@upstash/context7-mcp 4.0.2 → 4.0.3

package/dist/index.js

@@ -10,7 +10,7 @@ import express from "express";
 import { Command } from "commander";
 import { AsyncLocalStorage } from "async_hooks";
 import { randomUUID } from "node:crypto";
-import { SERVER_VERSION, RESOURCE_URL, AUTH_SERVER_URL, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
+import { SERVER_VERSION, RESOURCE_URL, OAUTH_AUTH_SERVER_URL, EMA_ISSUER, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
 import { maybeElicitAuthSignIn } from "./lib/auth/auth-prompt.js";
 import { getClientIp } from "./lib/client-ip.js";
 /** Default HTTP server port */
@@ -372,13 +372,16 @@ async function main() {
         app.get("/.well-known/oauth-protected-resource", (_req, res) => {
             res.json({
                 resource: RESOURCE_URL,
-                authorization_servers: [AUTH_SERVER_URL],
+                // Each entry is an independent authorization server. Clerk handles
+                // regular authorization-code flows; Context7 handles only the
+                // enterprise-managed id-jag exchange.
+                authorization_servers: Array.from(new Set([OAUTH_AUTH_SERVER_URL, EMA_ISSUER])),
                 scopes_supported: ["profile", "email"],
                 bearer_methods_supported: ["header"],
             });
         });
         app.get("/.well-known/oauth-authorization-server", async (_req, res) => {
-            const authServerUrl = AUTH_SERVER_URL;
+            const authServerUrl = OAUTH_AUTH_SERVER_URL;
             try {
                 const response = await fetch(`${authServerUrl}/.well-known/oauth-authorization-server`);
                 if (!response.ok) {

package/dist/lib/constants.js

@@ -6,12 +6,20 @@ const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-
 export const SERVER_VERSION = pkg.version;
 const CONTEXT7_BASE_URL = "https://context7.com";
 const MCP_RESOURCE_URL = "https://mcp.context7.com";
-export const CLERK_DOMAIN = "clerk.context7.com";
+const DEFAULT_OAUTH_AUTH_SERVER_URL = "https://clerk.context7.com";
 export const CONTEXT7_API_BASE_URL = process.env.CONTEXT7_API_URL || `${CONTEXT7_BASE_URL}/api`;
 export const RESOURCE_URL = process.env.RESOURCE_URL || MCP_RESOURCE_URL;
-export const AUTH_SERVER_URL = process.env.AUTH_SERVER_URL || CONTEXT7_BASE_URL;
+// Clerk owns the interactive OAuth flow and is the issuer returned in the
+// authorization response. Advertising Clerk directly keeps RFC 8414 discovery
+// and RFC 9207 response-issuer validation on the same authorization-server
+// identity.
+export const OAUTH_AUTH_SERVER_URL = (process.env.OAUTH_AUTH_SERVER_URL || DEFAULT_OAUTH_AUTH_SERVER_URL).replace(/\/+$/, "");
+export const OAUTH_JWKS_URL = process.env.OAUTH_JWKS_URL || `${OAUTH_AUTH_SERVER_URL}/.well-known/jwks.json`;
 // Enterprise-Managed Auth (id-jag): access tokens minted by the Context7
 // authorization server, validated against its public JWKS.
-export const EMA_ISSUER = AUTH_SERVER_URL;
+// AUTH_SERVER_URL remains a backwards-compatible alias for local EMA setups;
+// it does not move interactive user OAuth. Local end-to-end OAuth environments
+// must set OAUTH_AUTH_SERVER_URL separately when Clerk is not the intended issuer.
+export const EMA_ISSUER = process.env.EMA_ISSUER || process.env.AUTH_SERVER_URL || CONTEXT7_BASE_URL;
 export const EMA_JWKS_URL = process.env.EMA_JWKS_URL || `${CONTEXT7_API_BASE_URL}/oauth/ema-jwks`;
 export const OPENAI_APPS_CHALLENGE_TOKEN = process.env.OPENAI_APPS_CHALLENGE_TOKEN;

package/dist/lib/jwt.js

@@ -1,7 +1,6 @@
 import * as jose from "jose";
-import { CLERK_DOMAIN, CONTEXT7_API_BASE_URL, EMA_ISSUER, EMA_JWKS_URL, RESOURCE_URL, } from "./constants.js";
-const CLERK_ISSUER = `https://${CLERK_DOMAIN}`;
-const clerkJwks = jose.createRemoteJWKSet(new URL(`https://${CLERK_DOMAIN}/.well-known/jwks.json`));
+import { CONTEXT7_API_BASE_URL, EMA_ISSUER, EMA_JWKS_URL, OAUTH_AUTH_SERVER_URL, OAUTH_JWKS_URL, RESOURCE_URL, } from "./constants.js";
+const oauthJwks = jose.createRemoteJWKSet(new URL(OAUTH_JWKS_URL));
 const emaJwks = jose.createRemoteJWKSet(new URL(EMA_JWKS_URL));
 const ENTRA_V2_ISSUER_RE = /^https:\/\/login\.microsoftonline\.com\/[0-9a-f-]{36}\/v2\.0$/;
 const jwksByTenant = new Map();
@@ -70,7 +69,7 @@ export async function validateJWT(token) {
             await jose.jwtVerify(token, emaJwks, { issuer: EMA_ISSUER, audience: RESOURCE_URL });
             return { valid: true };
         }
-        await jose.jwtVerify(token, clerkJwks, { issuer: CLERK_ISSUER });
+        await jose.jwtVerify(token, oauthJwks, { issuer: OAUTH_AUTH_SERVER_URL });
         return { valid: true };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
   "repository": {