@socialproof/memory-mcp 0.1.1

package/README.md

@@ -0,0 +1,189 @@
+# Memory MCP
+
+Secure stdio and hosted Streamable HTTP MCP server for `@socialproof/memory` and MySocial agent actions.
+
+The MCP process resolves a local signer, keeps private key material inside the
+process, and sends only public keys, signatures, and bounded session credentials
+to upstream services. Raw `key`, `ownerCoSignKey`, `x-delegate-key`, and
+`x-owner-delegate-key` transport is intentionally unsupported.
+
+## Install and run
+
+```bash
+pnpm --filter @socialproof/memory-mcp build
+pnpm --filter @socialproof/memory-mcp exec memory-mcp
+```
+
+The package binary and runtime version are both sourced from `package.json`.
+`node packages/mcp/dist/index.js` remains supported for existing local setups.
+
+### Localnet organization prerequisites
+
+After every `myso start --force-regenesis`, bootstrap MySocial and create one
+approved platform before starting the memory relayer:
+
+```bash
+./scripts/bootstrap.sh
+./scripts/proof-of-creativity-runnable.sh --create-platform
+```
+
+For a relayer running against local GraphQL/fullnode, set
+`SOCIAL_CHAIN_AUTO_DISCOVERY=true`, `SOCIAL_CHAIN_GRAPHQL_URL=http://127.0.0.1:9125/graphql`,
+and `LOCAL_SPONSOR_ENABLED=true`. Discovery fills missing singleton IDs, verifies
+their type and shared ownership against the fullnode, and replaces stale localnet
+IDs after regenesis. Local sponsorship uses `SERVER_MYSO_PRIVATE_KEYS` only as gas
+owners; the agent or owner wallet must still sign the transaction.
+
+## Credentials
+
+The default configuration path is `~/.memory/credentials.json`. Override it with
+`MEMORY_MCP_CREDENTIALS_FILE`.
+
+Recommended macOS Keychain configuration:
+
+```json
+{
+  "accountId": "<memory-account-object-id>",
+  "serverUrl": "http://127.0.0.1:8000",
+  "platformId": "<platform-object-id>",
+  "socialEnabled": false,
+  "signer": {
+    "type": "keychain",
+    "service": "network.mysocial.memory-mcp",
+    "account": "my-agent"
+  }
+}
+```
+
+`socialEnabled` defaults to `false`. When enabled, Tier 1A reactions and Tier 1B
+publishing actions are available only when authenticated capabilities, approval
+policy, and platform scope allow them. Network and shared-object IDs are discovered
+from authenticated agent context; callers do not need to copy raw object IDs:
+
+```json
+{
+  "accountId": "<memory-account-object-id>",
+  "serverUrl": "http://127.0.0.1:8000",
+  "socialEnabled": true,
+  "signer": {
+    "type": "keychain",
+    "service": "network.mysocial.memory-mcp",
+    "account": "my-agent"
+  }
+}
+```
+
+`mysoNetwork`, `mysoRpcUrl`, and `socialChain` remain optional deployment pins.
+When supplied, they must exactly match authenticated context or execution fails closed.
+
+Store a 32-byte Ed25519 key encoded as hex:
+
+```bash
+security add-generic-password \
+  -U \
+  -s network.mysocial.memory-mcp \
+  -a my-agent \
+  -w '<agent-private-key-hex>'
+```
+
+For local development only, a file-backed signer is available:
+
+```json
+{
+  "accountId": "<memory-account-object-id>",
+  "serverUrl": "http://127.0.0.1:8000",
+  "socialEnabled": false,
+  "signer": {
+    "type": "development-file",
+    "path": "~/.memory/dev-agent.key"
+  }
+}
+```
+
+The key file must be a regular, non-symlink file with mode `0600` or stricter,
+and the process must set `MEMORY_MCP_ALLOW_INSECURE_DEV_FILE=1`.
+
+Hosted or wallet-backed runtimes should import `InjectedAgentSigner` and
+`createMemoryMcpServer` instead of writing a key to disk. The current Memory SDK
+still needs a local secret-backed client; callers using a non-exportable signer
+must inject their own `MemoryClient` adapter.
+
+## Tools and result contract
+
+Memory tools:
+
+- `memory_remember`
+- `memory_recall`
+- `memory_health`
+
+Secure social tools currently exposed when enabled:
+
+- `social_react_post`
+- `social_react_comment`
+- `social_create_post`
+- `social_create_comment`
+- `social_create_repost`
+- `social_remove_post_reaction`, `social_remove_comment_reaction`
