@studiometa/forge-mcp 0.2.2 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +61 -19
- package/dist/auth.d.ts +12 -1
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +19 -1
- package/dist/auth.js.map +1 -1
- package/dist/crypto.d.ts +56 -0
- package/dist/crypto.d.ts.map +1 -0
- package/dist/crypto.js +110 -0
- package/dist/crypto.js.map +1 -0
- package/dist/handlers/auto-resolve.d.ts +24 -0
- package/dist/handlers/auto-resolve.d.ts.map +1 -0
- package/dist/handlers/batch.d.ts +14 -0
- package/dist/handlers/batch.d.ts.map +1 -0
- package/dist/handlers/context.d.ts +14 -0
- package/dist/handlers/context.d.ts.map +1 -0
- package/dist/handlers/help.d.ts.map +1 -1
- package/dist/handlers/index.d.ts.map +1 -1
- package/dist/handlers/schema.d.ts.map +1 -1
- package/dist/handlers/servers.d.ts +6 -1
- package/dist/handlers/servers.d.ts.map +1 -1
- package/dist/handlers/sites.d.ts +6 -1
- package/dist/handlers/sites.d.ts.map +1 -1
- package/dist/{http-BMOiJdyw.js → http-DN0I5GR6.js} +16 -4
- package/dist/http-DN0I5GR6.js.map +1 -0
- package/dist/http.d.ts +1 -1
- package/dist/http.d.ts.map +1 -1
- package/dist/http.js +2 -2
- package/dist/index.js +1 -1
- package/dist/oauth.d.ts +118 -0
- package/dist/oauth.d.ts.map +1 -0
- package/dist/oauth.js +571 -0
- package/dist/oauth.js.map +1 -0
- package/dist/server.d.ts +24 -6
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +33 -9
- package/dist/server.js.map +1 -1
- package/dist/tools.d.ts +1 -1
- package/dist/tools.d.ts.map +1 -1
- package/dist/{version-D3OFS3DQ.js → version-Gjth4BwC.js} +2799 -2450
- package/dist/version-Gjth4BwC.js.map +1 -0
- package/package.json +9 -1
- package/skills/SKILL.md +152 -29
- package/dist/http-BMOiJdyw.js.map +0 -1
- package/dist/version-D3OFS3DQ.js.map +0 -1
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth.js","names":[],"sources":["../src/oauth.ts"],"sourcesContent":["/**\n * OAuth 2.1 endpoints for Claude Desktop integration\n *\n * Implements OAuth 2.1 with PKCE as specified in the MCP authorization spec.\n * Uses stateless encrypted tokens — no server-side storage required.\n *\n * Spec: https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization\n *\n * Flow:\n * 1. Claude redirects user to /authorize with OAuth params (including PKCE)\n * 2. User enters their Forge API token in a login form\n * 3. Server encrypts the token + PKCE challenge into an authorization code\n * 4. Redirects back to Claude with the code\n * 5. Claude exchanges code for access token via /token (with code_verifier)\n * 6. Server validates PKCE and returns base64-encoded access token\n */\n\nimport {\n defineEventHandler,\n getQuery,\n getRequestHeader,\n readBody,\n sendRedirect,\n setResponseHeader,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\nimport { createHash } from \"node:crypto\";\n\nimport { createAuthCode, decodeAuthCode } from \"./crypto.ts\";\n\n/**\n * Create a base64-encoded access token from a Forge API token.\n * The access token is simply base64(apiToken) so that parseAuthHeader\n * can decode it on every request without any server-side lookup.\n */\nexport function createAccessToken(apiToken: string): string {\n return Buffer.from(apiToken).toString(\"base64\");\n}\n\n/**\n * OAuth metadata for discovery (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n *\n * MCP clients MUST check this endpoint first for server capabilities.\n */\nexport const oauthMetadataHandler = defineEventHandler((event: H3Event) => {\n const host = getRequestHeader(event, \"host\") || \"localhost:3000\";\n const protocol = getRequestHeader(event, \"x-forwarded-proto\") || \"http\";\n const baseUrl = `${protocol}://${host}`;\n\n setResponseHeader(event, \"Content-Type\", \"application/json\");\n setResponseHeader(event, \"Cache-Control\", \"public, max-age=3600\");\n\n return {\n // Required fields per RFC 8414\n issuer: baseUrl,\n authorization_endpoint: `${baseUrl}/authorize`,\n token_endpoint: `${baseUrl}/token`,\n response_types_supported: [\"code\"],\n\n // OAuth 2.1 / MCP requirements\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"none\"], // Public client\n\n // Optional but useful\n registration_endpoint: `${baseUrl}/register`,\n scopes_supported: [\"forge\"],\n service_documentation: \"https://github.com/studiometa/forge-tools\",\n };\n});\n\n/**\n * Protected resource metadata (RFC 9728)\n * GET /.well-known/oauth-protected-resource\n *\n * Tells MCP clients where to find the OAuth authorization server.\n */\nexport const protectedResourceHandler = defineEventHandler((event: H3Event) => {\n const host = getRequestHeader(event, \"host\") || \"localhost:3000\";\n const protocol = getRequestHeader(event, \"x-forwarded-proto\") || \"http\";\n const baseUrl = `${protocol}://${host}`;\n\n setResponseHeader(event, \"Content-Type\", \"application/json\");\n setResponseHeader(event, \"Cache-Control\", \"public, max-age=3600\");\n\n return {\n resource: `${baseUrl}/mcp`,\n authorization_servers: [baseUrl],\n bearer_methods_supported: [\"header\"],\n scopes_supported: [\"forge\"],\n };\n});\n\n/**\n * Dynamic Client Registration endpoint (RFC 7591)\n * POST /register\n *\n * MCP servers SHOULD support DCR to allow clients to register automatically.\n * Since we use stateless tokens, we accept any registration and return\n * a generated client_id.