@pyai/mcp 0.2.0 → 0.3.0

package/dist/hosted.js

@@ -0,0 +1,2 @@
+export { createMcpServer, MCP_VERSION } from "./server.js";
+export { PyAIClient } from "./client.js";

package/dist/http.js

@@ -1,74 +1,47 @@
-/**
- * Experimental HTTP transport for hosting pyai-mcp remotely (the basis for a
- * one-click remote MCP at mcp.pyai.com).
- *
- * This is a minimal single-response JSON-RPC endpoint: POST a JSON-RPC message,
- * get the JSON-RPC response back. It is intentionally small and dependency-free.
- * NOT YET a full MCP Streamable HTTP server — SSE streaming, session ids
- * (`Mcp-Session-Id`), and OAuth are deploy-time follow-ups before public
- * hosting. The supported install today is `npx @pyai/mcp` over stdio.
- *
- * A per-request `Authorization: Bearer <key>` overrides the env key, so a hosted
- * instance can serve multiple tenants. Each request gets its own client instance:
- * if `create_sandbox_key` adopts a key, that mutation is confined to the single
- * request and cannot leak into the next caller. Full remote MCP session support
- * still needs Streamable HTTP session ids before public hosting.
- */
+/** Loopback development host. Production OAuth is hosted by the control plane. */
 import { createServer } from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createMcpServer } from "./server.js";
 import { PyAIClient } from "./client.js";
-import { dispatch } from "./rpc.js";
-const MAX_BODY_BYTES = 1_000_000;
+import { localContext } from "./tools.js";
 export function startHttpServer(opts) {
-    const server = createServer((req, res) => {
-        if (req.method === "GET" && (req.url === "/health" || req.url === "/healthz")) {
+    const host = opts.host ?? "127.0.0.1";
+    if (!["127.0.0.1", "::1", "localhost"].includes(host))
+        throw Error("Development HTTP binds to loopback only. Use the hosted OAuth endpoint for remote clients.");
+    const server = createServer(async (req, res) => {
+        if (req.url === "/healthz" && req.method === "GET") {
             res.writeHead(200, { "content-type": "application/json" });
-            res.end(JSON.stringify({ status: "ok", server: "pyai-mcp" }));
+            res.end('{"status":"ok"}');
             return;
         }
-        if (req.method !== "POST") {
-            res.writeHead(405, { "content-type": "application/json", allow: "POST" });
-            res.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "Use POST for JSON-RPC" } }));
+        if (req.url !== "/mcp") {
+            res.writeHead(404);
+            res.end();
             return;
         }
-        const auth = req.headers["authorization"];
-        const bearer = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7).trim() : "";
-        const client = new PyAIClient({ apiKey: bearer || opts.apiKey, baseUrl: opts.baseUrl });
-        let raw = "";
-        let aborted = false;
-        req.on("data", (chunk) => {
-            raw += chunk;
-            if (raw.length > MAX_BODY_BYTES) {
-                aborted = true;
-                res.writeHead(413, { "content-type": "application/json" });
-                res.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "Payload too large" } }));
-                req.destroy();
-            }
+        const mcp = createMcpServer(new PyAIClient({ apiKey: opts.apiKey, baseUrl: opts.baseUrl }), { ...localContext, mode: "http" });
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+            enableDnsRebindingProtection: true,
+            allowedHosts: ["127.0.0.1", "localhost", "[::1]"].map((h) => `${h}:${server.address().port}`),
+            allowedOrigins: ["127.0.0.1", "localhost", "[::1]"].map((h) => `http://${h}:${server.address().port}`),
         });
-        req.on("end", () => {
-            if (aborted)
-                return;
-            let msg;
-            try {
-                msg = JSON.parse(raw);
-            }
-            catch {
-                res.writeHead(400, { "content-type": "application/json" });
-                res.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } }));
-                return;
-            }
-            dispatch(msg, { client })
-                .then((out) => {
-                res.writeHead(200, { "content-type": "application/json" });
-                // Notifications (no id) get an empty 200 ack.
-                res.end(out ? JSON.stringify(out) : "");
-            })
-                .catch(() => {
-                res.writeHead(500, { "content-type": "application/json" });
-                res.end(JSON.stringify({ jsonrpc: "2.0", id: msg.id ?? null, error: { code: -32603, message: "Internal error" } }));
-            });
+        res.on("close", () => {
+            void transport.close();
+            void mcp.close();
         });
+        try {
+            await mcp.connect(transport);
+            await transport.handleRequest(req, res);
+        }
+        catch {
+            if (!res.headersSent) {
+                res.writeHead(500);
+                res.end('{"error":"server_error"}');
+            }
+        }
     });
-    server.listen(opts.port, opts.host ?? "0.0.0.0", () => {
-        process.stderr.write(`pyai-mcp: HTTP transport listening on ${opts.host ?? "0.0.0.0"}:${opts.port}\n`);
-    });
+    server.listen(opts.port, host, () => process.stderr.write(`PyAI MCP development endpoint: http://${host}:${server.address().port}/mcp\n`));
+    return server;
 }

