@wrongstack/mcp 1.0.27 → 1.0.29

package/dist/index.js

@@ -45,7 +45,9 @@ function parseMcpBearerChallenge(header, resource) {
   const resourceMetadata = challengeParameter(parameters, "resource_metadata");
   if (resourceMetadata) {
     const metadataUrl = validateMetadataUrl(resourceMetadata);
-    if (metadataUrl) challenge.resourceMetadataUrl = metadataUrl;
+    if (metadataUrl && isSameHost(metadataUrl, resource)) {
+      challenge.resourceMetadataUrl = metadataUrl;
+    }
   }
   const scope = challengeParameter(parameters, "scope");
   if (scope) {
@@ -194,6 +196,13 @@ function validateMetadataUrl(value) {
     return void 0;
   }
 }
+function isSameHost(candidate, resource) {
+  try {
+    return unbracket(new URL(candidate).hostname).toLowerCase() === unbracket(new URL(resource).hostname).toLowerCase();
+  } catch {
+    return false;
+  }
+}
 function record(value, label2) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`MCP ${label2} must be an object`);
@@ -1892,7 +1901,7 @@ function validateElicitationContent(fields, content) {
       out[field.name] = [];
       continue;
     }
-    if (raw === void 0 || raw === null || raw === "" || Array.isArray(raw) && raw.length === 0) {
+    if (raw === void 0 || raw === null || Array.isArray(raw) && raw.length === 0) {
       if (field.required) return { ok: false, error: `${label(field)} is required` };
       continue;
     }
@@ -1999,6 +2008,7 @@ var ServerRequestResponder = class {
 import { ToolError as ToolError2 } from "@wrongstack/core/types";
 var MAX_MCP_HTTP_BODY_BYTES = 16 * 1024 * 1024;
 async function readBodyCapped(res, maxBytes = MAX_MCP_HTTP_BODY_BYTES) {
+  const safeCap = typeof maxBytes === "number" && Number.isFinite(maxBytes) && maxBytes >= 0 ? maxBytes : MAX_MCP_HTTP_BODY_BYTES;
   const body = res.body;
   if (!body || typeof body.getReader !== "function") {
     return await res.text();
@@ -2012,13 +2022,13 @@ async function readBodyCapped(res, maxBytes = MAX_MCP_HTTP_BODY_BYTES) {
       if (done) break;
       if (!value) continue;
       total += value.byteLength;
-      if (total > maxBytes) {
+      if (total > safeCap) {
         await reader.cancel().catch(() => void 0);
         throw new ToolError2({
-          message: `MCP response body exceeded ${maxBytes} bytes \u2014 refusing to buffer`,
+          message: `MCP response body exceeded ${safeCap} bytes \u2014 refusing to buffer`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport",
-          context: { maxBytes, received: total }
+          context: { maxBytes: safeCap, received: total }
         });
       }
       chunks.push(value);
@@ -2223,15 +2233,16 @@ function createTimeoutSignal(parent, timeoutMs, hold) {
   } else {
     parent?.addEventListener("abort", onAbort, { once: true });
   }
+  const safeTimeout = typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 6e4;
   const onTimeout = () => {
     if (hold?.()) {
-      timer = setTimeout(onTimeout, timeoutMs);
+      timer = setTimeout(onTimeout, safeTimeout);
       timer.unref?.();
       return;
     }
-    ctrl.abort(new Error(`MCP HTTP request timed out after ${timeoutMs}ms`));
+    ctrl.abort(new Error(`MCP HTTP request timed out after ${safeTimeout}ms`));
   };
-  let timer = setTimeout(onTimeout, timeoutMs);
+  let timer = setTimeout(onTimeout, safeTimeout);
   timer.unref?.();
   return {
     signal: ctrl.signal,
@@ -2274,8 +2285,8 @@ var BaseHTTPTransport = class {
     this.headers = { ...opts.headers };
     this.authorizationProvider = opts.authorizationProvider;
     this.authorizationResource = canonicalMcpResource(opts.url);
-    this.timeout = opts.startupTimeoutMs ?? 1e4;
-    this.requestTimeout = opts.requestTimeoutMs ?? 6e4;
+    this.timeout = typeof opts.startupTimeoutMs === "number" && Number.isFinite(opts.startupTimeoutMs) && opts.startupTimeoutMs > 0 ? opts.startupTimeoutMs : 1e4;