\n */\nexport const registerHandler = defineEventHandler(async (event: H3Event) => {\n setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n let body: Record<string, unknown>;\n try {\n body = (await readBody(event)) as Record<string, unknown>;\n } catch {\n setResponseStatus(event, 400);\n return {\n error: \"invalid_request\",\n error_description: \"Invalid JSON body\",\n };\n }\n\n // Extract client metadata\n const clientName = (body.client_name as string) || \"MCP Client\";\n const redirectUris = (body.redirect_uris as string[]) || [];\n\n // Generate a client_id based on the registration\n // Since we're stateless, we encode minimal info in the client_id\n const clientId = Buffer.from(\n JSON.stringify({\n name: clientName,\n ts: Date.now(),\n }),\n ).toString(\"base64url\");\n\n setResponseStatus(event, 201);\n return {\n client_id: clientId,\n client_name: clientName,\n redirect_uris: redirectUris,\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n };\n});\n\n/**\n * Authorization endpoint — shows login form\n * GET /authorize\n */\nexport const authorizeGetHandler = defineEventHandler((event: H3Event) => {\n const query = getQuery(event);\n\n // Extract OAuth parameters\n const redirectUri = query.redirect_uri as string;\n const state = query.state as string;\n const codeChallenge = query.code_challenge as string;\n const codeChallengeMethod = query.code_challenge_method as string;\n\n // Validate required parameters per OAuth 2.1\n if (!redirectUri) {\n setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n setResponseStatus(event, 400);\n return renderErrorPage(\"Missing required parameter: redirect_uri\");\n }\n\n // PKCE is REQUIRED for public clients per MCP spec\n if (!codeChallenge) {\n const errorUrl = new URL(redirectUri);\n errorUrl.searchParams.set(\"error\", \"invalid_request\");\n errorUrl.searchParams.set(\"error_description\", \"code_challenge is required\");\n if (state) errorUrl.searchParams.set(\"state\", state);\n return sendRedirect(event, errorUrl.toString(), 302);\n }\n\n if (codeChallengeMethod && codeChallengeMethod !== \"S256\") {\n const errorUrl = new URL(redirectUri);\n errorUrl.searchParams.set(\"error\", \"invalid_request\");\n errorUrl.searchParams.set(\"error_description\", \"Only S256 code_challenge_method is supported\");\n if (state) errorUrl.searchParams.set(\"state\", state);\n return sendRedirect(event, errorUrl.toString(), 302);\n }\n\n setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n\n return renderLoginForm({\n redirectUri,\n state,\n codeChallenge,\n codeChallengeMethod: codeChallengeMethod || \"S256\",\n });\n});\n\n/**\n * Authorization endpoint — process login\n * POST /authorize\n */\nexport const authorizePostHandler = defineEventHandler(async (event: H3Event) => {\n const body = (await readBody(event)) as Record<string, string>;\n\n const { apiToken, redirectUri, state, codeChallenge, codeChallengeMethod } = body;\n\n // Validate redirect URI first (security requirement)\n if (!redirectUri) {\n setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n setResponseStatus(event, 400);\n return renderErrorPage(\"Missing redirect_uri parameter\");\n }\n\n // Validate redirect URI format (must be HTTPS or localhost)\n try {\n const uri = new URL(redirectUri);\n const isLocalhost = uri.hostname === \"localhost\" || uri.hostname === \"127.0.0.1\";\n const isHttps = uri.protocol === \"https:\";\n if (!isLocalhost && !isHttps) {\n setResponseStatus(event, 400);\n return renderErrorPage(\"redirect_uri must be HTTPS or localhost\");\n }\n } catch {\n setResponseStatus(event, 400);\n return renderErrorPage(\"Invalid redirect_uri format\");\n }\n\n // Validate required credentials\n if (!apiToken) {\n setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n return renderLoginForm({\n redirectUri,\n state,\n codeChallenge,\n codeChallengeMethod,\n error: \"Forge API Token is required\",\n });\n }\n\n // Create encrypted authorization code with PKCE challenge\n const code = createAuthCode({\n apiToken,\n codeChallenge,\n codeChallengeMethod: codeChallengeMethod || \"S256\",\n });\n\n // Build redirect URL with authorization code\n const redirectUrl = new URL(redirectUri);\n redirectUrl.searchParams.set(\"code\", code);\n if (state) {\n redirectUrl.searchParams.set(\"state\", state);\n }\n\n // Show success page with auto-redirect\n setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n return renderSuccessPage(redirectUrl.toString());\n});\n\n/**\n * Token endpoint — exchange code for access token\n * POST /token\n *\n * Supports:\n * - authorization_code grant (with PKCE validation)\n * - refresh_token grant\n */\nexport const tokenHandler = defineEventHandler(async (event: H3Event) => {\n setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n // h3 auto-parses both JSON and URL-encoded bodies into objects\n const body = (await readBody(event)) as Record<string, string>;\n\n const { grant_type, code, code_verifier, refresh_token } = body;\n\n // Handle refresh token grant\n if (grant_type === \"refresh_token\") {\n return handleRefreshToken(event, refresh_token);\n }\n\n // Validate authorization code grant\n if (grant_type !