@sonoma-security/mcp-gateway 0.1.12 → 0.1.14

package/dist/http-proxy.js

@@ -0,0 +1,875 @@
+/**
+ * HTTP Proxy Server for MCP Gateway
+ *
+ * Transparent HTTP passthrough that forwards all MCP traffic (including OAuth
+ * discovery, auth headers, SSE streams) to upstream servers. Parses JSON-RPC
+ * request/response bodies for telemetry and policy enforcement.
+ *
+ * Architecture:
+ *   Client (http://localhost:{port}/proxy/{serverName}/mcp)
+ *     -> HTTP Proxy (parse JSON-RPC, enforce policy, record telemetry)
+ *       -> Upstream MCP Server (https://mcp.example.com/mcp)
+ *
+ * Unlike the previous MCP-level proxy (which terminated MCP sessions and
+ * created its own Server/Transport), this is a true HTTP passthrough.
+ * OAuth, SSE, session headers all flow through untouched.
+ */
+import { createServer } from "node:http";
+/**
+ * Bind an HTTP server to the given port immediately, returning both the server
+ * and a promise that resolves once it's listening. The server responds to any
+ * request with 503 Service Unavailable until `adoptHttpServer` swaps in a real
+ * handler. This lets the caller hold the port during slow startup work (auth,
+ * policy fetch, upstream connections) so clients probing the port get
+ * "service starting" instead of ECONNREFUSED.
+ *
+ * On EADDRINUSE, the bind is retried for up to ~10s. The launchd/Scheduled
+ * Task supervisor races its own bootout against the new process, and the
+ * old owner can hold the socket briefly during teardown. Without the retry
+ * the fresh daemon crashes immediately, and each crash-loop wipes any
+ * in-memory MCP session state, stranding clients with stale session IDs.
+ */
+export function preListenHttpServer(port) {
+    const server = createServer((_req, res) => {
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Retry-After", "1");
+        res.writeHead(503, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "gateway_starting" }));
+    });
+    const listening = new Promise((resolve, reject) => {
+        const deadline = Date.now() + 10_000;
+        const tryListen = () => {
+            const onError = (err) => {
+                if (err.code === "EADDRINUSE" && Date.now() < deadline) {
+                    setTimeout(tryListen, 500);
+                    return;
+                }
+                reject(err);
+            };
+            server.once("error", onError);
+            server.listen(port, () => {
+                server.off("error", onError);
+                resolve();
+            });
+        };
+        tryListen();
+    });
+    return { server, listening };
+}
+export class HttpProxyServer {
+    httpServer;
+    callbacks;
+    port;
+    // Track the last server that triggered OAuth discovery so we can route
+    // root-level auth requests (the SDK strips the path from the server URL
+    // when constructing the authorization server URL, so root-level requests
+    // like /.well-known/oauth-authorization-server and /register lose the
+    // server name context).
+    lastOAuthServerName;
+    // Cache of upstream AS metadata per server so we can route /authorize,
+    // /token, /register to the real upstream endpoints (which may live at
+    // non-root paths like /oauth/authorize).
+    upstreamAsEndpoints = new Map();
+    constructor(port, callbacks, preboundServer) {
+        this.port = port;
+        this.callbacks = callbacks;
+        if (preboundServer) {
+            this.httpServer = preboundServer;
+            this.preboundAdopted = true;
+            this.httpServer.removeAllListeners("request");
+            this.httpServer.on("request", this.handleRequest.bind(this));
+        }
+        else {
+            this.httpServer = createServer(this.handleRequest.bind(this));
+        }
+    }
+    preboundAdopted = false;
+    async start() {
+        if (this.preboundAdopted) {
+            this.callbacks.log(`HTTP proxy handler attached on port ${this.port} (prebound)`);
+            return;
+        }
+        return new Promise((resolve, reject) => {
+            this.httpServer.on("error", reject);
+            this.httpServer.listen(this.port, () => {
+                this.callbacks.log(`HTTP proxy server listening on port ${this.port}`);
+                resolve();
+            });
+        });
+    }
+    async stop() {
+        return new Promise((resolve) => {
+            this.httpServer.close(() => resolve());
+        });
+    }
+    /**
+     * Get the proxy URL for a specific server.
+     * Plugins should rewrite their URLs to this endpoint.
