@ultimatelemon-eu/mcp-http 2.1.0 → 2.2.0

package/README.md

@@ -53,7 +53,8 @@ With `apiKey` set, every request to `/mcp` must carry the caller's own key for
 the upstream API, in `X-Api-Key` or as `Authorization: Bearer <key>`
 (`X-Api-Key` wins when both are present). Without one the server answers 401
 before building an MCP server. The key reaches `createMcpServer` as
-`apiKey`; it is never logged or stored.
+`apiKey`; it is never logged or stored. Other per-caller settings can travel
+as headers of their own, read from `headers` in the same context.
 
 This suits public servers where each user brings their own credentials: no
 OAuth, no sessions, no database. In claude.ai, add the connector with

package/dist/server.d.ts

@@ -6,6 +6,8 @@ export interface Logger {
 export interface RequestContext {
     /** The caller's own key for the upstream API. Set when `apiKey` is configured. */
     apiKey?: string;
+    /** Headers of the HTTP request, for per-caller settings beyond the key. */
+    headers: Headers;
 }
 export interface ApiKeyOptions {
     /** Added to the 401 message, e.g. where to get a key. */

package/dist/server.js

@@ -82,7 +82,10 @@ export async function startMcpHttpServer(options) {
     const healthPaths = new Set([`${base}/healthz`, '/healthz']);
     // The key travels as pass-through authInfo, the SDK's channel from the
     // HTTP request to the per-request factory.
-    const mcpHandler = createMcpHandler(({ authInfo }) => options.createMcpServer(authInfo ? { apiKey: authInfo.token } : {}), {
+    const mcpHandler = createMcpHandler(({ authInfo, requestInfo }) => options.createMcpServer({
+        ...(authInfo ? { apiKey: authInfo.token } : {}),
+        headers: requestInfo?.headers ?? new Headers()
+    }), {
         onerror: (error) => {
             logger.error({ err: String(error) }, 'mcp request failed');
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimatelemon-eu/mcp-http",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Run an MCP server over stateless Streamable HTTP: /mcp, /healthz, a base path for proxies, the caller's own API key per request, and errors that never leak a stack trace.",
   "license": "MIT",
   "repository": {