@vantageos/mcp-boilerplate 0.6.3 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/mcp-boilerplate",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "description": "Clonable MCP server skeleton on the official @modelcontextprotocol/server SDK v2 (protocol 2026-07-28 + 2025 legacy, stdio + stateless Streamable HTTP), with its own OAuth 2.1 authorization server (Clerk person + organisation, cloud-identity), MCP Apps UI, tenant scoping, FR/EN i18n and a declarative eval harness.",
   "description_fr": "Squelette de serveur MCP clonable sur le SDK officiel @modelcontextprotocol/server v2 (protocole 2026-07-28 + héritage 2025, stdio + Streamable HTTP sans état), avec son propre serveur d'autorisation OAuth 2.1 (personne + organisation Clerk, cloud-identity), UI MCP Apps, scoping tenant, i18n FR/EN et un harnais d'évaluations déclaratif.",
   "type": "module",
@@ -53,11 +53,15 @@
   "homepage": "https://github.com/elpiarthera/vantage-mcp-boilerplate#readme",
   "author": "ElPi Corp / Laurent Perello",
   "scripts": {
-    "build": "node scripts/clean-dist.mjs && tsc && mkdir -p dist/locales && cp src/locales/en.json src/locales/fr.json dist/locales/ && node scripts/sync-plugin-version.mjs",
+    "build": "node scripts/clean-dist.mjs && tsc && mkdir -p dist/locales && cp src/locales/en.json src/locales/fr.json dist/locales/ && node scripts/sync-plugin-version.mjs && node scripts/listing-kit.mjs --check",
+    "listing:write": "node scripts/listing-kit.mjs",
+    "changelog:check": "node scripts/changelog-assemble.mjs --check",
+    "changelog:release": "node scripts/changelog-assemble.mjs",
     "prepack": "node scripts/check-dist-orphans.mjs",
     "build:ui": "vite build && mv dist/ui-bundle/index.html dist/ui-bundle/widget.html",
     "pretest": "npm run build && npm run build:ui",
     "test": "vitest run",
+    "test:a11y": "vitest run tests/widgetAxe.test.ts",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
     "start:http": "node dist/http.js",
@@ -83,7 +87,7 @@
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^2.0.3",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@vantageos/cloud-identity": "^0.20.2",
+    "@vantageos/cloud-identity": "^0.34.1",
     "@vantageos/mosaic-i18n": "^0.1.1",
     "hono": "^4.13.13",
     "jose": "^6.2.7",
@@ -100,11 +104,14 @@
   "devDependencies": {
     "@biomejs/biome": "1.9.4",
     "@modelcontextprotocol/client": "^2.3.1",
+    "@types/jsdom": "^30.0.0",
     "@types/node": "^20.14.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^4.3.0",
+    "axe-core": "^4.14.0",
     "convex": "1.46.0",
+    "jsdom": "^30.1.3",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "typescript": "^5.7.2",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "vantage-mcp-boilerplate",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "description": "Clonable MCP server template: SDK v2 on protocol 2026-07-28 (stdio + stateless Streamable HTTP), its own OAuth 2.1 authorization server (Clerk person + organisation), MCP Apps UI, FR/EN i18n and a declarative eval harness. Scaffold, extend, publish.",
   "author": {
     "name": "ElPi Corp / Laurent Perello"

package/scripts/plugin-manifest.source.json

@@ -31,5 +31,24 @@
   "openai": {
     "auth": { "type": "oauth", "client": { "mode": "cimd" } },
     "capabilities": ["Read"]
+  },
+  "listing": {
+    "testPrompts": {
+      "positive": [
+        "tools-call-ping-happy-path",
+        "tools-call-ping-default",
+        "tools-call-list-items-public-tier-unscoped",
+        "tools-call-list-items-page-truncated",
+        "tools-call-list-items-ui-link"
+      ],
+      "negative": [
+        "tools-call-ping-message-too-long-failure",
+        "tools-call-list-items-requires-tenant-refusal-failure",
+        "tools-call-list-items-invalid-cursor-failure"
+      ]
+    },
+    "reviewerAccount": {
+      "howToObtain": "Sign in at the server's /authorize page with any Clerk account; a reviewer organisation is created on request to the maintainers (README, 'Own authorization server'). No credential is stored in this repository."
+    }
   }
 }

package/scripts/readme-fr.mjs

@@ -27,7 +27,9 @@ import { fileURLToPath } from "node:url";
 export const BANNER =
   "<!-- Généré depuis README.md par mcp-readme-fr (@vantageos/mcp-boilerplate) : ne pas modifier à la main. -->";
 
-const MARKER = /^\s*<!--\s*(lang:([A-Za-z-]+)|\/lang)\s*-->\s*$/;
+// A marker sits at the start of a line with at most 3 spaces of indent (CommonMark): 4 or more spaces, or a tab, make
+// the line an indented code block, so such a "marker" is text, copied with the part it sits in, like a fenced one.
+const MARKER = /^ {0,3}<!--\s*(lang:([A-Za-z-]+)|\/lang)\s*-->\s*$/;
 const FENCE = /^ {0,3}(`{3,}|~{3,})(.*)$/;
 