+     */
+    getProxyUrl(serverName) {
+        return `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+    }
+    async handleRequest(req, res) {
+        const url = new URL(req.url ?? "/", `http://localhost:${this.port}`);
+        const accept = req.headers["accept"] ?? "";
+        const contentType = req.headers["content-type"] ?? "";
+        const mcpSessionId = req.headers["mcp-session-id"] ?? "";
+        this.callbacks.log(`[http-proxy] ${req.method} ${url.pathname} accept=${accept} ct=${contentType} session=${mcpSessionId}`);
+        // CORS headers for local access
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id, Last-Event-ID, Accept, MCP-Protocol-Version");
+        res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        // OAuth discovery: rewrite path and forward to upstream
+        // e.g., /.well-known/oauth-protected-resource/proxy/sentry/mcp
+        //     -> https://mcp.sentry.dev/.well-known/oauth-protected-resource
+        const wellKnownMatch = url.pathname.match(/^\/\.well-known\/([^/]+)\/proxy\/([^/]+)\/mcp$/);
+        if (wellKnownMatch) {
+            const wellKnownType = wellKnownMatch[1];
+            const serverName = decodeURIComponent(wellKnownMatch[2]);
+            this.lastOAuthServerName = serverName;
+            await this.forwardOAuthDiscovery(wellKnownType, serverName, req, res);
+            return;
+        }
+        // In-path .well-known: /proxy/{server}/mcp/.well-known/{type}
+        // Claude Code also probes this pattern for OpenID discovery.
+        const inPathWellKnown = url.pathname.match(/^\/proxy\/([^/]+)\/mcp\/\.well-known\/(.+)$/);
+        if (inPathWellKnown) {
+            const serverName = decodeURIComponent(inPathWellKnown[1]);
+            this.lastOAuthServerName = serverName;
+            await this.forwardOAuthDiscovery(inPathWellKnown[2], serverName, req, res);
+            return;
+        }
+        // Root-level OAuth requests: the MCP SDK constructs the authorization
+        // server URL as `new URL('/', serverUrl)` which strips the path, losing
+        // the server name. Forward these to the last server that triggered
+        // path-aware OAuth discovery.
+        const isRootOAuth = url.pathname.startsWith("/.well-known/")
+            || url.pathname === "/authorize"
+            || url.pathname === "/register"
+            || url.pathname === "/token"
+            || url.pathname.startsWith("/oauth/");
+        if (isRootOAuth) {
+            // For stdio servers, synthesize OAuth responses so Claude Code doesn't
+            // get stuck on "needs authentication". The proxy acts as a no-op OAuth
+            // server: it issues a dummy token that the SDK includes in POST headers,
+            // and the bridge ignores the Authorization header entirely.
+            if (this.lastOAuthServerName && this.callbacks.hasStdioUpstream(this.lastOAuthServerName)) {
+                await this.handleStdioOAuth(url, req, res);
+                return;
+            }
+            if (this.lastOAuthServerName) {
+                const upstreamUrl = this.callbacks.getUpstreamUrl(this.lastOAuthServerName);
+                if (upstreamUrl) {
+                    const upstreamOrigin = new URL(upstreamUrl).origin;
+                    const serverName = this.lastOAuthServerName;
+                    this.callbacks.log(`Root OAuth request ${url.pathname} -> forwarding to ${upstreamOrigin} (server: ${serverName})`);
+                    // /.well-known/oauth-authorization-server at root: fetch upstream
+                    // metadata and rewrite endpoints through forwardOAuthDiscovery.
+                    const rootWellKnown = url.pathname.match(/^\/\.well-known\/(.+)$/);
+                    if (rootWellKnown) {
+                        await this.forwardOAuthDiscovery(rootWellKnown[1], serverName, req, res);
+                        return;
+                    }
+                    // Look up the real upstream endpoint for this pathname. The upstream's
+                    // AS metadata may place /authorize, /token, /register at non-root
+                    // paths (e.g., betterstack serves /oauth/token).
+                    const endpoints = this.upstreamAsEndpoints.get(serverName);
+                    const upstreamEndpoint = endpoints
+                        ? (url.pathname === "/authorize" ? endpoints.authorization_endpoint
+                            : url.pathname === "/token" ? endpoints.token_endpoint
+                                : url.pathname === "/register" ? endpoints.registration_endpoint
+                                    : url.pathname === "/revoke" ? endpoints.revocation_endpoint
+                                        : url.pathname === "/introspect" ? endpoints.introspection_endpoint
+                                            : url.pathname === "/userinfo" ? endpoints.userinfo_endpoint
+                                                : undefined)
+                        : undefined;
+                    const target = upstreamEndpoint
+                        ? new URL(upstreamEndpoint)
+                        : new URL(`${upstreamOrigin}${url.pathname}`);
+                    // /authorize is browser-navigated; 302-redirect the browser to the
+                    // upstream's authorize endpoint with the `resource` param rewritten
+                    // from our proxy URL to the upstream's canonical resource URI.
