@tmcp/transport-http 0.5.2 → 0.5.4

package/README.md

@@ -5,11 +5,7 @@ An HTTP transport implementation for TMCP (TypeScript Model Context Protocol) se
 ## Installation
 
 ```bash
-npm install @tmcp/transport-http tmcp
-# or
 pnpm add @tmcp/transport-http tmcp
-# or
-yarn add @tmcp/transport-http tmcp
 ```
 
 ## Usage
@@ -54,56 +50,18 @@ server.tool(
 const transport = new HttpTransport(server);
 
 // Use with your preferred HTTP server
-// Example with Node.js built-in server:
-import { createServer } from 'http';
-
-const httpServer = createServer(async (req, res) => {
-	try {
-		let body = '';
-		req.on('data', (chunk) => (body += chunk));
-		req.on('end', async () => {
-			const request = new Request(`http://localhost${req.url}`, {
-				method: req.method,
-				headers: req.headers,
-				body: req.method === 'POST' ? body : undefined,
-			});
-
-			const response = await transport.respond(request);
-			
-			// If response is null, the request wasn't for MCP
-			if (response === null) {
-				res.statusCode = 404;
-				res.end('Not Found');
-				return;
-			}
-
-			// Copy response to Node.js response
-			response.headers.forEach((value, key) => {
-				res.setHeader(key, value);
-			});
-			res.statusCode = response.status;
-
-			if (response.body) {
-				const reader = response.body.getReader();
-				const pump = async () => {
-					const { done, value } = await reader.read();
-					if (done) {
-						res.end();
-						return;
-					}
-					res.write(value);
-					pump();
-				};
-				pump();
-			} else {
-				res.end();
-			}
-		});
-	} catch (error) {
-		res.statusCode = 500;
-		res.end('Internal Server Error');
+// Example with Node.js built-in server + @remix-run/
+import * as http from 'node:http';
+import { createRequestListener } from '@remix-run/node-fetch-server';
+
+let httpServer = http.createServer(createRequestListener((request)=>{
+	const response = await transport.respond(request);
+	if(response){
+		return response;
 	}
-});
+	return new Response(null, { status: 404 });
+}));
+
 
 httpServer.listen(3000, () => {
 	console.log('MCP HTTP server listening on port 3000');
@@ -157,6 +115,7 @@ Creates a new HTTP transport instance.
 interface HttpTransportOptions {
 	getSessionId: () => string; // Custom session ID generator
 	path?: string; // MCP endpoint path (default: '/mcp')
+	oauth?: OAuth; // an oauth provider generated from @tmcp/auth
 }
 ```
 
@@ -187,6 +146,7 @@ Processes an HTTP request and returns a Response with Server-Sent Events, or nul
 The transport supports three HTTP methods:
 
 #### POST - Message Processing
+
 Clients send JSON-RPC messages via HTTP POST requests:
 
 ```http
@@ -215,6 +175,7 @@ data: {"jsonrpc":"2.0","id":1,"result":{"tools":[...]}}
 ```
 
 #### GET - Notification Stream
+
 Establishes long-lived connections for server notifications:
 
 ```http
@@ -236,6 +197,7 @@ data: {"jsonrpc":"2.0","method":"notifications/initialized","params":{}}
 ```
 
 #### DELETE - Session Disconnect
+
 Disconnects a session and cleans up resources:
 
