@transloadit/mcp-server 0.4.1 → 0.5.0

package/README.md

@@ -2,23 +2,134 @@
 
 Transloadit MCP Server (Streamable HTTP + stdio), built on top of `@transloadit/node`.
 
-## Install
+## Connect by URL (recommended)
+
+The hosted server lives at:
+
+```text
+https://api2.transloadit.com/mcp
+```
+
+Add it to your MCP client by URL. The client discovers API2 as the OAuth authorization server,
+opens a browser consent page in the Transloadit Console, and keeps a short-lived token plus refresh
+token for you. No API keys leave your Workspace.
+
+The hosted endpoint asks you to sign in before any tool runs, Robot docs and linting included,
+because MCP clients only start OAuth when the endpoint challenges them. Robot docs and linting ask
+for no scopes. To use them without an account, run the server yourself (see Self-hosted).
+
+### Claude Code
 
 ```bash
-npm install @transloadit/mcp-server
+claude mcp add --transport http transloadit https://api2.transloadit.com/mcp
+claude mcp login transloadit
+```
+
+For non-interactive runs (for example `claude -p`), explicitly allow MCP tools:
+
+```bash
+claude -p "List templates" \
+  --allowedTools mcp__transloadit__* \
+  --output-format json
+```
+
+### Claude.ai and Claude Desktop
+
+Settings → Connectors → Add custom connector → enter `https://api2.transloadit.com/mcp`. Claude
+registers itself with API2 and opens the consent page.
+
+### ChatGPT
+
+Settings → Apps & Connectors → Advanced → Developer mode → Create, then enter the URL above with
+authentication set to OAuth. Files you attach in the chat are handed to
+`transloadit_create_assembly` as `attachments`; results render in the Assembly result widget.
+
+The plugin manifest for the ChatGPT and Codex catalog (`plugin.json`, `mcp.json` and the
+`.codex-plugin/plugin.json` fallback) lives in this package directory. It points at the hosted
+server and at the Agent Skills catalog at `https://transloadit.com/.well-known/skills/index.json`
+instead of bundling skill files.
+
+### Codex
+
+```bash
+codex mcp add transloadit --url https://api2.transloadit.com/mcp
+```
+
+Codex opens the consent page right away. To sign in again later, run
+`codex mcp login transloadit`.
+
+Or in `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.transloadit]
+url = "https://api2.transloadit.com/mcp"
+```
+
+### Cursor
+
+`~/.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "transloadit": {
+      "url": "https://api2.transloadit.com/mcp"
+    }
+  }
+}
+```
+
+### MCP Inspector
+
+```bash
+npx @modelcontextprotocol/inspector --cli https://api2.transloadit.com/mcp
+```
+
+## CI and headless agents
+
+Where no browser is available, mint a bearer token from an Auth Key and pass it as
+`Authorization: Bearer <token>`:
+
+```bash
+npx -y @transloadit/node auth token --aud mcp
 ```
 
-## Quick start (self-hosted, recommended)
+Generate this token in a trusted environment (backend, CI, or local shell), then hand it to the
+agent runtime. You can mint it via:
+
+- CLI: `npx -y @transloadit/node auth token --aud mcp`
+- API: `POST https://api2.transloadit.com/token` (HTTP Basic Auth with key/secret)
+- Node SDK: instantiate `Transloadit` with `authKey` + `authSecret`, then call
+  `client.mintBearerToken({ aud: 'mcp' })`
+
+Interactive CLI sessions can also run `npx -y @transloadit/node auth login` (device flow) and reuse
+the stored credentials.
+
+Bearer tokens satisfy signature auth on API2 requests; signature checks apply to key/secret
+requests.
+
+## Self-hosted
 
-For most teams, self-hosted MCP is the simplest happy path: run the server where your agent runs,
-set `TRANSLOADIT_KEY` and `TRANSLOADIT_SECRET`, and the server handles API auth automatically.
+Run the server where your agent runs, set `TRANSLOADIT_KEY` and `TRANSLOADIT_SECRET`, and the server
+handles API auth automatically.
 
