@upstash/context7-mcp 4.0.4 → 4.0.5

package/dist/index.js

@@ -12,8 +12,16 @@ import { AsyncLocalStorage } from "async_hooks";
 import { randomUUID } from "node:crypto";
 import { SERVER_VERSION, RESOURCE_URL, OAUTH_AUTH_SERVER_URL, EMA_ISSUER, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
 import { maybeElicitAuthSignIn } from "./lib/auth/auth-prompt.js";
+import { getMaxSubscriptions } from "./lib/subscriptions.js";
 /** Default HTTP server port */
 const DEFAULT_PORT = 3000;
+const CLAUDE_CODE_PLUGIN = "claude-code-plugin";
+function getPluginFromRequest(req) {
+    return req.query.client === CLAUDE_CODE_PLUGIN ? CLAUDE_CODE_PLUGIN : undefined;
+}
+function requiresAuthentication(req, plugin) {
+    return req.path === "/mcp/oauth" || Boolean(plugin);
+}
 // Parse CLI arguments using commander
 const program = new Command()
     .version(SERVER_VERSION, "-v, --version", "output the current version")
@@ -296,6 +304,7 @@ async function main() {
         // go idle and the gateway reaps them at streamIdleTimeout (300s).
         const mcpHandler = createMcpHandler(() => createMcpServer(), {
             keepAliveMs: 0,
+            maxSubscriptions: getMaxSubscriptions(),
             onerror: (error) => console.error("MCP handler error:", error),
         });
         // Without onerror, request-conversion / handler.fetch throws are answered
@@ -303,8 +312,9 @@ async function main() {
         const nodeHandler = toNodeHandler(mcpHandler, {
             onerror: (error) => console.error("MCP node adapter error:", error),
         });
-        const handleMcpRequest = async (req, res, requireAuth) => {
+        const handleMcpRequest = async (req, res) => {
             try {
+                const plugin = getPluginFromRequest(req);
                 const apiKey = extractApiKey(req);
                 const baseUrl = new URL(RESOURCE_URL).origin;
                 // OAuth discovery info header, used by MCP clients to discover the authorization server
@@ -313,7 +323,7 @@ async function main() {
                 // oauthMetadataResponse) — replace this hand-rolled header and the
                 // /.well-known/oauth-protected-resource route with them.
                 res.set("WWW-Authenticate", `Bearer resource_metadata="${baseUrl}/.well-known/oauth-protected-resource"`);
-                if (requireAuth) {
+                if (requiresAuthentication(req, plugin)) {
                     if (!apiKey) {
                         return res.status(401).json({
                             jsonrpc: "2.0",
@@ -340,8 +350,9 @@ async function main() {
                 }
                 const context = {
                     clientIp: req.ip,
-                    apiKey: apiKey,
+                    apiKey,
                     clientInfo: extractClientInfoFromUserAgent(req.headers["user-agent"]),
+                    plugin,
                     transport: "http",
                 };
                 await requestContext.run(context, async () => {
@@ -359,13 +370,12 @@ async function main() {
                 }
             }
         };
-        // Anonymous access endpoint - no authentication required
         app.all("/mcp", async (req, res) => {
-            await handleMcpRequest(req, res, false);
+            await handleMcpRequest(req, res);
         });
         // OAuth-protected endpoint - requires authentication
         app.all("/mcp/oauth", async (req, res) => {
-            await handleMcpRequest(req, res, true);
+            await handleMcpRequest(req, res);
         });
         app.get("/ping", (_req, res) => {
             res.json({ status: "ok", message: "pong" });

