@wrongstack/mcp 1.0.29 → 1.0.33

package/dist/registry-catalog-operations.d.ts

@@ -0,0 +1,29 @@
+import { type MCPInsertionPolicy, type MCPPromptInsertion, type MCPResourceInsertion } from './content-selection.js';
+import type { MCPGetPromptResult, MCPPrompt, MCPReadResourceResult, MCPResource, MCPResourceTemplate } from './protocol.js';
+import type { MCPRegistryCatalog } from './registry-types.js';
+export interface RegistryCatalogOperationsHost {
+    servers: Map<string, import('./registry-slots.js').ServerSlot>;
+    disabledServers: Map<string, import('@wrongstack/core/types').MCPServerConfig>;
+    requireSlot: (name: string) => import('./registry-slots.js').ServerSlot;
+    withConnectedClient: <T>(name: string, run: (client: import('./client.js').MCPClient, assertCurrent: () => void) => Promise<T>) => Promise<T>;
+    persistCapabilityManifest: (slot: import('./registry-slots.js').ServerSlot) => Promise<void>;
+    readResource: (name: string, uri: string) => Promise<import('./protocol.js').MCPReadResourceResult>;
+    getPrompt: (serverName: string, promptName: string, args?: Record<string, string> | undefined) => Promise<import('./protocol.js').MCPGetPromptResult>;
+}
+export declare function getCatalog(this: RegistryCatalogOperationsHost, name: string): MCPRegistryCatalog | undefined;
+export declare function listResources(this: RegistryCatalogOperationsHost, name: string, opts?: {
+    refresh?: boolean;
+}): Promise<MCPResource[]>;
+export declare function listResourceTemplates(this: RegistryCatalogOperationsHost, name: string, opts?: {
+    refresh?: boolean;
+}): Promise<MCPResourceTemplate[]>;
+export declare function readResource(this: RegistryCatalogOperationsHost, name: string, uri: string): Promise<MCPReadResourceResult>;
+export declare function selectResourceForInsertion(this: RegistryCatalogOperationsHost, name: string, uri: string, policy?: MCPInsertionPolicy | undefined): Promise<MCPResourceInsertion>;
+export declare function subscribeResource(this: RegistryCatalogOperationsHost, name: string, uri: string): Promise<void>;
+export declare function unsubscribeResource(this: RegistryCatalogOperationsHost, name: string, uri: string): Promise<void>;
+export declare function listPrompts(this: RegistryCatalogOperationsHost, name: string, opts?: {
+    refresh?: boolean;
+}): Promise<MCPPrompt[]>;
+export declare function getPrompt(this: RegistryCatalogOperationsHost, serverName: string, promptName: string, args?: Record<string, string> | undefined): Promise<MCPGetPromptResult>;
+export declare function selectPromptForInsertion(this: RegistryCatalogOperationsHost, serverName: string, promptName: string, args?: Record<string, string> | undefined, policy?: MCPInsertionPolicy | undefined): Promise<MCPPromptInsertion>;
+//# sourceMappingURL=registry-catalog-operations.d.ts.map

package/dist/registry-catalog.d.ts

@@ -1,6 +1,8 @@
 import type { ConnectionState } from './contracts.js';
 import type { MCPPrompt, MCPResource, MCPResourceTemplate, MCPServerMetadata } from './protocol.js';
+import type { ServerSlot } from './registry-slots.js';
 import type { MCPRegistryCatalog } from './registry-types.js';
+export declare function advanceCatalogVersion(slot: ServerSlot, kind: 'resources' | 'resourceTemplates' | 'prompts'): number;
 export declare function collectCatalogPages<Page extends {
     nextCursor?: string | undefined;
 }, Item>(load: (cursor?: string | undefined) => Promise<Page>, select: (page: Page) => Item[]): Promise<Item[]>;

package/dist/registry-slots.d.ts

@@ -26,6 +26,8 @@ export interface ServerSlot {
     resources?: MCPResource[] | undefined;
     resourceTemplates?: MCPResourceTemplate[] | undefined;
     prompts?: MCPPrompt[] | undefined;
+    /** Orders refreshes and list-change invalidations independently per catalog. */
+    catalogVersions?: Partial<Record<'resources' | 'resourceTemplates' | 'prompts', number>> | undefined;
     /** Serializes replacements so rapid list-change notifications cannot restore stale data. */
     manifestWrite?: Promise<void> | undefined;
     attempts: number;
@@ -39,6 +41,8 @@ export interface ServerSlot {
     lastUsed: number;
     /** Single-flight guard so concurrent first-calls trigger only one connect. */
     connecting?: Promise<MCPClient | undefined> | undefined;
+    /** Invalidates asynchronous startup work when a stop interrupts it. */
+    startupGeneration?: number | undefined;
     /** Whether this lazy server's resolver wrappers are registered (register once). */
     registeredLazy: boolean;
     /**

