@ttoss/http-server-mcp 0.37.1 → 0.39.0

package/README.md

@@ -1114,6 +1114,28 @@ const call = await request(app.callback())
 expect(call.status).toBe(200);
 ```
 
+A `2026-07-28` request carries the per-request envelope in `params._meta` and must also send the `Mcp-Method` and `MCP-Protocol-Version` headers; the SDK answers `-32020` (headers and body disagree) at HTTP 400 when the version header is missing:
+
+```typescript
+const discover = await request(app.callback())
+  .post('/mcp')
+  .set('Content-Type', 'application/json')
+  .set('Accept', 'application/json, text/event-stream')
+  .set('Mcp-Method', 'server/discover')
+  .set('MCP-Protocol-Version', '2026-07-28')
+  .send({
+    jsonrpc: '2.0',
+    id: 3,
+    method: 'server/discover',
+    params: {
+      _meta: {
+        'io.modelcontextprotocol/protocolVersion': '2026-07-28',
+        'io.modelcontextprotocol/clientCapabilities': {},
+      },
+    },
+  });
+```
+
 ### `publicMethods` and OAuth clients
 
 `auth.publicMethods` defaults to `['initialize', 'server/discover']`: the lifecycle handshake is reachable without a token, nothing else is. There are two entries because the exemption is about _the handshake_, not the method name — `initialize` is the 2025-era handshake and `server/discover` its `2026-07-28` replacement, since that revision removed `initialize` outright. Naming only one leaves the other era unable to negotiate at all.

package/dist/index.cjs

@@ -782,7 +782,7 @@ var rankTools = ({
 };
 var summaryOf = tool => {
   const [line] = (tool.summary ?? tool.description).trim().split("\n", 1);
-  return line.length > SUMMARY_MAX_LENGTH ? `${line.slice(0, SUMMARY_MAX_LENGTH - 1).trimEnd()}…` : line;
+  return line.length > SUMMARY_MAX_LENGTH ? `${line.slice(0, 159).trimEnd()}…` : line;
 };
 var editDistance = (a, b) => {
   const row = Array.from({
@@ -956,14 +956,15 @@ var searchToolOf = ({
     },
     handler: async args => {
       const limit = args.limit ?? searchLimit;
+      const matches = await searchTools({
+        query: args.query,
+        tag: args.tag,
+        limit,
+        tools: visibleTools()
+      });
       return jsonResult({
         data: {
-          tools: (await searchTools({
-            query: args.query,
-            tag: args.tag,
-            limit,
-            tools: visibleTools()
-          })).slice(0, limit).map(tool => {
+          tools: matches.slice(0, limit).map(tool => {
             return {
               name: tool.name,
               summary: summaryOf(tool),
@@ -1716,13 +1717,13 @@ var createMcpRouter = (server, options = {}) => {
 //#endregion
 exports.DEFAULT_DESCRIPTION_LIMIT = DEFAULT_DESCRIPTION_LIMIT;
 exports.DEFAULT_INSTRUCTIONS_LIMIT = DEFAULT_INSTRUCTIONS_LIMIT;
-Object.defineProperty(exports, 'InMemoryServerEventBus', {
+Object.defineProperty(exports, "InMemoryServerEventBus", {
   enumerable: true,
   get: function () {
     return _modelcontextprotocol_server.InMemoryServerEventBus;
   }
 });
-Object.defineProperty(exports, 'McpServer', {
+Object.defineProperty(exports, "McpServer", {
   enumerable: true,
   get: function () {
     return _modelcontextprotocol_server.McpServer;
@@ -1745,7 +1746,7 @@ exports.measureMcpSurface = measureMcpSurface;
 exports.rankTools = rankTools;
 exports.registerAppResource = registerAppResource;
 exports.registerTools = registerTools;
-Object.defineProperty(exports, 'z', {
+Object.defineProperty(exports, "z", {
   enumerable: true,
   get: function () {
     return zod.z;

package/dist/index.d.cts

@@ -2,23 +2,22 @@
 /// <reference types="node" />
 import { CallToolResult, InMemoryServerEventBus, McpServer, McpServer as McpServer$1, McpServerFactory, RegisteredResource, ServerEvent, ServerEventBus, ServerEventBus as ServerEventBus$1, ServerNotifier, ServerNotifier as ServerNotifier$1, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 import { Router } from "@ttoss/http-server";
-import accepts from "accepts";