+                    if (url.pathname === "/authorize") {
+                        const proxyResource = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+                        for (const [k, v] of url.searchParams) {
+                            target.searchParams.append(k, k === "resource" && v === proxyResource ? upstreamUrl : v);
+                        }
+                        res.writeHead(302, { Location: target.toString() });
+                        res.end();
+                        return;
+                    }
+                    await this.forwardRootOAuth(target.origin, target.pathname, url.search, req, res, serverName, upstreamUrl);
+                    return;
+                }
+            }
+            this.callbacks.log(`Root OAuth request ${url.pathname} -> no server context, returning 404`);
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "not_found" }));
+            return;
+        }
+        // Parse /proxy/{serverName}/mcp (with optional trailing paths for future MCP extensions)
+        const proxyMatch = url.pathname.match(/^\/proxy\/([^/]+)\/mcp(\/.*)?$/);
+        if (!proxyMatch) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Not found. Use /proxy/{serverName}/mcp" }));
+            return;
+        }
+        const serverName = decodeURIComponent(proxyMatch[1]);
+        const extraPath = proxyMatch[2] ?? "";
+        // Prefer the stdio bridge when the gateway has an active connection to
+        // the server. This bypasses OAuth discovery issues: the gateway already
+        // authenticated with the upstream, so the bridge reuses that connection.
+        // HTTP passthrough is only used when there's no gateway-level connection.
+        if (this.callbacks.hasStdioUpstream(serverName)) {
+            await this.bridgeToStdio(serverName, req, res);
+            return;
+        }
+        const upstreamUrl = this.callbacks.getUpstreamUrl(serverName);
+        if (!upstreamUrl) {
+            res.writeHead(502, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: `No upstream URL configured for server: ${serverName}` }));
+            return;
+        }
+        await this.forwardMcpRequest(serverName, upstreamUrl, extraPath, req, res);
+    }
+    /**
+     * Forward OAuth discovery requests to the upstream server.
+     * Rewrites the `resource` field in oauth-protected-resource responses
+     * to match the proxy URL so the SDK's validation passes.
+     */
+    async forwardOAuthDiscovery(wellKnownType, serverName, _req, res) {
+        const upstreamUrl = this.callbacks.getUpstreamUrl(serverName);
+        const hasGatewayConnection = this.callbacks.hasStdioUpstream(serverName);
+        this.callbacks.log(`OAuth discovery: type=${wellKnownType}, server=${serverName}, upstream=${upstreamUrl ?? "STDIO"}, gatewayConnected=${hasGatewayConnection}`);
+        if (!upstreamUrl || hasGatewayConnection) {
+            // Server is bridged through the gateway (either stdio-only or HTTP with
+            // an active gateway connection). Synthesize OAuth responses so Claude
+            // Code's proactive auth flow succeeds and proceeds to the MCP POST,
+            // which the bridge handles using the gateway's own authenticated session.
+            if (wellKnownType === "oauth-protected-resource") {
+                const proxyUrl = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+                const synthesized = {
+                    resource: proxyUrl,
+                    authorization_servers: [`http://localhost:${this.port}`],
+                };
+                this.callbacks.log(`OAuth discovery: synthesized oauth-protected-resource for stdio server ${serverName}`);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(synthesized));
+                return;
+            }
+            if (wellKnownType === "oauth-authorization-server" || wellKnownType === "openid-configuration") {
+                const metadata = this.buildStdioAuthServerMetadata();
+                this.callbacks.log(`OAuth discovery: synthesized ${wellKnownType} for stdio server ${serverName}`);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(metadata));
+                return;
+            }
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "not_found" }));
+            return;
+        }
+        try {
+            const upstream = new URL(upstreamUrl);
+            const upstreamOrigin = upstream.origin;
+            // RFC 9728: oauth-protected-resource is served at
+            // /.well-known/oauth-protected-resource{path}, where {path} is the
+            // resource's path (e.g., "/mcp" for https://mcp.sentry.dev/mcp).
+            // RFC 8414 oauth-authorization-server lives at origin root.
