@rifts_to/mcp 0.1.0

package/dist/worker.js

@@ -0,0 +1,247 @@
+/**
+ * MCP over Streamable HTTP, on Cloudflare Workers. What `mcp.rifts.to` runs.
+ *
+ * **Transport choice.** The SDK ships two Streamable HTTP server transports.
+ * `StreamableHTTPServerTransport` is written against Node's `IncomingMessage`
+ * and `ServerResponse`, so it needs `nodejs_compat` and a shim layer that would
+ * be load-bearing but never exercised by a test — a build that type-checks and
+ * then fails on the first real request. Its own implementation delegates to
+ * `WebStandardStreamableHTTPServerTransport`, which is written against
+ * `Request`/`Response`/`ReadableStream` and is documented for Workers, so this
+ * file uses that one directly and hand-rolls nothing. Writing a bespoke
+ * fetch-shaped transport was the other option and was rejected for the same
+ * reason: the SDK's version already handles Accept negotiation, protocol
+ * version checks and batched messages, and a reimplementation would drift from
+ * the spec the moment the spec moved.
+ *
+ * **Stateless, one server object per request.** Every caller presents a
+ * different bearer token, and a Worker isolate is shared between callers, so a
+ * long-lived `McpServer` would have to hold a token from some earlier request.
+ * Building the server and transport per request makes that impossible by
+ * construction. It costs a session: there is no `Mcp-Session-Id`, no `GET /mcp`
+ * notification stream, and no resumability. All four tools are plain
+ * request/response, so nothing here has a use for any of that.
+ *
+ * **No secrets, no bindings.** The Worker never sees a credential of its own.
+ * It reads the caller's bearer token, hands it to `/api/v1`, and turns the
+ * API's 401 back into a `WWW-Authenticate` challenge. Token validation happens
+ * in exactly one place, and compromising this Worker yields nothing that was
+ * not already presented to it.
+ */
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { DEFAULT_BASE_URL, RiftsClient } from "./client.js";
+import { createServer } from "./server.js";
+const MCP_PATH = "/mcp";
+/**
+ * RFC 9728 fixes this path for a resource identified by a bare origin. The
+ * `resource` this document advertises is the origin with no path, which is what
+ * makes that the right URL — and it is also the audience value `/api/v1`
+ * accepts for tokens minted for this server, so the two must not drift.
+ */
+const RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+/** rifts.to is the authorization server: it is where accounts and D1 live. */
+const AUTHORIZATION_SERVER = "https://rifts.to";
+const SCOPES = ["surveys:read", "surveys:write"];
+/**
+ * A wildcard origin is safe here only because this Worker has no ambient
+ * authority: no cookies, no bindings, and every request is authorized by a
+ * bearer token the caller had to already hold. A browser page that reaches this
+ * endpoint gains nothing it could not get with `curl`.
+ */
+const CORS_HEADERS = {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Authorization, Content-Type, Mcp-Session-Id, MCP-Protocol-Version, Last-Event-ID",
+    // Without this the browser hides both headers from the page: the session id a
+    // stateful client would need, and the challenge that starts the OAuth flow.
+    "Access-Control-Expose-Headers": "Mcp-Session-Id, WWW-Authenticate",
+    "Access-Control-Max-Age": "86400",
+};
+export default {
+    async fetch(request, env) {
+        const url = new URL(request.url);
+        if (request.method === "OPTIONS") {
+            return new Response(null, { status: 204, headers: CORS_HEADERS });
+        }
+        if (url.pathname === RESOURCE_METADATA_PATH) {
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                return methodNotAllowed("GET, HEAD, OPTIONS");
+            }
+            return resourceMetadata(url, env);
+        }
+        if (url.pathname === MCP_PATH) {
+            if (request.method !== "POST") {
+                // 405 rather than 404: a client probing `GET /mcp` for the optional
+                // server-initiated stream must learn that this server does not offer
+                // one, not that it typed the URL wrong.
+                return methodNotAllowed("POST, OPTIONS");
+            }
+            return handleMcp(request, env, url);
+        }
+        return json({ error: "not found" }, 404);
+    },
+};
+/**
+ * RFC 9728 metadata. Everything is derived rather than baked in, so one build
+ * is correct on workers.dev and on mcp.rifts.to without a config change that
+ * somebody has to remember.
+ *
+ * `authorization_servers` follows `RIFTS_API_URL` rather than being pinned to
+ * production, because the rifts.to deployment this server talks to *is* its
+ * authorization server. Pinning them apart is how a preview build ends up
+ * telling clients to go and authorize somewhere that does not know about it.
