@upload-post/mcp 0.3.0

package/dist/tools/upload_studio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload_studio.js","sourceRoot":"","sources":["../../src/tools/upload_studio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,iBAAiB,GAAG,2CAA2C,CAAC;AACtE,MAAM,aAAa,GAAG,CACpB,OAAO,CAAC,GAAG,CAAC,yBAAyB;IACrC,OAAO,CAAC,GAAG,CAAC,YAAY;IACxB,6BAA6B,CAC9B,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrB,MAAM,0BAA0B,GAAG;IACjC,mEAAmE;IACnE,8FAA8F;IAC9F,mEAAmE;IACnE,8FAA8F;CAC/F,CAAC;AACF,MAAM,kBAAkB,GAAG,CACzB,OAAO,CAAC,GAAG,CAAC,8BAA8B;IAC1C,OAAO,CAAC,GAAG,CAAC,6BAA6B;IACzC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CACrC;KACE,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;KACjD,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7D,MAAM,YAAY,GAAG;IACnB,EAAE,EAAE;QACF,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,aAAa;QACrB,GAAG,EAAE;YACH,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,EAAE;SACpB;KACF;IACD,0BAA0B,EACxB,wHAAwH;IAC1H,4BAA4B,EAAE,IAAI;IAClC,qBAAqB,EAAE,aAAa;IACpC,kBAAkB,EAAE;QAClB,eAAe,EAAE,kBAAkB;QACnC,gBAAgB,EAAE,EAAE;KACrB;CACF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IACpD,MAAM,CAAC,gBAAgB,CACrB,iCAAiC,EACjC,iBAAiB,EACjB;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,mEAAmE;QAChF,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,YAAY;KACpB,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,qBAAqB;gBAC/B,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,YAAY;aACpB;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,ibAAib;QACnb,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YACrF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YACzF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAClF,kBAAkB,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC7D,sCAAsC,CACvC;SACF;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;YACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;YACxB,kBAAkB,EAAE,uBAAuB;SAC5C;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;SACvB;QACD,KAAK,EAAE;YACL,EAAE,EAAE;gBACF,WAAW,EAAE,iBAAiB;gBAC9B,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;aAC7B;YACD,uBAAuB,EAAE,iBAAiB;YAC1C,yBAAyB,EAAE,IAAI;YAC/B,gCAAgC,EAAE,wBAAwB;YAC1D,+BAA+B,EAAE,sBAAsB;SACxD;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,IAOb,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QACrD,OAAO;YACL,iBAAiB,EAAE;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBACpE,KAAK;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;gBACvC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;gBACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,OAAO;aACxD;YACD,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oCAAoC;iBAC3C;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2rBjB,CAAC"}

package/dist/tools/users.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { UploadPostMcpClient } from "../client.js";
+export declare function registerUserTools(server: McpServer, client: UploadPostMcpClient): void;
+//# sourceMappingURL=users.d.ts.map

package/dist/tools/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/tools/users.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAIxD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CA2HtF"}

