@quantakrypto/mcp 0.1.0

package/HOSTING.md

@@ -0,0 +1,184 @@
+# Hosting quantakrypto MCP as a remote service
+
+This document describes how to run `@quantakrypto/mcp` as a hosted, multi-tenant
+service rather than a per-user local stdio process. The shipped `src/http.ts` is
+the minimal, working core of this design; everything below is the path from that
+scaffold to production.
+
+## 0. Safe-by-default posture (what `src/http.ts` enforces today)
+
+The stdio transport trusts the local user and is fully featured. The HTTP
+transport is **hardened by default** (P0-1 / security-audit Q-01–Q-03) because a
+hosted endpoint is reachable by untrusted peers. Out of the box `node dist/http.js`:
+
+- **Binds to `127.0.0.1`**, not `0.0.0.0`. Override with `QUANTAKRYPTO_MCP_HOST`.
+  Binding to a **non-loopback host without a token is refused at startup** — an
+  unauthenticated, network-reachable tool server would be an open relay into the
+  arbitrary-file-read tools.
+- **Requires Bearer auth when `QUANTAKRYPTO_MCP_TOKEN` is set.** Every `/mcp` request
+  must carry `Authorization: Bearer <token>`; auth is checked *before* the body
+  is read or dispatched. Missing/invalid token → `401` with `WWW-Authenticate: Bearer`.
+  `GET /health` is unauthenticated.
+- **Gates the filesystem tools off by default.** `scan_path`, `inventory_crypto`
+  and `generate_cbom` take a client-supplied path straight into `core.scan` and
+  would otherwise be an arbitrary-directory reader (`/etc`, `/root/.ssh`, …) with
+  matched-line snippets echoed back. Over HTTP they are registered **only when
+  `QUANTAKRYPTO_MCP_ALLOW_FS=1`**, so both `tools/list` and `tools/call` reflect the
+  gate. The knowledge tools (`explain_finding`, `suggest_hybrid`, `list_rules`)
+  are pure and always exposed. The gating is a pure function (`gateHttpTools`),
+  unit-tested in `test/http.test.ts`.
+- **Bounds each request.** A 1 MiB request-body cap (always), a per-request tool
+  timeout (`QUANTAKRYPTO_MCP_TIMEOUT_MS`, default 30 s → `504`) and a response-size cap
+  (`QUANTAKRYPTO_MCP_MAX_RESPONSE_BYTES`, default 4 MiB → `500`).
+
+| Env var | Default | Purpose |
+| --- | --- | --- |
+| `QUANTAKRYPTO_MCP_HOST` (or `HOST`) | `127.0.0.1` | Bind interface. Non-loopback **requires** a token. |
+| `PORT` | `3000` | Listen port. |
+| `QUANTAKRYPTO_MCP_TOKEN` | _(unset)_ | When set, requires `Authorization: Bearer <token>`. |
+| `QUANTAKRYPTO_MCP_ALLOW_FS` | _(off)_ | `1`/`true` exposes the filesystem tools over HTTP. |
+| `QUANTAKRYPTO_MCP_TIMEOUT_MS` | `30000` | Per-request tool-execution deadline. |
+| `QUANTAKRYPTO_MCP_MAX_RESPONSE_BYTES` | `4194304` | Response-body size cap. |
+
+**Design choice — refuse vs. warn on a wide-open bind.** Binding to a
+non-loopback host with `QUANTAKRYPTO_MCP_TOKEN` unset is **refused** (startup fails)
+rather than merely warned, because the failure mode is severe and silent (an
+internet-reachable arbitrary-tool endpoint). A non-loopback bind *with* a token
+is allowed but emits a hard `WARNING` to stderr. Even then, the recommendation
+remains to terminate TLS and validate keys at a gateway (§3) and to leave the
+filesystem tools off unless the path surface is sandboxed (§3.1 of the security
+audit). The sections below describe the remaining production hardening.
+
+## 1. Transport choice
+
+MCP defines two transports:
+
+- **stdio** — newline-delimited JSON over a child process's stdin/stdout. Ideal
+  for *local* agents (Claude Desktop/Code spawns the bin). Not hostable: one
+  process per client, no network surface.
+- **Streamable HTTP** — JSON-RPC over HTTP. A client `POST`s a JSON-RPC message
+  to a single endpoint (`/mcp`) and either gets a JSON response back, or upgrades
+  to an SSE (`text/event-stream`) stream for server-initiated messages.