+import * as accepts from "accepts";
 import { AsyncLocalStorage } from "async_hooks";
-import Cookies from "cookies";
+import * as Cookies from "cookies";
 import { EventEmitter } from "events";
 import { IncomingHttpHeaders, IncomingMessage, OutgoingHttpHeaders, Server, ServerResponse } from "http";
 import { Http2ServerRequest, Http2ServerResponse } from "http2";
-import httpAssert from "http-assert";
-import contentDisposition from "content-disposition";
-import HttpErrors from "http-errors";
-import Keygrip from "keygrip";
-import compose from "koa-compose";
+import * as httpAssert from "http-assert";
+import * as contentDisposition from "content-disposition";
+import * as HttpErrors from "http-errors";
+import * as Keygrip from "keygrip";
+import * as compose from "koa-compose";
 import { ListenOptions, Socket } from "net";
 import { ParsedUrlQuery } from "querystring";
 import * as url from "url";
 import { Catalog } from "@ttoss/i18n-core";
 import { z } from "zod";
-
 //#region ../../node_modules/.pnpm/@types+koa@3.0.3/node_modules/@types/koa/index.d.ts
 declare interface ContextDelegatedRequest {
   /**
@@ -674,7 +673,7 @@ declare namespace Application {
  * `getIdentity<{ sub: string; email: string }>()` returns `T | undefined`.
  * Omitting the type parameter keeps the return type as `unknown | undefined`.
  */
-declare const getIdentity: <T = unknown>() => T | undefined;
+export declare const getIdentity: <T = unknown>() => T | undefined;
 /**
  * Returns the headers `getApiHeaders` produced for the current MCP request —
  * the same headers `apiCall` injects. Use it inside a tool handler that runs
@@ -683,13 +682,13 @@ declare const getIdentity: <T = unknown>() => T | undefined;
  *
  * Returns `{}` outside a request, or when `getApiHeaders` is not configured.
  */
-declare const getApiHeaders: () => Record<string, string>;
+export declare const getApiHeaders: () => Record<string, string>;
 /**
  * The `Accept-Language` header of the current MCP request, or `undefined`
  * outside a request or when the client sent none. The default locale source
  * for `createToolGate`'s `i18n` option.
  */
-declare const getRequestLocale: () => string | undefined;
+export declare const getRequestLocale: () => string | undefined;
 //#endregion
 //#region src/tool.d.ts
 /**
@@ -800,11 +799,7 @@ interface DefineToolParams extends Omit<Tool, 'handler'> {
  * });
  * ```
  */
-declare const defineTool: ({
-  method,
-  notFoundMessage,
-  ...tool
-}: DefineToolParams) => Tool;
+export declare const defineTool: ({ method, notFoundMessage, ...tool }: DefineToolParams) => Tool;
 //#endregion
 //#region src/toolSearch.d.ts
 /** What the deferred `search` ranks: one call, already narrowed to the visible tools. */
@@ -823,12 +818,7 @@ interface ToolSearchArgs {
  * weighted name > summary > tags > description, and breaks ties by the
  * tools' order. No index — a few hundred tools need none.
  */
-declare const rankTools: ({
-  query,
-  tag,
-  limit,
-  tools
-}: ToolSearchArgs) => Tool[];
+export declare const rankTools: ({ query, tag, limit, tools }: ToolSearchArgs) => Tool[];
 //#endregion
 //#region src/deferTools.d.ts
 /** How {@link registerTools} defers tools behind `search` / `describe` / `call`. */
@@ -957,12 +947,12 @@ type McpSurfaceViolation = {
  * (https://code.claude.com/docs/en/mcp; a user can change it with
  * `CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH`).
  */
-declare const DEFAULT_INSTRUCTIONS_LIMIT = 2048;
+export declare const DEFAULT_INSTRUCTIONS_LIMIT = 2048;
 /**
  * Claude Code truncates each tool description at the same length as the
  * instructions, from the same documentation, and just as silently.
  */
-declare const DEFAULT_DESCRIPTION_LIMIT = 2048;
+export declare const DEFAULT_DESCRIPTION_LIMIT = 2048;
 /**
  * Measures what an MCP server costs every session that connects to it: each
  * tool's name, description and input schema, and the instructions.