-### Stdio (recommended)
+### Install
+
+```bash
+npm install @transloadit/mcp-server
+```
+
+### Stdio
 
 ```bash
 TRANSLOADIT_KEY=MY_AUTH_KEY TRANSLOADIT_SECRET=MY_SECRET_KEY npx -y @transloadit/mcp-server stdio
 ```
 
+Auth Keys sign with one HMAC algorithm. Keys created in the Console with "Allow signing Smart CDN
+URLs" (the default) require `sha256`, so add `TRANSLOADIT_SIGNATURE_ALGORITHM=sha256`, as the
+Console's snippet for the key shows. Other keys use the default `sha384`. A mismatch fails with
+`mcp_invalid_signature`, and its hint names the algorithm the key requires.
+
 ### HTTP
 
 ```bash
@@ -26,7 +137,8 @@ TRANSLOADIT_KEY=MY_AUTH_KEY TRANSLOADIT_SECRET=MY_SECRET_KEY \
 npx -y @transloadit/mcp-server http --host 127.0.0.1 --port 5723
 ```
 
-When binding HTTP mode to non-localhost hosts, `TRANSLOADIT_MCP_TOKEN` is required.
+When binding HTTP mode to non-localhost hosts, `TRANSLOADIT_MCP_TOKEN` (or the hosted-mode
+`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`) is required.
 
 ### Docker
 
@@ -37,15 +149,19 @@ docker run -i --rm \
   ghcr.io/transloadit/mcp-server:latest
 ```
 
-For HTTP mode via Docker, expose the port:
+For HTTP mode via Docker, override the `stdio` entrypoint, expose the port, and set a transport
+token, which binding to `0.0.0.0` requires:
 
 ```bash
+export TRANSLOADIT_MCP_TOKEN="$(openssl rand -hex 32)"
 docker run --rm \
   -e TRANSLOADIT_KEY=MY_AUTH_KEY \
   -e TRANSLOADIT_SECRET=MY_SECRET_KEY \
+  -e TRANSLOADIT_MCP_TOKEN \
   -p 5723:5723 \
+  --entrypoint transloadit-mcp \
   ghcr.io/transloadit/mcp-server:latest \
-  transloadit-mcp http --host 0.0.0.0 --port 5723
+  http --host 0.0.0.0 --port 5723
 ```
 
 ### `TRANSLOADIT_MCP_TOKEN` explained
@@ -65,36 +181,11 @@ export TRANSLOADIT_MCP_TOKEN="$(openssl rand -hex 32)"
 npx -y @transloadit/mcp-server http --host 0.0.0.0 --port 5723
 ```
 
-## Hosted endpoint
-
-If you cannot run `npx` where the agent runs, use the hosted endpoint:
-
-```text
-https://api2.transloadit.com/mcp
-```
-
-Use `Authorization: Bearer <token>`. Mint a token with:
-
-```bash
-npx -y @transloadit/node auth token --aud mcp
-```
-
-Generate this token in a trusted environment (backend, CI, or local shell), then hand it to the
-agent runtime. You can mint it via:
+### Self-hosted client setup
 
-- CLI: `npx -y @transloadit/node auth token --aud mcp`
-- API: `POST https://api2.transloadit.com/token` (HTTP Basic Auth with key/secret)
-- Node SDK: instantiate `Transloadit` with `authKey` + `authSecret`, then call
-  `client.mintBearerToken({ aud: 'mcp' })`
+Most self-hosted users add the server to their MCP client and let the client start it via stdio.
 
-Bearer tokens satisfy signature auth on API2 requests; signature checks apply to key/secret
-requests.
-
-## Agent client setup
-
-Most users add the server to their MCP client and let the client start it automatically via stdio.
-
-### Claude Code
+#### Claude Code
 
 ```bash
 claude mcp add --transport stdio transloadit \
@@ -103,15 +194,7 @@ claude mcp add --transport stdio transloadit \
   -- npx -y @transloadit/mcp-server stdio
 ```
 
-For non-interactive runs (for example `claude -p`), explicitly allow MCP tools:
-
-```bash
-claude -p "List templates" \
-  --allowedTools mcp__transloadit__* \
-  --output-format json
-```
-
-### Codex CLI
+#### Codex CLI
 
 ```bash
 codex mcp add transloadit \
@@ -129,7 +212,7 @@ args = ["-y", "@transloadit/mcp-server", "stdio"]
 enabled_tools = ["transloadit_list_templates"]
 ```
 
-### Gemini CLI
+#### Gemini CLI
 
 ```bash
 gemini mcp add --scope user transloadit npx -y @transloadit/mcp-server stdio \
@@ -155,7 +238,7 @@ Allowlist tools in `~/.gemini/settings.json`:
 }
 ```
 
-### Cursor
+#### Cursor
 
 `~/.cursor/mcp.json`:
 
@@ -174,7 +257,7 @@ Allowlist tools in `~/.gemini/settings.json`:
 }
 ```
 
-### OpenCode
+#### OpenCode
 
 `~/.config/opencode/opencode.json`:
 
@@ -193,27 +276,31 @@ Allowlist tools in `~/.gemini/settings.json`:
 }
 ```
 
