@ultimatelemon-eu/mcp-http 2.0.0 → 2.2.0

package/README.md

@@ -35,15 +35,15 @@ process.once('SIGTERM', () => {
 
 ## Options
 
-| Option            | Default     | Does                                                         |
-| ----------------- | ----------- | ------------------------------------------------------------ |
-| `createMcpServer` | required    | Returns a new `McpServer` per request, given `{ apiKey }`    |
-| `port`            | required    | `0` picks a free port; read it back from `.port`             |
-| `host`            | `'0.0.0.0'` | `'127.0.0.1'` keeps it local                                 |
-| `basePath`        | `''`        | Also serve `<basePath>/mcp` and `<basePath>/healthz`         |
-| `health`          | always ok   | Return `false` for a 503 on `/healthz`                       |
-| `apiKey`          | off         | Require the caller's key; `hint` is added to the 401 message |
-| `logger`          | silent      | Anything with `error(obj, msg)`, such as pino                |
+| Option            | Default     | Does                                                                          |
+| ----------------- | ----------- | ----------------------------------------------------------------------------- |
+| `createMcpServer` | required    | Returns a new `McpServer` per request, given `{ apiKey }`                     |
+| `port`            | required    | `0` picks a free port; read it back from `.port`                              |
+| `host`            | `'0.0.0.0'` | `'127.0.0.1'` keeps it local                                                  |
+| `basePath`        | `''`        | Also serve MCP on `<basePath>` and `<basePath>/mcp`, and `<basePath>/healthz` |
+| `health`          | always ok   | Return `false` for a 503 on `/healthz`                                        |
+| `apiKey`          | off         | Require the caller's key; `hint` is added to the 401 message                  |
+| `logger`          | silent      | Anything with `error(obj, msg)`, such as pino                                 |
 
 It returns `{ url, port, close() }`.
 
@@ -53,7 +53,8 @@ With `apiKey` set, every request to `/mcp` must carry the caller's own key for
 the upstream API, in `X-Api-Key` or as `Authorization: Bearer <key>`
 (`X-Api-Key` wins when both are present). Without one the server answers 401
 before building an MCP server. The key reaches `createMcpServer` as
-`apiKey`; it is never logged or stored.
+`apiKey`; it is never logged or stored. Other per-caller settings can travel
+as headers of their own, read from `headers` in the same context.
 
 This suits public servers where each user brings their own credentials: no
 OAuth, no sessions, no database. In claude.ai, add the connector with

package/dist/server.d.ts

@@ -6,6 +6,8 @@ export interface Logger {
 export interface RequestContext {
     /** The caller's own key for the upstream API. Set when `apiKey` is configured. */
     apiKey?: string;
+    /** Headers of the HTTP request, for per-caller settings beyond the key. */
+    headers: Headers;
 }
 export interface ApiKeyOptions {
     /** Added to the 401 message, e.g. where to get a key. */
@@ -17,7 +19,7 @@ export interface McpHttpOptions {
     port: number;
     /** Interface to listen on. Default `0.0.0.0`. */
     host?: string;
-    /** Prefix a proxy leaves on the path, e.g. `/ns`. Both `/mcp` and `<basePath>/mcp` are served. */
+    /** Prefix a proxy leaves on the path, e.g. `/ns`. MCP is served on `/mcp`, `<basePath>/mcp` and `<basePath>` itself. */
     basePath?: string;
     /** Readiness for `/healthz`; return false for a 503. Default: always ready. */
     health?: () => boolean | Promise<boolean>;

package/dist/server.js

@@ -77,10 +77,15 @@ export async function startMcpHttpServer(options) {
     const logger = options.logger ?? silent;
     const base = normalizeBasePath(options.basePath);
     const mcpPaths = new Set([`${base}/mcp`, '/mcp']);
+    if (base)
+        mcpPaths.add(base);
     const healthPaths = new Set([`${base}/healthz`, '/healthz']);
     // The key travels as pass-through authInfo, the SDK's channel from the
     // HTTP request to the per-request factory.
-    const mcpHandler = createMcpHandler(({ authInfo }) => options.createMcpServer(authInfo ? { apiKey: authInfo.token } : {}), {
+    const mcpHandler = createMcpHandler(({ authInfo, requestInfo }) => options.createMcpServer({
+        ...(authInfo ? { apiKey: authInfo.token } : {}),
+        headers: requestInfo?.headers ?? new Headers()
+    }), {
         onerror: (error) => {
             logger.error({ err: String(error) }, 'mcp request failed');
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimatelemon-eu/mcp-http",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "Run an MCP server over stateless Streamable HTTP: /mcp, /healthz, a base path for proxies, the caller's own API key per request, and errors that never leak a stack trace.",
   "license": "MIT",
   "repository": {