@@ -970,10 +960,7 @@ declare const DEFAULT_DESCRIPTION_LIMIT = 2048;
  * It does not judge; {@link checkMcpSurface} compares the same numbers with a
  * budget.
  */
-declare const measureMcpSurface: ({
-  tools,
-  instructions
-}: {
+export declare const measureMcpSurface: ({ tools, instructions }: {
   tools: McpSurfaceTool[];
   instructions?: string;
 }) => McpSurfaceReport;
@@ -995,11 +982,7 @@ declare const measureMcpSurface: ({
  * ).toEqual([]);
  * ```
  */
-declare const checkMcpSurface: ({
-  tools,
-  instructions,
-  budget
-}: {
+export declare const checkMcpSurface: ({ tools, instructions, budget }: {
   tools: McpSurfaceTool[];
   instructions?: string;
   budget?: McpSurfaceBudget;
@@ -1012,11 +995,7 @@ declare const checkMcpSurface: ({
  * Pass `pattern` (a global RegExp whose first group is the name) when the
  * instructions name tools some other way.
  */
-declare const findUnknownToolMentions: ({
-  instructions,
-  tools,
-  pattern
-}: {
+export declare const findUnknownToolMentions: ({ instructions, tools, pattern }: {
   instructions: string;
   tools: Array<Pick<McpSurfaceTool, "name">>;
   pattern?: RegExp;
@@ -1043,9 +1022,9 @@ declare const findUnknownToolMentions: ({
  * );
  * ```
  */
-declare const UI_EXTENSION_ID = "io.modelcontextprotocol/ui";
+export declare const UI_EXTENSION_ID = "io.modelcontextprotocol/ui";
 /** MIME type every MCP Apps HTML resource is served as. */
-declare const UI_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
+export declare const UI_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
 /**
  * Origins an app's view is allowed to reach, mapped by the host onto the
  * iframe's Content Security Policy. Anything not declared is blocked: an
@@ -1203,14 +1182,7 @@ interface RegisteredAppResource {
  * );
  * ```
  */
-declare const registerAppResource: ({
-  server,
-  name,
-  uri,
-  description,
-  html,
-  ui
-}: RegisterAppResourceParams) => RegisteredAppResource;
+export declare const registerAppResource: ({ server, name, uri, description, html, ui }: RegisterAppResourceParams) => RegisteredAppResource;
 //#endregion
 //#region src/registerTools.d.ts
 /** Parameters for {@link registerTools}. */
@@ -1258,11 +1230,7 @@ interface RegisterToolsParams {
  * registerTools({ server: deferredServer, tools, defer: true });
  * ```
  */
-declare const registerTools: ({
-  server,
-  tools,
-  defer
-}: RegisterToolsParams) => void;
+export declare const registerTools: ({ server, tools, defer }: RegisterToolsParams) => void;
 //#endregion
 //#region src/toolGate.d.ts
 /** Resolved identity for a gated tool call. */
@@ -1276,12 +1244,14 @@ type ToolIdentity = {
  * be both identity-aware and args-aware without multiple parameters.
  */
 type ToolCallContext = {
-  /** The resolved caller identity. */identity: ToolIdentity;
+  /** The resolved caller identity. */
+  identity: ToolIdentity;
   /**
    * The validated tool input. Arg-conditional gates read this to vary their
    * predicate per call.
    */
-  args: Record<string, unknown>; /** Tool name, for error attribution and gate labelling. */
+  args: Record<string, unknown>;
+  /** Tool name, for error attribution and gate labelling. */
   handler: string;
 };
 /** An authorization check. Throw to reject the call; return to continue. */
@@ -1401,19 +1371,12 @@ type ToolGate = (params: GateToolParams) => Tool;
  * });
  * ```
  */
-declare const createToolGate: ({
-  resolveIdentity,
-  gates,
-  enforceScope,
-  onError,
-  buildContext,
-  i18n
-}?: CreateToolGateOptions) => ToolGate;
+export declare const createToolGate: ({ resolveIdentity, gates, enforceScope, onError, buildContext, i18n }?: CreateToolGateOptions) => ToolGate;
 //#endregion
 //#region src/index.d.ts
 type Context$1 = Application.Context;
 /** Amazon Cognito user pool configuration for JWT verification. */
-interface CognitoUserPoolConfig {
+export interface CognitoUserPoolConfig {
   /** The Cognito User Pool ID (e.g. `us-east-1_abc123`). */
   userPoolId: string;
   /**
@@ -1429,7 +1392,7 @@ interface CognitoUserPoolConfig {
  * `@ttoss/http-server-auth`'s `oauth` strategy; supply either a Cognito user
  * pool or a custom `verifyToken`.
