@studiometa/forge-mcp 0.2.2 → 0.2.3

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAUtD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,GAAE,MAAqB,EAC3B,IAAI,GAAE,MAAqB,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CA8CjB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAUtD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,GAAE,MAAqB,EAC3B,IAAI,GAAE,MAAqB,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CAoDjB"}

package/dist/server.js

@@ -1,29 +1,47 @@
 #!/usr/bin/env node
 import { t as parseReadOnlyFlag } from "./flags-LFbdErsZ.js";
-import { t as VERSION } from "./version-D3OFS3DQ.js";
-import { a as SessionManager, n as createMcpRequestHandler, t as createHealthApp } from "./http-BMOiJdyw.js";
+import { t as VERSION } from "./version-BTMdX8xQ.js";
+import { a as SessionManager, n as createMcpRequestHandler, t as createHealthApp } from "./http-CK8WsamV.js";
 import { toNodeHandler } from "h3/node";
 import { createServer } from "node:http";
 /**
 * Forge MCP Server - HTTP Transport (Streamable HTTP)
 *
 * Implements the official MCP Streamable HTTP transport specification.
-* Credentials are passed via Bearer token in the Authorization header.
+* Supports both raw Bearer tokens and OAuth 2.1 with PKCE for
+* Claude Desktop compatibility.
 *
-* Token format: raw Forge API token
+* Token formats:
+*   - Raw Forge API token (Bearer <token>)
+*   - Base64-encoded token from OAuth flow (Bearer base64(<token>))
+*
+* Environment variables:
+*   PORT          - HTTP port (default: 3000)
+*   HOST          - Bind address (default: 0.0.0.0)
+*   FORGE_READ_ONLY - Disable write operations (default: false)
+*   OAUTH_SECRET  - AES-256-GCM encryption key for OAuth tokens.
+*                   Required in production. A default is used if unset.
 *
 * Usage:
 *   forge-mcp-server
 *   forge-mcp-server --read-only
-*   FORGE_READ_ONLY=true forge-mcp-server
+*   OAUTH_SECRET=my-secret forge-mcp-server
 *   PORT=3000 forge-mcp-server
 *
 * Endpoints:
-*   POST /mcp   - MCP Streamable HTTP (JSON-RPC messages)
-*   GET  /mcp   - MCP Streamable HTTP (SSE stream for server notifications)
-*   DELETE /mcp - MCP Streamable HTTP (session termination)
+*   POST /mcp    - MCP Streamable HTTP (JSON-RPC messages)
+*   GET  /mcp    - MCP Streamable HTTP (SSE stream for server notifications)
+*   DELETE /mcp  - MCP Streamable HTTP (session termination)
 *   GET  /       - Service info
 *   GET  /health - Health check
+*
+* OAuth 2.1 endpoints (for Claude Desktop):
+*   GET  /.well-known/oauth-authorization-server - OAuth metadata (RFC 8414)
+*   GET  /.well-known/oauth-protected-resource   - Protected resource (RFC 9728)
+*   POST /register  - Dynamic client registration (RFC 7591)
+*   GET  /authorize - Login form
+*   POST /authorize - Process login
+*   POST /token     - Token exchange (PKCE)
 */
 var DEFAULT_PORT = 3e3;
 var DEFAULT_HOST = "0.0.0.0";
@@ -57,7 +75,13 @@ function startHttpServer(port = DEFAULT_PORT, host = DEFAULT_HOST, options) {
 			console.log("");
 			console.log("Authentication:");
 			console.log("  Bearer token in Authorization header");
-			console.log("  Token format: your raw Forge API token");
+			console.log("  Token format: raw Forge API token or OAuth 2.1 access token");
