@wrongstack/mcp 1.0.2 → 1.0.4

package/dist/constants.d.ts

@@ -6,9 +6,36 @@
  * - Reconnect parameters can be overridden via config in the future
  * - No scattered magic values across multiple files
  */
+/**
+ * Protocol revisions this package actually implements, newest first.
+ *
+ * Deliberately conservative: a revision belongs here only once its wire
+ * requirements are met, because the version we send in `initialize` is a
+ * promise about what the peer may then use. WrongStack speaks the 2024-11-05
+ * shape — tools, resources, prompts, sampling — and does not implement the
+ * additions of later revisions (elicitation, structured tool output, resource
+ * links), so listing one of those would advertise capabilities that are not
+ * there.
+ *
+ * Adding a revision: implement its additions, then put it at the FRONT.
+ * `PROTOCOL_VERSION` follows automatically, and the negotiation below starts
+ * accepting a peer that asks for it.
+ */
+export declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+/**
+ * Pick the version to answer an `initialize` with.
+ *
+ * The spec's rule: echo what the peer asked for when it is supported,
+ * otherwise reply with our own latest and let the peer decide whether it can
+ * continue. Before this existed the server ignored the request entirely and
+ * always answered `2024-11-05`, so a peer that asked for a newer revision was
+ * told it had been granted nothing of the sort — silently, with no way to see
+ * the mismatch.
+ */
+export declare function negotiateProtocolVersion(requested: unknown): string;
 export declare const MCP_CONSTANTS: Readonly<{
-    /** MCP protocol version advertised during handshake. */
-    readonly PROTOCOL_VERSION: '2024-11-05';
+    /** MCP protocol version advertised during handshake: the newest we implement. */
+    readonly PROTOCOL_VERSION: string;
     /** Identity announced to MCP servers during `initialize`. */
     readonly CLIENT_INFO: Readonly<{
         name: "wrongstack";

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { authorizationHeaderForToken, authorizationServerMetadataUrls, canonicalMcpResource, createMcpAuthorizationRequest, discoverMcpAuthorization, exchangeMcpAuthorizationCode, type MCPAccessToken, type MCPAuthorizationChallenge, type MCPAuthorizationContext, type MCPAuthorizationDiscoveryOptions, type MCPAuthorizationDiscoveryResult, type MCPAuthorizationJsonFetcher, type MCPAuthorizationProvider, type MCPAuthorizationRequestOptions, type MCPAuthorizationServerMetadata, type MCPAuthorizationSession, type MCPProtectedResourceMetadata, type MCPTokenExchangeOptions, type MCPTokenRefreshOptions, type MCPTokenSet, parseAuthorizationServerMetadata, parseMcpAuthorizationCallback, parseMcpBearerChallenge, parseProtectedResourceMetadata, protectedResourceMetadataUrls, refreshMcpAccessToken, validateMcpAuthorizationServerMetadata, } from './authorization.js';
 export { type MCPAuthorizationCompleteInput, MCPAuthorizationManager, type MCPAuthorizationManagerOptions, type MCPAuthorizationStartInput, type MCPAuthorizationStartResult, type MCPAuthorizationStatus, } from './authorization-manager.js';
 export { MCPClient, type MCPClientOptions, type MCPListChangedListener, type MCPPageOptions, type MCPRequestOptions, type Transport, } from './client.js';
-export { MCP_CONSTANTS } from './constants.js';
+export { MCP_CONSTANTS, negotiateProtocolVersion, SUPPORTED_PROTOCOL_VERSIONS, } from './constants.js';
 export { DEFAULT_MCP_INSERTION_MAX_BYTES, DEFAULT_MCP_RESOURCE_SCHEMES, type MCPContentProvenance, type MCPInsertionPolicy, type MCPPromptInsertion, type MCPResourceInsertion, preparePromptInsertion, prepareResourceInsertion, } from './content-selection.js';
 export type { ConnectionState, JsonRpcResponse, MCPTool, ToolCallResult, } from './contracts.js';
 export { addMcp, disableMcp, discoverMcp, enableMcp, listMcp, MCP_ENV_MASK, type McpManageDeps, type McpOpResult, type McpServerInfo, type McpServerInput, removeMcp, restartMcp, updateMcp, } from './manage.js';