+- `social_edit_post`, `social_edit_comment`, `social_remove_repost`
+- `social_follow_profile`, `social_unfollow_profile`
+- `social_block_profile`, `social_unblock_profile`
+- `messaging_send_message`
+- `messaging_create_group`, `messaging_list_inbox`, `messaging_wait_for_message`
+- `organization_get_control`
+- `organization_create`, `organization_update_metadata`, `organization_update_category`
+- `organization_ensure_memory_group`, `organization_define_role`
+- `organization_assign_role`, `organization_revoke_role`, `organization_create_invitation`
+- `organization_accept_invitation`, `organization_decline_invitation`
+- `agent_provision_signer`, `agent_register_root`, `agent_register_child`
+- `agent_update_child`, `agent_deactivate_child`, `agent_revoke_child`
+- `chain_get_action_status`
+- `chain_request_action_approval`
+- `chain_approve_action`
+- `chain_prepare_approved_action`
+- `chain_submit_approved_action`
+
+Every social write checks fresh authenticated agent context and sends only its
+hard-coded registry ID, schema input, and required idempotency key to
+`/api/chain/actions/prepare`. The trusted gateway builds and durably records the
+registered action, then the local signer signs the sponsored transaction and
+submits only the signature to `/api/chain/actions/submit`. These paths have no
+direct-sign fallback and accept no model-supplied Move target or PTB. Reusing an
+idempotency key with the same input returns the existing result; reusing it with
+different input fails closed.
+
+Every tool declares an output schema and MCP annotations and returns both a
+short text summary and structured content:
+
+```json
+{
+  "ok": false,
+  "error": {
+    "code": "CAPABILITY_DENIED",
+    "message": "The agent is not permitted to perform this action.",
+    "retryable": false,
+    "approvalRequired": false
+  }
+}
+```
+
+Owner-approved actions use an exact-input intent followed by wallet transaction signing. The approval binds account, agent, registry action/version, parameter hash, idempotency key, expiry, and one prepared action. No owner private key crosses HTTP.
+
+Organization creation, root-agent registration, role changes, invitations, and organization deactivation use that owner-wallet flow. Delegated child-agent operations execute automatically only when the authenticated parent holds the matching capability; Move enforces ancestry, capability subset, platform scope, depth, and spend constraints. `agent_provision_signer` stores local secrets in macOS Keychain and returns only the public key, derived address, and signer reference. Hosted deployments inject a KMS-backed `AgentSignerProvisioner`.
+
+`messaging_wait_for_message` is a bounded long-poll primitive for OpenClaw response loops. It returns encrypted payload digests and durable URIs; plaintext and group keys never cross the MCP transport.
+
+## Hosted MCP
+
+`createHostedMcpHttpServer` serves stateless Streamable HTTP at `/mcp`. It verifies a Bearer token on every request, requires the exact RFC 8707 resource audience and `mcp:connect`, filters tools by OAuth scope, and enforces host/origin protections. Tokens must carry `accountId`, `agentObjectId`, and `signerSessionId` claims.
+
+`OAuthIntrospectionVerifier` provides an RFC 7662 verifier that checks the authorization server on every request, so revoked tokens stop working without waiting for a local cache.
+
+`KmsSessionAgentSigner` reauthorizes its session before every authentication or transaction signature. `HttpKmsSessionAuthorizer` and `RemoteKmsSigningProvider` implement the private HTTPS KMS/HSM service contract without exporting keys.
+
+## Verification
+
+```bash
+pnpm --filter @socialproof/memory-mcp typecheck
+pnpm --filter @socialproof/memory-mcp test
+pnpm --filter @socialproof/memory-mcp pack:check
+```

package/dist/bin/memory-mcp.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/memory-mcp.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runCliMain } from "../cli.js";
+runCliMain();

