@teampitch/mcpx 0.2.1 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@teampitch/mcpx",
-	"version": "0.2.1",
+	"version": "0.3.1",
 	"description": "Self-hosted MCP Code Mode gateway — aggregate multiple MCP servers behind 2 tools with V8 isolate execution",
 	"keywords": [
 		"claude",

package/src/backends.test.ts

@@ -1,4 +1,5 @@
 import { describe, test, expect } from "bun:test";
+
 import {
   generateTypeDefinitions,
   generateToolListing,
@@ -49,7 +50,7 @@ describe("generateTypeDefinitions", () => {
   test("returns header comment for empty backends", () => {
     const backends = new Map<string, Backend>();
     const result = generateTypeDefinitions(backends);
-    expect(result).toContain("Available MCP tool functions");
+    expect(result).toContain("Available tool functions");
   });
 
   test("generates declare function for each tool", () => {
@@ -59,7 +60,9 @@ describe("generateTypeDefinitions", () => {
           name: "search_dashboards",
           description: "Search dashboards",
           inputSchema: {
-            properties: { query: { type: "string", description: "Search query" } },
+            properties: {
+              query: { type: "string", description: "Search query" },
+            },
             required: ["query"],
           },
         },

package/src/backends.ts

@@ -3,6 +3,7 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 
 import type { BackendConfig } from "./config.js";
+import { getAccessToken } from "./oauth-client.js";
 import { createOpenApiBackend } from "./openapi.js";
 
 export interface ToolInfo {
@@ -42,11 +43,23 @@ async function connectStdio(name: string, config: BackendConfig): Promise<Backen
 }
 
 /** Connect to a backend MCP server via HTTP (Streamable HTTP) */
-async function connectHttp(name: string, config: BackendConfig): Promise<Backend> {
+async function connectHttp(
+  name: string,
+  config: BackendConfig,
+  tokensDir?: string,
+): Promise<Backend> {
   if (!config.url) throw new Error(`Backend "${name}" missing url`);
 
+  // Build headers — static headers + OAuth token if configured
+  const headers: Record<string, string> = { ...config.headers };
+
+  if (config.oauth && tokensDir) {
+    const token = await getAccessToken(name, config.url, tokensDir, config.oauth);
+    headers.Authorization = `Bearer ${token}`;
+  }
+
   const transport = new StreamableHTTPClientTransport(new URL(config.url), {
-    requestInit: config.headers ? { headers: config.headers } : undefined,
+    requestInit: Object.keys(headers).length > 0 ? { headers } : undefined,
   });
 
   const client = new Client({ name: `mcpx-${name}`, version: "0.1.0" });
@@ -66,6 +79,7 @@ async function connectHttp(name: string, config: BackendConfig): Promise<Backend
 /** Connect to all configured backends */
 export async function connectBackends(
   configs: Record<string, BackendConfig>,
+  opts?: { tokensDir?: string },
 ): Promise<Map<string, Backend>> {
   const backends = new Map<string, Backend>();
 
@@ -75,7 +89,7 @@ export async function connectBackends(
         const backend = await connectStdio(name, config);
         backends.set(name, backend);
       } else if (config.transport === "http") {
-        const backend = await connectHttp(name, config);
+        const backend = await connectHttp(name, config, opts?.tokensDir);
         backends.set(name, backend);
       } else if (config.transport === "openapi") {
         const backend = await createOpenApiBackend(name, config);
@@ -110,33 +124,66 @@ export async function refreshAllTools(backends: Map<string, Backend>): Promise<v
   }
 }
 
