@sync.so/mcp-server 0.1.3 → 0.2.0

package/dist/rate-limits.js

@@ -0,0 +1,67 @@
+import rateLimit, { ipKeyGenerator } from 'express-rate-limit';
+import { mergeBasicClientCredentials } from './auth/client-credentials.js';
+import { sessionOwner } from './session-registry.js';
+// Hosted clients such as ChatGPT and Claude.ai reach this server from a few shared
+// egress addresses, so a per-address limit would make all of their users share one
+// bucket. Ordinary traffic is limited per signed-in user or OAuth client instead.
+// Per address, only rejected requests count, which still bounds credential floods
+// (each invalid token costs an upstream verification) without capping that traffic.
+const WINDOW_MS = 60_000;
+const REQUESTS_PER_MINUTE = 120;
+const REJECTED_PER_MINUTE = 300;
+function addressKey(req) {
+    return `ip:${ipKeyGenerator(req.ip ?? '')}`;
+}
+function rejectedRequestLimit(rejectedStatuses) {
+    return rateLimit({
+        windowMs: WINDOW_MS,
+        limit: REJECTED_PER_MINUTE,
+        skipSuccessfulRequests: true,
+        requestWasSuccessful: (_req, res) => !rejectedStatuses.includes(res.statusCode),
+    });
+}
+/** Before bearer authentication: rejected credentials per address. */
+export function createMcpRejectedCredentialLimit() {
+    return rejectedRequestLimit([401, 403]);
+}
+/** After bearer authentication: requests per verified user, OAuth client and organization. */
+export function createMcpUserLimit() {
+    return rateLimit({
+        windowMs: WINDOW_MS,
+        limit: REQUESTS_PER_MINUTE,
+        keyGenerator: (req) => {
+            const owner = sessionOwner(req.auth);
+            return owner
+                ? `user:${JSON.stringify([owner.sub, owner.clientId, owner.organizationId])}`
+                : addressKey(req);
+        },
+    });
+}
+/** Token and revocation requests the API rejected, per address. */
+export function createOAuthRejectedRequestLimit() {
+    return rejectedRequestLimit([400, 401, 403]);
+}
+/**
+ * Accepted token and revocation requests per OAuth client. Client IDs are not secret,
+ * so requests the API rejects never spend a client's allowance; they count against
+ * the sender's address instead.
+ */
+export function createOAuthClientLimit() {
+    return rateLimit({
+        windowMs: WINDOW_MS,
+        limit: REQUESTS_PER_MINUTE,
+        skipFailedRequests: true,
+        keyGenerator: (req) => {
+            const body = req.body;
+            try {
+                const clientId = mergeBasicClientCredentials(typeof body === 'object' && body !== null ? body : {}, req.headers.authorization).client_id;
+                if (typeof clientId === 'string')
+                    return `client:${clientId}`;
+            }
+            catch {
+                // Malformed credentials fail in the proxy; count them by address here.
+            }
+            return addressKey(req);
+        },
+    });
+}

package/dist/revision.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The commit this process runs. The deploy job writes it to `.revision` in the image;
+ * local and test runs fall back to the environment.
+ */
+export declare const REVISION: string;
+//# sourceMappingURL=revision.d.ts.map

package/dist/revision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revision.d.ts","sourceRoot":"","sources":["../src/revision.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,QAAQ,QAAiB,CAAC"}

package/dist/revision.js

@@ -0,0 +1,17 @@
+import { readFileSync } from 'node:fs';
+/**
+ * The commit this process runs. The deploy job writes it to `.revision` in the image;
+ * local and test runs fall back to the environment.
+ */
+export const REVISION = readRevision();
+function readRevision() {
+    try {
+        const value = readFileSync(new URL('../.revision', import.meta.url), 'utf8').trim();
+        if (value && value !== 'unknown')
+            return value;
+    }
+    catch {
+        // No revision file outside a deployed image.
+    }
+    return process.env.PORTER_TAG ?? process.env.GIT_SHA ?? process.env.K_REVISION ?? 'unknown';
+}

package/dist/runtime-diagnostics.d.ts

@@ -0,0 +1,32 @@
+export type HttpRequestCompletion = {
+    statusCode: number;
+    aborted: boolean;
+    responseDelivered: boolean;
+    durationMs: number;
+};
+export type HttpRequestStats = {
+    total: number;
+    inFlight: number;
+    completed: number;
+    aborted: number;
+    status2xx: number;
+    status3xx: number;
+    status4xx: number;
+    /** Rate-limited responses, also counted in status4xx. */
+    status429: number;
+    status5xx: number;
+    durationMsTotal: number;
+    durationMsMax: number;
+};
+export declare class HttpRequestMetrics {
+    #private;
+    start(): (completion: HttpRequestCompletion) => void;
+    snapshot(): HttpRequestStats;
+}
+export declare function serializeError(error: unknown): {
+    name?: string;
+    message: string;
+    stack?: string;
+    code?: string;
+};
+//# sourceMappingURL=runtime-diagnostics.d.ts.map

package/dist/runtime-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-diagnostics.d.ts","sourceRoot":"","sources":["../src/runtime-diagnostics.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,kBAAkB;;IAe7B,KAAK,IAAI,CAAC,UAAU,EAAE,qBAAqB,KAAK,IAAI,CAqBnD;IAED,QAAQ,IAAI,gBAAgB,CAE3B;CACF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAWA"}