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+export declare function runCli(): Promise<void>;
+export declare function runCliMain(): void;

package/dist/cli.js

@@ -0,0 +1,61 @@
+import { Memory } from "@socialproof/memory";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadCredentials } from "./credentials.js";
+import { formatStartupError } from "./errors.js";
+import { createMemoryMcpServer } from "./server.js";
+import { SponsoredSocialGateway } from "./social-gateway.js";
+import { createCliSigner } from "./signers.js";
+import { LocalKeychainAgentProvisioner } from "./provisioning.js";
+export async function runCli() {
+    const credentials = loadCredentials();
+    const signer = createCliSigner(credentials.signer);
+    const memory = await signer.withLocalSecret((secret) => Memory.create({
+        key: secret.slice(),
+        accountId: credentials.accountId,
+        serverUrl: credentials.serverUrl,
+        platformId: credentials.platformId,
+    }));
+    const social = credentials.socialEnabled && credentials.social
+        ? new SponsoredSocialGateway({
+            signer,
+            accountId: credentials.accountId,
+            serverUrl: credentials.socialGatewayUrl,
+            platformId: credentials.platformId,
+            network: credentials.social.network,
+            rpcUrl: credentials.social.rpcUrl,
+            chain: credentials.social.chain,
+        })
+        : undefined;
+    const server = createMemoryMcpServer({
+        memory,
+        social,
+        agentProvisioner: process.platform === "darwin"
+            ? new LocalKeychainAgentProvisioner()
+            : undefined,
+    });
+    const transport = new StdioServerTransport();
+    let closing = false;
+    const shutdown = async () => {
+        if (closing)
+            return;
+        closing = true;
+        memory.destroy();
+        signer.destroy();
+        await server.close();
+    };
+    process.once("SIGINT", () => void shutdown());
+    process.once("SIGTERM", () => void shutdown());
+    try {
+        await server.connect(transport);
+    }
+    catch (error) {
+        await shutdown();
+        throw error;
+    }
+}
+export function runCliMain() {
+    runCli().catch((error) => {
+        process.stderr.write(`memory-mcp: ${formatStartupError(error)}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/credentials.d.ts

@@ -0,0 +1,21 @@
+import type { SocialChainConfig } from "@socialproof/social";
+import type { CliSignerReference } from "./signers.js";
+export declare const DEFAULT_CREDENTIALS_PATH: string;
+export interface McpCredentials {
+    accountId: string;
+    serverUrl: string;
+    platformId?: string;
+    socialEnabled: boolean;
+    socialGatewayUrl: string;
+    social?: {
+        /** Optional deployment pin. Authenticated agent context remains authoritative. */
+        network?: "mainnet" | "testnet" | "devnet" | "localnet";
+        /** Optional deployment pin. Authenticated agent context remains authoritative. */
+        rpcUrl?: string;
+        /** Optional object-id pins for deployments that previously configured them locally. */
+        chain?: Partial<SocialChainConfig>;
+    };
+    signer: CliSignerReference;
+}
+export declare function parseCredentials(value: unknown): McpCredentials;
+export declare function loadCredentials(credentialsPath?: string): McpCredentials;