package/dist/tools/users.js

@@ -0,0 +1,95 @@
+import { z } from "zod";
+import { compact } from "../client.js";
+import { genericResultOutputSchema, safe } from "../schemas.js";
+export function registerUserTools(server, client) {
+    server.registerTool("get_account_info", {
+        title: "Validate API key & get account",
+        description: "Validate the current API key and return account information. Useful as a first call to confirm credentials before doing real work.",
+        inputSchema: {},
+        outputSchema: genericResultOutputSchema,
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: false,
+            destructiveHint: false,
+        },
+    }, safe(async () => client.request("GET", "/uploadposts/me")));
+    server.registerTool("list_users", {
+        title: "List profiles",
+        description: "List all Upload-Post profiles in the account, with their connected social accounts.",
+        inputSchema: {},
+        outputSchema: genericResultOutputSchema,
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: false,
+            destructiveHint: false,
+        },
+    }, safe(async () => client.sdk.listUsers()));
+    server.registerTool("create_user", {
+        title: "Create profile",
+        description: "Create a new Upload-Post profile (logical container for connected socials).",
+        inputSchema: {
+            username: z.string(),
+        },
+        outputSchema: genericResultOutputSchema,
+        annotations: {
+            readOnlyHint: false,
+            openWorldHint: false,
+            destructiveHint: false,
+        },
+    }, safe(async ({ username }) => client.sdk.createUser(username)));
+    server.registerTool("delete_user", {
+        title: "Delete profile",
+        description: "Permanently delete a profile and disconnect its socials.",
+        inputSchema: {
+            username: z.string(),
+        },
+        outputSchema: genericResultOutputSchema,
+        annotations: {
+            readOnlyHint: false,
+            openWorldHint: false,
+            destructiveHint: true,
+        },
+    }, safe(async ({ username }) => client.sdk.deleteUser(username)));
+    server.registerTool("generate_jwt", {
+        title: "Generate platform-integration JWT",
+        description: "Generate a JWT + connection URL so an end-user can connect socials inside an embedded Upload-Post flow (white-label integration).",
+        inputSchema: {
+            username: z.string(),
+            redirectUrl: z.string().optional(),
+            logoImage: z.string().optional(),
+            redirectButtonText: z.string().optional(),
+            platforms: z.array(z.string()).optional(),
+            showCalendar: z.boolean().optional(),
+            readonlyCalendar: z.boolean().optional(),
+            connectTitle: z.string().optional(),
+            connectDescription: z.string().optional(),
+            language: z
+                .enum(["en", "es", "de", "fr", "pt"])
+                .optional()
+                .describe("Force the connection page language for this profile. When omitted, the page auto-detects the visitor's browser language and falls back to English."),
+        },
+        outputSchema: genericResultOutputSchema,
+        annotations: {
+            readOnlyHint: false,
+            openWorldHint: false,
+            destructiveHint: false,
+        },
+    }, safe(async (args) => {
+        const { username, ...rest } = args;
+        return client.sdk.generateJwt(username, compact(rest));
+    }));
+    server.registerTool("validate_jwt", {
+        title: "Validate platform-integration JWT",
+        description: "Verify a JWT previously issued by `generate_jwt`.",
+        inputSchema: {
+            jwt: z.string(),
+        },
+        outputSchema: genericResultOutputSchema,
+        annotations: {
+            readOnlyHint: true,
+            openWorldHint: false,
+            destructiveHint: false,
+        },
+    }, safe(async ({ jwt }) => client.sdk.validateJwt(jwt)));
+}
+//# sourceMappingURL=users.js.map

package/dist/tools/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/tools/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAEhE,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAA2B;IAC9E,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,oIAAoI;QACtI,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;SACvB;KACF,EACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAC3D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,qFAAqF;QAClG,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;SACvB;KACF,EACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CACzC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,6EAA6E;QAC1F,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;SACrB;QACD,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;SACvB;KACF,EACD,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAkB,CAAC,CAAC,CACxE,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,0DAA0D;QACvE,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;SACrB;QACD,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,IAAI;SACtB;KACF,EACD,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAkB,CAAC,CAAC,CACxE,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,mIAAmI;QACrI,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACzC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACzC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACzC,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;iBACpC,QAAQ,EAAE;iBACV,QAAQ,CACP,oJAAoJ,CACrJ;SACJ;QACD,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;SACvB;KACF,EACD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAkD,CAAC;QACjF,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAU,CAAC,CAAC;IAClE,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EAAE,mDAAmD;QAChE,WAAW,EAAE;YACX,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB;QACD,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;SACvB;KACF,EACD,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,GAAa,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC"}