== \"authorization_code\") {\n setResponseStatus(event, 400);\n return {\n error: \"unsupported_grant_type\",\n error_description: \"Supported grant types: authorization_code, refresh_token\",\n };\n }\n\n if (!code) {\n setResponseStatus(event, 400);\n return {\n error: \"invalid_request\",\n error_description: \"Missing authorization code\",\n };\n }\n\n if (!code_verifier) {\n setResponseStatus(event, 400);\n return {\n error: \"invalid_request\",\n error_description: \"Missing code_verifier (PKCE required)\",\n };\n }\n\n try {\n // Decode the authorization code\n const payload = decodeAuthCode(code);\n\n // Validate PKCE: SHA256(code_verifier) must equal code_challenge\n if (payload.codeChallenge) {\n const expectedChallenge = createS256Challenge(code_verifier);\n if (expectedChallenge !== payload.codeChallenge) {\n setResponseStatus(event, 400);\n return {\n error: \"invalid_grant\",\n error_description: \"Invalid code_verifier\",\n };\n }\n }\n\n // Create access token: base64(apiToken) — decodable on every request\n const accessToken = createAccessToken(payload.apiToken);\n\n // Create refresh token (encrypted credentials, longer expiry)\n const refreshToken = createAuthCode(\n { apiToken: payload.apiToken },\n 86400 * 30, // 30 days\n );\n\n return {\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: 3600, // 1 hour\n refresh_token: refreshToken,\n };\n } catch (error) {\n setResponseStatus(event, 400);\n return {\n error: \"invalid_grant\",\n error_description: error instanceof Error ? error.message : \"Invalid authorization code\",\n };\n }\n});\n\n/**\n * Handle refresh token grant\n */\nfunction handleRefreshToken(event: H3Event, refreshToken: string | undefined) {\n if (!refreshToken) {\n setResponseStatus(event, 400);\n return {\n error: \"invalid_request\",\n error_description: \"Missing refresh_token\",\n };\n }\n\n try {\n // Decode refresh token (it's just an encrypted auth code with longer expiry)\n const payload = decodeAuthCode(refreshToken);\n\n // Create new access token\n const accessToken = createAccessToken(payload.apiToken);\n\n // Create new refresh token (rotate for security)\n const newRefreshToken = createAuthCode(\n { apiToken: payload.apiToken },\n 86400 * 30, // 30 days\n );\n\n return {\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: newRefreshToken,\n };\n } catch (error) {\n setResponseStatus(event, 400);\n return {\n error: \"invalid_grant\",\n error_description: error instanceof Error ? error.message : \"Invalid refresh token\",\n };\n }\n}\n\n/**\n * Create S256 PKCE challenge from verifier\n * SHA256(code_verifier) encoded as base64url\n */\nexport function createS256Challenge(codeVerifier: string): string {\n return createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n}\n\n/**\n * Escape HTML special characters\n */\nfunction escapeHtml(str: string): string {\n return str\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\n/**\n * Render the login form HTML\n */\nfunction renderLoginForm(params: {\n redirectUri?: string;\n state?: string;\n codeChallenge?: string;\n codeChallengeMethod?: string;\n error?: string;\n}): string {\n const { redirectUri, state, codeChallenge, codeChallengeMethod, error } = params;\n\n return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n <meta charset=\"UTF-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n <title>Connect to Laravel Forge</title>\n <style>\n * { box-sizing: border-box; margin: 0; padding: 0; }\n body {\n font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);\n min-height: 100vh;\n display: flex;\n align-items: center;\n justify-content: center;\n padding: 20px;\n }\n .container {\n background: white;\n border-radius: 16px;\n box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n padding: 40px;\n width: 100%;\n max-width: 420px;\n }\n .logo {\n text-align: center;\n margin-bottom: 24px;\n }\n .logo svg { width: 48px; height: 48px; }\n h1 {\n text-align: center;\n color: #1a1a2e;\n font-size: 24px;\n margin-bottom: 8px;\n }\n .subtitle {\n text-align: center;\n color: #666;\n font-size: 14px;\n margin-bottom: 32px;\n }\n .error {\n background: #fee2e2;\n border: 1px solid #fecaca;\n color: #dc2626;\n padding: 12px 16px;\n border-radius: 8px;\n margin-bottom: 24px;\n font-size: 14px;\n }\n .notice {\n background: #f0fdf4;\n border: 1px solid #bbf7d0;\n color: #166534;\n padding: 12px 16px;\n border-radius: 8px;\n margin-bottom: 24px;\n font-size: 13px;\n line-height: 1.4;\n }\n .form-group { margin-bottom: 20px; }\n label {\n display: block;\n font-size: 14px;\n font-weight: 500;\n color: #374151;\n margin-bottom: 6px;\n }\n input {\n width: 100%;\n padding: 12px 16px;\n border: 1px solid #d1d5db;\n border-radius: 8px;\n font-size: 16px;\n transition: border-color 0.2s, box-shadow 0.2s;\n }\n input:focus {\n outline: none;\n border-color: #18b69b;\n box-shadow: 0 0 0 3px rgba(24, 182, 155, 0.2);\n }\n input::placeholder { color: #9ca3af; }\n .help-text {\n font-size: 12px;\n color: #6b7280;\n margin-top: 4px;\n }\n .help-text a { color: #18b69b; text-decoration: none; }\n .help-text a:hover { text-decoration: underline; }\n button {\n width: 100%;\n padding: 14px 24px;\n background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);\n color: white;\n border: none;\n border-radius: 8px;\n font-size: 16px;\n font-weight: 600;\n cursor: pointer;\n transition: transform 0.2s, box-shadow 0.2s;\n }\n button:hover {\n transform: translateY(-1px);\n box-shadow: 0 4px 12px rgba(24, 182, 155, 0.4);\n }\n button:active { transform: translateY(0); }\n .footer {\n text-align: center;\n margin-top: 24px;\n font-size: 12px;\n color: #9ca3af;\n }\n .footer a { color: #18b69b; text-decoration: none; }\n .footer a:hover { text-decoration: underline; }\n </style>\n</head>\n<body>\n <div class=\"container\">\n <div class=\"logo\">\n <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n <path d=\"M12 2L2 7L12 12L22 7L12 2Z\" stroke=\"#18b69b\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n <path d=\"M2 17L12 22L22 17\" stroke=\"#0e7460\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n <path d=\"M2 12L12 17L22 12\" stroke=\"#18b69b\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n </svg>\n </div>\n <h1>Connect to Laravel Forge</h1>\n <p class=\"subtitle\">Enter your Forge API token to connect with Claude</p>\n\n ${error ? `<div class=\"error\">${escapeHtml(error)}</div>` : \"\"}\n\n <div class=\"notice\">\n <strong>Your token is not stored on this server.</strong> It is encrypted into the authorization code and sent back to Claude Desktop, which holds it in its own secure storage.\n </div>\n\n <form method=\"POST\" action=\"/authorize\">\n <input type=\"hidden\" name=\"redirectUri\" value=\"${escapeHtml(redirectUri || \"\")}\">\n <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(state || \"\")}\">\n <input type=\"hidden\" name=\"codeChallenge\" value=\"${escapeHtml(codeChallenge || \"\")}\">\n <input type=\"hidden\" name=\"codeChallengeMethod\" value=\"${escapeHtml(codeChallengeMethod || \"S256\")}\">\n\n <div class=\"form-group\">\n <label for=\"apiToken\">Forge API Token *</label>\n <input type=\"password\" id=\"apiToken\" name=\"apiToken\" required placeholder=\"Enter your Forge API token\">\n <p class=\"help-text\">\n Generate at <a href=\"https://forge.laravel.com/user-profile/api\" target=\"_blank\" rel=\"noopener\">forge.laravel.com → API Tokens</a>\n </p>\n </div>\n\n <button type=\"submit\">Connect to Forge</button>\n </form>\n\n <p class=\"footer\">\n Powered by <a href=\"https://github.com/studiometa/forge-tools\" target=\"_blank\" rel=\"noopener\">forge-tools</a>\n </p>\n </div>\n</body>\n</html>`;\n}\n\n/**\n * Render success page with auto-redirect\n */\nfunction renderSuccessPage(redirectUrl: string): string {\n return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n <meta charset=\"UTF-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n <meta http-equiv=\"refresh\" content=\"2;url=${escapeHtml(redirectUrl)}\">\n <title>Connected — Forge MCP</title>\n <style>\n * { box-sizing: border-box; margin: 0; padding: 0; }\n body {\n font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);\n min-height: 100vh;\n display: flex;\n align-items: center;\n justify-content: center;\n padding: 20px;\n }\n .container {\n background: white;\n border-radius: 16px;\n box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n padding: 40px;\n width: 100%;\n max-width: 420px;\n text-align: center;\n }\n .success-icon {\n width: 64px;\n height: 64px;\n margin: 0 auto 24px;\n background: linear-gradient(135deg, #10b981 0%, #059669 100%);\n border-radius: 50%;\n display: flex;\n align-items: center;\n justify-content: center;\n }\n .success-icon svg { width: 32px; height: 32px; stroke: white; }\n h1 { color: #1a1a2e; font-size: 24px; margin-bottom: 8px; }\n .message { color: #666; font-size: 14px; margin-bottom: 24px; }\n .spinner {\n width: 24px;\n height: 24px;\n border: 3px solid #e5e7eb;\n border-top-color: #18b69b;\n border-radius: 50%;\n animation: spin 1s linear infinite;\n margin: 0 auto 16px;\n }\n @keyframes spin { to { transform: rotate(360deg); } }\n .redirect-text { color: #9ca3af; font-size: 13px; margin-bottom: 16px; }\n .manual-link { color: #18b69b; text-decoration: none; font-size: 14px; }\n .manual-link:hover { text-decoration: underline; }\n </style>\n</head>\n<body>\n <div class=\"container\">\n <div class=\"success-icon\">\n <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n <path d=\"M20 6L9 17L4 12\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n </svg>\n </div>\n <h1>Successfully Connected!</h1>\n <p class=\"message\">Your Forge API token has been encrypted and transmitted securely.</p>\n <div class=\"spinner\"></div>\n <p class=\"redirect-text\">Redirecting to Claude Desktop...</p>\n <a href=\"${escapeHtml(redirectUrl)}\" class=\"manual-link\">Click here if not redirected automatically</a>\n </div>\n <script>\n setTimeout(function() {\n window.location.href = ${JSON.stringify(redirectUrl)};\n }, 2000);\n </script>\n</body>\n</html>`;\n}\n\n/**\n * Render error page\n */\nfunction renderErrorPage(message: string): string {\n return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n <meta charset=\"UTF-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n <title>Error — Forge MCP</title>\n <style>\n body {\n font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n background: #f3f4f6;\n min-height: 100vh;\n display: flex;\n align-items: center;\n justify-content: center;\n padding: 20px;\n }\n .container {\n background: white;\n border-radius: 16px;\n box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);\n padding: 40px;\n text-align: center;\n max-width: 400px;\n }\n h1 { color: #dc2626; margin-bottom: 16px; }\n p { color: #6b7280; }\n </style>\n</head>\n<body>\n <div class=\"container\">\n <h1>Error</h1>\n <p>${escapeHtml(message)}</p>\n </div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,kBAAkB,UAA0B;AAC1D,QAAO,OAAO,KAAK,SAAS,CAAC,SAAS,SAAS;;;;;;;;AASjD,MAAa,uBAAuB,oBAAoB,UAAmB;CACzE,MAAM,OAAO,iBAAiB,OAAO,OAAO,IAAI;CAEhD,MAAM,UAAU,GADC,iBAAiB,OAAO,oBAAoB,IAAI,OACrC,KAAK;AAEjC,mBAAkB,OAAO,gBAAgB,mBAAmB;AAC5D,mBAAkB,OAAO,iBAAiB,uBAAuB;AAEjE,QAAO;EAEL,QAAQ;EACR,wBAAwB,GAAG,QAAQ;EACnC,gBAAgB,GAAG,QAAQ;EAC3B,0BAA0B,CAAC,OAAO;EAGlC,uBAAuB,CAAC,sBAAsB,gBAAgB;EAC9D,kCAAkC,CAAC,OAAO;EAC1C,uCAAuC,CAAC,OAAO;EAG/C,uBAAuB,GAAG,QAAQ;EAClC,kBAAkB,CAAC,QAAQ;EAC3B,uBAAuB;EACxB;EACD;;;;;;;AAQF,MAAa,2BAA2B,oBAAoB,UAAmB;CAC7E,MAAM,OAAO,iBAAiB,OAAO,OAAO,IAAI;CAEhD,MAAM,UAAU,GADC,iBAAiB,OAAO,oBAAoB,IAAI,OACrC,KAAK;AAEjC,mBAAkB,OAAO,gBAAgB,mBAAmB;AAC5D,mBAAkB,OAAO,iBAAiB,uBAAuB;AAEjE,QAAO;EACL,UAAU,GAAG,QAAQ;EACrB,uBAAuB,CAAC,QAAQ;EAChC,0BAA0B,CAAC,SAAS;EACpC,kBAAkB,CAAC,QAAQ;EAC5B;EACD;;;;;;;;;AAUF,MAAa,kBAAkB,mBAAmB,OAAO,UAAmB;AAC1E,mBAAkB,OAAO,gBAAgB,mBAAmB;CAE5D,IAAI;AACJ,KAAI;AACF,SAAQ,MAAM,SAAS,MAAM;SACvB;AACN,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;CAIH,MAAM,aAAc,KAAK,eAA0B;CACnD,MAAM,eAAgB,KAAK,iBAA8B,EAAE;CAI3D,MAAM,WAAW,OAAO,KACtB,KAAK,UAAU;EACb,MAAM;EACN,IAAI,KAAK,KAAK;EACf,CAAC,CACH,CAAC,SAAS,YAAY;AAEvB,mBAAkB,OAAO,IAAI;AAC7B,QAAO;EACL,WAAW;EACX,aAAa;EACb,eAAe;EACf,4BAA4B;EAC5B,aAAa,CAAC,sBAAsB,gBAAgB;EACpD,gBAAgB,CAAC,OAAO;EACzB;EACD;;;;;AAMF,MAAa,sBAAsB,oBAAoB,UAAmB;CACxE,MAAM,QAAQ,SAAS,MAAM;CAG7B,MAAM,cAAc,MAAM;CAC1B,MAAM,QAAQ,MAAM;CACpB,MAAM,gBAAgB,MAAM;CAC5B,MAAM,sBAAsB,MAAM;AAGlC,KAAI,CAAC,aAAa;AAChB,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,oBAAkB,OAAO,IAAI;AAC7B,SAAO,gBAAgB,2CAA2C;;AAIpE,KAAI,CAAC,eAAe;EAClB,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,WAAS,aAAa,IAAI,SAAS,kBAAkB;AACrD,WAAS,aAAa,IAAI,qBAAqB,6BAA6B;AAC5E,MAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,SAAO,aAAa,OAAO,SAAS,UAAU,EAAE,IAAI;;AAGtD,KAAI,uBAAuB,wBAAwB,QAAQ;EACzD,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,WAAS,aAAa,IAAI,SAAS,kBAAkB;AACrD,WAAS,aAAa,IAAI,qBAAqB,+CAA+C;AAC9F,MAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,SAAO,aAAa,OAAO,SAAS,UAAU,EAAE,IAAI;;AAGtD,mBAAkB,OAAO,gBAAgB,2BAA2B;AAEpE,QAAO,gBAAgB;EACrB;EACA;EACA;EACA,qBAAqB,uBAAuB;EAC7C,CAAC;EACF;;;;;AAMF,MAAa,uBAAuB,mBAAmB,OAAO,UAAmB;CAG/E,MAAM,EAAE,UAAU,aAAa,OAAO,eAAe,wBAFvC,MAAM,SAAS,MAAM;AAKnC,KAAI,CAAC,aAAa;AAChB,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,oBAAkB,OAAO,IAAI;AAC7B,SAAO,gBAAgB,iCAAiC;;AAI1D,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,YAAY;EAChC,MAAM,cAAc,IAAI,aAAa,eAAe,IAAI,aAAa;EACrE,MAAM,UAAU,IAAI,aAAa;AACjC,MAAI,CAAC,eAAe,CAAC,SAAS;AAC5B,qBAAkB,OAAO,IAAI;AAC7B,UAAO,gBAAgB,0CAA0C;;SAE7D;AACN,oBAAkB,OAAO,IAAI;AAC7B,SAAO,gBAAgB,8BAA8B;;AAIvD,KAAI,CAAC,UAAU;AACb,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,SAAO,gBAAgB;GACrB;GACA;GACA;GACA;GACA,OAAO;GACR,CAAC;;CAIJ,MAAM,OAAO,eAAe;EAC1B;EACA;EACA,qBAAqB,uBAAuB;EAC7C,CAAC;CAGF,MAAM,cAAc,IAAI,IAAI,YAAY;AACxC,aAAY,aAAa,IAAI,QAAQ,KAAK;AAC1C,KAAI,MACF,aAAY,aAAa,IAAI,SAAS,MAAM;AAI9C,mBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,QAAO,kBAAkB,YAAY,UAAU,CAAC;EAChD;;;;;;;;;AAUF,MAAa,eAAe,mBAAmB,OAAO,UAAmB;AACvE,mBAAkB,OAAO,gBAAgB,mBAAmB;CAK5D,MAAM,EAAE,YAAY,MAAM,eAAe,kBAF3B,MAAM,SAAS,MAAM;AAKnC,KAAI,eAAe,gBACjB,QAAO,mBAAmB,OAAO,cAAc;AAIjD,KAAI,eAAe,sBAAsB;AACvC,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI,CAAC,MAAM;AACT,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI,CAAC,eAAe;AAClB,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI;EAEF,MAAM,UAAU,eAAe,KAAK;AAGpC,MAAI,QAAQ;OACgB,oBAAoB,cAAc,KAClC,QAAQ,eAAe;AAC/C,sBAAkB,OAAO,IAAI;AAC7B,WAAO;KACL,OAAO;KACP,mBAAmB;KACpB;;;AAaL,SAAO;GACL,cATkB,kBAAkB,QAAQ,SAAS;GAUrD,YAAY;GACZ,YAAY;GACZ,eATmB,eACnB,EAAE,UAAU,QAAQ,UAAU,EAC9B,QAAQ,GACT;GAOA;UACM,OAAO;AACd,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;GAC7D;;EAEH;;;;AAKF,SAAS,mBAAmB,OAAgB,cAAkC;AAC5E,KAAI,CAAC,cAAc;AACjB,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI;EAEF,MAAM,UAAU,eAAe,aAAa;AAW5C,SAAO;GACL,cATkB,kBAAkB,QAAQ,SAAS;GAUrD,YAAY;GACZ,YAAY;GACZ,eATsB,eACtB,EAAE,UAAU,QAAQ,UAAU,EAC9B,QAAQ,GACT;GAOA;UACM,OAAO;AACd,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;GAC7D;;;;;;;AAQL,SAAgB,oBAAoB,cAA8B;AAChE,QAAO,WAAW,SAAS,CAAC,OAAO,aAAa,CAAC,OAAO,YAAY;;;;;AAMtE,SAAS,WAAW,KAAqB;AACvC,QAAO,IACJ,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,SAAS,CACvB,QAAQ,MAAM,SAAS;;;;;AAM5B,SAAS,gBAAgB,QAMd;CACT,MAAM,EAAE,aAAa,OAAO,eAAe,qBAAqB,UAAU;AAE1E,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAiIH,QAAQ,sBAAsB,WAAW,MAAM,CAAC,UAAU,GAAG;;;;;;;uDAOZ,WAAW,eAAe,GAAG,CAAC;iDACpC,WAAW,SAAS,GAAG,CAAC;yDAChB,WAAW,iBAAiB,GAAG,CAAC;+DAC1B,WAAW,uBAAuB,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBzG,SAAS,kBAAkB,aAA6B;AACtD,QAAO;;;;;8CAKqC,WAAW,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6DvD,WAAW,YAAY,CAAC;;;;+BAIR,KAAK,UAAU,YAAY,CAAC;;;;;;;;;AAU3D,SAAS,gBAAgB,SAAyB;AAChD,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA+BA,WAAW,QAAQ,CAAC"}
|
package/dist/server.d.ts
CHANGED
|
@@ -3,22 +3,40 @@
|
|
|
3
3
|
* Forge MCP Server - HTTP Transport (Streamable HTTP)
|
|
4
4
|
*
|
|
5
5
|
* Implements the official MCP Streamable HTTP transport specification.