 /** README.md text -> { fr, errors }. `fr` is the README.fr.md content (banner first). */

package/dist/oauth/clientAssertion.d.ts

@@ -1,28 +0,0 @@
-import { type CimdOptions } from "./clientRegistry.js";
-export declare const JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-export declare const ASSERTION_SIGNING_ALGS: readonly ["RS256"];
-export type AssertionResult = {
-    ok: true;
-    clientId: string;
-} | {
-    ok: false;
-    reason: string;
-};
-/** Bounded set of accepted jti values, each held until its assertion expires. */
-export declare function createJtiStore(maxEntries?: number): {
-    /** True when the jti is new (and is now recorded); false on a replay or when full. */
-    accept(clientId: string, jti: string, exp: number, nowSeconds: number): boolean;
-};
-export interface AssertionVerifierOptions extends CimdOptions {
-    now?: () => number;
-    jtiStore?: ReturnType<typeof createJtiStore>;
-}
-export declare function createClientAssertionVerifier(options?: AssertionVerifierOptions): {
-    verify(input: {
-        assertionType: string | undefined;
-        assertion: string | undefined;
-        /** The `client_id` request parameter, when sent. */
-        clientId: string | undefined;
-        audiences: string[];
-    }): Promise<AssertionResult>;
-};

package/dist/oauth/clientAssertion.js

@@ -1,106 +0,0 @@
-/**
- * private_key_jwt client authentication at `/token` (RFC 7523 / OIDC Core 9).
- *
- * A presented assertion is VERIFIED, never ignored and never trusted unverified:
- *  - the key set comes from the `jwks_uri` of the client's CIMD document, fetched through the
- *    same SSRF guard as the document itself;
- *  - alg is pinned to RS256 (a document declaring another signing alg is refused), so `none`
- *    and HMAC assertions cannot verify;
- *  - `iss` and `sub` equal the client_id; `aud` is this token endpoint or this issuer; `exp`
- *    is required (30 s skew); `jti` is required and accepted ONCE.
- */
-import { createLocalJWKSet, decodeJwt, jwtVerify } from "jose";
-import { fetchGuardedJson, isUrlShapedClientId, resolveCimdDocument, } from "./clientRegistry.js";
-export const JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-export const ASSERTION_SIGNING_ALGS = ["RS256"];
-const SKEW_SECONDS = 30;
-const MAX_JWKS_BYTES = 64 * 1024;
-/** Bounded set of accepted jti values, each held until its assertion expires. */
-export function createJtiStore(maxEntries = 10_000) {
-    const seen = new Map(); // `${clientId}\n${jti}` -> exp (epoch seconds)
-    return {
-        /** True when the jti is new (and is now recorded); false on a replay or when full. */
-        accept(clientId, jti, exp, nowSeconds) {
-            for (const [k, e] of seen)
-                if (e + SKEW_SECONDS <= nowSeconds)
-                    seen.delete(k);
-            const key = `${clientId}\n${jti}`;
-            if (seen.has(key))
-                return false;
-            if (seen.size >= maxEntries)
-                return false; // fail closed: never evict a live jti
-            seen.set(key, exp);
-            return true;
-        },
-    };
-}
-export function createClientAssertionVerifier(options = {}) {
-    const now = options.now ?? (() => Date.now());
-    const jtiStore = options.jtiStore ?? createJtiStore();
-    const fetchOpts = {
-        fetchImpl: options.fetchImpl,
-        resolveHost: options.resolveHost,
-        maxBytes: MAX_JWKS_BYTES,
-        ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
-    };
-    return {
-        async verify(input) {
-            const fail = (reason) => ({ ok: false, reason });
-            if (input.assertionType !== JWT_BEARER_ASSERTION_TYPE || !input.assertion) {
-                return fail("unsupported client assertion");
-            }
-            // The unverified iss only LOCATES the key set; it is re-checked against the verified claims.
-            let claimedIss;
-            try {
-                claimedIss = decodeJwt(input.assertion).iss;
-            }
-            catch {
-                return fail("malformed client assertion");
-            }
-            if (!claimedIss || !isUrlShapedClientId(claimedIss))
-                return fail("unknown client");
-            if (input.clientId !== undefined && input.clientId !== claimedIss) {
-                return fail("client_id does not match the assertion issuer");
-            }
-            const clientId = claimedIss;
-            const cimd = await resolveCimdDocument(clientId, options);
-            if (!cimd?.jwksUri)
-                return fail("client has no verifiable key set");
-            if (cimd.signingAlg !== undefined &&
-                !ASSERTION_SIGNING_ALGS.includes(cimd.signingAlg)) {
-                return fail("unsupported signing algorithm");
-            }
-            let jwksUrl;
-            try {
-                jwksUrl = new URL(cimd.jwksUri);
-            }
-            catch {
-                return fail("invalid jwks_uri");
-            }
-            const jwks = (await fetchGuardedJson(jwksUrl, fetchOpts));
-            if (!jwks || !Array.isArray(jwks.keys))
-                return fail("key set unavailable");
-            let payload;
-            try {
-                const verified = await jwtVerify(input.assertion, createLocalJWKSet(jwks), {
-                    algorithms: [...ASSERTION_SIGNING_ALGS],
-                    issuer: clientId,
-                    subject: clientId,
-                    audience: input.audiences,
-                    clockTolerance: SKEW_SECONDS,
-                    currentDate: new Date(now()),
-                    requiredClaims: ["iss", "sub", "aud", "exp", "jti"],
-                });
-                payload = verified.payload;
-            }
-            catch {
-                return fail("client assertion rejected");
-            }
-            const exp = payload.exp;
-            if (!payload.jti || !jtiStore.accept(clientId, payload.jti, exp, Math.floor(now() / 1000))) {
-                return fail("client assertion replayed");
-            }
-            return { ok: true, clientId };
-        },
-    };
-}