+    this.requestTimeout = typeof opts.requestTimeoutMs === "number" && Number.isFinite(opts.requestTimeoutMs) && opts.requestTimeoutMs > 0 ? opts.requestTimeoutMs : 6e4;
     if (opts.tls) {
       if (opts.tls.rejectUnauthorized === false) {
         const where = urlOriginForLog(this.url);
@@ -3789,7 +3800,7 @@ var MCPClient = class _MCPClient {
         capabilities: this.serverRequests.capabilities(),
         clientInfo: MCP_CONSTANTS.CLIENT_INFO
       },
-      this.opts.startupTimeoutMs ?? 1e4
+      typeof this.opts.startupTimeoutMs === "number" && Number.isFinite(this.opts.startupTimeoutMs) && this.opts.startupTimeoutMs > 0 ? this.opts.startupTimeoutMs : 1e4
     );
     if (initialize.error) {
       this.state = "failed";
@@ -3914,9 +3925,13 @@ var MCPClient = class _MCPClient {
     await Promise.allSettled([this.sseTransport?.close(), this.httpTransport?.close()]);
     this.state = "disconnected";
   }
-  request(method, params, timeoutMs = this.opts.requestTimeoutMs ?? 6e4, opts) {
-    if (this.sseTransport) return this.sseTransport.request(method, params, timeoutMs, opts);
-    if (this.httpTransport) return this.httpTransport.request(method, params, timeoutMs, opts);
+  request(method, params, timeoutMs, opts) {
+    const defaultTimeoutMs = typeof this.opts.requestTimeoutMs === "number" && Number.isFinite(this.opts.requestTimeoutMs) && this.opts.requestTimeoutMs > 0 ? this.opts.requestTimeoutMs : 6e4;
+    const effectiveTimeoutMs = typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : defaultTimeoutMs;
+    if (this.sseTransport)
+      return this.sseTransport.request(method, params, effectiveTimeoutMs, opts);
+    if (this.httpTransport)
+      return this.httpTransport.request(method, params, effectiveTimeoutMs, opts);
     const signal = opts?.signal;
     if (signal?.aborted) {
       const err = new Error(`MCP "${this.opts.name}" request "${method}" aborted before send`);
@@ -3946,13 +3961,15 @@ var MCPClient = class _MCPClient {
       };
       const onTimeout = () => {
         if (this.serverRequests.awaitingUser) {
-          entry.timer = setTimeout(onTimeout, timeoutMs);
+          entry.timer = setTimeout(onTimeout, effectiveTimeoutMs);
           return;
         }
         this.pending.delete(id);
         detach();
         reject(
-          new Error(`MCP "${this.opts.name}" request "${method}" timed out after ${timeoutMs}ms`)
+          new Error(
+            `MCP "${this.opts.name}" request "${method}" timed out after ${effectiveTimeoutMs}ms`
+          )
         );
       };
       const entry = {
@@ -3966,7 +3983,7 @@ var MCPClient = class _MCPClient {
           detach();
           reject(err);
         },
-        timer: setTimeout(onTimeout, timeoutMs)
+        timer: setTimeout(onTimeout, effectiveTimeoutMs)
       };
       this.pending.set(id, entry);
       const stdin = this.child?.stdin;
@@ -4607,8 +4624,12 @@ function toUserInputRequest(request3, problem) {
 function answerValue(field, answer) {
   if (!answer || answer.delegated) return void 0;
   switch (field.kind) {
-    case "string":
-      return answer.text?.trim() ? answer.text : void 0;
+    case "string": {
+      const text = answer.text;
+      if (text === void 0) return void 0;
+      if (!text.trim() && !field.required) return void 0;
+      return text;
+    }
     case "number":
     case "integer":
       return answer.text?.trim() || void 0;
@@ -4695,8 +4716,14 @@ async function readConfig(path2) {
 async function writeConfig(path2, cfg) {
   const raw = JSON.stringify(cfg, null, 2);
   const tmp = `${path2}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
-  await fs.writeFile(tmp, raw, "utf8");
+  let mode = 384;
+  try {
+    mode = (await fs.stat(path2)).mode & 511;
+  } catch {
+  }
   try {
+    await fs.writeFile(tmp, raw, { encoding: "utf8", mode });