+
+**For hosting, use Streamable HTTP.** Our `http.ts` implements the JSON
+request/response half (sufficient for stateless tool calls). To fully conform,
+add:
+
+- **SSE responses**: when a client sends `Accept: text/event-stream`, reply with
+  an event stream so the server can push notifications/progress. quantakrypto's tools
+  are currently synchronous request/response, so this is optional until we add
+  long-running scans with progress events.
+- **`GET /mcp`**: opens a standalone SSE stream for server→client messages.
+
+```
+            ┌────────────┐   POST /mcp (JSON-RPC)   ┌──────────────────┐
+  MCP       │            │ ───────────────────────► │  HTTP transport  │
+  client ◄──┤  client    │                          │  (src/http.ts)   │
+            │            │ ◄─── 200 JSON / SSE ───── │                  │
+            └────────────┘                          └────────┬─────────┘
+                                                             │ handle()
+                                                    ┌────────▼─────────┐
+                                                    │   McpServer      │
+                                                    │ (src/server.ts)  │
+                                                    └────────┬─────────┘
+                                                             │ tools
+                                                    ┌────────▼─────────┐
+                                                    │   @quantakrypto/core   │
+                                                    └──────────────────┘
+```
+
+## 2. Multi-tenant sessions
+
+The MCP Streamable HTTP transport uses an **`Mcp-Session-Id`** header. Our
+scaffold echoes a provided id or mints one with `randomUUID()`, but keeps **no
+state** (every request is independent). For production:
+
+1. On `initialize`, mint a session id, create a `Session` record, and return the
+   id in the `Mcp-Session-Id` response header.
+2. Require that header on every subsequent request; reject unknown/expired
+   sessions with `404` (so clients re-`initialize`).
+3. Store per-session state in a shared store (Redis / Postgres), **not** process
+   memory, so any instance behind a load balancer can serve any session:
+   - tenant/identity, negotiated protocol version, capabilities;
+   - rate-limit counters, usage metering;
+   - any in-flight long-running scan handles.
+4. Expire idle sessions (TTL) and support explicit teardown
+   (`DELETE /mcp` with the session header).
+
+Keep the `McpServer` instance **stateless and shared** across sessions — it
+already is (the only mutable field is an informational `initialized` flag, which
+should move into the session record once sessions exist).
+
+## 3. Authentication & API keys
+
+stdio trusts the local user; a hosted endpoint must not.
+
+- **API keys / bearer tokens.** Require `Authorization: Bearer <token>` on
+  `/mcp`. Validate before `readBody`/dispatch. Map the key → tenant for metering
+  and quotas. This is the natural place to gate access in `handleMcpPost`.
+- **OAuth 2.1.** The MCP spec defines an OAuth flow for HTTP transports
+  (Protected Resource Metadata + Authorization Server). For first-party clients,
+  scoped API keys are simpler; add OAuth when third-party clients must connect on
+  a user's behalf.
+- **mTLS / network policy.** For internal/enterprise deployments, terminate mTLS
+  at the gateway and keep `/mcp` private.
+- Never log request bodies that may contain source code; treat scanned content
+  as sensitive.
+
+## 4. Rate limiting & quotas
+
+- **Per-key token bucket** at the edge (gateway) and a backstop in-process limit.
+  Scans are CPU- and I/O-bound, so limit by *concurrent scans* per tenant, not
+  just request rate.
+- **Body size cap** — already enforced (`MAX_BODY_BYTES`, 1 MiB). Make it
+  configurable and tenant-tiered.
+- **Per-call timeouts** for tool execution; return an `isError` tool result on
+  timeout rather than hanging the connection.
+- **Cost metering** keyed by session/tenant for billing and abuse detection.
+
+## 5. Scaling
+
+- **Stateless app tier.** With sessions in a shared store, run N replicas behind
+  an L7 load balancer; no sticky sessions needed for request/response. *Sticky
+  routing is required only for long-lived SSE streams* — pin those to the
+  instance that owns the stream, or use a pub/sub fan-out (Redis) so any instance
+  can deliver server→client events.
+- **Horizontal autoscale** on CPU (scans are CPU-heavy). Consider offloading
+  large scans to a worker queue and returning progress over SSE.
+- **Caching.** Cache `tools/list`, `list_rules`, and remediation lookups (static
+  per core version). Optionally cache scan results keyed by a content hash.
+- **Health & readiness.** `GET /health` exists; add a readiness probe that checks
+  the session store and a liveness probe that excludes it.