|
|
6
|
-
*
|
|
6
|
+
* Supports both raw Bearer tokens and OAuth 2.1 with PKCE for
|
|
7
|
+
* Claude Desktop compatibility.
|
|
7
8
|
*
|
|
8
|
-
* Token
|
|
9
|
+
* Token formats:
|
|
10
|
+
* - Raw Forge API token (Bearer <token>)
|
|
11
|
+
* - Base64-encoded token from OAuth flow (Bearer base64(<token>))
|
|
12
|
+
*
|
|
13
|
+
* Environment variables:
|
|
14
|
+
* PORT - HTTP port (default: 3000)
|
|
15
|
+
* HOST - Bind address (default: 0.0.0.0)
|
|
16
|
+
* FORGE_READ_ONLY - Disable write operations (default: false)
|
|
17
|
+
* OAUTH_SECRET - AES-256-GCM encryption key for OAuth tokens.
|
|
18
|
+
* Required in production. A default is used if unset.
|
|
9
19
|
*
|
|
10
20
|
* Usage:
|
|
11
21
|
* forge-mcp-server
|
|
12
22
|
* forge-mcp-server --read-only
|
|
13
|
-
*
|
|
23
|
+
* OAUTH_SECRET=my-secret forge-mcp-server
|
|
14
24
|
* PORT=3000 forge-mcp-server
|
|
15
25
|
*
|
|
16
26
|
* Endpoints:
|
|
17
|
-
* POST /mcp
|
|
18
|
-
* GET /mcp
|
|
19
|
-
* DELETE /mcp
|
|
27
|
+
* POST /mcp - MCP Streamable HTTP (JSON-RPC messages)
|
|
28
|
+
* GET /mcp - MCP Streamable HTTP (SSE stream for server notifications)
|
|
29
|
+
* DELETE /mcp - MCP Streamable HTTP (session termination)
|
|
20
30
|
* GET / - Service info
|
|
21
31
|
* GET /health - Health check
|
|
32
|
+
*
|
|
33
|
+
* OAuth 2.1 endpoints (for Claude Desktop):
|
|
34
|
+
* GET /.well-known/oauth-authorization-server - OAuth metadata (RFC 8414)
|
|
35
|
+
* GET /.well-known/oauth-protected-resource - Protected resource (RFC 9728)
|
|
36
|
+
* POST /register - Dynamic client registration (RFC 7591)
|
|
37
|
+
* GET /authorize - Login form
|
|
38
|
+
* POST /authorize - Process login
|
|
39
|
+
* POST /token - Token exchange (PKCE)
|
|
22
40
|
*/
|
|
23
41
|
import { type Server } from "node:http";
|
|
24
42
|
/**
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAEA
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAUtD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,GAAE,MAAqB,EAC3B,IAAI,GAAE,MAAqB,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CAoDjB"}
|
package/dist/server.js
CHANGED
|
@@ -1,29 +1,47 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
import { t as parseReadOnlyFlag } from "./flags-LFbdErsZ.js";
|
|
3
|
-
import { t as VERSION } from "./version-
|
|
4
|
-
import { a as SessionManager, n as createMcpRequestHandler, t as createHealthApp } from "./http-
|
|
3
|
+
import { t as VERSION } from "./version-Gjth4BwC.js";
|
|
4
|
+
import { a as SessionManager, n as createMcpRequestHandler, t as createHealthApp } from "./http-DN0I5GR6.js";
|
|
5
5
|
import { toNodeHandler } from "h3/node";
|
|
6
6
|
import { createServer } from "node:http";
|
|
7
7
|
/**
|
|
8
8
|
* Forge MCP Server - HTTP Transport (Streamable HTTP)
|
|
9
9
|
*
|
|
10
10
|
* Implements the official MCP Streamable HTTP transport specification.
|
|
11
|
-
*
|
|
11
|
+
* Supports both raw Bearer tokens and OAuth 2.1 with PKCE for
|
|
12
|
+
* Claude Desktop compatibility.
|
|
12
13
|
*
|
|
13
|
-
* Token
|
|
14
|
+
* Token formats:
|
|
15
|
+
* - Raw Forge API token (Bearer <token>)
|
|
16
|
+
* - Base64-encoded token from OAuth flow (Bearer base64(<token>))
|
|
17
|
+
*
|
|
18
|
+
* Environment variables:
|
|
19
|
+
* PORT - HTTP port (default: 3000)
|
|
20
|
+
* HOST - Bind address (default: 0.0.0.0)
|
|
21
|
+
* FORGE_READ_ONLY - Disable write operations (default: false)
|
|
22
|
+
* OAUTH_SECRET - AES-256-GCM encryption key for OAuth tokens.
|
|
23
|
+
* Required in production. A default is used if unset.
