@tinycloud/mcp 0.8.3-beta.14 → 0.8.3-beta.16

package/dist/http.cjs

@@ -1538,7 +1538,7 @@ function outcomeCode(result) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.8.3-beta.14",
+  version: "0.8.3-beta.16",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -1609,9 +1609,9 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/node": "2.0.0-beta.5",
     "@modelcontextprotocol/server": "2.0.0-beta.5",
-    "@tinycloud/node-sdk": "3.8.0-beta.14",
+    "@tinycloud/node-sdk": "3.8.0-beta.15",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/operations": "0.7.7-beta.13",
+    "@tinycloud/operations": "0.7.7-beta.14",
     jose: "6.2.4"
   },
   devDependencies: {
@@ -1635,6 +1635,8 @@ var MCP_SERVER_NAME = "tinycloud-mcp";
 
 // src/http.ts
 var REQUIRED_SCOPE = "tinycloud:mcp";
+var LOCAL_CLI_PACKAGE = ["@tinycloud", "cli"].join("/");
+var LOCAL_MCP_PACKAGE = ["@tinycloud", "mcp"].join("/");
 function createHostedMcpApp(config) {
   const resourceUrl = canonicalResourceUrl(config.publicUrl);
   const pluginUrl = new URL("./chatgpt/mcp", resourceUrl);
@@ -1714,14 +1716,173 @@ function createHostedSurface(config, resourceUrl, surface, tokenStatus) {
   const allowedHosts = [resourceUrl.hostname];
   return {
     async fetch(request) {
-      const metadata = (0, import_server4.oauthMetadataResponse)(request, metadataOptions);
-      if (metadata !== void 0) return metadata;
       const url = new URL(request.url);
+      if (url.pathname !== "/healthz") {
+        const hostFailure = (0, import_server4.hostHeaderValidationResponse)(request, allowedHosts);
+        if (hostFailure !== void 0) return hostFailure;
+      }
+      if (url.pathname === "/.well-known/oauth-protected-resource" && surface === "hosted") {
+        const metadataUrl = new URL((0, import_server4.getOAuthProtectedResourceMetadataUrl)(resourceUrl));
+        const metadataRequest = new Request(metadataUrl.toString(), {
+          method: request.method,
+          headers: request.headers
+        });
+        const response = (0, import_server4.oauthMetadataResponse)(metadataRequest, metadataOptions);
+        if (response !== void 0) return withBearerMethodsSupported(response);
+      }
+      const metadata = (0, import_server4.oauthMetadataResponse)(request, metadataOptions);
+      if (metadata !== void 0) {
+        return surface === "hosted" ? withBearerMethodsSupported(metadata) : metadata;
+      }
+      if (url.pathname === "/.well-known/ai-catalog.json" && surface === "hosted") {
+        if (request.method === "OPTIONS") {
+          return publicMetadataCors(new Response(null, { status: 204 }), request);
+        }
+        if (request.method !== "GET") return methodNotAllowed("GET");
+        return publicMetadataCors(Response.json({
+          specVersion: "1.0",
+          host: {
+            displayName: "TinyCloud, Inc.",
+            identifier: "https://mcp.tinycloud.xyz",
+            documentationUrl: "https://docs.tinycloud.xyz/cli/mcp"
+          },
+          entries: [{
+            identifier: "urn:air:tinycloud.xyz:mcp:tinycloud-mcp",
+            displayName: "TinyCloud MCP",
+            type: "application/json",
+            description: "Hosted Streamable HTTP MCP server for delegated TinyCloud operations.",
+            url: new URL("/.well-known/mcp/server-card.json", resourceUrl).toString(),
+            representativeQueries: [
+              "How do I connect to TinyCloud's hosted MCP server?",
+              "Which endpoint provides TinyCloud's delegated MCP operations?",
+              "How can I connect to TinyCloud MCP using local stdio?"