+- **Observability.** Structured logs (never bodies), per-method latency/error
+  metrics, and tracing across HTTP → `McpServer.handle` → core.
+
+## 6. What runs server-side vs. in core
+
+| Concern | Where |
+| --- | --- |
+| HTTP framing, sessions, auth, rate limiting, metering | **HTTP transport / gateway** (`src/http.ts` + infra) |
+| JSON-RPC 2.0 dispatch, MCP methods, error mapping | **`McpServer`** (`src/server.ts`) — pure, reused by every transport |
+| Tool schemas, argument validation, result shaping | **Tools** (`src/tools.ts`) |
+| Crypto detection, inventory, remediation knowledge | **`@quantakrypto/core`** — the single source of truth; transports never reimplement detection logic |
+
+The guiding principle: **transports do I/O and policy; `McpServer` does protocol;
+`@quantakrypto/core` does cryptographic analysis.** Hosting adds an HTTP/edge layer
+around the exact same `McpServer` used over stdio, so behaviour is identical
+whether quantakrypto runs locally or as a service.
+
+## 7. Minimal deployment example
+
+```bash
+# Container entrypoint. A non-loopback bind REQUIRES a token (else startup is
+# refused). Leave QUANTAKRYPTO_MCP_ALLOW_FS unset to keep the filesystem tools off.
+PORT=8080 \
+QUANTAKRYPTO_MCP_HOST=0.0.0.0 \
+QUANTAKRYPTO_MCP_TOKEN="$(cat /run/secrets/quantakrypto_mcp_token)" \
+node dist/http.js
+```
+
+Put it behind a gateway that terminates TLS, validates API keys, applies rate
+limits, and forwards to `/mcp`. Run ≥2 replicas with a shared session store and a
+health check on `/health`. The built-in Bearer check is a backstop; the gateway
+should remain the primary auth boundary. Enable `QUANTAKRYPTO_MCP_ALLOW_FS=1` only when
+the scanned path surface is sandboxed (e.g. a read-only, dedicated mount).

package/README.md

@@ -0,0 +1,227 @@
+# @quantakrypto/mcp
+
+A **Model Context Protocol (MCP) server** that gives AI coding agents post-quantum
+readiness superpowers. It scans code for classical (quantum-vulnerable) asymmetric
+cryptography and recommends NIST post-quantum / hybrid migrations, all backed by
+[`@quantakrypto/core`](../core).
+
+- **Zero runtime dependencies.** The MCP / JSON-RPC 2.0 protocol is implemented
+  from scratch on Node built-ins (`node:readline`, `node:http`, `node:process`).
+  The only dependency is `@quantakrypto/core`.
+- **Two transports.** A `stdio` transport (the `quantakrypto-mcp` bin) for local agents
+  like Claude, and a hostable `http` transport for running quantakrypto as a remote
+  service (see [HOSTING.md](./HOSTING.md)).
+- **Transport-agnostic core.** All protocol logic lives in a pure, unit-tested
+  `McpServer` class; transports only do I/O.
+
+## Install / register with an MCP client
+
+The published package exposes a `quantakrypto-mcp` binary that speaks MCP over stdio:
+
+```bash
+# Claude Code / Claude Desktop
+claude mcp add quantakrypto npx @quantakrypto/mcp
+```
+
+Equivalently, in an MCP client config:
+
+```json
+{
+  "mcpServers": {
+    "quantakrypto": {
+      "command": "npx",
+      "args": ["@quantakrypto/mcp"]
+    }
+  }
+}
+```
+
+The bin is `quantakrypto-mcp` (→ `dist/stdio.js`). You can also run it directly:
+
+```bash
+node dist/stdio.js
+```
+
+## Protocol
+
+MCP **stdio transport** is newline-delimited JSON: exactly one JSON-RPC 2.0
+message per line on stdin/stdout (this is *not* HTTP-style `Content-Length`
+framing). Supported methods:
+
+| Method | Notes |
+| --- | --- |
+| `initialize` | Replies with `protocolVersion`, `capabilities.tools.listChanged = false`, and `serverInfo { name: "quantakrypto", version }`. |
+| `notifications/initialized` | Notification; no response. |
+| `ping` | Replies `{}`. |
+| `tools/list` | Lists all tools with JSON-Schema `inputSchema`. |
+| `tools/call` | Runs a tool, returns `{ content: [...], isError? }`. |
+
+Unknown methods return JSON-RPC error `-32601`; bad params return `-32602`;
+unparseable input returns `-32700`; non-request objects return `-32600`.