package/dist/lib/encryption.js

@@ -1,7 +1,6 @@
 import { createCipheriv, randomBytes } from "crypto";
 import { isIP } from "node:net";
 import { SERVER_VERSION } from "./constants.js";
-const LEGACY_ALGORITHM = "aes-256-cbc";
 const ASSERTION_ALGORITHM = "aes-256-gcm";
 const ASSERTION_VERSION = "v1";
 let reportedInvalidAssertionKey = false;
@@ -9,31 +8,16 @@ function validateEncryptionKey(key) {
     // Must be exactly 64 hex characters (32 bytes)
     return /^[0-9a-fA-F]{64}$/.test(key);
 }
-function encryptionKey(name) {
-    const key = process.env[name];
+function assertionKey() {
+    const key = process.env.MCP_CLIENT_IP_ASSERTION_KEY;
     return key && validateEncryptionKey(key) ? Buffer.from(key, "hex") : null;
 }
-/**
- * Temporary compatibility header for API deployments that predate authenticated assertions.
- * This header is ignored by patched API deployments. Removal is tracked by CTX7-2536.
- */
-function encryptLegacyClientIp(clientIp, key) {
-    try {
-        const iv = randomBytes(16);
-        const cipher = createCipheriv(LEGACY_ALGORITHM, key, iv);
-        const encrypted = Buffer.concat([cipher.update(clientIp, "utf8"), cipher.final()]);
-        return `${iv.toString("hex")}:${encrypted.toString("hex")}`;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Create a short-lived, authenticated client-IP assertion.
  * Format: v1:<unix timestamp seconds>:<12-byte nonce hex>:<ciphertext + tag hex>
  */
 export function createClientIpAssertion(clientIp, nowMs = Date.now(), nonce = randomBytes(12)) {
-    const key = encryptionKey("MCP_CLIENT_IP_ASSERTION_KEY");
+    const key = assertionKey();
     if (!key) {
         if (!reportedInvalidAssertionKey) {
             reportedInvalidAssertionKey = true;
@@ -67,14 +51,8 @@ export function generateHeaders(context) {
     };
     if (context.clientIp) {
         const assertion = createClientIpAssertion(context.clientIp);
-        if (assertion) {
+        if (assertion)
             headers["mcp-client-ip-assertion"] = assertion;
-            // Producer-first rollout compatibility. Removal is tracked by CTX7-2536.
-            const key = encryptionKey("CLIENT_IP_ENCRYPTION_KEY");
-            const legacyValue = key ? encryptLegacyClientIp(context.clientIp, key) : null;
-            if (legacyValue)
-                headers["mcp-client-ip"] = legacyValue;
-        }
     }
     if (context.sessionId) {
         headers["mcp-session-id"] = context.sessionId;
@@ -88,6 +66,9 @@ export function generateHeaders(context) {
     if (context.clientInfo?.version) {
         headers["X-Context7-Client-Version"] = context.clientInfo.version;
     }
+    if (context.plugin) {
+        headers["X-Context7-Plugin"] = context.plugin;
+    }
     if (context.transport) {
         headers["X-Context7-Transport"] = context.transport;
     }

package/dist/lib/subscriptions.js

@@ -0,0 +1,11 @@
+// 16k stayed near baseline latency in Docker; 32,768 raised tools/list p95 to ~39 ms.
+export const DEFAULT_MAX_SUBSCRIPTIONS = 16_000;
+export function getMaxSubscriptions(value = process.env.MCP_MAX_SUBSCRIPTIONS) {
+    if (value === undefined)
+        return DEFAULT_MAX_SUBSCRIPTIONS;
+    const parsed = Number(value);
+    if (Number.isSafeInteger(parsed) && parsed > 0)
+        return parsed;
+    console.warn(`Invalid MCP_MAX_SUBSCRIPTIONS; using the default of ${DEFAULT_MAX_SUBSCRIPTIONS}.`);
+    return DEFAULT_MAX_SUBSCRIPTIONS;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "4.0.4",
+  "version": "4.0.5",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
   "repository": {
@@ -45,6 +45,7 @@
   "devDependencies": {
     "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "^25.0.3",
+    "esbuild": "^0.28.2",
     "typescript": "^5.8.2",
     "vitest": "^4.1.9"
   },
@@ -61,6 +62,7 @@
     "format:check": "prettier --check .",
     "dev": "tsc --watch",
     "start": "node dist/index.js --transport http",
-    "pack-mcpb": "pnpm install && pnpm run build && rm -rf node_modules && pnpm install --prod && cp mcpb/manifest.json manifest.json && cp mcpb/.mcpbignore .mcpbignore && cp ../../public/icon.png icon.png && mcpb validate manifest.json && mcpb pack . mcpb/context7.mcpb && rm manifest.json .mcpbignore icon.png && pnpm install"
+    "build:mcpb": "esbuild src/index.ts --bundle --platform=node --target=node20 --format=esm --outfile=mcpb/stage/server/dist/index.mjs --banner:js=\"import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);\"",
+    "pack-mcpb": "rm -rf mcpb/stage && pnpm run build:mcpb && cp package.json mcpb/stage/package.json && cp mcpb/manifest.json mcpb/stage/manifest.json && cp ../../public/icon.png mcpb/stage/icon.png && mcpb validate mcpb/stage/manifest.json && mcpb pack mcpb/stage mcpb/context7.mcpb && rm -rf mcpb/stage"
   }
 }