package/dist/credentials.js

@@ -0,0 +1,157 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { McpRuntimeError } from "./errors.js";
+export const DEFAULT_CREDENTIALS_PATH = path.join(os.homedir(), ".memory", "credentials.json");
+function requireObject(value, label) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", `${label} must be a JSON object.`);
+    }
+    return value;
+}
+function requireNonEmptyString(value, label) {
+    if (typeof value !== "string" || !value.trim()) {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", `${label} must be a non-empty string.`);
+    }
+    return value.trim();
+}
+function optionalString(value, label) {
+    if (value === undefined)
+        return undefined;
+    return requireNonEmptyString(value, label);
+}
+function normalizeUrl(value, label, fallback) {
+    const raw = optionalString(value, label) ?? fallback;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", `${label} must be an absolute HTTP(S) URL.`);
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", `${label} must use HTTP or HTTPS.`);
+    }
+    const localHostnames = new Set(["localhost", "127.0.0.1", "::1"]);
+    if (parsed.protocol === "http:" && !localHostnames.has(parsed.hostname)) {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", `${label} must use HTTPS unless it targets localhost.`);
+    }
+    return parsed.toString().replace(/\/$/, "");
+}
+function parseSigner(value) {
+    const signer = requireObject(value, "signer");
+    if (signer.type === "keychain") {
+        const parsed = {
+            type: "keychain",
+            service: requireNonEmptyString(signer.service, "signer.service"),
+            account: requireNonEmptyString(signer.account, "signer.account"),
+        };
+        return parsed;
+    }
+    if (signer.type === "development-file") {
+        const parsed = {
+            type: "development-file",
+            path: requireNonEmptyString(signer.path, "signer.path"),
+        };
+        return parsed;
+    }
+    if (signer.type === "injected") {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", "Injected signers must be supplied programmatically and cannot be configured in credentials.json.");
+    }
+    throw new McpRuntimeError("INVALID_CONFIGURATION", "signer.type must be keychain or development-file.");
+}
+function parseSocialChain(value) {
+    if (value === undefined)
+        return undefined;
+    const chain = requireObject(value, "socialChain");
+    const parsed = {};
+    const fields = [
+        "packageId",
+        "usernameRegistryId",
+        "platformRegistryId",
+        "platformObjectId",
+        "blockListRegistryId",
+        "postConfigId",
+        "memoryConfigId",
+        "mydataRegistryId",
+        "clockId",
+        "socialGraphId",
+        "messagingPackageId",
+        "messagingVersionId",
+        "messagingConfigId",
+        "messagingNamespaceId",
+        "messagingGroupManagerId",
+        "messagingGroupLeaverId",
+    ];
+    for (const field of fields) {
+        const configured = optionalString(chain[field], `socialChain.${field}`);
+        if (configured !== undefined)
+            parsed[field] = configured;
+    }
+    return Object.keys(parsed).length > 0 ? parsed : undefined;
+}
+function parseNetwork(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "mainnet" || value === "testnet" || value === "devnet" || value === "localnet") {
+        return value;
+    }
+    throw new McpRuntimeError("INVALID_CONFIGURATION", "mysoNetwork must be mainnet, testnet, devnet, or localnet when provided.");
+}
+export function parseCredentials(value) {
+    const input = requireObject(value, "credentials");
+    if ("key" in input || "ownerCoSignKey" in input) {
+        throw new McpRuntimeError("UNSAFE_LEGACY_CREDENTIALS", "Raw key and ownerCoSignKey fields are no longer accepted. Store the agent key in macOS Keychain and configure a signer reference; owner operations require the future approval flow.");
+    }
+    const accountId = requireNonEmptyString(input.accountId, "accountId");
+    if (!/^0x[0-9a-fA-F]{1,64}$/.test(accountId)) {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", "accountId must be a valid MySo object ID.");
+    }
+    const serverUrl = normalizeUrl(input.serverUrl, "serverUrl", "https://memory.mysocial.network");
+    const socialGatewayUrl = normalizeUrl(input.socialGatewayUrl, "socialGatewayUrl", serverUrl);
+    if (input.socialEnabled !== undefined && typeof input.socialEnabled !== "boolean") {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", "socialEnabled must be a boolean.");
+    }
+    const socialEnabled = input.socialEnabled === true;
+    const social = socialEnabled
+        ? {
+            network: parseNetwork(input.mysoNetwork),
+            rpcUrl: input.mysoRpcUrl === undefined
+                ? undefined
+                : normalizeUrl(input.mysoRpcUrl, "mysoRpcUrl", ""),
+            chain: parseSocialChain(input.socialChain),
+        }
+        : undefined;
+    return {
+        accountId,
+        serverUrl,
+        platformId: optionalString(input.platformId, "platformId"),
+        socialEnabled,
+        socialGatewayUrl,
+        social,
+        signer: parseSigner(input.signer),
+    };
+}
+export function loadCredentials(credentialsPath = process.env.MEMORY_MCP_CREDENTIALS_FILE ?? DEFAULT_CREDENTIALS_PATH) {
+    let raw;
+    try {
+        const stat = fs.lstatSync(credentialsPath);
+        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o022) !== 0) {
+            throw new McpRuntimeError("INVALID_CONFIGURATION", `MCP credentials at ${credentialsPath} must be a regular file that is not group- or world-writable.`);
+        }
+        raw = fs.readFileSync(credentialsPath, "utf8");
+    }
+    catch (error) {
+        if (error instanceof McpRuntimeError)
+            throw error;
+        throw new McpRuntimeError("INVALID_CONFIGURATION", `Unable to read MCP credentials from ${credentialsPath}.`, { cause: error });
+    }
+    try {
+        return parseCredentials(JSON.parse(raw));
+    }
+    catch (error) {
+        if (error instanceof McpRuntimeError)
+            throw error;
+        throw new McpRuntimeError("INVALID_CONFIGURATION", `MCP credentials at ${credentialsPath} are not valid JSON.`, { cause: error });
+    }
+}