+
+## Tools
+
+Each tool returns MCP content: `{ content: [{ type: "text", text }], isError? }`.
+
+### `scan_path`
+
+Scan a file or directory for quantum-vulnerable cryptography.
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "path":   { "type": "string", "description": "Path to scan." },
+    "format": { "type": "string", "enum": ["summary", "json"] }
+  },
+  "required": ["path"]
+}
+```
+
+Returns a readiness summary (or the raw `ScanResult` JSON when `format: "json"`).
+
+### `inventory_crypto`
+
+Produce a 0–100 readiness score plus counts by algorithm, category, and severity.
+
+```json
+{
+  "type": "object",
+  "properties": { "path": { "type": "string" } },
+  "required": ["path"]
+}
+```
+
+### `explain_finding`
+
+Explain a finding and its remediation. Provide a `ruleId`, an `algorithm`, or both.
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "ruleId":    { "type": "string" },
+    "algorithm": { "type": "string", "description": "RSA, ECDH, ECDSA, …" }
+  }
+}
+```
+
+### `suggest_hybrid`
+
+Recommend a PQC / hybrid migration from an `algorithm` or free-text `context`.
+
+```json
+{
+  "type": "object",
+  "properties": {
+    "algorithm": { "type": "string" },
+    "context":   { "type": "string" }
+  }
+}
+```
+
+### `list_rules`
+
+List the quantakrypto detector catalog (ids + descriptions). No input.
+
+```json
+{ "type": "object", "properties": {} }
+```
+
+### `generate_cbom`
+
+Scan a path and emit a **CycloneDX 1.6 Cryptographic Bill of Materials (CBOM)**
+of the classical cryptographic assets found, for compliance / supply-chain
+tooling. Reads the filesystem, so it is gated like `scan_path` over HTTP.
+
+```json
+{
+  "type": "object",
+  "properties": { "path": { "type": "string" } },
+  "required": ["path"]
+}
+```
+
+## Hosted HTTP server (safe-by-default)
+
+The same `McpServer` can be served over HTTP (a Streamable-HTTP-style JSON-RPC
+endpoint) for remote deployments. The stdio transport trusts the local user and
+is fully featured; the **HTTP transport is hardened**, because a hosted endpoint
+is reachable by untrusted peers:
+
+- **Binds to `127.0.0.1` by default** (not `0.0.0.0`). Override via
+  `QUANTAKRYPTO_MCP_HOST`. Binding to a non-loopback host **without a token is refused
+  at startup** (it would be an open, unauthenticated tool relay).
+- **Bearer-token auth.** Set `QUANTAKRYPTO_MCP_TOKEN` and every `/mcp` request must
+  send `Authorization: Bearer <token>`, else `401`. With no token set, only the
+  loopback bind is allowed.
+- **Filesystem tools are disabled by default.** `scan_path`, `inventory_crypto`
+  and `generate_cbom` read arbitrary server paths, so over HTTP they are exposed
+  only when `QUANTAKRYPTO_MCP_ALLOW_FS=1`. The knowledge tools (`explain_finding`,
+  `suggest_hybrid`, `list_rules`) are always available. `tools/list` and
+  `tools/call` both reflect the gating.
+- **Limits.** A 1 MiB request-body cap (always), a per-request tool timeout
+  (`QUANTAKRYPTO_MCP_TIMEOUT_MS`, default 30000 → `504` on timeout) and a response-size
+  cap (`QUANTAKRYPTO_MCP_MAX_RESPONSE_BYTES`, default 4 MiB).
+
+| Env var | Default | Purpose |
+| --- | --- | --- |
+| `QUANTAKRYPTO_MCP_HOST` (or `HOST`) | `127.0.0.1` | Bind interface. Non-loopback requires a token. |
+| `PORT` | `3000` | Listen port. |
+| `QUANTAKRYPTO_MCP_TOKEN` | _(unset)_ | When set, requires `Authorization: Bearer <token>`. |
+| `QUANTAKRYPTO_MCP_ALLOW_FS` | _(off)_ | `1`/`true` exposes the filesystem tools over HTTP. |
+| `QUANTAKRYPTO_MCP_TIMEOUT_MS` | `30000` | Per-request tool-execution deadline. |
+| `QUANTAKRYPTO_MCP_MAX_RESPONSE_BYTES` | `4194304` | Response-body size cap. |
+
+```bash
+# Local, knowledge tools only (default safe posture)
+node dist/http.js
+
+# Local with the filesystem tools enabled
+QUANTAKRYPTO_MCP_ALLOW_FS=1 node dist/http.js
+
+# Reachable from the network: a token is mandatory
+QUANTAKRYPTO_MCP_HOST=0.0.0.0 QUANTAKRYPTO_MCP_TOKEN="$(openssl rand -hex 32)" node dist/http.js
+```
+
+Endpoints:
+
+- `POST /mcp` — one JSON-RPC 2.0 message; the JSON-RPC response is the
+  `application/json` body. Notifications get `202` with no body. An
+  `mcp-session-id` header is echoed or minted on each request.