package/dist/index.js

@@ -1,67 +1,70 @@
 #!/usr/bin/env node
-/**
- * pyai-mcp — Model Context Protocol server for the PyAI API.
- *
- * Exposes PyAI operations (sandbox key minting, models, voices, TTS, async
- * transcription) as MCP tools so AI coding agents (Cursor, Claude Code, Codex)
- * can call them directly. Default transport is stdio: reads newline-delimited
- * JSON-RPC from stdin, writes responses to stdout. All diagnostics go to stderr
- * so they never corrupt the protocol. Pass `--http` for the experimental HTTP
- * transport (for hosting a remote server).
- *
- * Config (env):
- *   PYAI_API_KEY   (OPTIONAL) — a pyai_live_ or pyai_test_ key. If absent, the
- *                  server still starts; call the `create_sandbox_key` tool to
- *                  mint one with no human steps.
- *   PYAI_BASE_URL  (optional) — defaults to https://api.pyai.com.
- *   PORT           (optional, --http only) — defaults to 8080.
- */
-import { createInterface } from "node:readline";
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { PyAIClient } from "./client.js";
-import { dispatch } from "./rpc.js";
+import { createMcpServer, MCP_VERSION } from "./server.js";
 import { startHttpServer } from "./http.js";
-function startStdio(client) {
-    const rl = createInterface({ input: process.stdin });
-    const write = (obj) => process.stdout.write(`${JSON.stringify(obj)}\n`);
-    rl.on("line", (line) => {
-        const trimmed = line.trim();
-        if (!trimmed)
-            return;
-        let msg;
-        try {
-            msg = JSON.parse(trimmed);
-        }
-        catch {
-            write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } });
-            return;
-        }
-        // Process sequentially; each line is an independent JSON-RPC message.
-        dispatch(msg, { client })
-            .then((res) => {
-            if (res)
-                write(res);
-        })
-            .catch((err) => {
-            process.stderr.write(`pyai-mcp: dispatch error: ${err.message}\n`);
-            if (msg.id !== undefined && msg.id !== null) {
-                write({ jsonrpc: "2.0", id: msg.id, error: { code: -32603, message: "Internal error" } });
-            }
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.includes("--version")) {
+        process.stdout.write(MCP_VERSION + "\n");
+        return;
+    }
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`PyAI MCP ${MCP_VERSION}\n\nRemote endpoint: https://api.pyai.com/mcp\n  Add this URL in ChatGPT, Claude, Cursor or Codex and approve browser login.\n\nLocal use:\n  pyai-mcp login [--no-browser] [--profile NAME]   Sign in using the PyAI CLI\n  pyai-mcp [--profile NAME]                      Serve MCP over stdio\n  pyai-mcp --http                               Loopback development server\n\nPYAI_API_KEY overrides the selected local profile. No credentials are printed.\n`);
+        return;
+    }
+    // The dependency is pinned: these tested internal modules share exactly the CLI's
+    // permission checks, profile format and browser device flow without a second store.
+    const sdkEntry = import.meta.resolve("@pyai/sdk");
+    if (args[0] === "login") {
+        const child = spawn(process.execPath, [fileURLToPath(new URL("./cli.js", sdkEntry)), "login", ...args.slice(1)], { stdio: "inherit", env: process.env });
+        child.on("exit", (code) => {
+            process.exitCode = code ?? 1;
         });
-    });
-    rl.on("close", () => process.exit(0));
-    process.stderr.write("pyai-mcp: ready on stdio\n");
-}
-function main() {
-    const apiKey = process.env.PYAI_API_KEY;
-    const baseUrl = process.env.PYAI_BASE_URL;
-    if (!apiKey) {
-        process.stderr.write("pyai-mcp: no PYAI_API_KEY set — call the create_sandbox_key tool to mint a free key.\n");
+        child.on("error", () => {
+            process.stderr.write("Could not start PyAI login.\n");
+            process.exitCode = 1;
+        });
+        return;
+    }
+    let profile;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--http")
+            continue;
+        if (args[i] === "--profile" && args[i + 1]) {
+            profile = args[++i];
+            continue;
+        }
+        throw Error(`Unknown option: ${args[i]}. Run pyai-mcp --help.`);
     }
-    if (process.argv.includes("--http")) {
+    const { resolveConfig } = (await import(__rewriteRelativeImportExtension(new URL("./cli-config.js", sdkEntry).href)));
+    const config = await resolveConfig({ profile });
+    if (args.includes("--http")) {
         const port = Number(process.env.PORT ?? 8080);
-        startHttpServer({ apiKey, baseUrl, port });
+        if (!Number.isInteger(port) || port < 0 || port > 65535)
+            throw Error("Invalid PORT.");
+        startHttpServer({ apiKey: config.apiKey, baseUrl: config.baseURL, port });
         return;
     }
-    startStdio(new PyAIClient({ apiKey, baseUrl }));
+    const server = createMcpServer(new PyAIClient({ apiKey: config.apiKey, baseUrl: config.baseURL }));
+    await server.connect(new StdioServerTransport());
+    process.stderr.write("PyAI MCP ready. " +
+        (config.apiKey
+            ? "Using your authorized PyAI profile."
+            : "Run pyai-mcp login to connect your account.") +
+        "\n");
 }
-main();
+main().catch(() => {
+    process.stderr.write("PyAI MCP could not start. Check your options and profile with pyai-mcp --help or run pyai-mcp login.\n");
+    process.exitCode = 1;
+});