|
|
14
24
|
*
|
|
15
25
|
* Usage:
|
|
16
26
|
* forge-mcp-server
|
|
17
27
|
* forge-mcp-server --read-only
|
|
18
|
-
*
|
|
28
|
+
* OAUTH_SECRET=my-secret forge-mcp-server
|
|
19
29
|
* PORT=3000 forge-mcp-server
|
|
20
30
|
*
|
|
21
31
|
* Endpoints:
|
|
22
|
-
* POST /mcp
|
|
23
|
-
* GET /mcp
|
|
24
|
-
* DELETE /mcp
|
|
32
|
+
* POST /mcp - MCP Streamable HTTP (JSON-RPC messages)
|
|
33
|
+
* GET /mcp - MCP Streamable HTTP (SSE stream for server notifications)
|
|
34
|
+
* DELETE /mcp - MCP Streamable HTTP (session termination)
|
|
25
35
|
* GET / - Service info
|
|
26
36
|
* GET /health - Health check
|
|
37
|
+
*
|
|
38
|
+
* OAuth 2.1 endpoints (for Claude Desktop):
|
|
39
|
+
* GET /.well-known/oauth-authorization-server - OAuth metadata (RFC 8414)
|
|
40
|
+
* GET /.well-known/oauth-protected-resource - Protected resource (RFC 9728)
|
|
41
|
+
* POST /register - Dynamic client registration (RFC 7591)
|
|
42
|
+
* GET /authorize - Login form
|
|
43
|
+
* POST /authorize - Process login
|
|
44
|
+
* POST /token - Token exchange (PKCE)
|
|
27
45
|
*/
|
|
28
46
|
var DEFAULT_PORT = 3e3;
|
|
29
47
|
var DEFAULT_HOST = "0.0.0.0";
|
|
@@ -57,7 +75,13 @@ function startHttpServer(port = DEFAULT_PORT, host = DEFAULT_HOST, options) {
|
|
|
57
75
|
console.log("");
|
|
58
76
|
console.log("Authentication:");
|
|
59
77
|
console.log(" Bearer token in Authorization header");
|
|
60
|
-
console.log(" Token format:
|
|
78
|
+
console.log(" Token format: raw Forge API token or OAuth 2.1 access token");
|
|
79
|
+
console.log("");
|
|
80
|
+
console.log("OAuth 2.1 (Claude Desktop):");
|
|
81
|
+
console.log(` GET http://${displayHost}:${port}/.well-known/oauth-authorization-server`);
|
|
82
|
+
console.log(` POST http://${displayHost}:${port}/register`);
|
|
83
|
+
console.log(` GET http://${displayHost}:${port}/authorize`);
|
|
84
|
+
console.log(` POST http://${displayHost}:${port}/token`);
|
|
61
85
|
if (readOnly) {
|
|
62
86
|
console.log("");
|
|
63
87
|
console.log("Mode: READ-ONLY (write operations disabled)");
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","names":[],"sources":["../src/server.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * Forge MCP Server - HTTP Transport (Streamable HTTP)\n *\n * Implements the official MCP Streamable HTTP transport specification.\n *
|
|
1
|
+
{"version":3,"file":"server.js","names":[],"sources":["../src/server.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * Forge MCP Server - HTTP Transport (Streamable HTTP)\n *\n * Implements the official MCP Streamable HTTP transport specification.\n * Supports both raw Bearer tokens and OAuth 2.1 with PKCE for\n * Claude Desktop compatibility.\n *\n * Token formats:\n * - Raw Forge API token (Bearer <token>)\n * - Base64-encoded token from OAuth flow (Bearer base64(<token>))\n *\n * Environment variables:\n * PORT - HTTP port (default: 3000)\n * HOST - Bind address (default: 0.0.0.0)\n * FORGE_READ_ONLY - Disable write operations (default: false)\n * OAUTH_SECRET - AES-256-GCM encryption key for OAuth tokens.\n * Required in production. A default is used if unset.\n *\n * Usage:\n * forge-mcp-server\n * forge-mcp-server --read-only\n * OAUTH_SECRET=my-secret forge-mcp-server\n * PORT=3000 forge-mcp-server\n *\n * Endpoints:\n * POST /mcp - MCP Streamable HTTP (JSON-RPC messages)\n * GET /mcp - MCP Streamable HTTP (SSE stream for server notifications)\n * DELETE /mcp - MCP Streamable HTTP (session termination)\n * GET / - Service info\n * GET /health - Health check\n *\n * OAuth 2.1 endpoints (for Claude Desktop):\n * GET /.well-known/oauth-authorization-server - OAuth metadata (RFC 8414)\n * GET /.well-known/oauth-protected-resource - Protected resource (RFC 9728)\n * POST /register - Dynamic client registration (RFC 7591)\n * GET /authorize - Login form\n * POST /authorize - Process login\n * POST /token - Token exchange (PKCE)\n */\n\nimport { toNodeHandler } from \"h3/node\";\nimport { createServer, type Server } from \"node:http\";\n\nimport { createHealthApp, createMcpRequestHandler } from \"./http.ts\";\nimport { parseReadOnlyFlag } from \"./flags.ts\";\nimport { SessionManager } from \"./sessions.ts\";\nimport { VERSION } from \"./version.ts\";\n\nconst DEFAULT_PORT = 3000;\nconst DEFAULT_HOST = \"0.0.0.0\";\n\n/**\n * Options for the HTTP server.\n */\nexport interface HttpStartOptions {\n /** When true, forge_write tool is not registered. */\n readOnly?: boolean;\n}\n\n/**\n * Start the HTTP server with Streamable HTTP transport.\n */\nexport function startHttpServer(\n port: number = DEFAULT_PORT,\n host: string = DEFAULT_HOST,\n options?: HttpStartOptions,\n): Promise<Server> {\n return new Promise((resolve) => {\n const readOnly = options?.readOnly ?? false;\n const sessions = new SessionManager();\n const handleMcp = createMcpRequestHandler(sessions, { readOnly });\n const healthApp = createHealthApp();\n const healthHandler = toNodeHandler(healthApp);\n\n const server = createServer(async (req, res) => {\n const url = req.url ?? \"/\";\n\n // Route /mcp to MCP Streamable HTTP transport\n if (url === \"/mcp\" || url.startsWith(\"/mcp?