package/dist/transport/http.d.ts

@@ -0,0 +1,33 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { UploadPostMcpClient } from "../client.js";
+export interface HttpOptions {
+    port: number;
+    /** Optional override for upstream Upload-Post base URL. */
+    baseUrl?: string;
+    /**
+     * Factory that turns a freshly-built per-session `UploadPostMcpClient` into
+     * an `McpServer` with the tools registered. Injected so transport stays
+     * unaware of which tools exist.
+     */
+    buildServer: (client: UploadPostMcpClient) => McpServer;
+}
+/**
+ * Multi-tenant streamable-HTTP host.
+ *
+ * Each MCP session owns:
+ *   - one Upload-Post API key (either pasted directly via `Authorization:
+ *     ApiKey/Bearer <key>`, or resolved from an OAuth `Bearer up_oauth_...`
+ *     access token via upstream introspection),
+ *   - one `UploadPostMcpClient` bound to that key,
+ *   - one `McpServer` with tools that close over that client.
+ *
+ * Subsequent requests on the same session route to the same transport via the
+ * `mcp-session-id` header. Closing the transport drops the session from the
+ * map so the per-user state can be GC'd.
+ *
+ * The server itself stores nothing permanently — keys live only inside the
+ * in-memory client of the session that received them. The OAuth introspection
+ * cache is a TTL'd lookup table keyed by SHA-256(token), not raw plaintexts.
+ */
+export declare function runHttp(opts: HttpOptions): Promise<void>;
+//# sourceMappingURL=http.d.ts.map

package/dist/transport/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transport/http.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAenD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,SAAS,CAAC;CACzD;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA4I9D"}