+            const pathSuffix = wellKnownType === "oauth-protected-resource"
+                ? upstream.pathname.replace(/\/$/, "")
+                : "";
+            const discoveryUrl = `${upstreamOrigin}/.well-known/${wellKnownType}${pathSuffix}`;
+            const response = await fetch(discoveryUrl, {
+                headers: { Accept: "application/json" },
+                redirect: "follow",
+            });
+            if (!response.ok) {
+                // If the upstream doesn't support oauth-protected-resource, synthesize
+                // one. Without this, the SDK falls back to root-level discovery at
+                // http://localhost:{port}/.well-known/oauth-authorization-server which
+                // has no server name in the path and can't be routed.
+                //
+                // The synthesized response tells the SDK:
+                // 1. The resource is our proxy URL (passes checkResourceAllowed)
+                // 2. The authorization server is the upstream origin (direct auth)
+                if (wellKnownType === "oauth-protected-resource" && response.status === 404) {
+                    const synthesized = {
+                        resource: `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`,
+                        authorization_servers: [upstreamOrigin],
+                    };
+                    this.callbacks.log(`OAuth discovery: synthesized oauth-protected-resource for ${serverName}`);
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify(synthesized));
+                    return;
+                }
+                res.writeHead(response.status);
+                res.end();
+                return;
+            }
+            const metadata = await response.json();
+            // Rewrite discovery so the client treats our proxy as both the resource
+            // and the authorization server. This lets the SDK's checkResourceAllowed
+            // pass (resource == server URL), while /authorize, /token, /register
+            // route through our proxy so we can rewrite `resource` to the upstream's
+            // canonical URI (RFC 8707) before forwarding.
+            if (wellKnownType === "oauth-protected-resource") {
+                metadata.resource = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+                metadata.authorization_servers = [`http://localhost:${this.port}`];
+            }
+            else if (wellKnownType === "oauth-authorization-server"
+                || wellKnownType === "openid-configuration") {
+                const proxyOrigin = `http://localhost:${this.port}`;
+                // Cache the real upstream endpoints so /authorize, /token, /register
+                // on our proxy can forward to their true locations (which may be at
+                // non-root paths like /oauth/token).
+                this.upstreamAsEndpoints.set(serverName, {
+                    authorization_endpoint: typeof metadata.authorization_endpoint === "string" ? metadata.authorization_endpoint : undefined,
+                    token_endpoint: typeof metadata.token_endpoint === "string" ? metadata.token_endpoint : undefined,
+                    registration_endpoint: typeof metadata.registration_endpoint === "string" ? metadata.registration_endpoint : undefined,
+                    revocation_endpoint: typeof metadata.revocation_endpoint === "string" ? metadata.revocation_endpoint : undefined,
+                    introspection_endpoint: typeof metadata.introspection_endpoint === "string" ? metadata.introspection_endpoint : undefined,
+                    userinfo_endpoint: typeof metadata.userinfo_endpoint === "string" ? metadata.userinfo_endpoint : undefined,
+                });
+                metadata.issuer = proxyOrigin;
+                metadata.authorization_endpoint = `${proxyOrigin}/authorize`;
+                metadata.token_endpoint = `${proxyOrigin}/token`;
+                metadata.registration_endpoint = `${proxyOrigin}/register`;
+                if (metadata.revocation_endpoint)
+                    metadata.revocation_endpoint = `${proxyOrigin}/revoke`;
+                if (metadata.introspection_endpoint)
+                    metadata.introspection_endpoint = `${proxyOrigin}/introspect`;
+                if (metadata.userinfo_endpoint)
+                    metadata.userinfo_endpoint = `${proxyOrigin}/userinfo`;
+            }
+            const body = JSON.stringify(metadata);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(body);
+        }
+        catch {
+            res.writeHead(502);
+            res.end();
+        }
+    }
+    /**
+     * Forward root-level OAuth requests (/token, /register) to the upstream.
+     * Rewrites the `resource` parameter from the proxy URL to the upstream's
+     * canonical resource URI (RFC 8707) so the upstream AS accepts the token
+     * request bound to the resource it knows about.
+     */
+    async forwardRootOAuth(upstreamOrigin, pathname, search, req, res, serverName, upstreamUrl) {
+        let targetSearch = search;
+        let body;
+        if (req.method === "POST") {
+            body = await readBody(req);
+        }
+        if (serverName && upstreamUrl) {
+            const proxyResource = `http://localhost:${this.port}/proxy/${encodeURIComponent(serverName)}/mcp`;
+            // Rewrite `resource` in query string.
+            if (targetSearch.includes("resource=")) {
+                const params = new URLSearchParams(targetSearch);
+                if (params.get("resource") === proxyResource) {
+                    params.set("resource", upstreamUrl);
+                    targetSearch = `?${params.toString()}`;
+                }
+            }
+            // Rewrite `resource` in form-urlencoded body (e.g., /token exchange).