+/** Map a JSON Schema type to a TypeScript type string */
+function schemaTypeToTs(schema: Record<string, unknown>): string {
+  const type = schema.type as string | undefined;
+  if (schema.enum) return (schema.enum as unknown[]).map((v) => JSON.stringify(v)).join(" | ");
+  if (type === "array") {
+    const items = schema.items as Record<string, unknown> | undefined;
+    return items ? `${schemaTypeToTs(items)}[]` : "any[]";
+  }
+  if (type === "object") {
+    const props = schema.properties as Record<string, Record<string, unknown>> | undefined;
+    if (!props) return "Record<string, unknown>";
+    const fields = Object.entries(props)
+      .map(([k, v]) => `${k}: ${schemaTypeToTs(v)}`)
+      .join("; ");
+    return `{ ${fields} }`;
+  }
+  if (type === "string") return "string";
+  if (type === "number" || type === "integer") return "number";
+  if (type === "boolean") return "boolean";
+  return "any";
+}
+
 /** Generate TypeScript type definitions from all backend tools for the LLM */
 export function generateTypeDefinitions(backends: Map<string, Backend>): string {
   const lines: string[] = [
-    "// Available MCP tool functions — call these in your execute code",
-    "// Each function returns a Promise<{ content: Array<{ type: string, text: string }> }>",
+    "// Available tool functions — call via namespace: await backend.toolName(args)",
     "",
   ];
 
   for (const [name, backend] of backends) {
     lines.push(`// === ${name} ===`);
     for (const tool of backend.tools) {
-      const params = tool.inputSchema?.properties
-        ? Object.entries(
-            tool.inputSchema.properties as Record<string, { type?: string; description?: string }>,
-          )
-            .map(([k, v]) => {
-              const required = (tool.inputSchema.required as string[] | undefined)?.includes(k);
-              return `${k}${required ? "" : "?"}: ${v.type === "array" ? "any[]" : (v.type ?? "any")}`;
-            })
-            .join(", ")
-        : "";
-      const desc = tool.description ? ` — ${tool.description.slice(0, 80)}` : "";
-      lines.push(
-        `declare function ${name}_${sanitizeName(tool.name)}(args: { ${params} }): Promise<any>;${desc}`,
-      );
+      const props = tool.inputSchema?.properties as
+        | Record<string, Record<string, unknown>>
+        | undefined;
+      const required = (tool.inputSchema?.required as string[]) ?? [];
+
+      if (props && Object.keys(props).length > 0) {
+        // Generate interface
+        const ifaceName = `${name}_${sanitizeName(tool.name)}_Input`;
+        lines.push(`interface ${ifaceName} {`);
+        for (const [k, v] of Object.entries(props)) {
+          const opt = required.includes(k) ? "" : "?";
+          const desc = v.description ? ` // ${(v.description as string).slice(0, 60)}` : "";
+          lines.push(`  ${k}${opt}: ${schemaTypeToTs(v)};${desc}`);
+        }
+        lines.push("}");
+
+        const desc = tool.description ? ` — ${tool.description.slice(0, 80)}` : "";
+        lines.push(
+          `declare function ${name}_${sanitizeName(tool.name)}(args: ${ifaceName}): Promise<any>;${desc}`,
+        );
+      } else {
+        const desc = tool.description ? ` — ${tool.description.slice(0, 80)}` : "";
+        lines.push(
+          `declare function ${name}_${sanitizeName(tool.name)}(args?: {}): Promise<any>;${desc}`,
+        );
+      }
+      lines.push("");
     }
-    lines.push("");
   }
 
   return lines.join("\n");

package/src/config.ts

@@ -17,6 +17,13 @@ export interface BackendConfig {
   env?: Record<string, string>;
   /** HTTP headers for http transport — supports ${VAR} interpolation */
   headers?: Record<string, string>;
+  /** OAuth client config for HTTP backends (MCP OAuth flow) */
+  oauth?: {
+    /** Callback port for local OAuth redirect (default: 9876) */
+    callbackPort?: number;
+    /** Custom redirect URI (default: http://localhost:{callbackPort}/oauth/callback) */
+    redirectUri?: string;
+  };
   /** JWT roles allowed to access this backend */
   allowedRoles?: string[];
   /** JWT teams allowed to access this backend */

package/src/executor.test.ts

@@ -89,7 +89,7 @@ describe("executeCode", () => {
     const backends = new Map([["test", mockBackend]]);
 
     const result = await executeCode(
-      'const r = await test_echo({ msg: "hello" }); return r.content[0].text;',
+      'const r = await test.echo({ msg: "hello" }); return r.content[0].text;',
       backends,
     );
     expect(result.isOk()).toBe(true);
@@ -126,9 +126,9 @@ describe("executeCode", () => {
     const backends = new Map([["mock", mockBackend]]);
 
