCP
+* endpoint in front of this app. It answers itself rather than through `c.notFound()`, which a host mounting this app
+* would answer with its own page.
+*/
+const closedMcpRoutes = (app, path) => {
+	app.all(path, (c) => c.text("404 Not Found", 404));
+	app.all(`${path}/*`, (c) => c.text("404 Not Found", 404));
+};
 //#endregion
-export { mcpRoutes };
+export { closedMcpRoutes, mcpRoutes };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.40.3",
+  "version": "0.40.5",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.40.3",
-    "@protobase/query": "0.40.3",
-    "@protobase/schema": "0.40.3",
+    "@protobase/layout": "0.40.5",
+    "@protobase/query": "0.40.5",
+    "@protobase/schema": "0.40.5",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",