+- `GET /health` — liveness probe returning `{ "status": "ok" }` (no auth).
+
+```bash
+curl -s localhost:3000/health
+curl -s localhost:3000/mcp \
+  -H 'content-type: application/json' \
+  -H 'authorization: Bearer YOUR_TOKEN' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
+```
+
+See [HOSTING.md](./HOSTING.md) for the full production design (auth, multi-tenant
+sessions, rate limiting, scaling). A sample request/response transcript lives in
+[`examples/transcript.jsonl`](./examples/transcript.jsonl).
+
+## Programmatic use
+
+```ts
+import { createQuantakryptoServer } from "@quantakrypto/mcp";
+
+const server = createQuantakryptoServer();
+const res = await server.handle({ jsonrpc: "2.0", id: 1, method: "tools/list" });
+```
+
+## Development
+
+```bash
+npm run build   # tsc -b
+npm test        # node --import tsx --test test/*.test.ts
+```
+
+Tests drive `McpServer.handle` directly (and the stdio loop via in-memory
+streams) — no process spawning.
+
+## License
+
+Apache-2.0

package/dist/http.d.ts

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+/**
+ * quantakrypto MCP — hostable HTTP transport (Streamable-HTTP-style JSON-RPC).
+ *
+ * A zero-dependency {@link node:http} server that exposes the same
+ * {@link McpServer} over HTTP so the quantakrypto MCP can run as a remote service:
+ *
+ *   POST /mcp     — body is a single JSON-RPC 2.0 message; the JSON-RPC
+ *                   response is returned as the 200 response body
+ *                   (`application/json`). Notifications get HTTP 202 with no body.
+ *   GET  /health  — liveness probe, returns `{ status: "ok", ... }`.
+ *
+ * This is the minimal-but-working core of the MCP Streamable HTTP transport.
+ * The full spec also supports an SSE response (`text/event-stream`) for
+ * server-initiated messages; this server speaks the JSON request/response half,
+ * which is sufficient for stateless tool calls. See HOSTING.md for the
+ * production design (auth, multi-tenant sessions, rate limiting, scaling).
+ *
+ * SAFE-BY-DEFAULT POSTURE (P0-1). Unlike the stdio transport — which trusts the
+ * local user and stays fully featured — the HTTP transport is hardened because a
+ * hosted endpoint is reachable by untrusted peers:
+ *
+ *   - Binds to 127.0.0.1 by default (NOT 0.0.0.0). Override with QUANTAKRYPTO_MCP_HOST.
+ *   - Bearer-token auth: when QUANTAKRYPTO_MCP_TOKEN is set, every /mcp request must
+ *     send `Authorization: Bearer <token>` (else 401). Binding to a non-loopback
+ *     host WITHOUT a token is refused at startup (it would be an open relay).
+ *   - The filesystem tools (scan_path, inventory_crypto, generate_cbom) read
+ *     arbitrary server paths and are DISABLED over HTTP unless QUANTAKRYPTO_MCP_ALLOW_FS=1
+ *     (security audit Q-01). The knowledge tools (explain_finding, suggest_hybrid,
+ *     list_rules) are always available. Gating is enforced by registering only the
+ *     permitted tools, so tools/list and tools/call both reflect it.
+ *   - Per-request timeout (QUANTAKRYPTO_MCP_TIMEOUT_MS) and a response-size cap
+ *     (QUANTAKRYPTO_MCP_MAX_RESPONSE_BYTES), in addition to the 1 MiB request-body cap.
+ *
+ * Run with `node dist/http.js` (PORT/QUANTAKRYPTO_MCP_* from env).