-## Run the server manually
-
-HTTP:
-
-```bash
-npx -y @transloadit/mcp-server http --host 127.0.0.1 --port 5723
-```
-
-Stdio:
-
-```bash
-npx -y @transloadit/mcp-server stdio
-```
-
 ## Auth model
 
 ### Hosted (`https://api2.transloadit.com/mcp`)
 
-- Mint token via `POST https://api2.transloadit.com/token`.
-- Send `Authorization: Bearer <access_token>`.
-- Bearer auth satisfies signature auth; signature checks apply to key/secret requests.
+- Requests without a bearer token get `401` with
+  `WWW-Authenticate: Bearer resource_metadata="https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp"`.
+  MCP clients follow that document to API2's authorization server (authorization code + PKCE,
+  Dynamic Client Registration or Client ID Metadata Documents).
+- This includes a bare `GET /mcp`, because some clients (Codex) discover the authorization server
+  from that probe. Directory health checks therefore see `401` instead of `200`; the JSON body
+  still carries `name`, `status` and `docs`. Self-hosted and unauthenticated deployments keep
+  answering the bare `GET` with `200`.
+- Bearer tokens (OAuth or minted with `--aud mcp`) are forwarded to API2, which verifies them on
+  every call. A rejected or expired token yields a tool result with `isError` and
+  `_meta["mcp/www_authenticate"]`, so ChatGPT and Claude prompt you to reconnect.
+- Each tool declares `securitySchemes` (top level and in `_meta`). Because the hosted endpoint
+  challenges every unauthenticated request, all tools declare `oauth2` there; the Robot docs and
+  linting tools ask for no scopes.
+- A rejected or expired key/secret on a self-hosted server is reported as
+  `mcp_credentials_rejected` without an OAuth challenge, since only an operator can fix it.
+- Browser requests must come from ChatGPT, Claude, Transloadit or loopback origins; requests without
+  an `Origin` header (CLIs, servers) are not restricted. Set `allowedOrigins` to change the list.
+- `TRANSLOADIT_MCP_UPSTREAM_SECRET` is set by Transloadit's own deployment so API2 can tell that a
+  relayed `aud=mcp` token arrives from the hosted service; it is not needed for self-hosting.
+  Hosted mode refuses to start without it, because every authenticated call would fail.
 
 ### Self-hosted
 
@@ -229,7 +316,17 @@ npx -y @transloadit/mcp-server stdio
 
 - `TRANSLOADIT_KEY`
 - `TRANSLOADIT_SECRET`
+- `TRANSLOADIT_SIGNATURE_ALGORITHM` (optional, `sha1`, `sha256` or `sha384`, default `sha384`;
+  must match the Auth Key)
 - `TRANSLOADIT_MCP_TOKEN`
+- `TRANSLOADIT_MCP_RESOURCE_METADATA_URL` (hosted mode: protected-resource metadata URL to
+  advertise in `401` challenges)
+- `TRANSLOADIT_MCP_UPSTREAM_SECRET` (hosted mode only, set by Transloadit's deployment; sent to
+  API2 as `Transloadit-Mcp-Upstream` next to forwarded bearer tokens)
+- `TRANSLOADIT_MCP_RESULT_DOMAINS` (optional, comma-separated origins the result widget may load
+  previews from; default `https://*.transloadit.com,https://*.transloadit.net,https://*.r2.dev`)
+- `TRANSLOADIT_MCP_CONSOLE_URL` (optional, default `https://transloadit.com`; Console origin for
+  widget deep links)
 - `TRANSLOADIT_ENDPOINT` (optional, default `https://api2.transloadit.com`)
 - `TRANSLOADIT_MCP_METRICS_PATH` (optional, default `/metrics`)
 - `TRANSLOADIT_MCP_METRICS_USER` (optional)
@@ -241,21 +338,50 @@ npx -y @transloadit/mcp-server stdio
 - `npx -y @transloadit/mcp-server http --endpoint https://api2.transloadit.com`
 - `npx -y @transloadit/mcp-server http --config path/to/config.json`
 
+The JSON config accepts the same keys as `createTransloaditMcpHttpHandler()`, including
+`allowedOrigins`, `resourceMetadataUrl`, `signatureAlgorithm`, `resultDomains` and `consoleUrl`.
+
 ## Tool surface
 