 ```http
@@ -298,6 +260,27 @@ Deno.serve({ port: 3000 }, async (req) => {
 });
 ```
 
+### `srvx`
+
+If you want to have the same experience throughout Deno, Bun or Node you can also use `srvx`
+
+```js
+import { McpServer } from 'tmcp';
+import { HttpTransport } from '@tmcp/transport-http';
+import { serve } from 'srvx';
+
+const server = new McpServer(/* ... */);
+const transport = new HttpTransport(server);
+
+serve(async (req) => {
+	const response = await transport.respond(req);
+	if (response === null) {
+		return new Response('Not Found', { status: 404 });
+	}
+	return response;
+});
+```
+
 ## Error Handling
 
 The transport includes comprehensive error handling:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tmcp/transport-http",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Transport for TMCP using HTTP",
   "type": "module",
   "main": "src/index.js",
@@ -16,7 +16,7 @@
     "src/**/*"
   ],
   "peerDependencies": {
-    "tmcp": "^1.9.1"
+    "tmcp": "^1.10.2"
   },
   "keywords": [
     "tmcp",
@@ -29,15 +29,16 @@
     "directory": "packages/transport-http"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.16.0",
+    "@modelcontextprotocol/sdk": "^1.17.1",
+    "@remix-run/node-fetch-server": "^0.8.0",
     "@types/node": "^24.0.15",
     "dts-buddy": "^0.6.2",
     "publint": "^0.3.12",
     "valibot": "^1.1.0",
     "vitest": "^3.2.4",
-    "@tmcp/adapter-valibot": "^0.1.3",
-    "@tmcp/auth": "^0.3.2",
-    "tmcp": "^1.9.1"
+    "@tmcp/adapter-valibot": "^0.1.4",
+    "tmcp": "^1.10.2",
+    "@tmcp/auth": "^0.3.3"
   },
   "publishConfig": {
     "access": "public"

package/src/index.js

@@ -3,11 +3,23 @@
  * @import { OAuth  } from "@tmcp/auth";
  */
 
+/**
+ * @typedef {{
+ * 	origin?: string | string[] | boolean
+ * 	methods?: string[]
+ * 	allowedHeaders?: string[]
+ * 	exposedHeaders?: string[]
+ * 	credentials?: boolean
+ * 	maxAge?: number
+ * }} CorsConfig
+ */
+
 /**
  * @typedef {{
  * 	getSessionId?: () => string
  * 	path?: string
  * 	oauth?: OAuth<"built">
+ * 	cors?: CorsConfig | boolean
  * }} HttpTransportOptions
  */
 
@@ -19,7 +31,7 @@ export class HttpTransport {
 	#server;
 
 	/**
-	 * @type {Required<Omit<HttpTransportOptions, 'oauth'>>}
+	 * @type {Required<Omit<HttpTransportOptions, 'oauth' | 'cors'>> & { cors?: CorsConfig | boolean }}
 	 */
 	#options;
 
@@ -60,6 +72,7 @@ export class HttpTransport {
 			getSessionId = () => crypto.randomUUID(),
 			path = '/mcp',
 			oauth,
+			cors,
 		} = options ?? {
 			getSessionId: () => crypto.randomUUID(),
 		};
@@ -68,7 +81,7 @@ export class HttpTransport {
 			this.#oauth = oauth;
 		}
 
-		this.#options = { getSessionId, path };
+		this.#options = { getSessionId, path, cors };
 		this.#path = path;
 		this.#server.on('send', ({ request, context: { sessions } }) => {
 			// use the current controller if the request has an id (it means it's a request and not a notification)
@@ -95,6 +108,89 @@ export class HttpTransport {
 		});
 	}
 
+	/**
+	 * Applies CORS headers to a response based on the configuration
+	 * @param {Response} response - The response to modify
+	 * @param {Request} request - The original request
+	 */
+	#apply_cors_headers(response, request) {
+		const cors_config = this.#options.cors;
+		if (!cors_config) {
+			return;
+		}
+
+		// Handle boolean true (allow all origins)
+		if (cors_config === true) {
+			response.headers.set('Access-Control-Allow-Origin', '*');
+			response.headers.set(
+				'Access-Control-Allow-Methods',
+				'GET, POST, DELETE, OPTIONS',
+			);
+			response.headers.set('Access-Control-Allow-Headers', '*');
+			return;
+		}
+
+		// Handle detailed configuration
+		const config = /** @type {CorsConfig} */ (cors_config);
+		const origin = request.headers.get('origin');
+
+		// Handle origin
+		if (config.origin !== undefined) {