+            ]
+          }]
+        }, {
+          headers: {
+            "cache-control": "public, max-age=300",
+            "content-type": "application/json; charset=utf-8"
+          }
+        }), request);
+      }
+      if (url.pathname === "/.well-known/poppy.json" && surface === "hosted") {
+        if (request.method === "OPTIONS") {
+          return publicMetadataCors(new Response(null, { status: 204 }), request);
+        }
+        if (request.method !== "GET") return methodNotAllowed("GET");
+        return publicMetadataCors(Response.json({
+          protocol_version: "0.1",
+          organization: {
+            name: "TinyCloud, Inc.",
+            domain: resourceUrl.hostname
+          },
+          web: {}
+        }, {
+          headers: {
+            "cache-control": "public, max-age=300",
+            "content-type": "application/json; charset=utf-8"
+          }
+        }), request);
+      }
+      if (url.pathname === "/auth.md" && surface === "hosted") {
+        if (request.method === "OPTIONS") {
+          return publicMetadataCors(new Response(null, { status: 204 }), request);
+        }
+        if (request.method !== "GET") return methodNotAllowed("GET");
+        const issuerUrl = new URL(issuer);
+        const authorizationServerMetadataUrl = new URL(
+          `/.well-known/oauth-authorization-server${issuerUrl.pathname}`,
+          issuerUrl.origin
+        );
+        const registrationEndpoint = config.oauthMetadata.registration_endpoint;
+        const registrationNote = typeof registrationEndpoint === "string" ? `OpenKey's OAuth \`registration_endpoint\` is ${registrationEndpoint}; it registers OAuth clients, not TinyCloud users or agents.` : "The authorization server does not advertise an OAuth client registration endpoint.";
+        const authDoc = [
+          "# TinyCloud MCP auth.md",
+          "",
+          `Protected resource: ${resourceUrl}.`,
+          "",
+          "Send an OAuth access token in the `Authorization: Bearer` header.",
+          "",
+          `Protected Resource Metadata: ${new URL("/.well-known/oauth-protected-resource", resourceUrl)}.`,
+          `Authorization server issuer: ${issuer}.`,
+          `Authorization server metadata: ${authorizationServerMetadataUrl}.`,
+          `Scope: \`${REQUIRED_SCOPE}\`.`,
+          "",
+          "Hosted access uses OpenKey OAuth.",
+          registrationNote,
+          "TinyCloud does not host an Auth.md agent-enrollment or user-registration endpoint for this service.",
+          "No `agent_auth` registration block is published because no agent-registration endpoint is available.",
+          "",
+          `Local stdio is a separate option configured with \`${LOCAL_CLI_PACKAGE}\` and \`${LOCAL_MCP_PACKAGE}\`.`,
+          "",
+          "Connection steps: https://docs.tinycloud.xyz/cli/mcp"
+        ].join("\n") + "\n";
+        return publicMetadataCors(publicText(authDoc, "text/markdown; charset=utf-8"), request);
+      }
+      if (url.pathname === "/robots.txt" && surface === "hosted") {
+        return request.method === "GET" ? publicText(`User-agent: *
+Allow: /
+Sitemap: ${new URL("/sitemap.xml", resourceUrl)}
+Agentmap: ${new URL("/.well-known/ai-catalog.json", resourceUrl)}
+`, "text/plain; charset=utf-8") : methodNotAllowed("GET");
+      }
+      if ((url.pathname === "/mcp/server-card" || url.pathname === "/.well-known/mcp/server-card.json") && surface === "hosted") {
+        if (request.method === "OPTIONS") {
+          return publicMetadataCors(new Response(null, { status: 204 }), request);
+        }
+        if (request.method !== "GET") return methodNotAllowed("GET");
+        return publicMetadataCors(Response.json({
+          $schema: "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json",
+          name: `xyz.tinycloud/${MCP_SERVER_NAME}`,
+          title: "TinyCloud MCP",
+          version: MCP_VERSION,
+          description: "MCP server for delegated TinyCloud operations.",
+          websiteUrl: "https://docs.tinycloud.xyz/cli/mcp",
+          repository: { source: "github", url: "https://github.com/TinyCloudLabs/js-sdk", subfolder: "packages/mcp" },
+          remotes: [{ type: "streamable-http", url: resourceUrl.toString() }]
+        }, { headers: { "cache-control": "public, max-age=300" } }), request);
+      }
+      if (url.pathname === "/llms.txt" && surface === "hosted") {
+        return request.method === "GET" ? publicText(`# TinyCloud MCP
+
+Hosted Streamable HTTP endpoint: https://mcp.tinycloud.xyz/mcp (OpenKey OAuth).
+
+Connection documentation: https://docs.tinycloud.xyz/cli/mcp
+
+Local alternative: install ${LOCAL_CLI_PACKAGE} and ${LOCAL_MCP_PACKAGE}, then set up tinycloud-mcp as a stdio server in your MCP client.