package/dist/index.js

@@ -875,9 +875,16 @@ function parseEmptyResult(value) {
 }
 
 // src/constants.ts
+var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze(["2024-11-05"]);
+function negotiateProtocolVersion(requested) {
+  if (typeof requested === "string" && SUPPORTED_PROTOCOL_VERSIONS.includes(requested)) {
+    return requested;
+  }
+  return MCP_CONSTANTS.PROTOCOL_VERSION;
+}
 var MCP_CONSTANTS = Object.freeze({
-  /** MCP protocol version advertised during handshake. */
-  PROTOCOL_VERSION: "2024-11-05",
+  /** MCP protocol version advertised during handshake: the newest we implement. */
+  PROTOCOL_VERSION: SUPPORTED_PROTOCOL_VERSIONS[0],
   /** Identity announced to MCP servers during `initialize`. */
   CLIENT_INFO: Object.freeze({
     name: "wrongstack",
@@ -1262,7 +1269,7 @@ import { Agent as UndiciAgent, fetch as undiciFetch } from "undici";
 import * as dns2 from "node:dns/promises";
 import * as net2 from "node:net";
 import { ConfigError } from "@wrongstack/core/types";
-import { isPrivateIPv4 as isPrivateIPv42, isPrivateIPv6 as isPrivateIPv62 } from "@wrongstack/core/utils";
+import { embeddedIPv4, expandIPv6, isPrivateIPv4 as isPrivateIPv42, isPrivateIPv6 as isPrivateIPv62 } from "@wrongstack/core/utils";
 function isTlsUnsafeAllowed() {
   return process.env["WRONGSTACK_UNSAFE_MCP_TLS"] === "1";
 }
@@ -1351,6 +1358,11 @@ function classifyTransportAddress(address, family) {
       }
       return "blocked";
     }
+    const groups = expandIPv6(v6);
+    if (groups !== null) {
+      const embedded = embeddedIPv4(groups);
+      if (embedded !== void 0) return classifyTransportAddress(embedded, 4);
+    }
     return isPrivateIPv62(v6) ? "private" : "public";
   }
   return "blocked";
@@ -1425,6 +1437,9 @@ function makeAbortError(method) {
   err.name = "AbortError";
   return err;
 }
+function nextJsonRpcId(id) {
+  return id >= Number.MAX_SAFE_INTEGER ? 1 : id + 1;
+}
 function createTimeoutSignal(parent, timeoutMs) {
   const ctrl = new AbortController();
   const onAbort = () => ctrl.abort(parent?.reason);
@@ -1807,7 +1822,9 @@ var SSETransport = class extends BaseHTTPTransport {
     super(opts, "SSETransport");
   }
   genId() {
-    return this._nextId++;
+    const id = this._nextId;
+    this._nextId = nextJsonRpcId(id);
+    return id;
   }
   /** Refresh tool list when server sends notifications/tools/list_changed. */
   async handleToolsListChanged() {
@@ -2121,7 +2138,9 @@ var StreamableHTTPTransport = class _StreamableHTTPTransport extends BaseHTTPTra
     super(opts, "StreamableHTTP");
   }
   genId() {
-    return this._nextId++;
+    const id = this._nextId;
+    this._nextId = nextJsonRpcId(id);
+    return id;
   }
   consumeResponseText(text, requestId) {
     const envelopes = extractJsonRpcEnvelopes(text);
@@ -2166,6 +2185,7 @@ var StreamableHTTPTransport = class _StreamableHTTPTransport extends BaseHTTPTra
     const signal = this.abortController.signal;
     const startupTimer = setTimeout(() => this.abortController?.abort(), this.timeout);
     try {
+      const initializeId = this.genId();
       const initFetchOpts = {
         method: "POST",
         headers: {
@@ -2175,7 +2195,7 @@ var StreamableHTTPTransport = class _StreamableHTTPTransport extends BaseHTTPTra
         },
         body: JSON.stringify({
           jsonrpc: "2.0",
-          id: this.genId(),
+          id: initializeId,
           method: "initialize",
           params: {
             protocolVersion: MCP_CONSTANTS.PROTOCOL_VERSION,
@@ -2201,7 +2221,7 @@ var StreamableHTTPTransport = class _StreamableHTTPTransport extends BaseHTTPTra
       if (!data) {
         throw new Error("Could not parse initialize response");
       }
-      data = assertMatchingJsonRpcResult(data, this._nextId - 1, "initialize");
+      data = assertMatchingJsonRpcResult(data, initializeId, "initialize");
       if (data.error) {
         throw new Error(`initialize failed: ${data.error.message}`);
       }
@@ -2451,6 +2471,7 @@ var MCPClient = class _MCPClient {
     this.disconnectListeners.delete(listener);
   }
   async connect() {
+    if (this.state === "connected" || this.state === "connecting") return;
     this.state = "connecting";
     this._serverMetadata = void 0;
     try {
@@ -2794,7 +2815,7 @@ var MCPClient = class _MCPClient {
           gracefulTimer.unref?.();
         })
       ]);
-      if (gracefulTimer) clearTimeout(gracefulTimer);
+      clearTimeout(gracefulTimer);
       if (gracefulRace === "timeout") {
         forceKillTree(child);
         let forceTimer;
@@ -2805,7 +2826,7 @@ var MCPClient = class _MCPClient {
             forceTimer.unref?.();
           })
         ]);
-        if (forceTimer) clearTimeout(forceTimer);
+        clearTimeout(forceTimer);
       }
       child.stdout?.removeAllListeners();
       child.stderr?.removeAllListeners();
@@ -2826,7 +2847,8 @@ var MCPClient = class _MCPClient {
       err.name = "AbortError";
       return Promise.reject(err);
     }
-    const id = this.nextId++;
+    const id = this.nextId;
+    this.nextId = nextJsonRpcId(id);
     const req = { jsonrpc: "2.0", id, method, params };
     return new Promise((resolve, reject) => {
       const onAbort = signal ? () => {
@@ -5015,7 +5037,9 @@ var MCPServer = class {
     switch (method) {
       case "initialize":
         return {
-          protocolVersion: MCP_CONSTANTS.PROTOCOL_VERSION,
+          protocolVersion: negotiateProtocolVersion(
+            params?.protocolVersion
+          ),
           capabilities: {
             tools: { listChanged: false },
             ...this.resources.length > 0 ? { resources: { subscribe: false, listChanged: false } } : {},
@@ -5420,11 +5444,9 @@ async function handleHttpRequest(server, req, res, token, log, boundHost) {
   req.on("end", () => {
     if (aborted) return;
     void server.handleMessage(body).then((out) => {
-      if (aborted) return;
       if (out === null) return send(202, "");
       return send(200, out);
     }).catch((err) => {
-      if (aborted) return;
       log?.warn?.(`MCP http handler error: ${toErrorMessage2(err)}`);
       send(500, JSON.stringify({ error: "internal error" }));
     });
@@ -5795,6 +5817,7 @@ export {
   MCP_OPERATION_LIMITS,
   SSEReader,
   SSETransport,
+  SUPPORTED_PROTOCOL_VERSIONS,
   StreamableHTTPTransport,
   addMcp,
   authorizationHeaderForToken,
@@ -5809,6 +5832,7 @@ export {
   exchangeMcpAuthorizationCode,
   listMcp,
   manifestConfigHash,
+  negotiateProtocolVersion,
   parseAuthorizationServerMetadata,
   parseGetPromptResult,
   parseListPromptsResult,

