@scorehub/mcp-server 0.2.5 → 0.2.7

package/README.md

@@ -51,7 +51,7 @@ In `claude_desktop_config.json` or `.claude/mcp.json`:
       "command": "npx",
       "args": ["-y", "@scorehub/mcp-server"],
       "env": {
-        "SCOREHUB_REMOTE_MCP_URL": "https://mcp.scorehub.cn"
+        "SCOREHUB_REMOTE_MCP_URL": "https://app.scorehub.cn/mcp"
       }
     }
   }
@@ -69,7 +69,7 @@ In `mcp.json`:
       "command": "npx",
       "args": ["-y", "@scorehub/mcp-server"],
       "env": {
-        "SCOREHUB_REMOTE_MCP_URL": "https://mcp.scorehub.cn"
+        "SCOREHUB_REMOTE_MCP_URL": "https://app.scorehub.cn/mcp"
       }
     }
   }
@@ -91,17 +91,17 @@ In `mcp.json`:
 
 | Variable | Required | Default | Description |
 |---|---|---|---|
-| `SCOREHUB_REMOTE_MCP_URL` | No | `https://mcp.scorehub.cn` | Base URL of the remote ScoreHub MCP endpoint |
+| `SCOREHUB_REMOTE_MCP_URL` | No | `https://app.scorehub.cn/mcp` | Base URL of the remote ScoreHub MCP endpoint |
 
 ### Token storage
 
 OAuth tokens are stored at:
 
 ```
-~/.scorehub/<host>/oauth.json
+~/.scorehub/<endpoint>/oauth.json
 ```
 
-The `<host>` is derived from the `SCOREHUB_REMOTE_MCP_URL` (e.g., `mcp.scorehub.cn`). This means you can run staging and production side-by-side by pointing each configuration at a different URL — tokens are isolated per host.
+The `<endpoint>` is derived from the `SCOREHUB_REMOTE_MCP_URL` host and path (for example, `app.scorehub.cn_mcp`). This means you can run staging and production side-by-side by pointing each configuration at a different URL — tokens are isolated per endpoint.
 
 **Token file structure:**
 
@@ -116,6 +116,8 @@ The `<host>` is derived from the `SCOREHUB_REMOTE_MCP_URL` (e.g., `mcp.scorehub.
 
 To log out or switch accounts, delete the `~/.scorehub/` directory or just the host-specific subdirectory.
 
+The `authorize` tool reuses cached credentials by default. If the cached access token is still valid, or the refresh token can renew it, `authorize` returns without opening the browser. To force a new browser login, call `authorize` with `force: true`.
+
 ## Available Tools
 
 ### Local tools
@@ -124,7 +126,7 @@ These tools run locally on your machine — they do not call the remote endpoint
 
 | Tool | Description |
 |---|---|
-| `authorize` | Opens your browser for ScoreHub OAuth login. Forces a fresh authorization flow every time. |
+| `authorize` | Checks ScoreHub OAuth status. Reuses cached credentials by default; pass `force: true` to open the browser for a fresh login. |
 | `status` | Returns connection status: remote URL, authorization state, and count of available tools. |
 
 ### Remote tools
@@ -158,7 +160,7 @@ These tools are **dynamically loaded** from the remote MCP endpoint at startup a
          ├─ POST /token ───────────────────▶│
          │◀── access_token + refresh_token  │
          │                                  │
-         ├─ saves to ~/.scorehub/<host>/oauth.json
+        ├─ saves to ~/.scorehub/<endpoint>/oauth.json
 ```
 
 ### Token lifecycle
@@ -169,12 +171,31 @@ These tools are **dynamically loaded** from the remote MCP endpoint at startup a
 | **Subsequent calls** | Read cached file → check expiry with 5-minute buffer |
 | **Near expiry** | Auto-refresh with `refresh_token` → write new token back to file |
 | **Refresh fails** | Returns an error message with the authorization URL — call `authorize` again |
-| **Manual logout** | Delete `~/.scorehub/<host>/oauth.json` or the entire `~/.scorehub/` directory |
+| **Manual logout** | Delete `~/.scorehub/<endpoint>/oauth.json` or the entire `~/.scorehub/` directory |
 
 ### Headless environments
 
 If you're running on a server or in a headless environment where a browser cannot open automatically, the authorization URL will be printed to stderr. Copy it and open it manually in any browser. After login, the callback goes to `http://127.0.0.1:19836/callback` — make sure port 19836 is accessible on the machine running mcp-server.
 
+### Local remote development
+
+When testing a local `mcp-remote`, point this local proxy at the same local base URL:
+
+```bash
+SCOREHUB_REMOTE_MCP_URL=http://127.0.0.1:5201 npm start -w packages/mcp-server
+```
+
+Start `mcp-remote` with a matching `BASE_URL`:
+
+```bash
+cd packages/mcp-remote
+PORT=5201 BASE_URL=http://127.0.0.1:5201 npm start
+```
+
+`BASE_URL` controls where `mcp-remote` sends the browser after login, for example `http://127.0.0.1:5201/consent?...`. `SCOREHUB_REMOTE_MCP_URL` controls which remote endpoint this proxy uses for `/authorize`, `/token`, and `/mcp`. In production, `https://app.scorehub.cn/mcp` maps to externally visible `/mcp/authorize`, `/mcp/token`, and `/mcp/mcp` paths.
+
+OAuth tokens are isolated by endpoint under `~/.scorehub/<endpoint>/oauth.json`, so local tokens for `127.0.0.1:5201` do not overwrite production tokens for `app.scorehub.cn/mcp`.
+
 ## Architecture
 