+`, "text/plain; charset=utf-8") : methodNotAllowed("GET");
+      }
+      if (url.pathname === "/sitemap.xml" && surface === "hosted") {
+        const sitemap = `<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><url><loc>${new URL("/", resourceUrl)}</loc></url></urlset>`;
+        return request.method === "GET" ? publicText(sitemap, "application/xml; charset=utf-8") : methodNotAllowed("GET");
+      }
+      if (url.pathname === "/" && surface === "hosted") {
+        if (request.method !== "GET" && request.method !== "HEAD") return methodNotAllowed("GET, HEAD");
+        const markdown = request.headers.get("accept")?.includes("text/markdown") ?? false;
+        const content = markdown ? `# TinyCloud MCP
+
+Hosted endpoint: <https://mcp.tinycloud.xyz/mcp> (Streamable HTTP, OpenKey OAuth).
+
+[Connection documentation](https://docs.tinycloud.xyz/cli/mcp).
+
+Local alternative: install \`${LOCAL_CLI_PACKAGE}\` and \`${LOCAL_MCP_PACKAGE}\` and connect the \`tinycloud-mcp\` stdio server.
+` : `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="ai-catalog" href="/.well-known/ai-catalog.json"><title>TinyCloud MCP</title></head><main><h1>TinyCloud MCP</h1><p>Hosted MCP endpoint: <code>https://mcp.tinycloud.xyz/mcp</code> (Streamable HTTP, OpenKey OAuth).</p><p><a href="https://docs.tinycloud.xyz/cli/mcp">Connection documentation</a></p><p>Local alternative: install <code>${LOCAL_CLI_PACKAGE}</code> and <code>${LOCAL_MCP_PACKAGE}</code> and connect the <code>tinycloud-mcp</code> stdio server.</p></main></html>`;
+        const headers = new Headers({
+          "content-type": markdown ? "text/markdown; charset=utf-8" : "text/html; charset=utf-8",
+          "cache-control": "public, max-age=300",
+          "content-security-policy": "default-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+          "x-content-type-options": "nosniff",
+          vary: "Accept"
+        });
+        headers.set(
+          "link",
+          `<${new URL("/mcp/server-card", resourceUrl)}>; rel="describedby"; type="application/json", <https://docs.tinycloud.xyz/cli/mcp>; rel="service-doc"`
+        );
+        return new Response(request.method === "HEAD" ? null : content, { headers });
+      }
       if (url.pathname === "/healthz") {
         return request.method === "GET" ? json({ ok: true }) : methodNotAllowed("GET");
       }
-      const hostFailure = (0, import_server4.hostHeaderValidationResponse)(request, allowedHosts);
-      if (hostFailure !== void 0) return hostFailure;
       if (url.pathname === connectPath) {
         if (request.method !== "GET") return methodNotAllowed("GET");
         try {
@@ -1891,6 +2052,41 @@ function callbackCors(response, openkeyHost) {
 function json(value, status = 200) {
   return Response.json(value, { status, headers: { "cache-control": "no-store" } });
 }
+async function withBearerMethodsSupported(response) {
+  if (response.status === 204 || response.body === null) return response;
+  const metadata = await response.json();
+  const headers = new Headers(response.headers);
+  headers.delete("content-length");
+  headers.delete("content-encoding");
+  return new Response(JSON.stringify({ ...metadata, bearer_methods_supported: ["header"] }), {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function publicMetadataCors(response, request) {
+  const headers = new Headers(response.headers);
+  headers.set("access-control-allow-origin", "*");
+  headers.set("access-control-allow-methods", "GET, OPTIONS");
+  const requestedHeaders = request.method === "OPTIONS" ? request.headers.get("access-control-request-headers") : null;
+  if (requestedHeaders !== null) {
+    headers.set("access-control-allow-headers", requestedHeaders);
+  }
+  headers.set(
+    "vary",
+    requestedHeaders === null ? "Origin" : "Origin, Access-Control-Request-Headers"
+  );
+  return new Response(response.body, { status: response.status, headers });
+}
+function publicText(text, contentType) {
+  return new Response(text, {
+    headers: {
+      "content-type": contentType,
+      "cache-control": "public, max-age=300",
+      "x-content-type-options": "nosniff"
+    }
+  });
+}
 function methodNotAllowed(allow) {
   return new Response("Method not allowed", { status: 405, headers: { allow } });
 }