+            if (body) {
+                const contentType = String(req.headers["content-type"] ?? "");
+                if (contentType.includes("application/x-www-form-urlencoded")) {
+                    const params = new URLSearchParams(body.toString());
+                    if (params.get("resource") === proxyResource) {
+                        params.set("resource", upstreamUrl);
+                        body = Buffer.from(params.toString());
+                    }
+                }
+            }
+        }
+        const targetUrl = `${upstreamOrigin}${pathname}${targetSearch}`;
+        const forwardHeaders = {};
+        for (const [key, value] of Object.entries(req.headers)) {
+            if (key === "host" || key === "connection" || key === "transfer-encoding" || key === "content-length")
+                continue;
+            if (value) {
+                forwardHeaders[key] = Array.isArray(value) ? value.join(", ") : value;
+            }
+        }
+        // Prevent compressed responses (e.g., zstd from Cloudflare) that the
+        // SDK's fetch may not decompress, causing JSON parse failures
+        forwardHeaders["accept-encoding"] = "identity";
+        try {
+            const response = await fetch(targetUrl, {
+                method: req.method ?? "GET",
+                headers: forwardHeaders,
+                body: body ? new Uint8Array(body) : undefined,
+                redirect: "follow",
+            });
+            const responseHeaders = {};
+            response.headers.forEach((value, key) => {
+                if (key === "transfer-encoding" || key === "connection")
+                    return;
+                if (key === "content-encoding")
+                    return;
+                responseHeaders[key] = value;
+            });
+            const responseBody = new Uint8Array(await response.arrayBuffer());
+            res.writeHead(response.status, responseHeaders);
+            res.end(responseBody);
+        }
+        catch {
+            res.writeHead(502);
+            res.end();
+        }
+    }
+    /**
+     * Build synthetic OAuth authorization server metadata for stdio-bridged servers.
+     * Points all OAuth endpoints back to this proxy so the full flow completes locally.
+     */
+    buildStdioAuthServerMetadata() {
+        const issuer = `http://localhost:${this.port}`;
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}/authorize`,
+            token_endpoint: `${issuer}/token`,
+            registration_endpoint: `${issuer}/register`,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "client_credentials", "refresh_token"],
+            token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+            code_challenge_methods_supported: ["S256"],
+        };
+    }
+    /**
+     * Handle OAuth endpoints for stdio-bridged servers.
+     * Synthesizes valid responses so Claude Code's proactive auth flow succeeds
+     * without requiring actual user authentication. The bridge ignores the
+     * Authorization header, so the dummy token is harmless.
+     */
+    async handleStdioOAuth(url, req, res) {
+        this.callbacks.log(`Stdio OAuth: ${req.method} ${url.pathname}`);
+        // .well-known discovery at root level
+        if (url.pathname === "/.well-known/oauth-authorization-server"
+            || url.pathname === "/.well-known/openid-configuration") {
+            const metadata = this.buildStdioAuthServerMetadata();
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(metadata));
+            return;
+        }
+        if (url.pathname === "/.well-known/oauth-protected-resource") {
+            // Return protected resource metadata pointing to this proxy
+            const synthesized = {
+                resource: `http://localhost:${this.port}`,
+                authorization_servers: [`http://localhost:${this.port}`],
+            };
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(synthesized));
+            return;
+        }
+        // Dynamic client registration: return a valid client_id
+        if (url.pathname === "/register" && req.method === "POST") {
+            const body = await readBody(req);
+            let clientMetadata = {};
+            try {
+                clientMetadata = JSON.parse(body.toString());
+            }
+            catch {
+                // Use defaults
+            }
+            const clientId = `stdio-bridge-${Date.now()}`;
+            const registration = {
+                client_id: clientId,
+                client_name: clientMetadata.client_name ?? "stdio-bridge-client",
+                redirect_uris: clientMetadata.redirect_uris ?? [],
+                grant_types: ["authorization_code", "client_credentials", "refresh_token"],
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+            };
+            this.callbacks.log(`Stdio OAuth: registered client ${clientId}`);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(registration));
+            return;
+        }
+        // Token endpoint: issue a long-lived dummy token with a refresh token.
+        // Real auth is handled by the gateway's upstream OAuth; these tokens are
+        // placeholders so the MCP SDK has something to send in Authorization
+        // headers. The bridge ignores them. A refresh_token is included so
+        // Claude Code's UI treats the session as durably authenticated and
+        // doesn't flip to "not authenticated" when the access token expires.