+ */
+function resourceMetadata(url, env) {
+    const authorizationServer = env.RIFTS_API_URL?.trim() || AUTHORIZATION_SERVER;
+    return json({
+        resource: url.origin,
+        authorization_servers: [authorizationServer.replace(/\/$/, "")],
+        scopes_supported: SCOPES,
+        // OAuth 2.1 and the MCP spec both forbid a token in a query string, and
+        // this server reads only the header. Saying so is not decoration: it is
+        // the machine-readable half of that rule.
+        bearer_methods_supported: ["header"],
+    }, 200, {
+        // Metadata that rarely changes, but a stale copy sends a client to the
+        // wrong authorization server, so keep the window short.
+        "Cache-Control": "public, max-age=3600",
+    });
+}
+async function handleMcp(request, env, url) {
+    const token = bearerToken(request.headers.get("Authorization"));
+    if (!token)
+        return unauthorized(url, "no bearer token was presented");
+    const baseUrl = env.RIFTS_API_URL?.trim() || DEFAULT_BASE_URL;
+    // Validate before serving anything.
+    //
+    // The reactive check below only trips when a tool actually calls the API, and
+    // `initialize` and `tools/list` never do. Without this, a request carrying a
+    // revoked or expired token got a cheerful 200 listing four tools, so a client
+    // sat there looking connected and only discovered the problem on the first
+    // tool call, as an error message rather than as the 401 that would have made
+    // it refresh. For an OAuth client the 401 *is* the signal, so it has to come
+    // before the work, not after.
+    //
+    // The cost is one edge-to-edge request per call. These are conversational
+    // volumes, not /api/respond volumes, and correctness here is worth more than
+    // the round trip.
+    const probe = await fetch(`${baseUrl}/api/v1/me`, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    if (probe.status === 401) {
+        return unauthorized(url, "the rifts.to API rejected the token", "invalid_token");
+    }
+    if (probe.status === 403) {
+        // Entitlement, not authentication. A challenge would send the client round
+        // the OAuth loop again to arrive at the same place, so say what is wrong
+        // instead: this needs a subscription, not a fresh token.
+        return json({
+            error: "insufficient_scope",
+            error_description: "this rifts.to account does not have an active subscription",
+        }, 403);
+    }
+    // The API is the only thing that can tell a live token from a dead one, so
+    // "was this token rejected" is observed at the fetch layer rather than
+    // guessed at. A tool call that 401s is not a tool failure the model should
+    // apologise for; it is an expired credential, and the client can only know to
+    // re-authenticate if it gets the challenge as an HTTP status.
+    let tokenRejected = false;
+    const client = new RiftsClient({
+        baseUrl,
+        token,
+        fetchImpl: async (input, init) => {
+            const response = await fetch(input, init);
+            if (response.status === 401)
+                tokenRejected = true;
+            return response;
+        },
+    });
+    const server = createServer(client);
+    const transport = new WebStandardStreamableHTTPServerTransport({
+        // Stateless: no session to resume and nowhere to keep one. See the header.
+        sessionIdGenerator: undefined,
+        // Plain JSON rather than an SSE frame per response. Nothing here streams,
+        // and a resolved Response (as opposed to a stream the isolate must stay
+        // alive to feed) is also what lets the 401 check below run before anything
+        // has been sent.
+        enableJsonResponse: true,
+    });
+    try {
+        await server.connect(transport);
+        const response = await transport.handleRequest(request);
+        if (tokenRejected) {
+            return unauthorized(url, "the rifts.to API rejected the token", "invalid_token");
+        }
+        return withCors(response);
+    }
+    catch (error) {
+        // A throw out of the transport is this server's bug, not the caller's, and
+        // it still has to come back as JSON-RPC or the client reports a transport
+        // error with nothing in it.
+        return json({
+            jsonrpc: "2.0",
+            error: { code: -32603, message: message(error) },
+            id: null,
+        }, 500);
+    }
+    finally {
+        // In JSON mode the body is fully materialised before handleRequest
+        // resolves, so closing here cannot truncate a response in flight.
+        await server.close().catch(() => { });
+    }
+}
+/**
+ * The `resource_metadata` parameter is the whole point of this response: it is
+ * what tells a client where to look up the authorization server, and a client
+ * that cannot parse it simply never offers to sign in. RFC 9728 quotes the
+ * value, so it is quoted here.
+ *
+ * `error` is omitted when nothing was presented at all, per RFC 6750: an
+ * `invalid_token` code on a request that carried no token tells a client its
+ * stored credential was rejected, which would send it to refresh a token it
+ * never sent.