  */
-interface McpAuthOptions {
+export interface McpAuthOptions {
   /** Amazon Cognito user pool config; a `CognitoJwtVerifier` is built from it. */
   cognitoUserPool?: CognitoUserPoolConfig;
   /**
@@ -1561,11 +1524,11 @@ interface McpAuthOptions {
  * }
  * ```
  */
-declare const errorBodyMessage: (body: unknown) => string | undefined;
+export declare const errorBodyMessage: (body: unknown) => string | undefined;
 /**
  * Options for a single `apiCall` request.
  */
-interface ApiCallOptions {
+export interface ApiCallOptions {
   /**
    * JSON-serialisable request body. Automatically serialised and sent with
    * `Content-Type: application/json`.
@@ -1631,7 +1594,7 @@ interface ApiCallOptions {
  * });
  * ```
  */
-declare const apiCall: (method: string, url: string, options?: ApiCallOptions) => Promise<unknown>;
+export declare const apiCall: (method: string, url: string, options?: ApiCallOptions) => Promise<unknown>;
 /**
  * Asserts that the current request's token contains all required scopes.
  * Throws if any scope is missing — the MCP SDK catches this and returns a
@@ -1649,12 +1612,12 @@ declare const apiCall: (method: string, url: string, options?: ApiCallOptions) =
  * });
  * ```
  */
-declare const checkScopes: (required: string[]) => void;
+export declare const checkScopes: (required: string[]) => void;
 /**
  * The router {@link createMcpRouter} returns: a Koa router, plus the two
  * operations on the `2026-07-28` streams it serves.
  */
-type McpRouter = Router & {
+export type McpRouter = Router & {
   /**
    * Publishes the `list_changed` notifications (and `resources/updated`) to
    * every open `subscriptions/listen` stream that opted in. Call
@@ -1676,7 +1639,7 @@ type McpRouter = Router & {
 /**
  * Options for configuring the MCP router
  */
-interface McpRouterOptions {
+export interface McpRouterOptions {
   /**
    * The HTTP path where the MCP server will be mounted
    * @default '/mcp'
@@ -1851,6 +1814,6 @@ interface McpRouterOptions {
  * app.listen(3000);
  * ```
  */
-declare const createMcpRouter: (server: McpServer$1, options?: McpRouterOptions) => McpRouter;
+export declare const createMcpRouter: (server: McpServer$1, options?: McpRouterOptions) => McpRouter;
 //#endregion
-export { ApiCallOptions, CognitoUserPoolConfig, type CreateToolGateOptions, DEFAULT_DESCRIPTION_LIMIT, DEFAULT_INSTRUCTIONS_LIMIT, type DeferToolsOptions, type DefineToolParams, type GateToolParams, InMemoryServerEventBus, type JsonObjectSchema, McpAuthOptions, McpRouter, McpRouterOptions, McpServer, type McpSurfaceBudget, type McpSurfaceReport, type McpSurfaceTool, type McpSurfaceViolation, type RegisterAppResourceParams, type RegisterToolsParams, type RegisteredAppResource, type ServerEvent, type ServerEventBus, type ServerNotifier, type Tool, type ToolCallContext, type ToolCallGate, type ToolGate, type ToolIdentity, type ToolMetaParams, type ToolSchema, type ToolSearchArgs, UI_EXTENSION_ID, UI_RESOURCE_MIME_TYPE, type UiResourceCsp, type UiResourceMeta, type UiResourcePermissions, type UiToolVisibility, apiCall, checkMcpSurface, checkScopes, createMcpRouter, createToolGate, defineTool, errorBodyMessage, findUnknownToolMentions, getApiHeaders, getIdentity, getRequestLocale, measureMcpSurface, rankTools, registerAppResource, registerTools, z };
+export { type CreateToolGateOptions, type DeferToolsOptions, type DefineToolParams, type GateToolParams, InMemoryServerEventBus, type JsonObjectSchema, McpServer, type McpSurfaceBudget, type McpSurfaceReport, type McpSurfaceTool, type McpSurfaceViolation, type RegisterAppResourceParams, type RegisterToolsParams, type RegisteredAppResource, type ServerEvent, type ServerEventBus, type ServerNotifier, type Tool, type ToolCallContext, type ToolCallGate, type ToolGate, type ToolIdentity, type ToolMetaParams, type ToolSchema, type ToolSearchArgs, type UiResourceCsp, type UiResourceMeta, type UiResourcePermissions, type UiToolVisibility, z };