+        if (url.pathname === "/token" && req.method === "POST") {
+            const tokenResponse = {
+                access_token: `stdio-bridge-token-${Date.now()}`,
+                token_type: "Bearer",
+                expires_in: 315_360_000,
+                refresh_token: `stdio-bridge-refresh-${Date.now()}`,
+                scope: "mcp",
+            };
+            this.callbacks.log("Stdio OAuth: issued dummy token");
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(tokenResponse));
+            return;
+        }
+        // Authorization endpoint: redirect back with an auth code immediately.
+        // Claude Code opens this in a browser; we redirect to the callback with
+        // a synthetic code that the token endpoint will accept.
+        if (url.pathname === "/authorize") {
+            const redirectUri = url.searchParams.get("redirect_uri");
+            const state = url.searchParams.get("state");
+            if (redirectUri) {
+                const callbackUrl = new URL(redirectUri);
+                callbackUrl.searchParams.set("code", `stdio-auth-code-${Date.now()}`);
+                if (state)
+                    callbackUrl.searchParams.set("state", state);
+                this.callbacks.log(`Stdio OAuth: redirecting to ${callbackUrl.origin}${callbackUrl.pathname}`);
+                res.writeHead(302, { Location: callbackUrl.toString() });
+                res.end();
+                return;
+            }
+        }
+        // Fallback
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "not_found" }));
+    }
+    /**
+     * Bridge an HTTP MCP request to a stdio upstream via JSON-RPC.
+     *
+     * For command-based (stdio) servers that have no HTTP URL, we parse the
+     * incoming JSON-RPC request, forward it through the gateway's MCP Client
+     * connection, and return the response as HTTP.
+     *
+     * Handles: initialize, tools/list, tools/call, resources/list, etc.
+     * Also synthesizes MCP server metadata for the initial handshake.
+     */
+    async bridgeToStdio(serverName, req, res) {
+        // GET requests: the SDK sends GET with Accept: text/event-stream to open
+        // an SSE stream for server-initiated messages. Stdio servers don't push
+        // server-initiated messages, but some clients (Claude Code's /mcp status
+        // UI) treat a 405 response as a failed connection. Return an empty,
+        // long-lived SSE stream instead: 200 with Content-Type text/event-stream,
+        // keep-alive comments, and close when the client disconnects.
+        if (req.method === "GET") {
+            res.writeHead(200, {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache, no-transform",
+                "Connection": "keep-alive",
+            });
+            res.write(":ok\n\n");
+            const keepAlive = setInterval(() => {
+                if (!res.writableEnded)
+                    res.write(":keepalive\n\n");
+            }, 30_000);
+            const cleanup = () => {
+                clearInterval(keepAlive);
+                if (!res.writableEnded)
+                    res.end();
+            };
+            req.on("close", cleanup);
+            req.on("error", cleanup);
+            return;
+        }
+        if (req.method === "DELETE") {
+            // Session cleanup: no-op for stdio
+            res.writeHead(200);
+            res.end();
+            return;
+        }
+        // POST: parse JSON-RPC body
+        const body = await readBody(req);
+        let jsonRpc;
+        try {
+            jsonRpc = JSON.parse(body.toString());
+        }
+        catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32700, message: "Parse error" }, id: null }));
+            return;
+        }
+        const requests = Array.isArray(jsonRpc) ? jsonRpc : [jsonRpc];
+        const responses = [];
+        for (const rpcReq of requests) {
+            const { method, params, id } = rpcReq;
+            // Policy enforcement for tools/call
+            if (method === "tools/call" && params) {
+                const p = params;
+                const toolName = p.name ?? "unknown";
+                if (this.callbacks.isToolBlocked(serverName, toolName)) {
+                    this.callbacks.recordToolCall({
+                        serverName,
+                        toolName,
+                        durationMs: 0,
+                        status: "blocked",
+                        argumentKeys: p.arguments ? Object.keys(p.arguments) : [],
+                    });
+                    responses.push({
+                        jsonrpc: "2.0",
+                        id: id ?? null,
+                        result: {
+                            isError: true,
+                            content: [{ type: "text", text: `Tool ${serverName}.${toolName} is blocked by organization policy` }],
+                        },
+                    });
+                    continue;
+                }
+            }
+            const startTime = Date.now();
+            try {
+                const result = await this.callbacks.forwardJsonRpc(serverName, method, params);
+                const durationMs = Date.now() - startTime;
+                // Record telemetry for tools/call
+                if (method === "tools/call" && params) {
+                    const p = params;
+                    this.callbacks.recordToolCall({
+                        serverName,
+                        toolName: p.name ?? "unknown",
+                        durationMs,
+                        status: result.error ? "error" : "success",
+                        argumentKeys: p.arguments ? Object.keys(p.arguments) : [],
+                        ...(result.error ? { errorMessage: result.error.message } : {}),
+                    });
+                }
+                if (result.error) {
+                    responses.push({ jsonrpc: "2.0", id: id ?? null, error: result.error });
+                }
+                else {
+                    responses.push({ jsonrpc: "2.0", id: id ?? null, result: result.result });
+                }
+            }
+            catch (error) {
+                const durationMs = Date.now() - startTime;
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                if (method === "tools/call" && params) {
+                    const p = params;
+                    this.callbacks.recordToolCall({
+                        serverName,
+                        toolName: p.name ?? "unknown",
+                        durationMs,
+                        status: "error",
+                        errorMessage,
+                        argumentKeys: p.arguments ? Object.keys(p.arguments) : [],
+                    });
+                }
+                responses.push({
+                    jsonrpc: "2.0",
+                    id: id ?? null,
+                    error: { code: -32603, message: errorMessage },
+                });
+            }
+        }
+        // If all messages are notifications (no id), return 202 Accepted (no body).
