@upstash/context7-mcp 4.0.5 → 4.0.7

package/README.md

@@ -1621,6 +1621,34 @@ Stay updated and join our community:
 - [AICodeKing: "Context7 + Cline & RooCode: This MCP Server Makes CLINE 100X MORE EFFECTIVE!"](https://www.youtube.com/watch?v=qZfENAPMnyo)
 - [Sean Kochel: "5 MCP Servers For Vibe Coding Glory (Just Plug-In & Go)"](https://www.youtube.com/watch?v=LqTQi8qexJM)
 
+## Vercel Marketplace OIDC
+
+Vercel Marketplace resources can call the remote MCP server without a
+long-lived Context7 API key. Obtain a fresh per-resource access token from
+Vercel's Marketplace integration runtime and send it as the bearer credential:
+
+```ts
+import { getIntegrationToken } from "@vercel/integrations";
+
+const authorization = `Bearer ${await getIntegrationToken("context7")}`;
+```
+
+The `getIntegrationToken` signature is based on Vercel's current provider
+specification and may change before Marketplace OIDC is generally available.
+
+Use `authorization` as the `Authorization` header when creating the MCP HTTP
+transport. Create the transport inside the request that uses it so a short-lived
+token is not retained across function invocations. Its `resource` claim must
+match the Context7 resource created during Marketplace provisioning.
+
+The hosted MCP service must be configured with the exact issuer and audience
+assigned by Vercel when the Context7 Marketplace product is created:
+
+```sh
+VERCEL_MARKETPLACE_OIDC_ISSUER=https://integrations.vercel.com/oac_...
+VERCEL_MARKETPLACE_OIDC_AUDIENCE=https://integrations.vercel.com/context7/icfg_...
+```
+
 ## 📄 License
 
 MIT

package/dist/index.js

@@ -13,6 +13,7 @@ import { randomUUID } from "node:crypto";
 import { SERVER_VERSION, RESOURCE_URL, OAUTH_AUTH_SERVER_URL, EMA_ISSUER, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
 import { maybeElicitAuthSignIn } from "./lib/auth/auth-prompt.js";
 import { getMaxSubscriptions } from "./lib/subscriptions.js";
+import { mcpBodyErrorHandler } from "./lib/mcp-body-error-handler.js";
 /** Default HTTP server port */
 const DEFAULT_PORT = 3000;
 const CLAUDE_CODE_PLUGIN = "claude-code-plugin";
@@ -20,7 +21,11 @@ function getPluginFromRequest(req) {
     return req.query.client === CLAUDE_CODE_PLUGIN ? CLAUDE_CODE_PLUGIN : undefined;
 }
 function requiresAuthentication(req, plugin) {
-    return req.path === "/mcp/oauth" || Boolean(plugin);
+    // The MCP routes live on a router mounted at /mcp, so req.path is relative to it.
+    const isOAuthEndpoint = `${req.baseUrl}${req.path}` === "/mcp/oauth";
+    // The current official Claude plugin expands an unset API key to an empty header.
+    const hasEmptyPluginAuthorization = plugin === CLAUDE_CODE_PLUGIN && req.headers.authorization === "";
+    return isOAuthEndpoint || (Boolean(plugin) && !hasEmptyPluginAuthorization);
 }
 // Parse CLI arguments using commander
 const program = new Command()
@@ -252,7 +257,9 @@ async function main() {
         // Only private/local infrastructure may supply forwarding headers. Express
         // then walks the chain right-to-left and ignores attacker-added prefixes.
         app.set("trust proxy", ["loopback", "linklocal", "uniquelocal", "100.64.0.0/10"]);
-        app.use(express.json());
+        // Registered ahead of the MCP router so its error responses carry the CORS
+        // headers too; browser clients would otherwise see a CORS failure instead
+        // of the status.
         app.use((req, res, next) => {
             res.setHeader("Access-Control-Allow-Origin", "*");
             res.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS,DELETE");
@@ -370,13 +377,16 @@ async function main() {
                 }
             }
         };
-        app.all("/mcp", async (req, res) => {
-            await handleMcpRequest(req, res);
-        });
+        // JSON bodies and JSON-RPC error envelopes are the MCP contract only, so the
+        // parser and its error boundary live on the MCP router: every other route
+        // stays out of the parser and keeps its own response shape.
+        const mcpRouter = express.Router();
+        mcpRouter.use(express.json());
+        mcpRouter.use(mcpBodyErrorHandler);
+        mcpRouter.all("/", (req, res) => handleMcpRequest(req, res));
         // OAuth-protected endpoint - requires authentication
-        app.all("/mcp/oauth", async (req, res) => {
-            await handleMcpRequest(req, res);
-        });
+        mcpRouter.all("/oauth", (req, res) => handleMcpRequest(req, res));
+        app.use("/mcp", mcpRouter);
         app.get("/ping", (_req, res) => {
             res.json({ status: "ok", message: "pong" });
         });