package/dist/errors.d.ts

@@ -0,0 +1,26 @@
+export type McpErrorCode = "INVALID_ARGUMENT" | "INVALID_CONFIGURATION" | "UNSAFE_LEGACY_CREDENTIALS" | "SIGNER_UNAVAILABLE" | "SOCIAL_GATEWAY_UNAVAILABLE" | "APPROVAL_FLOW_NOT_AVAILABLE" | "AUTHENTICATION_FAILED" | "CAPABILITY_DENIED" | "RATE_LIMITED" | "CONFLICT" | "UPSTREAM_UNAVAILABLE" | "UNKNOWN_TOOL" | "INTERNAL_ERROR";
+export interface StructuredMcpError {
+    code: McpErrorCode;
+    message: string;
+    retryable: boolean;
+    approvalRequired: boolean;
+    actionId?: string;
+    digest?: string;
+}
+export declare class McpRuntimeError extends Error {
+    readonly code: McpErrorCode;
+    readonly retryable: boolean;
+    readonly approvalRequired: boolean;
+    readonly actionId?: string;
+    readonly digest?: string;
+    constructor(code: McpErrorCode, message: string, options?: {
+        retryable?: boolean;
+        approvalRequired?: boolean;
+        actionId?: string;
+        digest?: string;
+        cause?: unknown;
+    });
+}
+export declare function redactSensitiveText(value: string): string;
+export declare function toStructuredMcpError(error: unknown): StructuredMcpError;
+export declare function formatStartupError(error: unknown): string;

package/dist/errors.js

@@ -0,0 +1,57 @@
+export class McpRuntimeError extends Error {
+    code;
+    retryable;
+    approvalRequired;
+    actionId;
+    digest;
+    constructor(code, message, options = {}) {
+        super(message, { cause: options.cause });
+        this.name = "McpRuntimeError";
+        this.code = code;
+        this.retryable = options.retryable ?? false;
+        this.approvalRequired = options.approvalRequired ?? false;
+        this.actionId = options.actionId;
+        this.digest = options.digest;
+    }
+}
+const SECRET_ASSIGNMENT = /\b(key|secret|token|authorization)\b\s*[:=]\s*[^\s,;}]+/gi;
+const MYSO_PRIVATE_KEY = /mysoprivkey1[a-z0-9]+/gi;
+export function redactSensitiveText(value) {
+    return value
+        .replace(SECRET_ASSIGNMENT, "$1=[REDACTED]")
+        .replace(MYSO_PRIVATE_KEY, "[REDACTED_PRIVATE_KEY]")
+        .slice(0, 400);
+}
+export function toStructuredMcpError(error) {
+    if (error instanceof McpRuntimeError) {
+        return {
+            code: error.code,
+            message: redactSensitiveText(error.message),
+            retryable: error.retryable,
+            approvalRequired: error.approvalRequired,
+            ...(error.actionId ? { actionId: error.actionId } : {}),
+            ...(error.digest ? { digest: error.digest } : {}),
+        };
+    }
+    if (error instanceof TypeError && error.message.toLowerCase().includes("fetch")) {
+        return {
+            code: "UPSTREAM_UNAVAILABLE",
+            message: "The configured upstream service is unavailable.",
+            retryable: true,
+            approvalRequired: false,
+        };
+    }
+    return {
+        code: "INTERNAL_ERROR",
+        message: "The MCP server could not complete the request.",
+        retryable: false,
+        approvalRequired: false,
+    };
+}
+export function formatStartupError(error) {
+    return toStructuredMcpError(error instanceof McpRuntimeError
+        ? error
+        : new McpRuntimeError("INVALID_CONFIGURATION", "The MCP server could not start.", {
+            cause: error,
+        })).message;
+}