+        // The SDK expects 202 for notifications and only processes JSON for requests.
+        const allNotifications = requests.every((r) => r.id === undefined || r.id === null);
+        if (allNotifications) {
+            res.writeHead(202);
+            res.end();
+            return;
+        }
+        const responseBody = Array.isArray(jsonRpc) ? responses : responses[0];
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(responseBody));
+    }
+    /**
+     * Forward an MCP request to the upstream server.
+     * For POST requests, parses the JSON-RPC body to detect tools/call for
+     * policy enforcement and telemetry. All other requests pass through as-is.
+     */
+    async forwardMcpRequest(serverName, upstreamUrl, extraPath, req, res) {
+        // Build upstream target URL
+        const targetUrl = extraPath ? `${upstreamUrl}${extraPath}` : upstreamUrl;
+        // Read request body for POST (needed for JSON-RPC parsing)
+        let requestBody;
+        if (req.method === "POST") {
+            requestBody = await readBody(req);
+        }
+        // Parse JSON-RPC to detect tools/call for policy and telemetry
+        let toolCallInfo;
+        let blocked = false;
+        if (requestBody) {
+            try {
+                const jsonRpc = JSON.parse(requestBody.toString());
+                // Handle both single requests and batches
+                const requests = Array.isArray(jsonRpc) ? jsonRpc : [jsonRpc];
+                for (const rpcReq of requests) {
+                    if (rpcReq.method === "tools/call" && rpcReq.params) {
+                        const params = rpcReq.params;
+                        const toolName = params.name ?? "unknown";
+                        const argumentKeys = params.arguments ? Object.keys(params.arguments) : [];
+                        toolCallInfo = { toolName, argumentKeys };
+                        // Check policy before forwarding
+                        if (this.callbacks.isToolBlocked(serverName, toolName)) {
+                            blocked = true;
+                            this.callbacks.recordToolCall({
+                                serverName,
+                                toolName,
+                                durationMs: 0,
+                                status: "blocked",
+                                argumentKeys,
+                            });
+                        }
+                    }
+                }
+            }
+            catch {
+                // Not valid JSON or not JSON-RPC; forward as-is
+            }
+        }
+        // If tool is blocked by policy, return an MCP error response without forwarding
+        if (blocked && toolCallInfo) {
+            const errorResponse = {
+                jsonrpc: "2.0",
+                id: extractRequestId(requestBody),
+                result: {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `Tool ${serverName}.${toolCallInfo.toolName} is blocked by organization policy`,
+                        },
+                    ],
+                },
+            };
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(errorResponse));
+            return;
+        }
+        // Forward the request to upstream
+        const startTime = Date.now();
+        // Build headers for upstream request
+        const forwardHeaders = {};
+        for (const [key, value] of Object.entries(req.headers)) {
+            // Skip hop-by-hop headers and host
+            if (key === "host" || key === "connection" || key === "transfer-encoding")
+                continue;
+            if (value) {
+                forwardHeaders[key] = Array.isArray(value) ? value.join(", ") : value;
+            }
+        }
+        // Prevent compressed responses (e.g., Brotli from Cloudflare) that fetch()
+        // auto-decompresses but whose content-encoding header would confuse the client
+        forwardHeaders["accept-encoding"] = "identity";
+        try {
+            const upstreamResponse = await fetch(targetUrl, {
+                method: req.method ?? "GET",
+                headers: forwardHeaders,
+                body: requestBody ? new Uint8Array(requestBody) : undefined,
+                redirect: "follow",
+            });
+            // Record telemetry for tool calls
+            if (toolCallInfo) {
+                const durationMs = Date.now() - startTime;
+                const status = upstreamResponse.ok ? "success" : "error";
+                this.callbacks.recordToolCall({
+                    serverName,
+                    toolName: toolCallInfo.toolName,
+                    durationMs,
+                    status,
+                    argumentKeys: toolCallInfo.argumentKeys,