package/dist/transport/http.js

@@ -0,0 +1,263 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { UploadPostMcpClient } from "../client.js";
+import { loadOAuthConfig } from "../oauth/config.js";
+import { authorizationServerMetadata, protectedResourceMetadata, serveJson, } from "../oauth/metadata.js";
+import { handleRegistration } from "../oauth/registration.js";
+import { handleAuthorize } from "../oauth/authorize.js";
+import { handleToken, handleRevoke } from "../oauth/tokens.js";
+import { UpstreamOAuthClient } from "../oauth/upstream_client.js";
+import { IntrospectCache } from "../oauth/introspect_cache.js";
+import { resolveAuth } from "../oauth/auth_resolver.js";
+const OPENAI_APPS_CHALLENGE_PATH = "/.well-known/openai-apps-challenge";
+// Glama directory ownership verification. Glama claims a connector by fetching
+// /.well-known/glama.json from the server's domain and matching a maintainer
+// email. Override the email via GLAMA_MAINTAINER_EMAIL if needed.
+const GLAMA_WELL_KNOWN_PATH = "/.well-known/glama.json";
+const GLAMA_MAINTAINER_EMAIL = process.env.GLAMA_MAINTAINER_EMAIL ?? "jc.caverogracia@gmail.com";
+const DEFAULT_OPENAI_APPS_CHALLENGE_TOKEN = "9O0B9c5XudnvLv1et2HdZ9WG2_H85jGPciJ7c8QBHjY";
+/**
+ * Multi-tenant streamable-HTTP host.
+ *
+ * Each MCP session owns:
+ *   - one Upload-Post API key (either pasted directly via `Authorization:
+ *     ApiKey/Bearer <key>`, or resolved from an OAuth `Bearer up_oauth_...`
+ *     access token via upstream introspection),
+ *   - one `UploadPostMcpClient` bound to that key,
+ *   - one `McpServer` with tools that close over that client.
+ *
+ * Subsequent requests on the same session route to the same transport via the
+ * `mcp-session-id` header. Closing the transport drops the session from the
+ * map so the per-user state can be GC'd.
+ *
+ * The server itself stores nothing permanently — keys live only inside the
+ * in-memory client of the session that received them. The OAuth introspection
+ * cache is a TTL'd lookup table keyed by SHA-256(token), not raw plaintexts.
+ */
+export async function runHttp(opts) {
+    const sessions = new Map();
+    const oauthCfg = loadOAuthConfig();
+    const upstream = new UpstreamOAuthClient(oauthCfg);
+    const introspectCache = new IntrospectCache(oauthCfg.introspectCacheTtlMs);
+    const authDeps = { cfg: oauthCfg, upstream, cache: introspectCache };
+    const httpServer = createServer(async (req, res) => {
+        const url = req.url ?? "";
+        const method = req.method ?? "GET";
+        // ----- ChatGPT Apps domain verification -----------------------------
+        // This must be reachable publicly before Origin validation because the
+        // OpenAI verifier may include its own browser/developer-console Origin.
+        if (isOpenAiAppsChallengePath(url)) {
+            if (method === "OPTIONS") {
+                return sendOpenAiAppsChallengeOptions(res);
+            }
+            if (method === "GET" || method === "HEAD") {
+                return sendOpenAiAppsChallenge(res, method);
+            }
+            res.statusCode = 405;
+            res.setHeader("allow", "GET, HEAD, OPTIONS");
+            res.end("Method Not Allowed");
+            return;
+        }
+        // ----- Glama directory ownership verification -----------------------
+        // Served publicly (before Origin validation) so Glama's verifier can fetch
+        // it. Static file matching the connector.json schema with our maintainer.
+        if (method === "GET" && url === GLAMA_WELL_KNOWN_PATH) {
+            return serveJson(res, {
+                $schema: "https://glama.ai/mcp/schemas/connector.json",
+                maintainers: [{ email: GLAMA_MAINTAINER_EMAIL }],
+            });
+        }
+        // ----- Defense-in-depth: Origin validation --------------------------
+        // The MCP spec recommends rejecting requests whose `Origin` header (when
+        // present) is not on a known allow-list, to prevent DNS-rebinding attacks
+        // against agents that connect from a browser. Server-to-server callers
+        // (claude.ai backend, curl, etc.) typically omit the header — those pass
+        // through unchanged. Bearer/ApiKey auth on /mcp remains the primary gate.
+        if (!isOriginAllowed(req.headers["origin"])) {
+            res.statusCode = 403;
+            res.setHeader("content-type", "application/json");
+            res.end(JSON.stringify({ error: "origin_not_allowed" }));
+            return;
+        }
+        // ----- Liveness ------------------------------------------------------
+        if (method === "GET" && (url === "/healthz" || url === "/health")) {
+            res.statusCode = 200;
+            res.setHeader("content-type", "application/json");
+            res.end(JSON.stringify({ ok: true, oauth: oauthCfg.enabled }));
+            return;
+        }
+        // ----- OAuth surface (only if configured) ----------------------------
+        if (oauthCfg.enabled) {
+            if (method === "GET" && url === "/.well-known/oauth-protected-resource") {
+                return serveJson(res, protectedResourceMetadata(oauthCfg));
+            }
+            if (method === "GET" && url === "/.well-known/oauth-authorization-server") {
+                return serveJson(res, authorizationServerMetadata(oauthCfg));
+            }
+            if (method === "POST" && url === "/register") {
+                return handleRegistration(req, res);
+            }
+            if (method === "GET" && url.startsWith("/authorize")) {
+                return handleAuthorize(req, res, oauthCfg);
+            }
+            if (method === "POST" && url === "/token") {
+                return handleToken(req, res, upstream);
+            }
+            if (method === "POST" && url === "/revoke") {
+                return handleRevoke(req, res, upstream, introspectCache);
+            }
+        }
+        // ----- MCP -----------------------------------------------------------
+        if (url !== "/mcp") {
+            res.statusCode = 404;
+            res.end("Not Found");
+            return;
+        }
+        const sessionId = req.headers["mcp-session-id"];
+        let session = sessionId ? sessions.get(sessionId) : undefined;
+        if (!session) {
+            const resolution = await resolveAuth(req.headers["authorization"], authDeps);
+            if (!resolution) {
+                return sendUnauthorized(res, oauthCfg.enabled, oauthCfg.issuer);
+            }
+            const client = new UploadPostMcpClient({ apiKey: resolution.apiKey, baseUrl: opts.baseUrl });
+            const server = opts.buildServer(client);
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: (id) => {
+                    sessions.set(id, { transport, server });
+                },
+            });
+            transport.onclose = () => {
+                if (transport.sessionId)
+                    sessions.delete(transport.sessionId);
+            };
+            await server.connect(transport);
+            session = { transport, server };
+        }
+        let body = undefined;
+        if (method === "POST") {
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            const raw = Buffer.concat(chunks).toString("utf8");
+            if (raw.length) {
+                try {
+                    body = JSON.parse(raw);
+                }
+                catch {
+                    res.statusCode = 400;
+                    res.end("Invalid JSON");
+                    return;
+                }
+            }
+        }
+        await session.transport.handleRequest(req, res, body);
+    });
+    await new Promise((resolve) => {
+        httpServer.listen(opts.port, () => {
+            process.stderr.write(`[upload-post-mcp] streamable HTTP listening on http://0.0.0.0:${opts.port}/mcp ` +
+                `(auth: ApiKey/Bearer header${oauthCfg.enabled ? " + OAuth 2.1 (PKCE+DCR)" : ""})\n`);
+            resolve();
+        });
+    });
+}
+/**
+ * 401 with both a legacy `ApiKey` challenge and (when OAuth is enabled) the
+ * `Bearer resource_metadata=...` challenge that claude.ai needs to discover
+ * the authorization server. Sending BOTH keeps the existing API-key flow
+ * working and unlocks the OAuth Custom-Connector flow on the same endpoint.
+ */
+function sendUnauthorized(res, oauthEnabled, issuer) {
+    const challenges = [];
+    if (oauthEnabled) {
+        challenges.push(`Bearer realm="upload-post", resource_metadata="${issuer}/.well-known/oauth-protected-resource"`);
+    }
+    challenges.push('ApiKey realm="upload-post"');
+    res.statusCode = 401;
+    res.setHeader("www-authenticate", challenges.join(", "));
+    res.setHeader("content-type", "application/json");
+    res.end(JSON.stringify({
+        error: "Missing or malformed Authorization header. Send 'Authorization: ApiKey <your_upload_post_api_key>' (or 'Bearer <key>'). Get your key at https://app.upload-post.com" +
+            (oauthEnabled
+                ? " — or connect via OAuth from a Custom Connector–capable client (e.g. claude.ai)."
+                : ""),
+    }));
+}
+function requestPath(url) {
+    const queryStart = url.indexOf("?");
+    return queryStart >= 0 ? url.slice(0, queryStart) : url;
+}
+function isOpenAiAppsChallengePath(url) {
+    const path = requestPath(url).replace(/\/+$/, "");
+    return path === OPENAI_APPS_CHALLENGE_PATH;
+}
+function openAiAppsChallengeToken() {
+    return (process.env.OPENAI_APPS_CHALLENGE_TOKEN?.trim() ||
+        DEFAULT_OPENAI_APPS_CHALLENGE_TOKEN);
+}
+function setOpenAiAppsChallengeHeaders(res) {
+    res.setHeader("access-control-allow-origin", "*");
+    res.setHeader("access-control-allow-methods", "GET, HEAD, OPTIONS");
+    res.setHeader("access-control-allow-headers", "*");
+    res.setHeader("cache-control", "no-store");
+    res.setHeader("vary", "Origin");
+}
+function sendOpenAiAppsChallengeOptions(res) {
+    res.statusCode = 204;
+    setOpenAiAppsChallengeHeaders(res);
+    res.end();
+}
+function sendOpenAiAppsChallenge(res, method) {
+    const token = openAiAppsChallengeToken();
+    res.statusCode = 200;
+    setOpenAiAppsChallengeHeaders(res);
+    res.setHeader("content-type", "text/plain; charset=utf-8");
+    res.setHeader("content-length", Buffer.byteLength(token));
+    res.end(method === "HEAD" ? undefined : token);
+}
+/**
+ * Allow-list of Origins permitted to call this server from a browser context.
+ * Augmented via the OAUTH_EXTRA_ALLOWED_ORIGINS env var (comma-separated)
+ * for self-hosters that front the server with their own dashboard origin.
+ *
+ * Requests WITHOUT an Origin header (server-to-server: claude.ai backend,
+ * curl, MCP stdio bridges, etc.) are allowed through — Origin only ships
+ * from browsers, where the DNS-rebinding risk lives.
+ */
+function isOriginAllowed(origin) {
+    if (!origin || Array.isArray(origin))
+        return true;
+    const value = origin.trim();
+    if (!value)
+        return true;
+    const defaults = new Set([
+        "https://claude.ai",
+        "https://claude.com",
+        "https://www.claude.ai",
+        "https://chatgpt.com",
+        "https://chat.openai.com",
+        "https://app.upload-post.com",
+        "http://localhost",
+        "http://127.0.0.1",
+    ]);
+    for (const extra of (process.env.OAUTH_EXTRA_ALLOWED_ORIGINS ?? "").split(",")) {
+        const trimmed = extra.trim();
+        if (trimmed)
+            defaults.add(trimmed);
+    }
+    if (defaults.has(value))
+        return true;
+    // Allow any localhost / 127.0.0.1 port combination for local dev.
+    try {
+        const url = new URL(value);
+        if (url.hostname === "localhost" || url.hostname === "127.0.0.1")
+            return true;
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+//# sourceMappingURL=http.js.map