+			if (config.origin === true || config.origin === '*') {
+				response.headers.set('Access-Control-Allow-Origin', '*');
+			} else if (typeof config.origin === 'string') {
+				if (origin === config.origin) {
+					response.headers.set(
+						'Access-Control-Allow-Origin',
+						config.origin,
+					);
+				}
+			} else if (Array.isArray(config.origin)) {
+				if (origin && config.origin.includes(origin)) {
+					response.headers.set('Access-Control-Allow-Origin', origin);
+				}
+			}
+		}
+
+		// Handle other CORS headers with defaults
+		const methods = config.methods ?? ['GET', 'POST', 'DELETE', 'OPTIONS'];
+		response.headers.set(
+			'Access-Control-Allow-Methods',
+			methods.join(', '),
+		);
+
+		const allowed_headers = config.allowedHeaders ?? '*';
+		if (Array.isArray(allowed_headers)) {
+			response.headers.set(
+				'Access-Control-Allow-Headers',
+				allowed_headers.join(', '),
+			);
+		} else {
+			response.headers.set(
+				'Access-Control-Allow-Headers',
+				allowed_headers,
+			);
+		}
+
+		if (config.exposedHeaders) {
+			response.headers.set(
+				'Access-Control-Expose-Headers',
+				config.exposedHeaders.join(', '),
+			);
+		}
+
+		if (config.credentials) {
+			response.headers.set('Access-Control-Allow-Credentials', 'true');
+		}
+
+		if (config.maxAge !== undefined) {
+			response.headers.set(
+				'Access-Control-Max-Age',
+				config.maxAge.toString(),
+			);
+		}
+	}
+
 	/**
 	 * @param {string} session_id
 	 */
@@ -288,7 +384,7 @@ export class HttpTransport {
 				status: 405,
 				headers: {
 					'Content-Type': 'application/json',
-					Allow: 'GET, POST, DELETE',
+					Allow: 'GET, POST, DELETE, OPTIONS',
 				},
 			},
 		);
@@ -339,22 +435,42 @@ export class HttpTransport {
 			request.headers.get('mcp-session-id') ||
 			this.#options.getSessionId();
 
+		/**
+		 * @type {Response | null}
+		 */
+		let response = null;
+
+		// Handle OPTIONS request - preflight CORS
+		if (method === 'OPTIONS') {
+			response = new Response(null, {
+				status: 204,
+				headers: {
+					'Content-Type': 'application/json',
+				},
+			});
+		}
 		// Handle DELETE request - disconnect session
-		if (method === 'DELETE') {
-			return this.#handle_delete(session_id);
+		else if (method === 'DELETE') {
+			response = this.#handle_delete(session_id);
 		}
-
 		// Handle GET request - establish long-lived connection for notifications
-		if (method === 'GET') {
-			return this.#handle_get(session_id);
+		else if (method === 'GET') {
+			response = this.#handle_get(session_id);
 		}
-
 		// Handle POST request - process message and respond through event stream
-		if (method === 'POST') {
-			return this.#handle_post(session_id, request, auth_info);
+		else if (method === 'POST') {
+			response = await this.#handle_post(session_id, request, auth_info);
 		}
-
 		// Method not supported
-		return this.#handle_default(method);
+		else {
+			response = this.#handle_default(method);
+		}
+
+		// Apply CORS headers if we have a response
+		if (response) {
+			this.#apply_cors_headers(response, request);
+		}
+
+		return response;
 	}
 }

package/src/types/index.d.ts

@@ -8,10 +8,19 @@ declare module '@tmcp/transport-http' {
 		respond(request: Request): Promise<Response | null>;
 		#private;
 	}
+	export type CorsConfig = {
+		origin?: string | string[] | boolean;
+		methods?: string[];
+		allowedHeaders?: string[];
+		exposedHeaders?: string[];
+		credentials?: boolean;
+		maxAge?: number;
+	};
 	export type HttpTransportOptions = {
 		getSessionId?: () => string;
 		path?: string;
 		oauth?: OAuth<"built">;
+		cors?: CorsConfig | boolean;
 	};
 
 	export {};

package/src/types/index.d.ts.map

@@ -10,6 +10,6 @@
 	"sourcesContent": [
 		null
 	],
-	"mappings": ";;;cAcaA,aAAaA",
+	"mappings": ";;;cA0BaA,aAAaA",
 	"ignoreList": []
 }