+			console.log("");
+			console.log("OAuth 2.1 (Claude Desktop):");
+			console.log(`  GET  http://${displayHost}:${port}/.well-known/oauth-authorization-server`);
+			console.log(`  POST http://${displayHost}:${port}/register`);
+			console.log(`  GET  http://${displayHost}:${port}/authorize`);
+			console.log(`  POST http://${displayHost}:${port}/token`);
 			if (readOnly) {
 				console.log("");
 				console.log("Mode: READ-ONLY (write operations disabled)");

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":[],"sources":["../src/server.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * Forge MCP Server - HTTP Transport (Streamable HTTP)\n *\n * Implements the official MCP Streamable HTTP transport specification.\n * Credentials are passed via Bearer token in the Authorization header.\n *\n * Token format: raw Forge API token\n *\n * Usage:\n *   forge-mcp-server\n *   forge-mcp-server --read-only\n *   FORGE_READ_ONLY=true forge-mcp-server\n *   PORT=3000 forge-mcp-server\n *\n * Endpoints:\n *   POST /mcp   - MCP Streamable HTTP (JSON-RPC messages)\n *   GET  /mcp   - MCP Streamable HTTP (SSE stream for server notifications)\n *   DELETE /mcp - MCP Streamable HTTP (session termination)\n *   GET  /       - Service info\n *   GET  /health - Health check\n */\n\nimport { toNodeHandler } from \"h3/node\";\nimport { createServer, type Server } from \"node:http\";\n\nimport { createHealthApp, createMcpRequestHandler } from \"./http.ts\";\nimport { parseReadOnlyFlag } from \"./flags.ts\";\nimport { SessionManager } from \"./sessions.ts\";\nimport { VERSION } from \"./version.ts\";\n\nconst DEFAULT_PORT = 3000;\nconst DEFAULT_HOST = \"0.0.0.0\";\n\n/**\n * Options for the HTTP server.\n */\nexport interface HttpStartOptions {\n  /** When true, forge_write tool is not registered. */\n  readOnly?: boolean;\n}\n\n/**\n * Start the HTTP server with Streamable HTTP transport.\n */\nexport function startHttpServer(\n  port: number = DEFAULT_PORT,\n  host: string = DEFAULT_HOST,\n  options?: HttpStartOptions,\n): Promise<Server> {\n  return new Promise((resolve) => {\n    const readOnly = options?.readOnly ?? false;\n    const sessions = new SessionManager();\n    const handleMcp = createMcpRequestHandler(sessions, { readOnly });\n    const healthApp = createHealthApp();\n    const healthHandler = toNodeHandler(healthApp);\n\n    const server = createServer(async (req, res) => {\n      const url = req.url ?? \"/\";\n\n      // Route /mcp to MCP Streamable HTTP transport\n      if (url === \"/mcp\" || url.startsWith(\"/mcp?\")) {\n        await handleMcp(req, res);\n        return;\n      }\n\n      // Everything else goes to h3 (health checks, service info)\n      healthHandler(req, res);\n    });\n\n    server.listen(port, host, () => {\n      const displayHost = host === \"0.0.0.0\" ? \"localhost\" : host;\n      const mode = readOnly ? \" (read-only)\" : \"\";\n      console.log(`Forge MCP server v${VERSION}${mode}`);\n      console.log(`Node.js ${process.version}`);\n      console.log(\"\");\n      console.log(`Running at http://${displayHost}:${port}`);\n      console.log(\"\");\n      console.log(\"Endpoints:\");\n      console.log(\n        `  POST/GET/DELETE http://${displayHost}:${port}/mcp - MCP Streamable HTTP endpoint`,\n      );\n      console.log(`  GET  http://${displayHost}:${port}/health - Health check`);\n      console.log(\"\");\n      console.log(\"Authentication:\");\n      console.log(\"  Bearer token in Authorization header\");\n      console.log(\"  Token format: your raw Forge API token\");\n      if (readOnly) {\n        console.log(\"\");\n        console.log(\"Mode: READ-ONLY (write operations disabled)\");\n      }\n      console.log(\"\");\n      resolve(server);\n    });\n  });\n}\n\n// Start server when run directly\nconst isMainModule =\n  import.meta.url === `file://${process.argv[1]}` ||\n  process.argv[1]?.endsWith(\"/forge-mcp-server\") ||\n  process.argv[1]?.endsWith(\"\\\\forge-mcp-server\");\n\nif (isMainModule) {\n  const port = Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10);\n  const host = process.env.HOST || DEFAULT_HOST;\n  const readOnly = parseReadOnlyFlag();\n\n  startHttpServer(port, host, { readOnly }).catch((error) => {\n    console.error(\"Fatal error:\", error);\n    process.exit(1);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAM,eAAe;AACrB,IAAM,eAAe;;;;AAarB,SAAgB,gBACd,OAAe,cACf,OAAe,cACf,SACiB;AACjB,QAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,WAAW,SAAS,YAAY;EAEtC,MAAM,YAAY,wBADD,IAAI,gBAAgB,EACe,EAAE,UAAU,CAAC;EAEjE,MAAM,gBAAgB,cADJ,iBAAiB,CACW;EAE9C,MAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;GAC9C,MAAM,MAAM,IAAI,OAAO;AAGvB,OAAI,QAAQ,UAAU,IAAI,WAAW,QAAQ,EAAE;AAC7C,UAAM,UAAU,KAAK,IAAI;AACzB;;AAIF,iBAAc,KAAK,IAAI;IACvB;AAEF,SAAO,OAAO,MAAM,YAAY;GAC9B,MAAM,cAAc,SAAS,YAAY,cAAc;GACvD,MAAM,OAAO,WAAW,iBAAiB;AACzC,WAAQ,IAAI,qBAAqB,UAAU,OAAO;AAClD,WAAQ,IAAI,WAAW,QAAQ,UAAU;AACzC,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,qBAAqB,YAAY,GAAG,OAAO;AACvD,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,aAAa;AACzB,WAAQ,IACN,4BAA4B,YAAY,GAAG,KAAK,qCACjD;AACD,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,wBAAwB;AACzE,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,kBAAkB;AAC9B,WAAQ,IAAI,yCAAyC;AACrD,WAAQ,IAAI,2CAA2C;AACvD,OAAI,UAAU;AACZ,YAAQ,IAAI,GAAG;AACf,YAAQ,IAAI,8CAA8C;;AAE5D,WAAQ,IAAI,GAAG;AACf,WAAQ,OAAO;IACf;GACF;;AASJ,IAJE,OAAO,KAAK,QAAQ,UAAU,QAAQ,KAAK,QAC3C,QAAQ,KAAK,IAAI,SAAS,oBAAoB,IAC9C,QAAQ,KAAK,IAAI,SAAS,qBAAqB,CAO/C,iBAJa,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,aAAa,EAAE,GAAG,EAC7D,QAAQ,IAAI,QAAQ,cAGL,EAAE,UAFb,mBAAmB,EAEI,CAAC,CAAC,OAAO,UAAU;AACzD,SAAQ,MAAM,gBAAgB,MAAM;AACpC,SAAQ,KAAK,EAAE;EACf"}
+{"version":3,"file":"server.js","names":[],"sources":["../src/server.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * Forge MCP Server - HTTP Transport (Streamable HTTP)\n *\n * Implements the official MCP Streamable HTTP transport specification.\n * Supports both raw Bearer tokens and OAuth 2.1 with PKCE for\n * Claude Desktop compatibility.\n *\n * Token formats:\n *   - Raw Forge API token (Bearer <token>)\n *   - Base64-encoded token from OAuth flow (Bearer base64(<token>))\n *\n * Environment variables:\n *   PORT          - HTTP port (default: 3000)\n *   HOST          - Bind address (default: 0.0.0.0)\n *   FORGE_READ_ONLY - Disable write operations (default: false)\n *   OAUTH_SECRET  - AES-256-GCM encryption key for OAuth tokens.