-- `transloadit_lint_assembly_instructions`
-- `transloadit_create_assembly`
-- `transloadit_get_assembly_status`
-- `transloadit_wait_for_assembly`
-- `transloadit_list_robots`
-- `transloadit_get_robot_help`
-- `transloadit_list_templates`
+| Tool                                     | Account | OAuth scopes                         | Notes                                           |
+| ---------------------------------------- | ------- | ------------------------------------ | ----------------------------------------------- |
+| `transloadit_lint_assembly_instructions` | no      | none                                 | read-only                                       |
+| `transloadit_list_robots`                | no      | none                                 | read-only                                       |
+| `transloadit_get_robot_help`             | no      | none                                 | read-only                                       |
+| `transloadit_create_assembly`            | yes     | `assemblies:write`, `templates:read` | destructive, open-world (URL imports), widget   |
+| `transloadit_get_assembly_status`        | yes     | `assemblies:read`                    | read-only                                       |
+| `transloadit_wait_for_assembly`          | yes     | `assemblies:read`                    | read-only, result widget                        |
+| `transloadit_list_templates`             | yes     | `templates:read`                     | read-only                                       |
+| `transloadit_get_profile`                | yes     | `assemblies:read`, `templates:read`  | read-only, `_meta["openai/profile"]`            |
+
+Every tool carries `title`, `readOnlyHint`, `destructiveHint`, `idempotentHint` and
+`openWorldHint` annotations. `transloadit_create_assembly` is the only destructive one: export
+Robots such as `/s3/store` can overwrite files at their destination, so hosts should confirm it.
+
+`securitySchemes` depend on how the server runs: hosted (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`)
+declares `oauth2` with the scopes above for every tool; a server holding `TRANSLOADIT_KEY` and
+`TRANSLOADIT_SECRET` declares `noauth` everywhere; otherwise the account tools declare `oauth2` and
+the others `noauth`. `TRANSLOADIT_MCP_TOKEN` and `TRANSLOADIT_MCP_RESOURCE_METADATA_URL` cannot be
+combined.
 
 `transloadit_list_templates` supports:
 
 - `include_builtin`: `all`, `latest`, `exclusively-all`, `exclusively-latest`
 - `include_content`: include parsed `steps` in each template item
 
+`transloadit_get_profile` returns `{ id, name?, nickname? }` for the Workspace behind the current
+credentials, derived from the Workspace's own Assemblies or Templates.
+
+### Result widget
+
+`transloadit_create_assembly` and `transloadit_wait_for_assembly` link the MCP Apps resource
+`ui://transloadit/assembly-result` (`_meta.ui.resourceUri`, also `_meta["openai/outputTemplate"]`).
+Hosts that support MCP Apps render each Step's results with image, video and audio previews,
+download links, an "Open in Console" link and a "Save as Template" shortcut. It speaks the MCP Apps
+`2026-01-26` protocol (`ui/initialize` with `appInfo`) and also reads ChatGPT's `window.openai`.
+Its CSP allows `https://*.transloadit.com`, `https://*.transloadit.net` and `https://*.r2.dev`
+(result buckets); override the list with `TRANSLOADIT_MCP_RESULT_DOMAINS` or `resultDomains`.
+
 ## Input files
 
 ```ts
@@ -276,14 +402,57 @@ export type InputFile =
     }
 ```
 
+Hosts that attach chat files (ChatGPT) pass them under `attachments` instead, as declared by
+`_meta["openai/fileParams"]`:
+
+```ts
+type Attachment = {
+  download_url: string
+  file_id: string
+  mime_type?: string
+  file_name?: string
+}
+```
+
+Each attachment becomes a URL input (`attachment_1`, `attachment_2`, …) and follows the URL rules
+below.
+
+### Files that exist only locally or in your sandbox
+
+If the file exists only locally or in your sandbox, call `transloadit_create_assembly` with
+`expected_uploads` and run the returned `upload_instructions`; this needs outbound HTTPS from the
+sandbox to Transloadit (Claude.ai: Settings → code execution network access must allow it). Hosts
+such as Claude.ai do not hand chat attachments to connector tools, and base64 in tool arguments is
+impractical for anything but tiny files, so the agent uploads the file itself:
+
+1. Call `transloadit_create_assembly` with your instructions and `expected_uploads: 1` (one per
+   file, at most 100 per call). The call returns right away, even with `wait_for_completion: true`,
+   because the Assembly now waits for those uploads.
+2. Each `upload_instructions` entry has the tus endpoint, the tus metadata (`assembly_url`,
+   `fieldname`) and a ready-to-run `curl` command. Set `FILE` to the file's path and run it in a
+   bash shell; it prints `201` once the file is uploaded (tus creation-with-upload, one request).
+3. Call `transloadit_wait_for_assembly` with the Assembly URL.
+
+The commands contain no credentials: the Assembly URL is the only capability, and it lets the holder
+add files to that one Assembly while it waits for uploads.
+
 ## Limits
 
 These limits apply to inline JSON/base64 payloads. For larger files, use a public URL or upload from
 your own machine with `npx -y @transloadit/node upload`.
 