     const result = await executeCode(
-      `const idResult = await mock_get_id({});
+      `const idResult = await mock.getId({});
        const id = idResult.content[0].text;
-       const details = await mock_get_details({ id });
+       const details = await mock.getDetails({ id });
        return details.content[0].text;`,
       backends,
     );

package/src/executor.ts

@@ -3,6 +3,7 @@ import { createNodeDriver, NodeExecutionDriver, type BindingFunction } from "sec
 
 import { validateSyntax } from "./ast.js";
 import type { Backend } from "./backends.js";
+import type { Skill } from "./skills.js";
 
 type ToolFunction = (args: Record<string, unknown>) => Promise<unknown>;
 
@@ -11,9 +12,28 @@ export interface LogEntry {
   args: unknown[];
 }
 
+export interface ExecutionEvent {
+  type:
+    | "tool_call"
+    | "tool_result"
+    | "tool_error"
+    | "console"
+    | "execution_start"
+    | "execution_end";
+  timestamp: number;
+  tool?: string;
+  args?: unknown;
+  result?: unknown;
+  error?: string;
+  durationMs?: number;
+  level?: string;
+  message?: string;
+}
+
 export interface ExecuteResult {
   value: unknown;
   logs: LogEntry[];
+  events: ExecutionEvent[];
 }
 
 export type ExecuteError =
@@ -33,26 +53,98 @@ export function snakeToCamel(name: string): string {
 }
 
 /** Build a map of prefixed tool names → backend tool call functions */
-function buildToolRegistry(backends: Map<string, Backend>): Map<string, ToolFunction> {
+function buildToolRegistry(
+  backends: Map<string, Backend>,
+  skills: Map<string, Skill>,
+  events: ExecutionEvent[],
+): Map<string, ToolFunction> {
   const registry = new Map<string, ToolFunction>();
 
+  // Backend tools
   for (const [name, backend] of backends) {
     for (const tool of backend.tools) {
       const prefixed = `${name}_${sanitizeName(tool.name)}`;
       registry.set(prefixed, async (args) => {
-        return backend.client.callTool({
-          name: tool.name,
-          arguments: args,
+        const start = Date.now();
+        events.push({
+          type: "tool_call",
+          timestamp: start,
+          tool: prefixed,
+          args,
         });
+        try {
+          const result = await backend.client.callTool({
+            name: tool.name,
+            arguments: args,
+          });
+          events.push({
+            type: "tool_result",
+            timestamp: Date.now(),
+            tool: prefixed,
+            result,
+            durationMs: Date.now() - start,
+          });
+          return result;
+        } catch (e) {
+          const msg = (e as Error).message;
+          events.push({
+            type: "tool_error",
+            timestamp: Date.now(),
+            tool: prefixed,
+            error: msg,
+            durationMs: Date.now() - start,
+          });
+          return { error: msg };
+        }
       });
     }
   }
 
+  // Skill tools — execute saved code in the same sandbox context
+  for (const [, skill] of skills) {
+    const prefixed = `skill_${sanitizeName(skill.name)}`;
+    registry.set(prefixed, async (args) => {
+      const start = Date.now();
+      events.push({
+        type: "tool_call",
+        timestamp: start,
+        tool: prefixed,
+        args,
+      });
+      try {
+        // Skills run as inline functions — they have access to the same tool bindings
+        const fn = new Function("args", `return (async () => { ${skill.code} })()`);
+        const result = await fn(args);
+        events.push({
+          type: "tool_result",
+          timestamp: Date.now(),
+          tool: prefixed,
+          result,
+          durationMs: Date.now() - start,
+        });
+        return result;
+      } catch (e) {
+        const msg = (e as Error).message;
+        events.push({
+          type: "tool_error",
+          timestamp: Date.now(),
+          tool: prefixed,
+          error: msg,
+          durationMs: Date.now() - start,
+        });
+        return { error: msg };
+      }
+    });
+  }
+
   return registry;
 }
 