+    await fs.chmod(tmp, mode);
     await fs.rename(tmp, path2);
   } catch (err) {
     await fs.rm(tmp, { force: true });
@@ -5130,52 +5157,59 @@ function healthStateFor(connectionState, operations, enabled = true) {
 function evaluateHealthThresholds(operations, thresholds) {
   if (!thresholds) return [];
   const checks = [];
-  if (thresholds.connectionLatencyP95Ms !== void 0 && operations.connectionSamples.length > 0) {
+  const connectionP95 = thresholds.connectionLatencyP95Ms;
+  if (isUsableThreshold(connectionP95) && operations.connectionSamples.length > 0) {
     const value = percentile(
       [...operations.connectionSamples].sort((a, b) => a - b),
       0.95
     );
     checks.push({
       name: "connection-latency-p95",
-      passed: value <= thresholds.connectionLatencyP95Ms,
+      passed: value <= connectionP95,
       value,
-      threshold: thresholds.connectionLatencyP95Ms
+      threshold: connectionP95
     });
   }
-  if (thresholds.discoveryLatencyP95Ms !== void 0 && operations.discoverySamples.length > 0) {
+  const discoveryP95 = thresholds.discoveryLatencyP95Ms;
+  if (isUsableThreshold(discoveryP95) && operations.discoverySamples.length > 0) {
     const value = percentile(
       [...operations.discoverySamples].sort((a, b) => a - b),
       0.95
     );
     checks.push({
       name: "discovery-latency-p95",
-      passed: value <= thresholds.discoveryLatencyP95Ms,
+      passed: value <= discoveryP95,
       value,
-      threshold: thresholds.discoveryLatencyP95Ms
+      threshold: discoveryP95
     });
   }
-  if (thresholds.callLatencyP95Ms !== void 0 && operations.callSamples.length > 0) {
+  const callP95 = thresholds.callLatencyP95Ms;
+  if (isUsableThreshold(callP95) && operations.callSamples.length > 0) {
     const value = percentile(
       [...operations.callSamples].sort((a, b) => a - b),
       0.95
     );
     checks.push({
       name: "call-latency-p95",
-      passed: value <= thresholds.callLatencyP95Ms,
+      passed: value <= callP95,
       value,
-      threshold: thresholds.callLatencyP95Ms
+      threshold: callP95
     });
   }
-  if (thresholds.inFlightCalls !== void 0) {
+  const inFlight = thresholds.inFlightCalls;
+  if (isUsableThreshold(inFlight)) {
     checks.push({
       name: "in-flight-calls",
-      passed: operations.peakInFlightCalls <= thresholds.inFlightCalls,
+      passed: operations.peakInFlightCalls <= inFlight,
       value: operations.peakInFlightCalls,
-      threshold: thresholds.inFlightCalls
+      threshold: inFlight
     });
   }
   return checks;
 }
+function isUsableThreshold(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
 function applyHealthThresholds(state, checks) {
   if (state !== "healthy") return state;
   return checks.some((c) => !c.passed) ? "degraded" : "healthy";
@@ -6623,6 +6657,7 @@ var MCPServer = class {
   logger;
   resources;
   prompts;
+  instructions;
   inFlightRequests = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.host = opts.host;
@@ -6631,6 +6666,7 @@ var MCPServer = class {
       version: MCP_CONSTANTS.CLIENT_INFO.version
     };
     this.logger = opts.logger;
+    this.instructions = opts.instructions?.trim() || void 0;
     this.resources = structuredClone(opts.resources ?? []);
     this.prompts = structuredClone(opts.prompts ?? []);
   }
@@ -6697,7 +6733,8 @@ var MCPServer = class {
             ...this.resources.length > 0 ? { resources: { subscribe: false, listChanged: false } } : {},
             ...this.prompts.length > 0 ? { prompts: { listChanged: false } } : {}
           },
-          serverInfo: this.serverInfo
+          serverInfo: this.serverInfo,
+          ...this.instructions ? { instructions: this.instructions } : {}
         };
       case "ping":
         return {};
@@ -6751,7 +6788,7 @@ var MCPServer = class {