\")) {\n await handleMcp(req, res);\n return;\n }\n\n // Everything else goes to h3 (health checks, service info)\n healthHandler(req, res);\n });\n\n server.listen(port, host, () => {\n const displayHost = host === \"0.0.0.0\" ? \"localhost\" : host;\n const mode = readOnly ? \" (read-only)\" : \"\";\n console.log(`Forge MCP server v${VERSION}${mode}`);\n console.log(`Node.js ${process.version}`);\n console.log(\"\");\n console.log(`Running at http://${displayHost}:${port}`);\n console.log(\"\");\n console.log(\"Endpoints:\");\n console.log(\n ` POST/GET/DELETE http://${displayHost}:${port}/mcp - MCP Streamable HTTP endpoint`,\n );\n console.log(` GET http://${displayHost}:${port}/health - Health check`);\n console.log(\"\");\n console.log(\"Authentication:\");\n console.log(\" Bearer token in Authorization header\");\n console.log(\" Token format: raw Forge API token or OAuth 2.1 access token\");\n console.log(\"\");\n console.log(\"OAuth 2.1 (Claude Desktop):\");\n console.log(` GET http://${displayHost}:${port}/.well-known/oauth-authorization-server`);\n console.log(` POST http://${displayHost}:${port}/register`);\n console.log(` GET http://${displayHost}:${port}/authorize`);\n console.log(` POST http://${displayHost}:${port}/token`);\n if (readOnly) {\n console.log(\"\");\n console.log(\"Mode: READ-ONLY (write operations disabled)\");\n }\n console.log(\"\");\n resolve(server);\n });\n });\n}\n\n// Start server when run directly\nconst isMainModule =\n import.meta.url === `file://${process.argv[1]}` ||\n process.argv[1]?.endsWith(\"/forge-mcp-server\") ||\n process.argv[1]?.endsWith(\"\\\\forge-mcp-server\");\n\nif (isMainModule) {\n const port = Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10);\n const host = process.env.HOST || DEFAULT_HOST;\n const readOnly = parseReadOnlyFlag();\n\n startHttpServer(port, host, { readOnly }).catch((error) => {\n console.error(\"Fatal error:\", error);\n process.exit(1);\n });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,IAAM,eAAe;AACrB,IAAM,eAAe;;;;AAarB,SAAgB,gBACd,OAAe,cACf,OAAe,cACf,SACiB;AACjB,QAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,WAAW,SAAS,YAAY;EAEtC,MAAM,YAAY,wBADD,IAAI,gBAAgB,EACe,EAAE,UAAU,CAAC;EAEjE,MAAM,gBAAgB,cADJ,iBAAiB,CACW;EAE9C,MAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;GAC9C,MAAM,MAAM,IAAI,OAAO;AAGvB,OAAI,QAAQ,UAAU,IAAI,WAAW,QAAQ,EAAE;AAC7C,UAAM,UAAU,KAAK,IAAI;AACzB;;AAIF,iBAAc,KAAK,IAAI;IACvB;AAEF,SAAO,OAAO,MAAM,YAAY;GAC9B,MAAM,cAAc,SAAS,YAAY,cAAc;GACvD,MAAM,OAAO,WAAW,iBAAiB;AACzC,WAAQ,IAAI,qBAAqB,UAAU,OAAO;AAClD,WAAQ,IAAI,WAAW,QAAQ,UAAU;AACzC,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,qBAAqB,YAAY,GAAG,OAAO;AACvD,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,aAAa;AACzB,WAAQ,IACN,4BAA4B,YAAY,GAAG,KAAK,qCACjD;AACD,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,wBAAwB;AACzE,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,kBAAkB;AAC9B,WAAQ,IAAI,yCAAyC;AACrD,WAAQ,IAAI,gEAAgE;AAC5E,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,8BAA8B;AAC1C,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,yCAAyC;AAC1F,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,WAAW;AAC5D,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,YAAY;AAC7D,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,QAAQ;AACzD,OAAI,UAAU;AACZ,YAAQ,IAAI,GAAG;AACf,YAAQ,IAAI,8CAA8C;;AAE5D,WAAQ,IAAI,GAAG;AACf,WAAQ,OAAO;IACf;GACF;;AASJ,IAJE,OAAO,KAAK,QAAQ,UAAU,QAAQ,KAAK,QAC3C,QAAQ,KAAK,IAAI,SAAS,oBAAoB,IAC9C,QAAQ,KAAK,IAAI,SAAS,qBAAqB,CAO/C,iBAJa,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,aAAa,EAAE,GAAG,EAC7D,QAAQ,IAAI,QAAQ,cAGL,EAAE,UAFb,mBAAmB,EAEI,CAAC,CAAC,OAAO,UAAU;AACzD,SAAQ,MAAM,gBAAgB,MAAM;AACpC,SAAQ,KAAK,EAAE;EACf"}
|
package/dist/tools.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ import type { Tool } from "@modelcontextprotocol/sdk/types.js";
|
|
|
2
2
|
/**
|
|
3
3
|
* Read-only actions — safe operations that don't modify server state.
|
|
4
4
|
*/
|
|
5
|
-
export declare const READ_ACTIONS: readonly ["list", "get", "help", "schema"];
|
|
5
|
+
export declare const READ_ACTIONS: readonly ["list", "get", "resolve", "help", "schema", "context"];
|
|
6
6
|
/**
|
|
7
7
|
* Write actions — operations that modify server state.
|
|
8
8
|
* These are separated into the `forge_write` tool for safety.
|
package/dist/tools.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAI/D;;GAEG;AACH,eAAO,MAAM,YAAY,
|
|
1
|
+
{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAI/D;;GAEG;AACH,eAAO,MAAM,YAAY,kEAAmE,CAAC;AAE7F;;;GAGG;AACH,eAAO,MAAM,aAAa,2FAShB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACvD,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,WAAW,CAEnE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,UAAU,CAEjE;AAkQD;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,EAAE,IAAI,EAAwC,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,EAAE,CAK1D;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,IAAI,EAsDlC,CAAC"}
|