\n *                   Required in production. A default is used if unset.\n *\n * Usage:\n *   forge-mcp-server\n *   forge-mcp-server --read-only\n *   OAUTH_SECRET=my-secret forge-mcp-server\n *   PORT=3000 forge-mcp-server\n *\n * Endpoints:\n *   POST /mcp    - MCP Streamable HTTP (JSON-RPC messages)\n *   GET  /mcp    - MCP Streamable HTTP (SSE stream for server notifications)\n *   DELETE /mcp  - MCP Streamable HTTP (session termination)\n *   GET  /       - Service info\n *   GET  /health - Health check\n *\n * OAuth 2.1 endpoints (for Claude Desktop):\n *   GET  /.well-known/oauth-authorization-server - OAuth metadata (RFC 8414)\n *   GET  /.well-known/oauth-protected-resource   - Protected resource (RFC 9728)\n *   POST /register  - Dynamic client registration (RFC 7591)\n *   GET  /authorize - Login form\n *   POST /authorize - Process login\n *   POST /token     - Token exchange (PKCE)\n */\n\nimport { toNodeHandler } from \"h3/node\";\nimport { createServer, type Server } from \"node:http\";\n\nimport { createHealthApp, createMcpRequestHandler } from \"./http.ts\";\nimport { parseReadOnlyFlag } from \"./flags.ts\";\nimport { SessionManager } from \"./sessions.ts\";\nimport { VERSION } from \"./version.ts\";\n\nconst DEFAULT_PORT = 3000;\nconst DEFAULT_HOST = \"0.0.0.0\";\n\n/**\n * Options for the HTTP server.\n */\nexport interface HttpStartOptions {\n  /** When true, forge_write tool is not registered. */\n  readOnly?: boolean;\n}\n\n/**\n * Start the HTTP server with Streamable HTTP transport.\n */\nexport function startHttpServer(\n  port: number = DEFAULT_PORT,\n  host: string = DEFAULT_HOST,\n  options?: HttpStartOptions,\n): Promise<Server> {\n  return new Promise((resolve) => {\n    const readOnly = options?.readOnly ?? false;\n    const sessions = new SessionManager();\n    const handleMcp = createMcpRequestHandler(sessions, { readOnly });\n    const healthApp = createHealthApp();\n    const healthHandler = toNodeHandler(healthApp);\n\n    const server = createServer(async (req, res) => {\n      const url = req.url ?? \"/\";\n\n      // Route /mcp to MCP Streamable HTTP transport\n      if (url === \"/mcp\" || url.startsWith(\"/mcp?\")) {\n        await handleMcp(req, res);\n        return;\n      }\n\n      // Everything else goes to h3 (health checks, service info)\n      healthHandler(req, res);\n    });\n\n    server.listen(port, host, () => {\n      const displayHost = host === \"0.0.0.0\" ? \"localhost\" : host;\n      const mode = readOnly ? \" (read-only)\" : \"\";\n      console.log(`Forge MCP server v${VERSION}${mode}`);\n      console.log(`Node.js ${process.version}`);\n      console.log(\"\");\n      console.log(`Running at http://${displayHost}:${port}`);\n      console.log(\"\");\n      console.log(\"Endpoints:\");\n      console.log(\n        `  POST/GET/DELETE http://${displayHost}:${port}/mcp - MCP Streamable HTTP endpoint`,\n      );\n      console.log(`  GET  http://${displayHost}:${port}/health - Health check`);\n      console.log(\"\");\n      console.log(\"Authentication:\");\n      console.log(\"  Bearer token in Authorization header\");\n      console.log(\"  Token format: raw Forge API token or OAuth 2.1 access token\");\n      console.log(\"\");\n      console.log(\"OAuth 2.1 (Claude