+ */
+function unauthorized(url, detail, code) {
+    const params = [
+        `realm="rifts.to"`,
+        ...(code ? [`error="${code}"`] : []),
+        `error_description="${detail}"`,
+        `resource_metadata="${url.origin}${RESOURCE_METADATA_PATH}"`,
+    ];
+    return json({ error: code ?? "unauthorized", error_description: detail }, 401, {
+        "WWW-Authenticate": `Bearer ${params.join(", ")}`,
+    });
+}
+/**
+ * Only the `Bearer` scheme, and the scheme name compared case-insensitively
+ * because RFC 7235 says it is. Anything else is treated as no token at all, so
+ * a client sending Basic credentials gets the challenge rather than a 500.
+ */
+function bearerToken(header) {
+    if (!header)
+        return undefined;
+    const match = /^Bearer[ ]+(.+)$/i.exec(header.trim());
+    return match?.[1]?.trim() || undefined;
+}
+function methodNotAllowed(allow) {
+    return json({ error: "method not allowed" }, 405, { Allow: allow });
+}
+function json(body, status, headers = {}) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "Content-Type": "application/json", ...CORS_HEADERS, ...headers },
+    });
+}
+/** The transport builds its own Response, so CORS has to be added afterwards. */
+function withCors(response) {
+    const headers = new Headers(response.headers);
+    for (const [name, value] of Object.entries(CORS_HEADERS))
+        headers.set(name, value);
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+const message = (error) => (error instanceof Error ? error.message : String(error));
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AACzH,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAO3C,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,uCAAuC,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,MAAM,MAAM,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,YAAY,GAA2B;IAC3C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,kFAAkF;IACpF,8EAA8E;IAC9E,4EAA4E;IAC5E,+BAA+B,EAAE,kCAAkC;IACnE,wBAAwB,EAAE,OAAO;CAClC,CAAC;AAEF,eAAe;IACb,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1D,OAAO,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,oEAAoE;gBACpE,qEAAqE;gBACrE,wCAAwC;gBACxC,OAAO,gBAAgB,CAAC,eAAe,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,GAAQ,EAAE,GAAQ;IAC1C,MAAM,mBAAmB,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC;IAE9E,OAAO,IAAI,CACT;QACE,QAAQ,EAAE,GAAG,CAAC,MAAM;QACpB,qBAAqB,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,gBAAgB,EAAE,MAAM;QACxB,wEAAwE;QACxE,wEAAwE;QACxE,0CAA0C;QAC1C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,EACD,GAAG,EACH;QACE,uEAAuE;QACvE,wDAAwD;QACxD,eAAe,EAAE,sBAAsB;KACxC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAQ;IAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC;IAE9D,oCAAoC;IACpC,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,8BAA8B;IAC9B,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;QAChD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAC9C,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,GAAG,EAAE,qCAAqC,EAAE,eAAe,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,2EAA2E;QAC3E,yEAAyE;QACzE,yDAAyD;QACzD,OAAO,IAAI,CACT;YACE,KAAK,EAAE,oBAAoB;YAC3B,iBAAiB,EACf,4DAA4D;SAC/D,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,8DAA8D;IAC9D,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;QAC7B,OAAO;QACP,KAAK;QACL,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,aAAa,GAAG,IAAI,CAAC;YAClD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,2EAA2E;QAC3E,kBAAkB,EAAE,SAAS;QAC7B,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,iBAAiB;QACjB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC,GAAG,EAAE,qCAAqC,EAAE,eAAe,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,0EAA0E;QAC1E,4BAA4B;QAC5B,OAAO,IAAI,CACT;YACE,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;YAChD,EAAE,EAAE,IAAI;SACT,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,GAAQ,EAAE,MAAc,EAAE,IAAsB;IACpE,MAAM,MAAM,GAAG;QACb,kBAAkB;QAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,sBAAsB,MAAM,GAAG;QAC/B,sBAAsB,GAAG,CAAC,MAAM,GAAG,sBAAsB,GAAG;KAC7D,CAAC;IAEF,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE;QAC7E,kBAAkB,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAqB;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,MAAc,EAAE,UAAkC,EAAE;IAC/E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@rifts_to/mcp",
+  "version": "0.1.0",
+  "description": "rifts.to MCP server. Create live audience surveys and read their results from an AI client.",
+  "license": "Apache-2.0",
+  "author": "RIFTS TO, LLC",
+  "homepage": "https://rifts.to",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/riftsto/mcp.git"
+  },
+  "type": "module",
+  "bin": {
+    "rifts-mcp": "dist/stdio.js"
+  },
+  "main": "dist/server.js",
+  "types": "dist/server.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "modelcontextprotocol",
+    "rifts.to",
+    "survey",
+    "poll"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "dev": "wrangler dev",
+    "deploy": "wrangler deploy",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^4.1.13"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.9",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10",
+    "wrangler": "^4.120.0"
+  },
+  "bugs": {
+    "url": "https://github.com/riftsto/mcp/issues"
+  }
+}