package/dist/registry.d.ts

@@ -1,7 +1,7 @@
 import type { MCPServerConfig } from '@wrongstack/core/types';
 import type { MCPAuthorizationStartResult, MCPAuthorizationStatus } from './authorization-manager.js';
 import type { MCPClient } from './client.js';
-import { type MCPInsertionPolicy, type MCPPromptInsertion, type MCPResourceInsertion } from './content-selection.js';
+import type { MCPInsertionPolicy, MCPPromptInsertion, MCPResourceInsertion } from './content-selection.js';
 import type { ConnectionState } from './contracts.js';
 import { type MCPOperationListener, type MCPServerOperationalHealth } from './operations.js';
 import type { MCPGetPromptResult, MCPPrompt, MCPReadResourceResult, MCPResource, MCPResourceTemplate } from './protocol.js';
@@ -139,6 +139,8 @@ export declare class MCPRegistry {
         refresh?: boolean;
     }): Promise<MCPPrompt[]>;
     getPrompt(serverName: string, promptName: string, args?: Record<string, string> | undefined): Promise<MCPGetPromptResult>;
+    /** Keep all remote requests awake and reject results from superseded clients. */
+    private withConnectedClient;
     selectPromptForInsertion(serverName: string, promptName: string, args?: Record<string, string> | undefined, policy?: MCPInsertionPolicy | undefined): Promise<MCPPromptInsertion>;
     /**
      * Resolve the live tool names for a slot — the registered names in normal
@@ -201,5 +203,6 @@ export declare class MCPRegistry {
     private recordFailure;
     private recordOperation;
     private attemptConnect;
+    private registryCatalogOperationsHost;
 }
 //# sourceMappingURL=registry.d.ts.map