+ */
+import type { Server } from "node:http";
+import type { ToolDefinition } from "./protocol.js";
+import type { McpServer } from "./server.js";
+/** Header carrying the MCP session id (per the Streamable HTTP transport). */
+export declare const SESSION_HEADER = "mcp-session-id";
+export interface HttpServerOptions {
+    /** Port to listen on. Defaults to env PORT or 3000. */
+    port?: number;
+    /** Host/interface to bind. Defaults to QUANTAKRYPTO_MCP_HOST / HOST or "127.0.0.1". */
+    host?: string;
+    /** Bearer token required on /mcp. Defaults to QUANTAKRYPTO_MCP_TOKEN (empty = none). */
+    token?: string;
+    /** Expose the filesystem tools over HTTP. Defaults to QUANTAKRYPTO_MCP_ALLOW_FS=1. */
+    allowFs?: boolean;
+    /** Per-request tool-execution timeout (ms). Defaults to QUANTAKRYPTO_MCP_TIMEOUT_MS. */
+    timeoutMs?: number;
+    /** Response-body size cap (bytes). Defaults to QUANTAKRYPTO_MCP_MAX_RESPONSE_BYTES. */
+    maxResponseBytes?: number;
+}
+/** A minimal env shape so the config resolver is pure and testable. */
+export type HttpEnv = Record<string, string | undefined>;
+/** Resolved, validated HTTP transport configuration. */
+export interface HttpConfig {
+    host: string;
+    port: number;
+    /** The bearer token, or "" when auth is disabled. */
+    token: string;
+    /** Whether the filesystem tools are exposed over HTTP. */
+    allowFs: boolean;
+    timeoutMs: number;
+    maxResponseBytes: number;
+    /** True when the host is a loopback interface (safe without auth). */
+    loopback: boolean;
+}
+/**
+ * Resolve the HTTP transport config from env + explicit overrides. Pure: does
+ * no I/O and never reads `process` directly. Overrides win over env.
+ */
+export declare function resolveHttpConfig(env: HttpEnv, options?: HttpServerOptions): HttpConfig;
+/** True when binding to `host` keeps the server private to this machine. */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Decide whether a non-loopback bind is permitted. A server reachable from the
+ * network MUST require auth; binding wide-open without a token would be an open,
+ * unauthenticated arbitrary-tool relay. Pure decision used at startup.
+ */
+export declare function startupDecision(config: HttpConfig): {
+    ok: boolean;
+    reason?: string;
+};
+/** A request-authorization outcome. */
+export interface AuthDecision {
+    authorized: boolean;
+    /** HTTP status to use when not authorized. */
+    status?: number;
+    message?: string;
+}
+/**
+ * Decide whether a request is authorized given the configured token and the
+ * incoming Authorization header. When no token is configured, all requests are
+ * allowed (the loopback / trusted-edge case). Pure and testable.
+ */
+export declare function authorizeRequest(token: string, authorizationHeader: string | undefined): AuthDecision;
+/**
+ * Select the tools to expose over HTTP for a given policy. The knowledge tools
+ * are always returned; the filesystem tools are included only when
+ * `allowFs` is true. Pure function of its inputs — the single source of truth
+ * for HTTP tool gating, so tools/list and tools/call stay consistent.
+ */
+export declare function gateHttpTools(tools: readonly ToolDefinition[], allowFs: boolean): ToolDefinition[];
+/**
+ * Build (but do not start) the HTTP server wrapping an {@link McpServer}.
+ * Exposed for testing and for embedding in a larger process. The `config`
+ * carries the resolved auth / timeout / response-cap policy.
+ */
+export declare function createHttpServer(server: McpServer, config: HttpConfig): Server;
+/**
+ * Build the HTTP-facing {@link McpServer}: the same server used over stdio but
+ * with the filesystem tools gated per policy. Exposed for tests.
+ */
+export declare function createHttpMcpServer(config: HttpConfig): McpServer;
+/** Start the HTTP server, resolving once it is listening. */
+export declare function startHttpServer(options?: HttpServerOptions): Promise<Server>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAmB,MAAM,EAAkB,MAAM,WAAW,CAAC;AAQzE,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,eAAe,CAAC;AAErE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,8EAA8E;AAC9E,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAc/C,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD,uEAAuE;AACvE,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEzD,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAoB3F;AASD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG;IACnD,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAUA;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,YAAY,CAYd;AAUD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,OAAO,EAAE,OAAO,GACf,cAAc,EAAE,CAGlB;AA4DD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAW9E;AAyGD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAEjE;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BhF"}