package/dist/index.d.mts

@@ -4,22 +4,21 @@ import { Router } from "@ttoss/http-server";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CallToolResult, InMemoryServerEventBus, McpServer, McpServer as McpServer$1, McpServerFactory, RegisteredResource, ServerEvent, ServerEventBus, ServerEventBus as ServerEventBus$1, ServerNotifier, ServerNotifier as ServerNotifier$1, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 import { z } from "zod";
-import accepts from "accepts";
+import * as accepts from "accepts";
 import { AsyncLocalStorage as AsyncLocalStorage$1 } from "async_hooks";
-import Cookies from "cookies";
+import * as Cookies from "cookies";
 import { EventEmitter } from "events";
 import { IncomingHttpHeaders, IncomingMessage, OutgoingHttpHeaders, Server, ServerResponse } from "http";
 import { Http2ServerRequest, Http2ServerResponse } from "http2";
-import httpAssert from "http-assert";
-import contentDisposition from "content-disposition";
-import HttpErrors from "http-errors";
-import Keygrip from "keygrip";
-import compose from "koa-compose";
+import * as httpAssert from "http-assert";
+import * as contentDisposition from "content-disposition";
+import * as HttpErrors from "http-errors";
+import * as Keygrip from "keygrip";
+import * as compose from "koa-compose";
 import { ListenOptions, Socket } from "net";
 import { ParsedUrlQuery } from "querystring";
 import * as url from "url";
 import { Catalog } from "@ttoss/i18n-core";
-
 //#region ../../node_modules/.pnpm/@types+koa@3.0.3/node_modules/@types/koa/index.d.ts
 declare interface ContextDelegatedRequest {
   /**
@@ -675,7 +674,7 @@ declare namespace Application {
  * `getIdentity<{ sub: string; email: string }>()` returns `T | undefined`.
  * Omitting the type parameter keeps the return type as `unknown | undefined`.
  */
-declare const getIdentity: <T = unknown>() => T | undefined;
+export declare const getIdentity: <T = unknown>() => T | undefined;
 /**
  * Returns the headers `getApiHeaders` produced for the current MCP request —
  * the same headers `apiCall` injects. Use it inside a tool handler that runs
@@ -684,13 +683,13 @@ declare const getIdentity: <T = unknown>() => T | undefined;
  *
  * Returns `{}` outside a request, or when `getApiHeaders` is not configured.
  */
-declare const getApiHeaders: () => Record<string, string>;
+export declare const getApiHeaders: () => Record<string, string>;
 /**
  * The `Accept-Language` header of the current MCP request, or `undefined`
  * outside a request or when the client sent none. The default locale source
  * for `createToolGate`'s `i18n` option.
  */
-declare const getRequestLocale: () => string | undefined;
+export declare const getRequestLocale: () => string | undefined;
 //#endregion
 //#region src/tool.d.ts
 /**
@@ -801,11 +800,7 @@ interface DefineToolParams extends Omit<Tool, 'handler'> {
  * });
  * ```
  */
-declare const defineTool: ({
-  method,
-  notFoundMessage,
-  ...tool
-}: DefineToolParams) => Tool;
+export declare const defineTool: ({ method, notFoundMessage, ...tool }: DefineToolParams) => Tool;
 //#endregion
 //#region src/toolSearch.d.ts
 /** What the deferred `search` ranks: one call, already narrowed to the visible tools. */
@@ -824,12 +819,7 @@ interface ToolSearchArgs {
  * weighted name > summary > tags > description, and breaks ties by the
  * tools' order. No index — a few hundred tools need none.