-- Hosted default request body limit: **1 MB**
+- Hosted default request body limit: **1 MiB**
 - Hosted `maxBase64Bytes`: **512,000** decoded bytes
-- Self-hosted default request body limit: **10 MB** (configurable)
+- Self-hosted default request body limit: **10 MiB**
+
+Set `maxRequestBodyBytes` (handler option or JSON config key) to change the body limit; larger
+requests get HTTP 413 and are not buffered. Express apps that install their own body parser set
+its limit there.
+
+URL inputs that the server downloads (for templates that expect uploads) are capped at 1 GiB in
+total per call and 10 minutes per download, redirects included; set `maxUrlDownloadBytes` and
+`urlDownloadTimeoutMs` to change that. On the hosted
+endpoint the caller's token is checked with API2 before anything is downloaded.
 
 ## URL inputs and template behavior
 
@@ -329,7 +498,8 @@ but this does not enable private-network URL file downloads.
 - Disable via `metricsPath: false`.
 - Optional metrics basic auth via `TRANSLOADIT_MCP_METRICS_USER` +
   `TRANSLOADIT_MCP_METRICS_PASSWORD` or `metricsAuth`.
-- Public discovery endpoint at `/.well-known/mcp/server-card.json`.
+- Public discovery endpoint at `/.well-known/mcp/server-card.json`, listing every tool with its
+  annotations and security schemes and, in hosted mode, the OAuth resource metadata URL.
 
 ## MCP vs skills/CLI
 
@@ -388,7 +558,3 @@ corepack yarn --cwd packages/mcp-server test:e2e
 - Add or update tests with behavior changes.
 - Keep README and website docs aligned for user-facing behavior.
 - Open a PR in `transloadit/node-sdk`.
-
-### Roadmap
-
-- Next.js Claude Web flow to mint and hand off bearer tokens for MCP.

package/dist/cli.js

@@ -4,6 +4,7 @@ import { createServer } from 'node:http';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { createTransloaditMcpHttpHandler, createTransloaditMcpServer } from "./index.js";
 import { buildRedactor, getLogger } from "./logger.js";
+import { signatureAlgorithmSchema } from "./server.js";
 const printHelp = () => {
     process.stdout.write(`transloadit-mcp
 
