@scorehub/mcp-server 0.1.0

package/dist/auth.d.ts

@@ -0,0 +1,47 @@
+export interface OAuthTokens {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    scope?: string;
+}
+export interface TokenStore {
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+    updated_at: string;
+}
+export interface AuthorizationCodeResult {
+    code: string;
+    state: string;
+}
+export interface AuthorizeParams {
+    authEndpoint: string;
+    tokenEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    port?: number;
+    scope?: string;
+    timeoutMs?: number;
+    host?: string;
+}
+export interface AuthorizeResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    scope?: string;
+}
+export declare function loadTokens(host: string): TokenStore | null;
+export declare function saveTokens(host: string, tokens: TokenStore): void;
+export declare function clearTokens(host: string): void;
+export declare function exchangeCodeForTokens(tokenEndpoint: string, code: string, codeVerifier: string, clientId: string, redirectUri: string): Promise<OAuthTokens>;
+export declare function refreshAccessToken(tokenEndpoint: string, refreshToken: string, clientId: string): Promise<OAuthTokens>;
+export declare function getValidAccessToken(host: string, tokenEndpoint: string, clientId: string): Promise<{
+    access_token: string;
+    source: "cache" | "refresh";
+} | null>;
+export declare function generateCodeVerifier(length?: number): string;
+export declare function generateCodeChallenge(verifier: string): string;
+export declare function generateState(length?: number): string;
+export declare function startCallbackServer(port: number, timeoutMs?: number): Promise<AuthorizationCodeResult>;
+export declare function openBrowser(url: string): void;
+export declare function authorize(params: AuthorizeParams): Promise<AuthorizeResult>;

package/dist/auth.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadTokens = loadTokens;
+exports.saveTokens = saveTokens;
+exports.clearTokens = clearTokens;
+exports.exchangeCodeForTokens = exchangeCodeForTokens;
+exports.refreshAccessToken = refreshAccessToken;
+exports.getValidAccessToken = getValidAccessToken;
+exports.generateCodeVerifier = generateCodeVerifier;
+exports.generateCodeChallenge = generateCodeChallenge;
+exports.generateState = generateState;
+exports.startCallbackServer = startCallbackServer;
+exports.openBrowser = openBrowser;
+exports.authorize = authorize;
+const node_https_1 = require("node:https");
+const node_http_1 = require("node:http");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const node_http_2 = require("node:http");
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+// ── Token Storage ────────────────────────────────────────────
+const SCOREHUB_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), ".scorehub");
+const TOKEN_FILE = (host) => (0, node_path_1.join)(SCOREHUB_DIR, host, "oauth.json");
+function ensureDir(filePath) {
+    const dir = (0, node_path_1.dirname)(filePath);
+    if (!(0, node_fs_1.existsSync)(dir)) {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    }
+}
+function loadTokens(host) {
+    const file = TOKEN_FILE(host);
+    if (!(0, node_fs_1.existsSync)(file))
+        return null;
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(file, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function saveTokens(host, tokens) {
+    const file = TOKEN_FILE(host);
+    ensureDir(file);
+    (0, node_fs_1.writeFileSync)(file, JSON.stringify(tokens, null, 2), "utf-8");
+}
+function clearTokens(host) {
+    const file = TOKEN_FILE(host);
+    if ((0, node_fs_1.existsSync)(file)) {
+        (0, node_fs_1.writeFileSync)(file, JSON.stringify({}), "utf-8");
+    }
+}
+// ── Token Exchange ───────────────────────────────────────────
+function tokenPostRequest(tokenEndpoint, body) {
+    const url = new URL(tokenEndpoint);
+    const transport = url.protocol === "http:" ? node_http_1.request : node_https_1.request;
+    return new Promise((resolve, reject) => {
+        const req = transport({
+            hostname: url.hostname,
+            port: url.port || (url.protocol === "http:" ? 80 : 443),
+            path: url.pathname + url.search,
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            rejectUnauthorized: false,
+        }, (res) => {
+            let data = "";
+            res.on("data", (chunk) => (data += chunk));
+            res.on("end", () => {
+                try {
+                    resolve(JSON.parse(data));
+                }
+                catch {
+                    reject(new Error(`Token endpoint returned non-JSON: ${data.substring(0, 200)}`));
+                }
+            });
+        });
+        req.on("error", reject);
+        req.write(body);
+        req.end();
+    });
+}
+async function exchangeCodeForTokens(tokenEndpoint, code, codeVerifier, clientId, redirectUri) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        code_verifier: codeVerifier,