package/dist/rpc.js

@@ -10,8 +10,8 @@
  * response or null for notifications) so it unit-tests without spawning a process.
  */
 import { callTool, TOOLS } from "./tools.js";
-export const PROTOCOL_VERSION = "2024-11-05";
-export const SERVER_INFO = { name: "pyai-mcp", version: "0.2.0" };
+export const PROTOCOL_VERSION = "2025-11-25";
+export const SERVER_INFO = { name: "pyai-mcp", version: "0.3.0" };
 function ok(id, result) {
     return { jsonrpc: "2.0", id: id ?? null, result };
 }
@@ -31,7 +31,7 @@ export async function dispatch(msg, deps) {
                 serverInfo: SERVER_INFO,
             });
         case "notifications/initialized":
-            return null; // notification — no response
+            return null; // notification, no response
         case "ping":
             return ok(msg.id, {});
         case "tools/list":

package/dist/server.js

@@ -0,0 +1,93 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, McpError, ErrorCode, } from "@modelcontextprotocol/sdk/types.js";
+import { TOOLS, TOOL_SCOPES, callTool, localContext, } from "./tools.js";
+import { GUIDE, RESOURCES, SERVER_INSTRUCTIONS, WORKFLOWS, } from "./workflows.js";
+export const MCP_VERSION = "0.3.0";
+export function createMcpServer(client, context = localContext) {
+    const server = new Server({
+        name: "pyai",
+        version: MCP_VERSION,
+        title: "PyAI Voice AI",
+        websiteUrl: "https://pyai.com/mcp",
+    }, {
+        capabilities: { tools: {}, resources: {}, prompts: {} },
+        instructions: SERVER_INSTRUCTIONS,
+    });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: TOOLS.filter((t) => context.mode === "stdio" || t.name !== "create_sandbox_key").map((t) => context.mode === "stdio"
+            ? t
+            : {
+                ...t,
+                securitySchemes: [
+                    {
+                        type: "oauth2",
+                        scopes: TOOL_SCOPES[t.name] ? [TOOL_SCOPES[t.name]] : [],
+                    },
+                ],
+                _meta: {
+                    ...t._meta,
+                    securitySchemes: [
+                        {
+                            type: "oauth2",
+                            scopes: TOOL_SCOPES[t.name] ? [TOOL_SCOPES[t.name]] : [],
+                        },
+                    ],
+                },
+            }),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        if (!TOOLS.some((t) => t.name === request.params.name) ||
+            (context.mode === "http" && request.params.name === "create_sandbox_key"))
+            throw new McpError(ErrorCode.InvalidParams, "Unknown tool.");
+        return (await callTool(request.params.name, request.params.arguments ?? {}, client, context));
+    });
+    server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+        resources: RESOURCES,
+    }));
+    server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+        const resource = RESOURCES.find((r) => r.uri === request.params.uri);
+        if (!resource)
+            throw new McpError(ErrorCode.InvalidParams, "Unknown resource.");
+        return {
+            contents: [
+                {
+                    uri: resource.uri,
+                    mimeType: resource.mimeType,
+                    text: resource.uri === "pyai://guide" ? GUIDE : JSON.stringify(WORKFLOWS),
+                },
+            ],
+        };
+    });
+    server.setRequestHandler(ListPromptsRequestSchema, async () => ({
+        prompts: Object.entries(WORKFLOWS).map(([name, w]) => ({
+            name,
+            title: w.title,
+            description: w.example,
+            arguments: [
+                {
+                    name: "task",
+                    description: "The user-authorized task, without credentials.",
+                    required: true,
+                },
+            ],
+        })),
+    }));
+    server.setRequestHandler(GetPromptRequestSchema, async (request) => {
+        const workflow = WORKFLOWS[request.params.name];
+        if (!workflow || !request.params.arguments?.task)
+            throw new McpError(ErrorCode.InvalidParams, "Choose a workflow and provide task.");
+        return {
+            description: workflow.title,
+            messages: [
+                {
+                    role: "user",
+                    content: {
+                        type: "text",
+                        text: `User task: ${request.params.arguments.task}\n\nAvailable workflow: ${workflow.steps.join(" ")}\nTools: ${workflow.tools.join(", ")}\nUse the authorized project. Do not invent input media or credentials.`,
+                    },
+                },
+            ],
+        };
+    });
+    return server;
+}