@@ -14,7 +15,12 @@ Usage:
 Environment:
   TRANSLOADIT_KEY
   TRANSLOADIT_SECRET
+  TRANSLOADIT_SIGNATURE_ALGORITHM (sha1, sha256 or sha384; must match the Auth Key)
   TRANSLOADIT_MCP_TOKEN
+  TRANSLOADIT_MCP_RESOURCE_METADATA_URL
+  TRANSLOADIT_MCP_UPSTREAM_SECRET
+  TRANSLOADIT_MCP_RESULT_DOMAINS (comma-separated origins for result previews)
+  TRANSLOADIT_MCP_CONSOLE_URL
   TRANSLOADIT_ENDPOINT
   TRANSLOADIT_MCP_METRICS_PATH
   TRANSLOADIT_MCP_METRICS_USER
@@ -66,6 +72,25 @@ const parseArgs = (args) => {
     }
     return { command, config };
 };
+/** Reads the key/secret signature algorithm; an unknown value would only fail later per call. */
+const parseSignatureAlgorithm = (value) => {
+    if (value === undefined || value === '')
+        return undefined;
+    const parsed = signatureAlgorithmSchema.safeParse(value);
+    if (!parsed.success) {
+        throw new Error('TRANSLOADIT_SIGNATURE_ALGORITHM must be one of sha1, sha256 or sha384.');
+    }
+    return parsed.data;
+};
+/** Accepts a JSON array (config file) or a comma-separated string (environment). */
+const parseResultDomains = (value) => {
+    const entries = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : [];
+    const domains = entries
+        .filter((entry) => typeof entry === 'string')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    return domains.length > 0 ? domains : undefined;
+};
 const isLocalHost = (host) => host === '127.0.0.1' || host === 'localhost' || host === '::1';
 const loadConfig = async (configPath) => {
     if (!configPath) {
@@ -100,9 +125,17 @@ const main = async () => {
             process.env.TRANSLOADIT_MCP_METRICS_PASSWORD);
         const endpoint = (config.endpoint ?? fileConfig.endpoint ?? process.env.TRANSLOADIT_ENDPOINT);
         const mcpToken = (fileConfig.mcpToken ?? process.env.TRANSLOADIT_MCP_TOKEN);
+        const resourceMetadataUrl = (fileConfig.resourceMetadataUrl ??
+            process.env.TRANSLOADIT_MCP_RESOURCE_METADATA_URL);
+        const upstreamSecret = (fileConfig.upstreamSecret ??
+            process.env.TRANSLOADIT_MCP_UPSTREAM_SECRET);
+        const consoleUrl = (fileConfig.consoleUrl ?? process.env.TRANSLOADIT_MCP_CONSOLE_URL);
+        const signatureAlgorithm = parseSignatureAlgorithm(fileConfig.signatureAlgorithm ?? process.env.TRANSLOADIT_SIGNATURE_ALGORITHM);
+        const resultDomains = parseResultDomains(fileConfig.resultDomains ?? process.env.TRANSLOADIT_MCP_RESULT_DOMAINS);
         const clientSuffix = process.env.TRANSLOADIT_CLIENT_SUFFIX;
-        if (!isLocalHost(host) && !mcpToken) {
-            throw new Error('TRANSLOADIT_MCP_TOKEN is required when binding to non-localhost host.');
+        // Hosted mode delegates token checks to API2, so it may bind publicly without a static token.
+        if (!isLocalHost(host) && !mcpToken && !resourceMetadataUrl) {
+            throw new Error('TRANSLOADIT_MCP_TOKEN or TRANSLOADIT_MCP_RESOURCE_METADATA_URL is required when binding to a non-localhost host.');
         }
         const handler = await createTransloaditMcpHttpHandler({
             authKey: (fileConfig.authKey ?? process.env.TRANSLOADIT_KEY),
@@ -110,6 +143,15 @@ const main = async () => {
             endpoint,
             clientSuffix,
             mcpToken,
+            resourceMetadataUrl,
+            upstreamSecret,
+            // Validated by the handler, which refuses anything but positive integers.
+            maxRequestBodyBytes: fileConfig.maxRequestBodyBytes,
+            maxUrlDownloadBytes: fileConfig.maxUrlDownloadBytes,
+            urlDownloadTimeoutMs: fileConfig.urlDownloadTimeoutMs,
+            signatureAlgorithm,
+            resultDomains,
+            consoleUrl,
             allowedOrigins: fileConfig.allowedOrigins,
             allowedHosts: fileConfig.allowedHosts,
             enableDnsRebindingProtection: fileConfig.enableDnsRebindingProtection,
@@ -136,7 +178,10 @@ const main = async () => {
     const server = createTransloaditMcpServer({
         authKey: process.env.TRANSLOADIT_KEY,
         authSecret: process.env.TRANSLOADIT_SECRET,
+        signatureAlgorithm: parseSignatureAlgorithm(process.env.TRANSLOADIT_SIGNATURE_ALGORITHM),
+        resultDomains: parseResultDomains(process.env.TRANSLOADIT_MCP_RESULT_DOMAINS),
         endpoint: process.env.TRANSLOADIT_ENDPOINT,
+        consoleUrl: process.env.TRANSLOADIT_MCP_CONSOLE_URL,
         clientSuffix: process.env.TRANSLOADIT_CLIENT_SUFFIX,
     });
     const transport = new StdioServerTransport();
@@ -148,6 +193,7 @@ main().catch((err) => {
         process.env.TRANSLOADIT_KEY,
         process.env.TRANSLOADIT_SECRET,
         process.env.TRANSLOADIT_MCP_TOKEN,
+        process.env.TRANSLOADIT_MCP_UPSTREAM_SECRET,
     ]);
     logger.err('MCP server failed: %s', redact(err));
     process.exit(1);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAEhF,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AACxF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEtD,MAAM,SAAS,GAAG,GAAS,EAAE;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;CActB,CAAC,CAAA;AACF,CAAC,CAAA;AASD,MAAM,SAAS,GAAG,CAAC,IAAc,EAA0C,EAAE;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAA;IAClC,MAAM,MAAM,GAAc,EAAE,CAAA;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACjC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACxD,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YACjD,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACxD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/B,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACjD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC7B,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,IAAwB,EAAW,EAAE,CACxD,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAA;AAEhE,MAAM,UAAU,GAAG,KAAK,EAAE,UAAmB,EAAoC,EAAE;IACjF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAA;AACxD,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE3C,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7C,SAAS,EAAE,CAAA;QACX,OAAM;IACR,CAAC;IAED,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,IAAI,WAAW,CAAW,CAAA;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAI,UAAU,CAAC,IAA2B,IAAI,MAAM,CAAA;QAC9D,MAAM,WAAW,GACd,UAAU,CAAC,WAAkC,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;QAC5F,MAAM,iBAAiB,GAAG,UAAU,CAAC,WAExB,CAAA;QACb,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,WAAW;YACzC,iBAAiB,EAAE,QAAQ;YAC3B,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAuB,CAAA;QACjE,MAAM,eAAe,GAAG,CAAC,UAAU,CAAC,eAAe;YACjD,iBAAiB,EAAE,QAAQ;YAC3B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAuB,CAAA;QACrE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAE/E,CAAA;QACb,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAE7D,CAAA;QACb,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAA+C,CAAA;QAEhF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;QAC1F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;YACpD,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAuB;YAClF,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAuB;YAC3F,QAAQ;YACR,YAAY;YACZ,QAAQ;YACR,cAAc,EAAE,UAAU,CAAC,cAAsC;YACjE,YAAY,EAAE,UAAU,CAAC,YAAoC;YAC7D,4BAA4B,EAAE,UAAU,CAAC,4BAAmD;YAC5F,IAAI;YACJ,WAAW;YACX,WAAW,EACT,WAAW,IAAI,eAAe;gBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE;gBACtD,CAAC,CAAC,SAAS;YACf,MAAM;SACP,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QAEpC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,8CAA8C,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;QAElF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC,CAAA;QAED,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAChC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjC,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QACpC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC1C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;KACpD,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC,CAAA;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,qBAAqB;KAClC,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAEhF,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AACxF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAEtD,MAAM,SAAS,GAAG,GAAS,EAAE;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;CAmBtB,CAAC,CAAA;AACF,CAAC,CAAA;AASD,MAAM,SAAS,GAAG,CAAC,IAAc,EAA0C,EAAE;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAA;IAClC,MAAM,MAAM,GAAc,EAAE,CAAA;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACjC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACxD,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YACjD,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACxD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/B,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACjD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC7B,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC5B,CAAC,CAAA;AAED,iGAAiG;AACjG,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAqC,EAAE;IACpF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACzD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAwB,EAAE;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChG,MAAM,OAAO,GAAG,OAAO;SACpB,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACjD,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,IAAwB,EAAW,EAAE,CACxD,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAA;AAEhE,MAAM,UAAU,GAAG,KAAK,EAAE,UAAmB,EAAoC,EAAE;IACjF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAA;AACxD,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE3C,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7C,SAAS,EAAE,CAAA;QACX,OAAM;IACR,CAAC;IAED,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,IAAI,WAAW,CAAW,CAAA;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAI,UAAU,CAAC,IAA2B,IAAI,MAAM,CAAA;QAC9D,MAAM,WAAW,GACd,UAAU,CAAC,WAAkC,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;QAC5F,MAAM,iBAAiB,GAAG,UAAU,CAAC,WAExB,CAAA;QACb,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,WAAW;YACzC,iBAAiB,EAAE,QAAQ;YAC3B,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAuB,CAAA;QACjE,MAAM,eAAe,GAAG,CAAC,UAAU,CAAC,eAAe;YACjD,iBAAiB,EAAE,QAAQ;YAC3B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAuB,CAAA;QACrE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAE/E,CAAA;QACb,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAE7D,CAAA;QACb,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB;YACzD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAuB,CAAA;QAC1E,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC,cAAc;YAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAuB,CAAA;QACpE,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAEvE,CAAA;QACb,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,UAAU,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAC7E,CAAA;QACD,MAAM,aAAa,GAAG,kBAAkB,CACtC,UAAU,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CACvE,CAAA;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAA+C,CAAA;QAEhF,8FAA8F;QAC9F,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC;YACpD,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAuB;YAClF,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAuB;YAC3F,QAAQ;YACR,YAAY;YACZ,QAAQ;YACR,mBAAmB;YACnB,cAAc;YACd,0EAA0E;YAC1E,mBAAmB,EAAE,UAAU,CAAC,mBAAyC;YACzE,mBAAmB,EAAE,UAAU,CAAC,mBAAyC;YACzE,oBAAoB,EAAE,UAAU,CAAC,oBAA0C;YAC3E,kBAAkB;YAClB,aAAa;YACb,UAAU;YACV,cAAc,EAAE,UAAU,CAAC,cAAsC;YACjE,YAAY,EAAE,UAAU,CAAC,YAAoC;YAC7D,4BAA4B,EAAE,UAAU,CAAC,4BAAmD;YAC5F,IAAI;YACJ,WAAW;YACX,WAAW,EACT,WAAW,IAAI,eAAe;gBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE;gBACtD,CAAC,CAAC,SAAS;YACf,MAAM;SACP,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QAEpC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,8CAA8C,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;QAElF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC,CAAA;QAED,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAChC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjC,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,0BAA0B,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QACpC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC1C,kBAAkB,EAAE,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QACxF,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC7E,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC1C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACnD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;KACpD,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC,CAAA;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,+BAA+B;KAC5C,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAU1D,MAAM,MAAM,4BAA4B,GAAG,yBAAyB,GAAG;IACrE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,wBAAgB,iCAAiC,CAAC,OAAO,GAAE,4BAAiC,8CA4F3F"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAiB1D,MAAM,MAAM,4BAA4B,GAAG,yBAAyB,GAAG;IACrE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,wBAAgB,iCAAiC,CAAC,OAAO,GAAE,4BAAiC,8CAmG3F"}