package/dist/server.d.ts

@@ -1,3 +1,4 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
 import type { MCPPromptArgument, MCPPromptMessage, MCPResourceContents } from './protocol.js';
 /**
  * Server-side MCP. The mirror image of `MCPClient`: instead of consuming a
@@ -164,4 +165,5 @@ export interface ServeHttpHandle {
  * otherwise expose tool execution to the whole network unauthenticated.
  */
 export declare function serveHttp(server: MCPServer, opts?: ServeHttpOptions): Promise<ServeHttpHandle>;
+export declare function handleHttpRequest(server: MCPServer, req: IncomingMessage, res: ServerResponse, token: string | undefined, log: MCPServerLogger | undefined, boundHost: string): Promise<void>;
 //# sourceMappingURL=server.d.ts.map

package/dist/transport-base.d.ts

@@ -49,6 +49,8 @@ export interface HttpTransportOptions {
  * classifyToolError maps it to FATAL / not-retryable (user cancellation).
  */
 export declare function makeAbortError(method: string): Error;
+/** Advance a JSON-RPC number id without leaving JavaScript's safe-integer range. */
+export declare function nextJsonRpcId(id: number): number;
 export declare function createTimeoutSignal(parent: AbortSignal | undefined, timeoutMs: number): {
     signal: AbortSignal;
     dispose: () => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/mcp",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "license": "MIT",
   "description": "WrongStack Model Context Protocol client and registry: stdio, SSE, and streamable HTTP transports.",
   "repository": {
@@ -26,7 +26,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "1.0.2",
+    "@wrongstack/core": "1.0.4",
     "undici": "^8.10.0"
   },
   "devDependencies": {