 ```
@@ -189,13 +210,13 @@ If you're running on a server or in a headless environment where a browser canno
 │  │  client)     │            │  • Tool forwarding  │             │
 │  └──────────────┘            └─────────┬───────────┘             │
 │                                        │                         │
-│                              ~/.scorehub/<host>/oauth.json        │
+│                              ~/.scorehub/<endpoint>/oauth.json    │
 └────────────────────────────────────────┼──────────────────────────┘
                                          │ Streamable HTTP
                                          ▼
                               ┌─────────────────────┐
                               │ ScoreHub Remote MCP │
-                              │ (mcp.scorehub.cn)   │
+                              │ (app.scorehub.cn/mcp)│
                               └─────────┬───────────┘
                                         │
                                         ▼
@@ -227,7 +248,7 @@ Yes, absolutely. `@scorehub/mcp-server` is a standalone MCP server. Any MCP-comp
 Delete the token file:
 
 ```bash
-rm ~/.scorehub/mcp.scorehub.cn/oauth.json
+rm ~/.scorehub/app.scorehub.cn_mcp/oauth.json
 ```
 
 Or delete the entire directory to clear all hosts:
@@ -238,7 +259,7 @@ rm -rf ~/.scorehub/
 
 ### How do I switch between staging and production?
 
-Set different `SCOREHUB_REMOTE_MCP_URL` values in separate MCP client configurations. Tokens are isolated per host, so staging and production credentials won't interfere with each other.
+Set different `SCOREHUB_REMOTE_MCP_URL` values in separate MCP client configurations. Tokens are isolated per endpoint, so staging and production credentials won't interfere with each other.
 
 ### What happens if the remote MCP is unreachable?
 

package/dist/auth.js

@@ -51,6 +51,9 @@ function clearTokens(host) {
         (0, node_fs_1.writeFileSync)(file, JSON.stringify({}), "utf-8");
     }
 }
+function hasSignedTokenShape(token) {
+    return token.split(".").length === 3;
+}
 // ── Token Exchange ───────────────────────────────────────────
 function tokenPostRequest(tokenEndpoint, body) {
     const url = new URL(tokenEndpoint);
@@ -100,7 +103,7 @@ async function refreshAccessToken(tokenEndpoint, refreshToken, clientId) {
 }
 async function getValidAccessToken(host, tokenEndpoint, clientId) {
     const cached = loadTokens(host);
-    if (cached && cached.access_token && cached.expires_at > Date.now() + 5 * 60 * 1000) {
+    if (cached && cached.access_token && hasSignedTokenShape(cached.access_token) && cached.expires_at > Date.now() + 5 * 60 * 1000) {
         return { access_token: cached.access_token, source: "cache" };
     }
     if (cached?.refresh_token) {