         const input = paramsRecord(params);
         const args = stringRecord(input["arguments"], "prompts/get arguments");
         for (const argument of prompt.arguments ?? []) {
-          if (argument.required && args[argument.name] === void 0) {
+          if (argument.required && !Object.hasOwn(args, argument.name)) {
             throw new Error(`Prompt "${name}" requires argument "${argument.name}"`);
           }
         }
@@ -6850,11 +6887,11 @@ function requiredParamString(params, field, method) {
   return value;
 }
 function stringRecord(value, label2) {
-  if (value === void 0) return {};
+  if (value === void 0) return /* @__PURE__ */ Object.create(null);
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${label2} must be an object`);
   }
-  const result = {};
+  const result = /* @__PURE__ */ Object.create(null);
   for (const [key, item] of Object.entries(value)) {
     if (typeof item !== "string") throw new Error(`${label2}.${key} must be a string`);
     result[key] = item;
@@ -6863,7 +6900,7 @@ function stringRecord(value, label2) {
 }
 function renderPromptTemplate(template, args) {
   return template.replace(/\{\{([A-Za-z_][A-Za-z0-9_.-]*)\}\}/g, (_match, name) => {
-    const value = args[name];
+    const value = Object.hasOwn(args, name) ? args[name] : void 0;
     if (value === void 0) throw new Error(`Missing prompt template argument "${name}"`);
     return value;
   });
@@ -6902,6 +6939,7 @@ function serveStdio(server, opts = {}) {
   let bufferBytes = 0;
   let closed = false;
   let bufferTooLarge = false;
+  const decoder = new TextDecoder();
   let writeChain = Promise.resolve();
   const inFlightHandlers = /* @__PURE__ */ new Set();
   const writeLine = (s) => {
@@ -6924,7 +6962,7 @@ function serveStdio(server, opts = {}) {
   };
   const onData = (chunk) => {
     if (bufferTooLarge) return;
-    const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    const text = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
     buffer += text;
     bufferBytes += Buffer.byteLength(text, "utf8");
     if (bufferBytes > HTTP_BODY_CAP) {
@@ -7215,8 +7253,8 @@ var MCPVaultTokenStore = class {
   async readFile() {
     let raw;
     try {
-      const stat2 = await fs3.stat(this.filePath);
-      if (stat2.size > MAX_STORE_BYTES) throw new Error("MCP token store exceeds size limit");
+      const stat3 = await fs3.stat(this.filePath);
+      if (stat3.size > MAX_STORE_BYTES) throw new Error("MCP token store exceeds size limit");
       raw = await fs3.readFile(this.filePath, "utf8");
     } catch (error) {
       if (error.code === "ENOENT") return emptyFile();

package/dist/server.d.ts

@@ -67,6 +67,11 @@ export interface MCPServerOptions {
     resources?: MCPServerResource[] | undefined;
     /** Explicit allowlist only; omitted means this server exposes no prompts. */
     prompts?: MCPServerPrompt[] | undefined;
+    /**
+     * `InitializeResult.instructions`: how and when to use this server. Clients
+     * that honour it (Claude Code does) put it in front of the model.
+     */
+    instructions?: string | undefined;
 }
 export declare class MCPServer {
     private readonly host;
@@ -74,6 +79,7 @@ export declare class MCPServer {
     private readonly logger?;
     private readonly resources;
     private readonly prompts;
+    private readonly instructions;
     private readonly inFlightRequests;
     constructor(opts: MCPServerOptions);
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/mcp",
-  "version": "1.0.27",
+  "version": "1.0.29",
   "license": "MIT",
   "description": "WrongStack Model Context Protocol client and registry: stdio, SSE, and streamable HTTP transports.",
   "repository": {
@@ -26,7 +26,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "1.0.27",
+    "@wrongstack/core": "1.0.29",
     "undici": "^8.10.2"
   },
   "devDependencies": {