package/dist/hosted.d.ts

@@ -0,0 +1,15 @@
+import { type Server } from "node:http";
+import type { OAuthTokenVerifier } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import { type HostedMcpPrincipal } from "./oauth.js";
+import type { ToolDependencies } from "./tools.js";
+export interface HostedMcpOptions {
+    verifier: OAuthTokenVerifier;
+    resourceUrl: string;
+    authorizationServerUrl: string;
+    allowedHosts: readonly string[];
+    allowedOrigins?: readonly string[];
+    maxContentLength?: number;
+    createDependencies(principal: HostedMcpPrincipal): Promise<ToolDependencies>;
+    destroyDependencies?(dependencies: ToolDependencies): void | Promise<void>;
+}
+export declare function createHostedMcpHttpServer(options: HostedMcpOptions): Server;

package/dist/hosted.js

@@ -0,0 +1,108 @@
+import { createServer } from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { McpRuntimeError, toStructuredMcpError } from "./errors.js";
+import { authenticateHostedRequest } from "./oauth.js";
+import { createMemoryMcpServer } from "./server.js";
+export function createHostedMcpHttpServer(options) {
+    const resource = new URL(options.resourceUrl);
+    if (resource.protocol !== "https:" && resource.hostname !== "localhost") {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", "Hosted MCP resourceUrl must use HTTPS.");
+    }
+    if (options.allowedHosts.length === 0) {
+        throw new McpRuntimeError("INVALID_CONFIGURATION", "Hosted MCP allowedHosts must not be empty.");
+    }
+    return createServer((request, response) => {
+        void handleHostedRequest(request, response, options, resource);
+    });
+}
+async function handleHostedRequest(request, response, options, resource) {
+    try {
+        applySecurityHeaders(response);
+        const url = new URL(request.url ?? "/", resource);
+        if (url.pathname === "/.well-known/oauth-protected-resource") {
+            if (request.method !== "GET")
+                return methodNotAllowed(response, "GET");
+            return json(response, 200, {
+                resource: resource.toString().replace(/\/$/, ""),
+                authorization_servers: [options.authorizationServerUrl],
+                scopes_supported: [
+                    "mcp:connect", "memory:read", "memory:write", "chain:read",
+                    "social:write", "social:publish", "social:approve", "social:destructive", "ai:spend",
+                    "messaging:read", "organization:read", "organization:admin", "agent:provision",
+                ],
+            });
+        }
+        if (url.pathname !== "/mcp")
+            return json(response, 404, { error: "not_found" });
+        assertHostAndOrigin(request, options);
+        const length = Number(request.headers["content-length"] ?? 0);
+        if (!Number.isFinite(length) || length < 0 || length > (options.maxContentLength ?? 1_048_576)) {
+            return json(response, 413, { error: "request_too_large" });
+        }
+        const principal = await authenticateHostedRequest(request, options.verifier, resource);
+        const dependencies = await options.createDependencies(principal);
+        const scopedDependencies = {
+            ...dependencies,
+            oauthScopes: new Set(principal.auth.scopes),
+        };
+        const server = createMemoryMcpServer(scopedDependencies);
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+        });
+        request.auth = principal.auth;
+        try {
+            await server.connect(transport);
+            await transport.handleRequest(request, response);