package/dist/index.js

@@ -16,17 +16,30 @@ const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const index_js_2 = require("@modelcontextprotocol/sdk/client/index.js");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
-const SCOREHUB_BASE_URL = process.env.SCOREHUB_REMOTE_MCP_URL || "https://mcp.scorehub.cn";
+const DEFAULT_SCOREHUB_BASE_URL = "https://app.scorehub.cn/mcp";
+const SCOREHUB_BASE_URL = normalizeBaseUrl(process.env.SCOREHUB_REMOTE_MCP_URL || DEFAULT_SCOREHUB_BASE_URL);
 // OAuth endpoints are at the root path
-const TOKEN_ENDPOINT = `${SCOREHUB_BASE_URL}/token`;
-const AUTHORIZE_URL = `${SCOREHUB_BASE_URL}/authorize`;
+const TOKEN_ENDPOINT = joinUrl(SCOREHUB_BASE_URL, "/token");
+const AUTHORIZE_URL = joinUrl(SCOREHUB_BASE_URL, "/authorize");
 // MCP Streamable HTTP transport endpoints are at /mcp
-const REMOTE_MCP_URL = `${SCOREHUB_BASE_URL}/mcp`;
+const REMOTE_MCP_URL = joinUrl(SCOREHUB_BASE_URL, "/mcp");
+function normalizeBaseUrl(value) {
+    return value.replace(/\/+$/, "");
+}
+function joinUrl(baseUrl, path) {
+    return `${baseUrl}/${path.replace(/^\/+/, "")}`;
+}
+function endpointTokenKey(baseUrl) {
+    const url = new URL(baseUrl);
+    const path = url.pathname.replace(/^\/+|\/+$/g, "");
+    const endpoint = path ? `${url.host}/${path}` : url.host;
+    return endpoint.replace(/[^A-Za-z0-9.-]+/g, "_");
+}
 // ── Auth State ──────────────────────────────────────────────
 const auth_js_1 = require("./auth.js");
 const node_http_1 = require("node:http");
 const node_child_process_1 = require("node:child_process");
-const HOST = new URL(REMOTE_MCP_URL).host;
+const TOKEN_STORE_KEY = endpointTokenKey(SCOREHUB_BASE_URL);
 const CLIENT_ID = "scorehub-mcp";
 // Proactively refresh token every 4 hours to prevent expiry during long sessions
 const TOKEN_KEEPALIVE_INTERVAL = 4 * 60 * 60 * 1000;
@@ -81,7 +94,7 @@ const server = new index_js_1.Server({ name: "scorehub-mcp", version: "0.1.0" },
 server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
     // Refresh remote tools on each list
     try {
-        const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
+        const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
         const freshTools = await fetchRemoteTools(tokenResult?.access_token);
         if (freshTools.length > 0 || remoteTools.length === 0) {
             remoteTools = freshTools;
@@ -95,10 +108,15 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
     const tools = [
         {
             name: "authorize",
-            description: "通过浏览器 OAuth 登录 ScoreHub。首次连接时自动调用，打开浏览器引导登录。已登录时可直接使用其他工具。",
+            description: "检查 ScoreHub OAuth 授权。已有有效授权时直接返回；仅在传入 force=true 时重新打开浏览器登录。",
             inputSchema: {
                 type: "object",
-                properties: {},
+                properties: {
+                    force: {
+                        type: "boolean",
+                        description: "是否强制清除当前端点的本地 token 并重新登录",
+                    },
+                },
                 required: [],
             },
         },
@@ -123,8 +141,18 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
     switch (name) {
         case "authorize": {
-            // Always force fresh OAuth flow when user explicitly authorizes
-            (0, auth_js_1.clearTokens)(HOST);
+            const force = args.force === true;
+            if (!force) {
+                const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
+                if (tokenResult) {
+                    return {
+                        content: [{ type: "text", text: `✅ 已授权（${tokenResult.source === "cache" ? "使用本地缓存" : "已自动刷新"}），可以直接使用 ScoreHub 工具。` }],
+                    };
+                }
+            }
+            else {
+                (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+            }
             // Port 0 lets the OS assign a random available port,
             // avoiding conflicts when multiple MCP clients run simultaneously
             let actualPort = 0;
@@ -150,8 +178,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                             "<p>You may close this window and return to the terminal.</p>" +
                             "</body></html>");
                         callbackServer.close();
-                        const baseUrl = new URL(REMOTE_MCP_URL).origin;
-                        fetch(`${baseUrl}/token`, {
+                        fetch(TOKEN_ENDPOINT, {
                             method: "POST",
                             headers: { "Content-Type": "application/json" },
                             body: JSON.stringify({ grant_type: "authorization_code", code }),
@@ -164,7 +191,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                                 });
                                 return;
                             }
-                            (0, auth_js_1.saveTokens)(HOST, {
+                            (0, auth_js_1.saveTokens)(TOKEN_STORE_KEY, {
                                 access_token: tokenData.access_token,
                                 refresh_token: tokenData.refresh_token ?? "",
                                 expires_at: Date.now() + (tokenData.expires_in ?? 3600) * 1000,
@@ -219,13 +246,14 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             });
         }
         case "status": {
-            const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
+            const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
             return {
                 content: [
                     {
                         type: "text",
                         text: JSON.stringify({
                             remote_url: REMOTE_MCP_URL,
+                            token_store_key: TOKEN_STORE_KEY,
                             authorized: !!tokenResult,
                             tools_count: remoteTools.length,
                             ...(lastFetchError ? { error: lastFetchError } : {}),
@@ -236,7 +264,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
         }
         default: {
             // Check authorization for remote tools — re-validates on every call
-            const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
+            const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
             if (!tokenResult) {
                 const authUrl = generateAuthUrl();
                 return {
@@ -250,6 +278,18 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             }
             try {
                 const result = await callRemoteTool(name, args, tokenResult.access_token);
+                if (result.includes("ScoreHub OAuth 授权已过期或无效")) {
+                    (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+                    const authUrl = generateAuthUrl();
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `⚠️ 授权已失效，已清除本地缓存。请调用 "authorize" 工具重新登录 ScoreHub。\n授权地址: ${authUrl}`,
+                            },
+                        ],
+                    };
+                }
                 return { content: [{ type: "text", text: result }] };
             }
             catch (e) {
@@ -267,7 +307,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
 function startTokenKeepAlive() {
     const timer = setInterval(async () => {
         try {
-            const result = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
+            const result = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
             if (result?.source === "refresh") {
                 console.error("[keep-alive] access token refreshed proactively");
             }
@@ -291,7 +331,7 @@ async function main() {
         process.exit(0);
     });
     try {
-        const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
+        const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
         remoteTools = await fetchRemoteTools(tokenResult?.access_token);
         if (remoteTools.length === 0 && lastFetchError) {
             console.error(`Warning: Could not fetch remote tools on startup: ${lastFetchError}. Retrying on first ListTools request.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "main": "dist/index.js",
   "bin": {