 /** Build a map of backend name → tool names (for namespace generation) */
-function buildBackendToolMap(backends: Map<string, Backend>): Map<string, string[]> {
+function buildBackendToolMap(
+  backends: Map<string, Backend>,
+  skills: Map<string, Skill>,
+): Map<string, string[]> {
   const map = new Map<string, string[]>();
   for (const [name, backend] of backends) {
     map.set(
@@ -60,18 +152,20 @@ function buildBackendToolMap(backends: Map<string, Backend>): Map<string, string
       backend.tools.map((t) => t.name),
     );
   }
+
+  // Skills get their own namespace
+  if (skills.size > 0) {
+    map.set(
+      "skill",
+      Array.from(skills.values()).map((s) => s.name),
+    );
+  }
+
   return map;
 }
 
-/**
- * Generate code bindings: flat aliases + namespace proxies + console capture.
- */
-function wrapCodeWithBindings(
-  code: string,
-  toolNames: string[],
-  backendTools: Map<string, string[]>,
-): string {
-  // Console capture
+/** Generate namespace proxy code for the sandbox */
+function wrapCodeWithBindings(code: string, backendTools: Map<string, string[]>): string {
   const consoleOverride = `
 const __consoleLogs = [];
 const console = {
@@ -82,12 +176,6 @@ const console = {
   debug: (...args) => __consoleLogs.push({ level: "debug", args }),
 };`;
 
-  // Flat aliases (backward compat)
-  const aliases = toolNames
-    .map((n) => `const ${n} = (args) => SecureExec.bindings.callTool("${n}", args || {});`)
-    .join("\n");
-
-  // Namespace proxies
   const namespaces: string[] = [];
   for (const [backendName, tools] of backendTools) {
     const methods = tools
@@ -102,7 +190,6 @@ const console = {
 
   return `
 ${consoleOverride}
-${aliases}
 ${namespaces.join("\n")}
 
 const __userResult = await (async () => { ${code} })();
@@ -114,10 +201,18 @@ export default { value: __userResult, logs: __consoleLogs };
 export async function executeCode(
   code: string,
   backends: Map<string, Backend>,
-  opts?: { memoryLimit?: number; cpuTimeLimitMs?: number },
+  opts?: {
+    memoryLimit?: number;
+    cpuTimeLimitMs?: number;
+    skills?: Map<string, Skill>;
+  },
 ): Promise<Result<ExecuteResult, ExecuteError>> {
-  const registry = buildToolRegistry(backends);
-  const backendTools = buildBackendToolMap(backends);
+  const events: ExecutionEvent[] = [];
+  const skills = opts?.skills ?? new Map();
+  const registry = buildToolRegistry(backends, skills, events);
+  const backendTools = buildBackendToolMap(backends, skills);
+
+  events.push({ type: "execution_start", timestamp: Date.now() });
 
   const callTool: BindingFunction = async (name: unknown, args: unknown) => {
     const toolName = name as string;
@@ -126,16 +221,11 @@ export async function executeCode(
     if (!fn) {
       return { error: `Unknown tool: ${toolName}` };
     }
-    try {
-      return await fn(toolArgs);
-    } catch (e) {
-      return { error: (e as Error).message };
-    }
+    return fn(toolArgs);
   };
 
-  const wrappedCode = wrapCodeWithBindings(code, [...registry.keys()], backendTools);
+  const wrappedCode = wrapCodeWithBindings(code, backendTools);
 
-  // AST validation — catch syntax errors with better messages before V8 execution
   const syntaxError = validateSyntax(wrappedCode);
   if (syntaxError) {
     return err({
@@ -170,6 +260,8 @@ export async function executeCode(
   try {
     const runResult = await driver.run(wrappedCode, "/entry.mjs");
 
+    events.push({ type: "execution_end", timestamp: Date.now() });
+
     if (runResult.code !== 0) {
       return err({ kind: "runtime", code: runResult.code });
     }
@@ -182,8 +274,10 @@ export async function executeCode(
     return ok({
       value: result?.value ?? null,
       logs: result?.logs ?? [],
+      events,
     });
   } catch (e) {
+    events.push({ type: "execution_end", timestamp: Date.now() });
     return err({ kind: "exception", message: (e as Error).message });
   } finally {
     driver.dispose();