+        client_id: clientId,
+        redirect_uri: redirectUri,
+    }).toString();
+    return tokenPostRequest(tokenEndpoint, body);
+}
+async function refreshAccessToken(tokenEndpoint, refreshToken, clientId) {
+    const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: clientId,
+    }).toString();
+    return tokenPostRequest(tokenEndpoint, body);
+}
+async function getValidAccessToken(host, tokenEndpoint, clientId) {
+    const cached = loadTokens(host);
+    if (cached && cached.access_token && cached.expires_at > Date.now() + 5 * 60 * 1000) {
+        return { access_token: cached.access_token, source: "cache" };
+    }
+    if (cached?.refresh_token) {
+        try {
+            const result = await refreshAccessToken(tokenEndpoint, cached.refresh_token, clientId);
+            if (result.access_token) {
+                saveTokens(host, {
+                    access_token: result.access_token,
+                    refresh_token: result.refresh_token ?? cached.refresh_token,
+                    expires_at: Date.now() + (result.expires_in ?? 3600) * 1000,
+                    updated_at: new Date().toISOString(),
+                });
+                return { access_token: result.access_token, source: "refresh" };
+            }
+        }
+        catch {
+            // refresh failed, need re-auth
+        }
+    }
+    return null;
+}
+// ── PKCE Utilities ───────────────────────────────────────────
+function generateCodeVerifier(length = 64) {
+    return (0, node_crypto_1.randomBytes)(length).toString("base64url").substring(0, 128);
+}
+function generateCodeChallenge(verifier) {
+    return (0, node_crypto_1.createHash)("sha256").update(Buffer.from(verifier, "ascii")).digest("base64url");
+}
+function generateState(length = 16) {
+    return (0, node_crypto_1.randomBytes)(length).toString("hex");
+}
+// ── Local Callback Server ────────────────────────────────────
+function startCallbackServer(port, timeoutMs = 120_000) {
+    return new Promise((resolve, reject) => {
+        let timeoutId;
+        const server = (0, node_http_2.createServer)((req, res) => {
+            const requestUrl = req.url ?? "/";
+            const url = new URL(requestUrl, `http://127.0.0.1:${port}`);
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state");
+            if (code) {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Authorization Complete</title></head>" +
+                    "<body style=\"font-family:sans-serif;text-align:center;padding-top:80px;\">" +
+                    "<h2>✅ Authorization Successful</h2>" +
+                    "<p>You may close this window and return to the terminal.</p>" +
+                    "</body></html>");
+            }
+            else {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Authorization Failed</title></head>" +
+                    "<body style=\"font-family:sans-serif;text-align:center;padding-top:80px;\">" +
+                    "<h2>❌ Authorization Failed</h2>" +
+                    "<p>No authorization code received from the provider.</p>" +
+                    "</body></html>");
+            }
+            if (timeoutId)
+                clearTimeout(timeoutId);
+            server.close();
+            if (code) {
+                resolve({ code, state: state ?? "" });
+            }
+            else {
+                reject(new Error("No authorization code in callback"));
+            }
+        });
+        server.on("error", (err) => {
+            if (timeoutId)
+                clearTimeout(timeoutId);
+            reject(err);
+        });
+        server.listen(port, "127.0.0.1", () => {
+            server.unref();
+            timeoutId = setTimeout(() => {
+                server.close();
+                reject(new Error(`Authorization timed out after ${timeoutMs / 1000}s. Please try again.`));
+            }, timeoutMs);
+        });
+    });
+}
+// ── Browser Launch ───────────────────────────────────────────
+function openBrowser(url) {
+    try {
+        const platform = process.platform;
+        if (platform === "darwin") {
+            (0, node_child_process_1.execSync)(`open "${url}"`, { stdio: "ignore", timeout: 3000 });
+        }
+        else if (platform === "win32") {
+            (0, node_child_process_1.execSync)(`start "" "${url}"`, { shell: "cmd.exe", stdio: "ignore", timeout: 3000 });
+        }
+        else {
+            (0, node_child_process_1.execSync)(`xdg-open "${url}"`, { stdio: "ignore", timeout: 3000 });
+        }
+    }
+    catch {
+        console.error(`[scorehub] Could not open browser automatically.`);
+        console.error(`[scorehub] Please visit this URL manually:\n  ${url}`);
+    }
+}
+// ── Full OAuth Flow ──────────────────────────────────────────
+async function authorize(params) {
+    const { authEndpoint, tokenEndpoint, clientId, redirectUri, port = 19836, scope, timeoutMs = 120_000, host, } = params;