package/dist/server-dispatch.d.ts

@@ -0,0 +1,160 @@
+import type { MCPPromptArgument, MCPPromptMessage, MCPResourceContents } from './protocol.js';
+/**
+ * Server-side MCP. The mirror image of `MCPClient`: instead of consuming a
+ * remote MCP server, this lets WrongStack *be* an MCP server — exposing its
+ * tools to any MCP client (Claude Desktop, another agent, an IDE) over a
+ * JSON-RPC 2.0 stream.
+ *
+ * The protocol core (`MCPServer`) is transport-agnostic: feed it a raw JSON
+ * line via `handleMessage`, get back a response string (or `null` for
+ * notifications). `serveStdio` wires it to stdin/stdout for the canonical
+ * stdio transport.
+ */
+/** A tool descriptor advertised over `tools/list`. */
+export interface MCPServerTool {
+    name: string;
+    description?: string | undefined;
+    inputSchema: Record<string, unknown>;
+}
+/** The result of a `tools/call`, as the host produces it. */
+export interface MCPServerCallResult {
+    /** Text or pre-built MCP content blocks. Strings are wrapped as a text block. */
+    content: unknown;
+    isError: boolean;
+}
+/**
+ * Bridges the MCP server to a tool backend (in the CLI, the `ToolRegistry`).
+ * Kept narrow so the protocol core has no dependency on `@wrongstack/core`.
+ */
+export interface MCPServerToolHost {
+    listTools(): MCPServerTool[] | Promise<MCPServerTool[]>;
+    callTool(name: string, args: Record<string, unknown>, opts?: {
+        signal?: AbortSignal | undefined;
+    }): Promise<MCPServerCallResult>;
+}
+export interface MCPServerResource {
+    uri: string;
+    name: string;
+    title?: string | undefined;
+    description?: string | undefined;
+    mimeType?: string | undefined;
+    size?: number | undefined;
+    contents: MCPResourceContents[];
+}
+export interface MCPServerPrompt {
+    name: string;
+    title?: string | undefined;
+    description?: string | undefined;
+    arguments?: MCPPromptArgument[] | undefined;
+    /** Static rich messages, or a text template using {{argument}} placeholders. */
+    messages?: MCPPromptMessage[] | undefined;
+    template?: string | undefined;
+}
+export interface MCPServerLogger {
+    warn?(msg: string): void;
+    info?(msg: string): void;
+}
+export interface MCPServerOptions {
+    host: MCPServerToolHost;
+    /** Advertised in the `initialize` handshake. Defaults to the wrongstack identity. */
+    serverInfo?: {
+        name: string;
+        version: string;
+    };
+    logger?: MCPServerLogger | undefined;
+    /** Explicit allowlist only; omitted means this server exposes no resources. */
+    resources?: MCPServerResource[] | undefined;
+    /** Explicit allowlist only; omitted means this server exposes no prompts. */
+    prompts?: MCPServerPrompt[] | undefined;
+    /**
+     * `InitializeResult.instructions`: how and when to use this server. Clients
+     * that honour it (Claude Code does) put it in front of the model.
+     */
+    instructions?: string | undefined;
+}
+export interface JsonRpcRequest {
+    jsonrpc?: string | undefined;
+    id?: number | string | null | undefined;
+    method?: string | undefined;
+    params?: unknown | undefined;
+}
+export declare const PARSE_ERROR = -32700;
+export declare const INVALID_REQUEST = -32600;
+export declare const METHOD_NOT_FOUND = -32601;
+export declare const INVALID_PARAMS = -32602;
+export declare const INTERNAL_ERROR = -32603;
+export declare class MCPServer {
+    private readonly host;
+    private readonly serverInfo;
+    private readonly logger?;
+    private readonly resources;
+    private readonly prompts;
+    private readonly instructions;
+    private readonly inFlightRequests;
+    constructor(opts: MCPServerOptions);
+    /**
+     * Handle one raw JSON-RPC line. Returns the response JSON string for
+     * requests, or `null` for notifications (no `id`) and for blank input —
+     * the caller should write the string to its output stream when non-null.
+     */
+    handleMessage(raw: string): Promise<string | null>;
+    private dispatch;
+    /**
+     * WS-026: enforce the `inputSchema` this server advertises on `tools/list`.
+     *
+     * `tools/call` used to forward `params.arguments` to the host verbatim after
+     * checking only that it was a non-array object — so every `enum`, `required`,
+     * `additionalProperties: false`, and numeric bound in the published schema
+     * was advisory. A client (or an attacker who reached the transport) could
+     * send `{mode: "../../etc"}` to a tool whose schema declares
+     * `enum: ["read","write"]` and the tool would receive it. Publishing a
+     * contract and not enforcing it is worse than publishing none: downstream
+     * tools are written against the schema they declared.
+     *
+     * SCOPE: `validateAgainstSchema` is the shared validator that also gates the
+     * agent's own tool executor. It checks `type`, `enum`, `required`, recurses
+     * through `properties`/`items`, enforces numeric bounds
+     * (`minimum`/`maximum`), rejects unknown keys on strict-closed objects
+     * (`additionalProperties: false`), validates the `additionalProperties`
+     * subschema form against unknown-key values, applies `patternProperties`
+     * to matching keys, enforces string lengths (`minLength`/`maxLength`) and
+     * `pattern`, array lengths (`minItems`/`maxItems`/`uniqueItems`), and the
+     * combinators `allOf`/`anyOf`/`oneOf` (all landed 2026-09-11). Still
+     * advisory per the 2026-09-11 usage survey: `const` and `$ref` — declared
+     * only in the techstack rulebook, which validates with its own
+     * `validateRulebook`, not this validator.
+     *
+     * Unknown tool names are left alone — the host owns that error, and
+     * answering "no such tool" here would fork the message for no benefit.
+     */
+    private assertArgumentsMatchSchema;
+    private encodeError;
+}
+/** Cap on how many schema violations are echoed back in one error message. */
+export declare const MAX_REPORTED_SCHEMA_ERRORS = 5;
+/**
+ * Marks a `tools/call` rejected by {@link MCPServer.assertArgumentsMatchSchema}
+ * so `handleMessage` can answer with JSON-RPC `-32602 Invalid params` rather
+ * than the generic internal-error code every other throw maps to.
+ */
+export declare class InvalidToolArgumentsError extends Error {
+    readonly name = "InvalidToolArgumentsError";
+}
+export declare const SERVER_PAGE_SIZE = 100;
+export declare function paginate<T>(items: T[], params: unknown): {
+    items: T[];
+    nextCursor?: string | undefined;
+};
+export declare function paramsRecord(params: unknown): Record<string, unknown>;
+export declare function requiredParamString(params: unknown, field: string, method: string): string;
+export declare function stringRecord(value: unknown, label: string): Record<string, string>;
+export declare function renderPromptTemplate(template: string, args: Record<string, string>): string;
+export declare const METHOD_NOT_FOUND_SENTINEL: unique symbol;
+export declare function isMCPContentBlock(c: unknown): boolean;
+/** Normalize a host result's content into MCP content blocks. */
+export declare function toContentBlocks(content: unknown): Array<{
+    type: string;
+    [key: string]: unknown;
+}>;
+export declare function stringifyItem(c: unknown): string;
+//# sourceMappingURL=server-dispatch.d.ts.map