  */
-declare const rankTools: ({
-  query,
-  tag,
-  limit,
-  tools
-}: ToolSearchArgs) => Tool[];
+export declare const rankTools: ({ query, tag, limit, tools }: ToolSearchArgs) => Tool[];
 //#endregion
 //#region src/deferTools.d.ts
 /** How {@link registerTools} defers tools behind `search` / `describe` / `call`. */
@@ -958,12 +948,12 @@ type McpSurfaceViolation = {
  * (https://code.claude.com/docs/en/mcp; a user can change it with
  * `CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH`).
  */
-declare const DEFAULT_INSTRUCTIONS_LIMIT = 2048;
+export declare const DEFAULT_INSTRUCTIONS_LIMIT = 2048;
 /**
  * Claude Code truncates each tool description at the same length as the
  * instructions, from the same documentation, and just as silently.
  */
-declare const DEFAULT_DESCRIPTION_LIMIT = 2048;
+export declare const DEFAULT_DESCRIPTION_LIMIT = 2048;
 /**
  * Measures what an MCP server costs every session that connects to it: each
  * tool's name, description and input schema, and the instructions.
@@ -971,10 +961,7 @@ declare const DEFAULT_DESCRIPTION_LIMIT = 2048;
  * It does not judge; {@link checkMcpSurface} compares the same numbers with a
  * budget.
  */
-declare const measureMcpSurface: ({
-  tools,
-  instructions
-}: {
+export declare const measureMcpSurface: ({ tools, instructions }: {
   tools: McpSurfaceTool[];
   instructions?: string;
 }) => McpSurfaceReport;
@@ -996,11 +983,7 @@ declare const measureMcpSurface: ({
  * ).toEqual([]);
  * ```
  */
-declare const checkMcpSurface: ({
-  tools,
-  instructions,
-  budget
-}: {
+export declare const checkMcpSurface: ({ tools, instructions, budget }: {
   tools: McpSurfaceTool[];
   instructions?: string;
   budget?: McpSurfaceBudget;
@@ -1013,11 +996,7 @@ declare const checkMcpSurface: ({
  * Pass `pattern` (a global RegExp whose first group is the name) when the
  * instructions name tools some other way.
  */
-declare const findUnknownToolMentions: ({
-  instructions,
-  tools,
-  pattern
-}: {
+export declare const findUnknownToolMentions: ({ instructions, tools, pattern }: {
   instructions: string;
   tools: Array<Pick<McpSurfaceTool, "name">>;
   pattern?: RegExp;
@@ -1044,9 +1023,9 @@ declare const findUnknownToolMentions: ({
  * );
  * ```
  */
-declare const UI_EXTENSION_ID = "io.modelcontextprotocol/ui";
+export declare const UI_EXTENSION_ID = "io.modelcontextprotocol/ui";
 /** MIME type every MCP Apps HTML resource is served as. */
-declare const UI_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
+export declare const UI_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
 /**
  * Origins an app's view is allowed to reach, mapped by the host onto the
  * iframe's Content Security Policy. Anything not declared is blocked: an
@@ -1204,14 +1183,7 @@ interface RegisteredAppResource {
  * );
  * ```
  */
-declare const registerAppResource: ({
-  server,
-  name,
-  uri,
-  description,
-  html,
-  ui
-}: RegisterAppResourceParams) => RegisteredAppResource;
+export declare const registerAppResource: ({ server, name, uri, description, html, ui }: RegisterAppResourceParams) => RegisteredAppResource;
 //#endregion
 //#region src/registerTools.d.ts
 /** Parameters for {@link registerTools}. */
@@ -1259,11 +1231,7 @@ interface RegisterToolsParams {
  * registerTools({ server: deferredServer, tools, defer: true });
  * ```
  */
-declare const registerTools: ({
-  server,
-  tools,
-  defer
-}: RegisterToolsParams) => void;
+export declare const registerTools: ({ server, tools, defer }: RegisterToolsParams) => void;
 //#endregion
 //#region src/toolGate.d.ts
 /** Resolved identity for a gated tool call. */
@@ -1277,12 +1245,14 @@ type ToolIdentity = {
  * be both identity-aware and args-aware without multiple parameters.