package/dist/transport/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/transport/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAmC,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAmBxD,MAAM,0BAA0B,GAAG,oCAAoC,CAAC;AAExE,+EAA+E;AAC/E,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,2BAA2B,CAAC;AACjG,MAAM,mCAAmC,GAAG,6CAA6C,CAAC;AAE1F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE5C,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAErE,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAClF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,8BAA8B,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7C,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,OAAO,EAAE,6CAA6C;gBACtD,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,uCAAuC,EAAE,CAAC;gBACxE,OAAO,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,yCAAyC,EAAE,CAAC;gBAC1E,OAAO,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC7C,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrD,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,IAAI,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;gBACtC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE;oBAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1C,CAAC;aACF,CAAC,CAAC;YACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,IAAI,SAAS,CAAC,SAAS;oBAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAChE,CAAC,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,GAAY,SAAS,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iEAAiE,IAAI,CAAC,IAAI,OAAO;gBAC/E,8BAA8B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,KAAK,CACvF,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,YAAqB,EAAE,MAAc;IAClF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,YAAY,EAAE,CAAC;QACjB,UAAU,CAAC,IAAI,CACb,kDAAkD,MAAM,wCAAwC,CACjG,CAAC;IACJ,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC9C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EACH,qKAAqK;YACrK,CAAC,YAAY;gBACX,CAAC,CAAC,kFAAkF;gBACpF,CAAC,CAAC,EAAE,CAAC;KACV,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,KAAK,0BAA0B,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC/C,mCAAmC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAmB;IACxD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAmB;IACzD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAmB,EAAE,MAAc;IAClE,MAAM,KAAK,GAAG,wBAAwB,EAAE,CAAC;IACzC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACnC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IAC3D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,MAAqC;IAC5D,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,mBAAmB;QACnB,oBAAoB;QACpB,uBAAuB;QACvB,qBAAqB;QACrB,yBAAyB;QACzB,6BAA6B;QAC7B,kBAAkB;QAClB,kBAAkB;KACnB,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/transport/stdio.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function runStdio(server: McpServer): Promise<void>;
+//# sourceMappingURL=stdio.d.ts.map