package/dist/runtime-diagnostics.js

@@ -0,0 +1,58 @@
+export class HttpRequestMetrics {
+    #stats = {
+        total: 0,
+        inFlight: 0,
+        completed: 0,
+        aborted: 0,
+        status2xx: 0,
+        status3xx: 0,
+        status4xx: 0,
+        status429: 0,
+        status5xx: 0,
+        durationMsTotal: 0,
+        durationMsMax: 0,
+    };
+    start() {
+        this.#stats.total += 1;
+        this.#stats.inFlight += 1;
+        let completed = false;
+        return (completion) => {
+            if (completed)
+                return;
+            completed = true;
+            this.#stats.inFlight = Math.max(0, this.#stats.inFlight - 1);
+            this.#stats.completed += 1;
+            if (completion.aborted)
+                this.#stats.aborted += 1;
+            if (completion.responseDelivered) {
+                if (completion.statusCode >= 200 && completion.statusCode < 300)
+                    this.#stats.status2xx += 1;
+                if (completion.statusCode >= 300 && completion.statusCode < 400)
+                    this.#stats.status3xx += 1;
+                if (completion.statusCode >= 400 && completion.statusCode < 500)
+                    this.#stats.status4xx += 1;
+                if (completion.statusCode === 429)
+                    this.#stats.status429 += 1;
+                if (completion.statusCode >= 500)
+                    this.#stats.status5xx += 1;
+            }
+            this.#stats.durationMsTotal += completion.durationMs;
+            this.#stats.durationMsMax = Math.max(this.#stats.durationMsMax, completion.durationMs);
+        };
+    }
+    snapshot() {
+        return { ...this.#stats };
+    }
+}
+export function serializeError(error) {
+    if (error instanceof Error) {
+        const code = error.code;
+        return {
+            name: error.name,
+            message: error.message,
+            ...(error.stack ? { stack: error.stack } : {}),
+            ...(typeof code === 'string' ? { code } : {}),
+        };
+    }
+    return { message: String(error) };
+}

package/dist/server.d.ts

@@ -1,4 +1,25 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { CallToolResult } from '@modelcontextprotocol/server';
+import { McpServer } from '@modelcontextprotocol/server';
+import { type ClientProfile } from './client-profile.js';
 import type { SyncMcpConfig } from './config.js';
-export declare function createSyncMcpServer(config: SyncMcpConfig): Promise<McpServer>;
+import type { McpToolDefinition } from './tools/index.js';
+import { type AvailableUpdate, type UpdateCheck } from './update-check.js';
+export declare const SERVER_INSTRUCTIONS: string;
+export declare function serverInstructions(profile: ClientProfile, spendConfirmation?: boolean, feedback?: boolean, update?: AvailableUpdate, toolsetNote?: string): string;
+export declare function serverDescription(spendConfirmation?: boolean): string;
+export declare const HOSTED_HTTP_TOOL_ALLOWLIST: Set<string>;
+export declare function createToolDescriptorMeta(meta: Record<string, unknown> | undefined): Record<string, unknown>;
+export declare function registerTools(server: McpServer, tools: McpToolDefinition[], authMetadataUrl?: string, onToolError?: (tool: string, error: unknown) => void, decorateResult?: (result: CallToolResult) => CallToolResult): void;
+/** One stdout line per failed tool call, for the hosted server's logs. */
+export declare function logToolError(profile: () => string): (tool: string, error: unknown) => void;
+export declare function createToolErrorResult(error: unknown, authMetadataUrl?: string): CallToolResult;
+export declare function createJsonToolResult(result: unknown, outputSchema?: Record<string, unknown>): CallToolResult;
+export declare function selectHostedHttpTools(tools: McpToolDefinition[], profile?: ClientProfile): McpToolDefinition[];
+export declare function createSyncMcpServer(config: SyncMcpConfig, options?: {
+    updateCheck?: UpdateCheck;
+}): Promise<McpServer>;
+export declare function createMcpServerFactory(config: SyncMcpConfig): Promise<{
+    createServer: (clientName?: string, handshakeClientName?: string) => McpServer;
+    toolCount: number;
+}>;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMjD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CA6CnF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAgBzD,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8CjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA2B1D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,WAAW,EAGjB,MAAM,mBAAmB,CAAC;AAqE3B,eAAO,MAAM,mBAAmB,QAAsD,CAAC;AAKvF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,iBAAiB,UAAO,EACxB,QAAQ,UAAQ,EAChB,MAAM,CAAC,EAAE,eAAe,EACxB,WAAW,SAAK,GACf,MAAM,CASR;AAED,wBAAgB,iBAAiB,CAAC,iBAAiB,UAAO,GAAG,MAAM,CAElE;AAWD,eAAO,MAAM,0BAA0B,aAyErC,CAAC;AA8DH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACxC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAmDD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,iBAAiB,EAAE,EAC1B,eAAe,CAAC,EAAE,MAAM,EACxB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,EACpD,cAAc,GAAE,CAAC,MAAM,EAAE,cAAc,KAAK,cAAmC,GAC9E,IAAI,CAoDN;AAuBD,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAe1F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,cAAc,CAmE9F;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,cAAc,CAmBhB;AAyDD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,iBAAiB,EAAE,EAC1B,OAAO,GAAE,aAAsC,GAC9C,iBAAiB,EAAE,CAKrB;AAsbD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,WAAW,CAAA;CAAO,GAC1C,OAAO,CAAC,SAAS,CAAC,CAkBpB;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAC3E,YAAY,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC;IAC/E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAiDD"}