  */
 type ToolCallContext = {
-  /** The resolved caller identity. */identity: ToolIdentity;
+  /** The resolved caller identity. */
+  identity: ToolIdentity;
   /**
    * The validated tool input. Arg-conditional gates read this to vary their
    * predicate per call.
    */
-  args: Record<string, unknown>; /** Tool name, for error attribution and gate labelling. */
+  args: Record<string, unknown>;
+  /** Tool name, for error attribution and gate labelling. */
   handler: string;
 };
 /** An authorization check. Throw to reject the call; return to continue. */
@@ -1402,19 +1372,12 @@ type ToolGate = (params: GateToolParams) => Tool;
  * });
  * ```
  */
-declare const createToolGate: ({
-  resolveIdentity,
-  gates,
-  enforceScope,
-  onError,
-  buildContext,
-  i18n
-}?: CreateToolGateOptions) => ToolGate;
+export declare const createToolGate: ({ resolveIdentity, gates, enforceScope, onError, buildContext, i18n }?: CreateToolGateOptions) => ToolGate;
 //#endregion
 //#region src/index.d.ts
 type Context$1 = Application.Context;
 /** Amazon Cognito user pool configuration for JWT verification. */
-interface CognitoUserPoolConfig {
+export interface CognitoUserPoolConfig {
   /** The Cognito User Pool ID (e.g. `us-east-1_abc123`). */
   userPoolId: string;
   /**
@@ -1430,7 +1393,7 @@ interface CognitoUserPoolConfig {
  * `@ttoss/http-server-auth`'s `oauth` strategy; supply either a Cognito user
  * pool or a custom `verifyToken`.
  */
-interface McpAuthOptions {
+export interface McpAuthOptions {
   /** Amazon Cognito user pool config; a `CognitoJwtVerifier` is built from it. */
   cognitoUserPool?: CognitoUserPoolConfig;
   /**
@@ -1562,11 +1525,11 @@ interface McpAuthOptions {
  * }
  * ```
  */
-declare const errorBodyMessage: (body: unknown) => string | undefined;
+export declare const errorBodyMessage: (body: unknown) => string | undefined;
 /**
  * Options for a single `apiCall` request.
  */
-interface ApiCallOptions {
+export interface ApiCallOptions {
   /**
    * JSON-serialisable request body. Automatically serialised and sent with
    * `Content-Type: application/json`.
@@ -1632,7 +1595,7 @@ interface ApiCallOptions {
  * });
  * ```
  */
-declare const apiCall: (method: string, url: string, options?: ApiCallOptions) => Promise<unknown>;
+export declare const apiCall: (method: string, url: string, options?: ApiCallOptions) => Promise<unknown>;
 /**
  * Asserts that the current request's token contains all required scopes.
  * Throws if any scope is missing — the MCP SDK catches this and returns a
@@ -1650,12 +1613,12 @@ declare const apiCall: (method: string, url: string, options?: ApiCallOptions) =
  * });
  * ```
  */
-declare const checkScopes: (required: string[]) => void;
+export declare const checkScopes: (required: string[]) => void;
 /**
  * The router {@link createMcpRouter} returns: a Koa router, plus the two
  * operations on the `2026-07-28` streams it serves.