Desktop):\");\n      console.log(`  GET  http://${displayHost}:${port}/.well-known/oauth-authorization-server`);\n      console.log(`  POST http://${displayHost}:${port}/register`);\n      console.log(`  GET  http://${displayHost}:${port}/authorize`);\n      console.log(`  POST http://${displayHost}:${port}/token`);\n      if (readOnly) {\n        console.log(\"\");\n        console.log(\"Mode: READ-ONLY (write operations disabled)\");\n      }\n      console.log(\"\");\n      resolve(server);\n    });\n  });\n}\n\n// Start server when run directly\nconst isMainModule =\n  import.meta.url === `file://${process.argv[1]}` ||\n  process.argv[1]?.endsWith(\"/forge-mcp-server\") ||\n  process.argv[1]?.endsWith(\"\\\\forge-mcp-server\");\n\nif (isMainModule) {\n  const port = Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10);\n  const host = process.env.HOST || DEFAULT_HOST;\n  const readOnly = parseReadOnlyFlag();\n\n  startHttpServer(port, host, { readOnly }).catch((error) => {\n    console.error(\"Fatal error:\", error);\n    process.exit(1);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,IAAM,eAAe;AACrB,IAAM,eAAe;;;;AAarB,SAAgB,gBACd,OAAe,cACf,OAAe,cACf,SACiB;AACjB,QAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,WAAW,SAAS,YAAY;EAEtC,MAAM,YAAY,wBADD,IAAI,gBAAgB,EACe,EAAE,UAAU,CAAC;EAEjE,MAAM,gBAAgB,cADJ,iBAAiB,CACW;EAE9C,MAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;GAC9C,MAAM,MAAM,IAAI,OAAO;AAGvB,OAAI,QAAQ,UAAU,IAAI,WAAW,QAAQ,EAAE;AAC7C,UAAM,UAAU,KAAK,IAAI;AACzB;;AAIF,iBAAc,KAAK,IAAI;IACvB;AAEF,SAAO,OAAO,MAAM,YAAY;GAC9B,MAAM,cAAc,SAAS,YAAY,cAAc;GACvD,MAAM,OAAO,WAAW,iBAAiB;AACzC,WAAQ,IAAI,qBAAqB,UAAU,OAAO;AAClD,WAAQ,IAAI,WAAW,QAAQ,UAAU;AACzC,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,qBAAqB,YAAY,GAAG,OAAO;AACvD,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,aAAa;AACzB,WAAQ,IACN,4BAA4B,YAAY,GAAG,KAAK,qCACjD;AACD,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,wBAAwB;AACzE,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,kBAAkB;AAC9B,WAAQ,IAAI,yCAAyC;AACrD,WAAQ,IAAI,gEAAgE;AAC5E,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,8BAA8B;AAC1C,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,yCAAyC;AAC1F,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,WAAW;AAC5D,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,YAAY;AAC7D,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,QAAQ;AACzD,OAAI,UAAU;AACZ,YAAQ,IAAI,GAAG;AACf,YAAQ,IAAI,8CAA8C;;AAE5D,WAAQ,IAAI,GAAG;AACf,WAAQ,OAAO;IACf;GACF;;AASJ,IAJE,OAAO,KAAK,QAAQ,UAAU,QAAQ,KAAK,QAC3C,QAAQ,KAAK,IAAI,SAAS,oBAAoB,IAC9C,QAAQ,KAAK,IAAI,SAAS,qBAAqB,CAO/C,iBAJa,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,aAAa,EAAE,GAAG,EAC7D,QAAQ,IAAI,QAAQ,cAGL,EAAE,UAFb,mBAAmB,EAEI,CAAC,CAAC,OAAO,UAAU;AACzD,SAAQ,MAAM,gBAAgB,MAAM;AACpC,SAAQ,KAAK,EAAE;EACf"}

package/dist/{version-D3OFS3DQ.js → version-BTMdX8xQ.js}

@@ -3464,7 +3464,7 @@ async function executeToolWithCredentials(name, args, credentials) {
 		return errorResult(errorMessage);
 	}
 }
-const VERSION = "0.2.2";
+const VERSION = "0.2.3";
 export { INSTRUCTIONS as a, getTools as i, executeToolWithCredentials as n, STDIO_ONLY_TOOLS as r, VERSION as t };
 
-//# sourceMappingURL=version-D3OFS3DQ.js.map
+//# sourceMappingURL=version-BTMdX8xQ.js.map