+                    ...(status === "error" ? { errorMessage: `HTTP ${upstreamResponse.status}` } : {}),
+                });
+            }
+            // Forward response status and headers
+            const responseHeaders = {};
+            upstreamResponse.headers.forEach((value, key) => {
+                // Skip hop-by-hop headers
+                if (key === "transfer-encoding" || key === "connection")
+                    return;
+                // Strip content-encoding since we requested identity (fetch auto-decompresses)
+                if (key === "content-encoding")
+                    return;
+                responseHeaders[key] = value;
+            });
+            // On 401, rewrite resource_metadata in WWW-Authenticate to point to our
+            // path-aware discovery endpoint. Without this, the SDK uses the upstream's
+            // resource_metadata URL, discovers auth at the upstream origin, then falls
+            // back to root-level /.well-known/ on our proxy (which has no server name
+            // and can't be routed).
+            if (upstreamResponse.status === 401) {
+                const proxyResourceMetadata = `http://localhost:${this.port}/.well-known/oauth-protected-resource/proxy/${encodeURIComponent(serverName)}/mcp`;
+                const existingAuth = responseHeaders["www-authenticate"] ?? "";
+                if (existingAuth.toLowerCase().startsWith("bearer")) {
+                    // Replace any existing resource_metadata with our proxy URL
+                    const rewritten = existingAuth.replace(/resource_metadata="[^"]*"/g, `resource_metadata="${proxyResourceMetadata}"`);
+                    // If there was no resource_metadata to replace, append it
+                    responseHeaders["www-authenticate"] = rewritten.includes("resource_metadata=")
+                        ? rewritten
+                        : `${existingAuth}, resource_metadata="${proxyResourceMetadata}"`;
+                }
+                else {
+                    responseHeaders["www-authenticate"] = `Bearer resource_metadata="${proxyResourceMetadata}"`;
+                }
+            }
+            // Check if this is an SSE response (streaming)
+            const contentType = upstreamResponse.headers.get("content-type") ?? "";
+            const isSSE = contentType.includes("text/event-stream");
+            res.writeHead(upstreamResponse.status, responseHeaders);
+            if (isSSE && upstreamResponse.body) {
+                // Stream SSE responses through as-is
+                const reader = upstreamResponse.body.getReader();
+                const pump = async () => {
+                    while (true) {
+                        const { done, value } = await reader.read();
+                        if (done)
+                            break;
+                        const canContinue = res.write(value);
+                        if (!canContinue) {
+                            await new Promise((resolve) => res.once("drain", resolve));
+                        }
+                    }
+                    res.end();
+                };
+                // If client disconnects, cancel the upstream stream
+                req.on("close", () => {
+                    reader.cancel().catch(() => { });
+                });
+                await pump();
+            }
+            else if (upstreamResponse.body) {
+                // Buffer non-streaming responses
+                const body = new Uint8Array(await upstreamResponse.arrayBuffer());
+                res.end(body);
+            }
+            else {
+                res.end();
+            }
+        }
+        catch (error) {
+            // Record telemetry for failed tool calls
+            if (toolCallInfo) {
+                this.callbacks.recordToolCall({
+                    serverName,
+                    toolName: toolCallInfo.toolName,
+                    durationMs: Date.now() - startTime,
+                    status: "error",
+                    errorMessage: error instanceof Error ? error.message : String(error),
+                    argumentKeys: toolCallInfo.argumentKeys,
+                });
+            }
+            this.callbacks.log(`Proxy error for ${serverName}: ${error instanceof Error ? error.message : error}`);
+            res.writeHead(502, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Failed to reach upstream server" }));
+        }
+    }
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+function extractRequestId(body) {
+    if (!body)
+        return null;
+    try {
+        const parsed = JSON.parse(body.toString());
+        const first = Array.isArray(parsed) ? parsed[0] : parsed;
+        return first?.id ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=http-proxy.js.map