package/dist/express.js

@@ -1,19 +1,26 @@
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
-import { isBasicAuthorized } from "./http-helpers.js";
+import { applyCorsHeaders, assertHttpOptions, corsAllowHeaders, isBasicAuthorized, rejectMissingBearerToken, resolveAllowedOrigins, } from "./http-helpers.js";
 import { getMetrics, getMetricsContentType } from "./metrics.js";
+import { createRequestTransport } from "./request-transport.js";
 import { createTransloaditMcpServer } from "./server.js";
 import { buildServerCard, serverCardPath } from "./server-card.js";
 export function createTransloaditMcpExpressRouter(options = {}) {
+    assertHttpOptions(options);
     const router = express.Router();
     const routePath = options.path ?? '/mcp';
     const metricsPath = options.metricsPath === false ? undefined : (options.metricsPath ?? '/metrics');
     const metricsAuth = options.metricsAuth;
-    const serverCardJson = JSON.stringify(buildServerCard(routePath, { authKey: options.authKey, authSecret: options.authSecret }));
+    // Explicit `allowedOrigins` or hosted mode add an Origin policy here; embedders own CORS otherwise.
+    const allowedOrigins = resolveAllowedOrigins(options);
+    const serverCardJson = JSON.stringify(buildServerCard(routePath, {
+        authKey: options.authKey,
+        authSecret: options.authSecret,
+        resourceMetadataUrl: options.resourceMetadataUrl,
+    }));
     const sendServerCard = (res, includeBody) => {
         res.setHeader('Access-Control-Allow-Origin', '*');
         res.setHeader('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID');
+        res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders);
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
         res.setHeader('Cache-Control', 'public, max-age=3600');
         res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -26,7 +33,7 @@ export function createTransloaditMcpExpressRouter(options = {}) {
     router.options(serverCardPath, (_req, res) => {
         res.setHeader('Access-Control-Allow-Origin', '*');
         res.setHeader('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID');
+        res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders);
         res.status(204).end();
     });
     router.get(serverCardPath, (_req, res) => {
@@ -36,6 +43,17 @@ export function createTransloaditMcpExpressRouter(options = {}) {
         sendServerCard(res, false);
     });
     router.all(routePath, async (req, res) => {
+        if (allowedOrigins) {
+            if (!applyCorsHeaders(req, res, allowedOrigins))
+                return;
+            if (req.method === 'OPTIONS') {
+                res.status(204).end();
+                return;
+            }
+        }
+        // Any unauthenticated hosted method gets the OAuth challenge, so GET-probing clients find API2.
+        if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl))
+            return;
         if (req.method !== 'POST') {
             res.status(405).json({
                 jsonrpc: '2.0',
@@ -44,19 +62,14 @@ export function createTransloaditMcpExpressRouter(options = {}) {
             });
             return;
         }
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            allowedOrigins: options.allowedOrigins,
-            allowedHosts: options.allowedHosts,
-            enableDnsRebindingProtection: options.enableDnsRebindingProtection,
-        });
+        const { transport, handle } = createRequestTransport(options);
         const server = createTransloaditMcpServer(options);
         res.on('close', () => {
             void transport.close();
             void server.close();
         });
         await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
+        await handle(req, res, req.body);
     });
     if (metricsPath) {
         router.get(metricsPath, async (req, res) => {