package/dist/lib/jwt.js

@@ -1,5 +1,6 @@
 import * as jose from "jose";
 import { CONTEXT7_API_BASE_URL, EMA_ISSUER, EMA_JWKS_URL, OAUTH_AUTH_SERVER_URL, OAUTH_JWKS_URL, RESOURCE_URL, } from "./constants.js";
+import { isVercelMarketplaceIssuer, validateVercelMarketplaceJwt } from "./vercelMarketplaceJwt.js";
 const oauthJwks = jose.createRemoteJWKSet(new URL(OAUTH_JWKS_URL));
 const emaJwks = jose.createRemoteJWKSet(new URL(EMA_JWKS_URL));
 const ENTRA_V2_ISSUER_RE = /^https:\/\/login\.microsoftonline\.com\/[0-9a-f-]{36}\/v2\.0$/;
@@ -69,6 +70,9 @@ export async function validateJWT(token) {
             await jose.jwtVerify(token, emaJwks, { issuer: EMA_ISSUER, audience: RESOURCE_URL });
             return { valid: true };
         }
+        if (isVercelMarketplaceIssuer(iss)) {
+            return validateVercelMarketplaceJwt(token, iss);
+        }
         await jose.jwtVerify(token, oauthJwks, { issuer: OAUTH_AUTH_SERVER_URL });
         return { valid: true };
     }

package/dist/lib/mcp-body-error-handler.js

@@ -0,0 +1,23 @@
+// Error boundary for the MCP router's JSON body parser. express.json() reports
+// a body it will not accept via next(err); left unhandled, Express answers with
+// an HTML stack trace naming dependency versions and absolute paths.
+export const mcpBodyErrorHandler = (err, req, res, next) => {
+    const { status, type } = err;
+    // body-parser tags every rejection with a 4xx; anything else is not a body
+    // problem. Once a response has started, only Express can wind it down.
+    if (typeof status !== "number" || status < 400 || status >= 500 || res.headersSent) {
+        return next(err);
+    }
+    // Method, path and size only: the body is the rejected input, and the
+    // headers carry the API key.
+    console.error(`Rejected request body (${status}, ${String(type ?? "unknown")}): ${req.method} ${req.baseUrl}${req.path} bytes=${req.headers["content-length"] ?? "unknown"}`);
+    // Fixed messages: body-parser's own quote offsets into the body.
+    const parseFailure = err instanceof SyntaxError && type === "entity.parse.failed";
+    res.status(status).json({
+        jsonrpc: "2.0",
+        error: parseFailure
+            ? { code: -32700, message: "Parse error" }
+            : { code: -32600, message: "Invalid Request" },
+        id: null,
+    });
+};

package/dist/lib/vercelMarketplaceJwt.js

@@ -0,0 +1,54 @@
+import * as jose from "jose";
+const VERCEL_INTEGRATIONS_ORIGIN = "https://integrations.vercel.com";
+const VERCEL_ISSUER_PATH = /^\/oac_[A-Za-z0-9]+$/;
+const VERCEL_AUDIENCE_PATH = /^\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\/icfg_[A-Za-z0-9]+$/;
+let jwks;
+function isExpectedVercelUrl(value, pathPattern) {
+    try {
+        const url = new URL(value);
+        return (url.origin === VERCEL_INTEGRATIONS_ORIGIN &&
+            !url.username &&
+            !url.password &&
+            !url.search &&
+            !url.hash &&
+            pathPattern.test(url.pathname));
+    }
+    catch {
+        return false;
+    }
+}
+function getConfig() {
+    const issuer = process.env.VERCEL_MARKETPLACE_OIDC_ISSUER ?? "";
+    const audience = process.env.VERCEL_MARKETPLACE_OIDC_AUDIENCE ?? "";
+    if (!isVercelMarketplaceIssuer(issuer) || !isExpectedVercelUrl(audience, VERCEL_AUDIENCE_PATH)) {
+        return null;
+    }
+    return { issuer, audience };
+}
+function getJwks(issuer) {
+    if (!jwks) {
+        jwks = jose.createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks`));
+    }
+    return jwks;
+}
+export function isVercelMarketplaceIssuer(issuer) {
+    return isExpectedVercelUrl(issuer, VERCEL_ISSUER_PATH);
+}
+export async function validateVercelMarketplaceJwt(token, tokenIssuer) {
+    const config = getConfig();
+    if (!config)
+        return { valid: false, error: "Vercel Marketplace OIDC not configured" };
+    if (tokenIssuer !== config.issuer) {
+        return { valid: false, error: "Untrusted Vercel Marketplace issuer" };
+    }
+    const { payload } = await jose.jwtVerify(token, getJwks(config.issuer), {
+        algorithms: ["RS256"],
+        audience: config.audience,
+        issuer: config.issuer,
+        clockTolerance: 60,
+    });
+    if (typeof payload.resource !== "string" || !payload.resource) {
+        return { valid: false, error: "Missing Vercel Marketplace resource" };
+    }
+    return { valid: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
   "repository": {