package/dist/transport/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transport/stdio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D"}

package/dist/transport/stdio.js

@@ -0,0 +1,7 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+export async function runStdio(server) {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // stdio servers are kept alive by the parent process pipe; nothing else to do.
+}
+//# sourceMappingURL=stdio.js.map

package/dist/transport/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/transport/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAiB;IAC9C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,+EAA+E;AACjF,CAAC"}

package/examples/mcp-config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "upload-post": {
+      "command": "npx",
+      "args": ["-y", "@upload-post/mcp"],
+      "env": {
+        "UPLOAD_POST_API_KEY": "YOUR_API_KEY"
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@upload-post/mcp",
+  "version": "0.3.0",
+  "description": "Official Model Context Protocol (MCP) server for Upload-Post — publish, schedule, analyze and manage social media across TikTok, Instagram, YouTube, LinkedIn, Facebook, Pinterest, Threads, Reddit, Bluesky, X and more from any MCP-compatible AI agent (Claude Desktop, Claude Code, Cursor, ...).",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "upload-post-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "examples",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "dev": "tsc --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "upload-post",
+    "social-media",
+    "tiktok",
+    "instagram",
+    "youtube",
+    "linkedin",
+    "facebook",
+    "pinterest",
+    "threads",
+    "reddit",
+    "bluesky",
+    "x",
+    "twitter",
+    "claude",
+    "claude-desktop",
+    "cursor",
+    "ai-agent"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Upload-Post/upload-post-mcp.git"
+  },
+  "homepage": "https://www.upload-post.com",
+  "bugs": {
+    "url": "https://github.com/Upload-Post/upload-post-mcp/issues"
+  },
+  "author": "Upload-Post <info@upload-post.com>",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "axios": "^1.7.7",
+    "form-data": "^4.0.1",
+    "upload-post": "^2.2.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "typescript": "^5.5.0"
+  }
+}