+    const storageHost = host ?? new URL(authEndpoint).host;
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    const authUrl = new URL(authEndpoint);
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    authUrl.searchParams.set("code_challenge", codeChallenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("response_type", "code");
+    if (scope)
+        authUrl.searchParams.set("scope", scope);
+    openBrowser(authUrl.toString());
+    let returnedCode;
+    let returnedState;
+    try {
+        const result = await startCallbackServer(port, timeoutMs);
+        returnedCode = result.code;
+        returnedState = result.state;
+    }
+    catch (err) {
+        clearTokens(storageHost);
+        throw err;
+    }
+    if (returnedState !== state) {
+        clearTokens(storageHost);
+        throw new Error("OAuth state mismatch — possible CSRF attack. Please restart the authorization flow.");
+    }
+    let tokens;
+    try {
+        tokens = await exchangeCodeForTokens(tokenEndpoint, returnedCode, codeVerifier, clientId, redirectUri);
+    }
+    catch (err) {
+        clearTokens(storageHost);
+        throw new Error(`Token exchange failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    saveTokens(storageHost, {
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        expires_at: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+        updated_at: new Date().toISOString(),
+    });
+    return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        scope: tokens.scope,
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * ScoreHub MCP Server — Local MCP Proxy
+ *
+ * Architecture (mirrors @lessie/mcp-server):
+ *   Agent (WorkBuddy/Claude)  ──stdio──  Local MCP Server  ──Streamable HTTP──  Remote MCP Server
+ *
+ * The local server handles:
+ * 1. OAuth 2.1 Authorization Code + PKCE — browser-based login to ScoreHub
+ * 2. Tool forwarding — proxies all remote tools to the remote MCP endpoint
+ */
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const REMOTE_MCP_URL = process.env.SCOREHUB_REMOTE_MCP_URL || "http://localhost:3100";
+const TOKEN_ENDPOINT = `${REMOTE_MCP_URL}/token`;
+const AUTHORIZE_URL = `${REMOTE_MCP_URL}/authorize`;
+// ── Auth State ──────────────────────────────────────────────
+const auth_js_1 = require("./auth.js");
+const node_child_process_1 = require("node:child_process");
+const HOST = new URL(REMOTE_MCP_URL).host;
+let cachedToken = null;
+function getStoredToken() {
+    if (cachedToken)
+        return cachedToken;
+    const t = (0, auth_js_1.loadTokens)(HOST);
+    if (t?.access_token && t.expires_at > Date.now() + 60_000) {
+        cachedToken = t.access_token;
+        return cachedToken;
+    }
+    return null;
+}
+// ── Remote Tool Proxy ───────────────────────────────────────
+async function fetchRemoteTools() {
+    try {
+        const resp = await fetch(REMOTE_MCP_URL.replace(/\/$/, "") + "/mcp/tools/list");
+        if (!resp.ok)
+            throw new Error(`Remote tools fetch failed: ${resp.status}`);
+        const data = await resp.json();
+        return data.tools || [];
+    }
+    catch {
+        // Return offline message when remote is not available
+        return [];
+    }
+}
+async function callRemoteTool(name, args) {
+    // Map tool names to remote endpoints
+    const toolEndpoints = {
+        search_creators: "/mcp/tools/search-creators",
+        creator_performance: "/mcp/tools/creator-performance",
+        create_conversation: "/mcp/tools/create-conversation",
+        send_message: "/mcp/tools/send-message",
+    };
+    const endpoint = toolEndpoints[name];
+    if (!endpoint) {
+        return JSON.stringify({ error: `Unknown tool: ${name}` });
+    }
+    const resp = await fetch(`${REMOTE_MCP_URL}${endpoint}`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            ...(cachedToken ? { Authorization: `Bearer ${cachedToken}` } : {}),
+        },
+        body: JSON.stringify(args),
+    });
+    const data = await resp.json();
+    return JSON.stringify(data, null, 2);
+}
+// ── OAuth authorize helper ──────────────────────────────────
+function generateAuthUrl() {
+    // Generate random state for CSRF protection
+    const state = Math.random().toString(36).substring(2);
+    return `${AUTHORIZE_URL}?client_id=scorehub-mcp&redirect_uri=http://127.0.0.1:19836/callback&state=${state}`;
+}
+// ── Fetch remote tools on startup ───────────────────────────
+let remoteTools = [];
+// ── MCP Server ──────────────────────────────────────────────
+const server = new index_js_1.Server({ name: "scorehub-mcp", version: "0.1.0" }, { capabilities: { tools: {} } });
+server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
+    // Refresh remote tools on each list
+    try {
+        remoteTools = await fetchRemoteTools();
+    }
+    catch { /* keep stale */ }
+    const tools = [
+        {
+            name: "authorize",