+        }
+        finally {
+            await server.close();
+            await options.destroyDependencies?.(dependencies);
+        }
+    }
+    catch (error) {
+        if (response.headersSent) {
+            response.destroy();
+            return;
+        }
+        const structured = toStructuredMcpError(error);
+        const status = structured.code === "AUTHENTICATION_FAILED" ? 401
+            : structured.code === "CAPABILITY_DENIED" ? 403 : 400;
+        if (status === 401) {
+            response.setHeader("WWW-Authenticate", `Bearer resource_metadata="${new URL("/.well-known/oauth-protected-resource", resource).toString()}"`);
+        }
+        json(response, status, { error: structured });
+    }
+}
+function assertHostAndOrigin(request, options) {
+    let host = "";
+    try {
+        host = new URL(`http://${request.headers.host ?? ""}`).hostname.toLowerCase();
+    }
+    catch {
+        throw new McpRuntimeError("AUTHENTICATION_FAILED", "Host is invalid.");
+    }
+    if (!options.allowedHosts.map((value) => value.toLowerCase()).includes(host)) {
+        throw new McpRuntimeError("AUTHENTICATION_FAILED", "Host is not allowed.");
+    }
+    const origin = request.headers.origin;
+    if (origin && !(options.allowedOrigins ?? []).includes(origin)) {
+        throw new McpRuntimeError("AUTHENTICATION_FAILED", "Origin is not allowed.");
+    }
+}
+function applySecurityHeaders(response) {
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+    response.setHeader("Referrer-Policy", "no-referrer");
+    response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("X-Frame-Options", "DENY");
+}
+function methodNotAllowed(response, allow) {
+    response.setHeader("Allow", allow);
+    json(response, 405, { error: "method_not_allowed" });
+}
+function json(response, status, body) {
+    response.statusCode = status;
+    response.setHeader("content-type", "application/json; charset=utf-8");
+    response.end(JSON.stringify(body));
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { runCli, runCliMain } from "./cli.js";
+export { DEFAULT_CREDENTIALS_PATH, loadCredentials, parseCredentials, type McpCredentials, } from "./credentials.js";
+export { McpRuntimeError, formatStartupError, redactSensitiveText, toStructuredMcpError, type McpErrorCode, type StructuredMcpError, } from "./errors.js";
+export { createMemoryMcpServer } from "./server.js";
+export { createHostedMcpHttpServer, type HostedMcpOptions } from "./hosted.js";
+export { authenticateHostedRequest, OAuthIntrospectionVerifier, type HostedMcpPrincipal, type OAuthIntrospectionVerifierOptions, } from "./oauth.js";
+export { SponsoredSocialGateway, type SocialGateway, type SponsoredSocialGatewayOptions, } from "./social-gateway.js";
+export { InjectedAgentSigner, KmsSessionAgentSigner, HttpKmsSessionAuthorizer, RemoteKmsSigningProvider, LocalEd25519Signer, createCliSigner, type AgentSigner, type CliSignerReference, type DevelopmentFileSignerReference, type InjectedSignerCallbacks, type KeychainSignerReference, type KmsSessionAuthorizer, type KmsSessionPolicy, type KmsSigningOperation, type KmsSigningProvider, type RemoteKmsClientOptions, type LocalSecretAgentSigner, } from "./signers.js";
+export { LocalKeychainAgentProvisioner, type AgentSignerProvisioner, type ProvisionedAgentSigner, } from "./provisioning.js";
+export { createToolCatalog, executeTool, type MemoryClient, type ToolDependencies, type ToolEnvelope, TOOL_OAUTH_SCOPES, } from "./tools.js";
+export { MCP_PACKAGE_NAME, MCP_PACKAGE_VERSION, MCP_SERVER_NAME, } from "./version.js";