  */
-type McpRouter = Router & {
+export type McpRouter = Router & {
   /**
    * Publishes the `list_changed` notifications (and `resources/updated`) to
    * every open `subscriptions/listen` stream that opted in. Call
@@ -1677,7 +1640,7 @@ type McpRouter = Router & {
 /**
  * Options for configuring the MCP router
  */
-interface McpRouterOptions {
+export interface McpRouterOptions {
   /**
    * The HTTP path where the MCP server will be mounted
    * @default '/mcp'
@@ -1852,6 +1815,6 @@ interface McpRouterOptions {
  * app.listen(3000);
  * ```
  */
-declare const createMcpRouter: (server: McpServer$1, options?: McpRouterOptions) => McpRouter;
+export declare const createMcpRouter: (server: McpServer$1, options?: McpRouterOptions) => McpRouter;
 //#endregion
-export { ApiCallOptions, CognitoUserPoolConfig, type CreateToolGateOptions, DEFAULT_DESCRIPTION_LIMIT, DEFAULT_INSTRUCTIONS_LIMIT, type DeferToolsOptions, type DefineToolParams, type GateToolParams, InMemoryServerEventBus, type JsonObjectSchema, McpAuthOptions, McpRouter, McpRouterOptions, McpServer, type McpSurfaceBudget, type McpSurfaceReport, type McpSurfaceTool, type McpSurfaceViolation, type RegisterAppResourceParams, type RegisterToolsParams, type RegisteredAppResource, type ServerEvent, type ServerEventBus, type ServerNotifier, type Tool, type ToolCallContext, type ToolCallGate, type ToolGate, type ToolIdentity, type ToolMetaParams, type ToolSchema, type ToolSearchArgs, UI_EXTENSION_ID, UI_RESOURCE_MIME_TYPE, type UiResourceCsp, type UiResourceMeta, type UiResourcePermissions, type UiToolVisibility, apiCall, checkMcpSurface, checkScopes, createMcpRouter, createToolGate, defineTool, errorBodyMessage, findUnknownToolMentions, getApiHeaders, getIdentity, getRequestLocale, measureMcpSurface, rankTools, registerAppResource, registerTools, z };
+export { type CreateToolGateOptions, type DeferToolsOptions, type DefineToolParams, type GateToolParams, InMemoryServerEventBus, type JsonObjectSchema, McpServer, type McpSurfaceBudget, type McpSurfaceReport, type McpSurfaceTool, type McpSurfaceViolation, type RegisterAppResourceParams, type RegisterToolsParams, type RegisteredAppResource, type ServerEvent, type ServerEventBus, type ServerNotifier, type Tool, type ToolCallContext, type ToolCallGate, type ToolGate, type ToolIdentity, type ToolMetaParams, type ToolSchema, type ToolSearchArgs, type UiResourceCsp, type UiResourceMeta, type UiResourcePermissions, type UiToolVisibility, z };

package/dist/index.mjs

@@ -779,7 +779,7 @@ var rankTools = ({
 };
 var summaryOf = tool => {
   const [line] = (tool.summary ?? tool.description).trim().split("\n", 1);
-  return line.length > SUMMARY_MAX_LENGTH ? `${line.slice(0, SUMMARY_MAX_LENGTH - 1).trimEnd()}…` : line;
+  return line.length > SUMMARY_MAX_LENGTH ? `${line.slice(0, 159).trimEnd()}…` : line;
 };
 var editDistance = (a, b) => {
   const row = Array.from({
@@ -953,14 +953,15 @@ var searchToolOf = ({
     },
     handler: async args => {
       const limit = args.limit ?? searchLimit;
+      const matches = await searchTools({
+        query: args.query,
+        tag: args.tag,
+        limit,
+        tools: visibleTools()
+      });
       return jsonResult({
         data: {
-          tools: (await searchTools({
-            query: args.query,
-            tag: args.tag,
-            limit,
-            tools: visibleTools()
-          })).slice(0, limit).map(tool => {
+          tools: matches.slice(0, limit).map(tool => {
             return {
               name: tool.name,
               summary: summaryOf(tool),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-mcp",
-  "version": "0.37.1",
+  "version": "0.39.0",
   "description": "Model Context Protocol (MCP) server integration for @ttoss/http-server",
   "keywords": [
     "ai",
@@ -35,20 +35,20 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/node": "^2.1.1",
-    "@modelcontextprotocol/server": "^2.0.0",
-    "zod": "^4.4.3",
-    "@ttoss/auth-core": "^0.18.0",
-    "@ttoss/http-server-auth": "^0.9.0",
-    "@ttoss/i18n-core": "^0.8.1",
-    "@ttoss/http-server": "^0.13.1"
+    "@modelcontextprotocol/server": "^2.3.1",
+    "zod": "^4.6.7",
+    "@ttoss/http-server": "^0.14.1",
+    "@ttoss/i18n-core": "^0.9.1",
+    "@ttoss/http-server-auth": "^0.10.1",
+    "@ttoss/auth-core": "^0.20.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.3.1",
     "@types/koa": "^3.0.3",
-    "jest": "^30.4.2",
-    "supertest": "^7.2.2",
-    "tsdown": "^0.22.2",
-    "@ttoss/config": "^1.41.0"
+    "jest": "^30.5.2",
+    "supertest": "^7.3.1",
+    "tsdown": "^0.23.1",
+    "@ttoss/config": "^3.0.0"
   },
   "publishConfig": {
     "access": "public",