+            description: "通过浏览器 OAuth 登录 ScoreHub。首次连接时自动调用，打开浏览器引导登录。已登录时可直接使用其他工具。",
+            inputSchema: {
+                type: "object",
+                properties: {},
+                required: [],
+            },
+        },
+        {
+            name: "status",
+            description: "检查 ScoreHub 连接状态和授权信息。",
+            inputSchema: {
+                type: "object",
+                properties: {},
+                required: [],
+            },
+        },
+        ...remoteTools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        })),
+    ];
+    return { tools };
+});
+server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+    const { name, arguments: args = {} } = request.params;
+    switch (name) {
+        case "authorize": {
+            const existing = getStoredToken();
+            if (existing) {
+                return {
+                    content: [{ type: "text", text: "✅ 已授权，可直接使用工具。" }],
+                };
+            }
+            const authUrl = generateAuthUrl();
+            const os = process.platform;
+            const cmd = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
+            // Start callback server BEFORE opening browser
+            const callbackPromise = (0, auth_js_1.startCallbackServer)(19836);
+            try {
+                (0, node_child_process_1.execSync)(`${cmd} "${authUrl}"`);
+            }
+            catch { /* headless env: user opens manually */ }
+            try {
+                const { code } = await callbackPromise;
+                const baseUrl = REMOTE_MCP_URL.replace(/\/mcp.*$/, "");
+                const tokenResp = await fetch(`${baseUrl}/token`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ grant_type: "authorization_code", code }),
+                });
+                const tokenData = await tokenResp.json();
+                if (!tokenData.access_token) {
+                    return {
+                        content: [{ type: "text", text: `❌ Token 获取失败: ${JSON.stringify(tokenData)}` }],
+                    };
+                }
+                (0, auth_js_1.saveTokens)(HOST, {
+                    access_token: tokenData.access_token,
+                    refresh_token: tokenData.refresh_token ?? "",
+                    expires_at: Date.now() + (tokenData.expires_in ?? 3600) * 1000,
+                    updated_at: new Date().toISOString(),
+                });
+                cachedToken = tokenData.access_token;
+                return {
+                    content: [{ type: "text", text: "✅ 授权成功！可以开始使用工具了。" }],
+                };
+            }
+            catch (e) {
+                return {
+                    content: [{ type: "text", text: `❌ 授权失败: ${String(e)}` }],
+                };
+            }
+        }
+        case "status": {
+            const token = getStoredToken();
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            remote_url: REMOTE_MCP_URL,
+                            authorized: !!token,
+                            tools_count: remoteTools.length,
+                        }, null, 2),
+                    },
+                ],
+            };
+        }
+        default: {
+            // Check authorization for remote tools
+            const token = getStoredToken();
+            cachedToken = token;
+            if (!cachedToken) {
+                const authUrl = generateAuthUrl();
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `⚠️ 未授权。请先调用 "authorize" 工具登录 ScoreHub。\n授权地址: ${authUrl}`,
+                        },
+                    ],
+                };
+            }
+            try {
+                const result = await callRemoteTool(name, args);
+                return { content: [{ type: "text", text: result }] };
+            }
+            catch (e) {
+                return {
+                    content: [{ type: "text", text: `❌ 工具调用失败: ${String(e)}` }],
+                };
+            }
+        }
+    }
+});
+// ── Start ───────────────────────────────────────────────────
+async function main() {
+    try {
+        remoteTools = await fetchRemoteTools();
+    }
+    catch {
+        console.error("Warning: Could not fetch remote tools on startup. Retrying on first ListTools request.");
+    }
+    const transport = new stdio_js_1.StdioServerTransport();
+    await server.connect(transport);
+    console.error(`ScoreHub MCP Server started (remote: ${REMOTE_MCP_URL})`);
+}
+main().catch((err) => {
+    console.error("Fatal:", err);
+    process.exit(1);
+});

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@scorehub/mcp-server",
+  "version": "0.1.0",
+  "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
+  "main": "dist/index.js",
+  "bin": {
+    "scorehub-mcp": "./dist/index.js"
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js"
+  },
+  "keywords": ["mcp", "scorehub", "tiktok", "oauth"],
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.5.0"
+  }
+}