package/dist/server-http.d.ts

@@ -0,0 +1,60 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import type { MCPServer, MCPServerLogger } from './server-dispatch.js';
+export interface ServeHttpOptions {
+    /** TCP port. 0 picks an ephemeral port (resolved in the handle). Default 0. */
+    port?: number | undefined;
+    /** Bind address. Default '127.0.0.1' (loopback only). */
+    host?: string | undefined;
+    /**
+     * Bearer token required on every request (`Authorization: Bearer <token>`).
+     * REQUIRED when binding to a non-loopback host — `serveHttp` refuses to
+     * expose tools to the network without one.
+     */
+    token?: string | undefined;
+    logger?: MCPServerLogger | undefined;
+}
+export interface ServeHttpHandle {
+    port: number;
+    host: string;
+    url: string;
+    close(): Promise<void>;
+}
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Run an `MCPServer` over HTTP: POST a single JSON-RPC request, get the JSON
+ * response (notifications → 202 with no body). Reuses `handleMessage`, so the
+ * protocol is identical to the stdio transport.
+ *
+ * Security: binds to loopback by default. Binding to any other host (e.g.
+ * `0.0.0.0`) REQUIRES a `token` — otherwise this rejects, because it would
+ * otherwise expose tool execution to the whole network unauthenticated.
+ */
+export declare function serveHttp(server: MCPServer, opts?: ServeHttpOptions): Promise<ServeHttpHandle>;
+export declare function handleHttpRequest(server: MCPServer, req: IncomingMessage, res: ServerResponse, token: string | undefined, log: MCPServerLogger | undefined, boundHost: string): Promise<void>;
+/** Hostnames that always denote this machine, regardless of the bind address. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Reject a request whose `Origin` names a site other than this server.
+ *
+ * A missing `Origin` is accepted: the clients this transport exists for
+ * (Claude Desktop, IDE extensions, `curl`) are not browsers and never send
+ * one. A browser, which is the threat here, always attaches it on a
+ * cross-origin request and cannot forge it.
+ */
+export declare function originIsAcceptable(req: IncomingMessage, boundHost: string): boolean;
+/**
+ * Pin the `Host` header to the bound address. Without this, an attacker
+ * registers `evil.example → 127.0.0.1`, gets a victim's browser to load a page
+ * there, and every request is same-origin by the browser's reckoning while
+ * landing on this server (DNS rebinding).
+ */
+export declare function hostHeaderIsAcceptable(req: IncomingMessage, boundHost: string): boolean;
+/** `application/json`, with or without parameters such as `; charset=utf-8`. */
+export declare function isJsonContentType(value: string | undefined): boolean;
+/**
+ * Constant-time bearer comparison. `auth !== expected` short-circuits on the
+ * first differing byte, which leaks the token prefix to a caller that can time
+ * responses — and a local attacker can time them very precisely.
+ */
+export declare function bearerTokenMatches(header: string | undefined, token: string): boolean;
+//# sourceMappingURL=server-http.d.ts.map

package/dist/server-stdio.d.ts

@@ -0,0 +1,19 @@
+import type { MCPServer } from './server-dispatch.js';
+export interface ServeStdioHandle {
+    /** Stop reading and detach listeners. Does not exit the process. */
+    close(): void;
+    /** Resolves when the input stream ends (EOF). */
+    done: Promise<void>;
+}
+export interface ServeStdioOptions {
+    stdin?: NodeJS.ReadableStream | undefined;
+    stdout?: NodeJS.WritableStream | undefined;
+}
+/**
+ * Run an `MCPServer` over stdio: newline-delimited JSON-RPC in on stdin,
+ * responses out on stdout. CRITICAL: nothing else may write to stdout while
+ * this runs — it is the JSON-RPC channel. Route all logging to stderr.
+ */
+export declare function serveStdio(server: MCPServer, opts?: ServeStdioOptions): ServeStdioHandle;
+export declare const HTTP_BODY_CAP: number;
+//# sourceMappingURL=server-stdio.d.ts.map

package/dist/server.d.ts

@@ -1,182 +1,7 @@
-import { type IncomingMessage, type ServerResponse } from 'node:http';
-import type { MCPPromptArgument, MCPPromptMessage, MCPResourceContents } from './protocol.js';
-/**
- * Server-side MCP. The mirror image of `MCPClient`: instead of consuming a
- * remote MCP server, this lets WrongStack *be* an MCP server — exposing its
- * tools to any MCP client (Claude Desktop, another agent, an IDE) over a
- * JSON-RPC 2.0 stream.
- *
- * The protocol core (`MCPServer`) is transport-agnostic: feed it a raw JSON
- * line via `handleMessage`, get back a response string (or `null` for
- * notifications). `serveStdio` wires it to stdin/stdout for the canonical
- * stdio transport.
- */
-/** A tool descriptor advertised over `tools/list`. */
-export interface MCPServerTool {
-    name: string;
-    description?: string | undefined;
-    inputSchema: Record<string, unknown>;
-}
-/** The result of a `tools/call`, as the host produces it. */
-export interface MCPServerCallResult {
-    /** Text or pre-built MCP content blocks. Strings are wrapped as a text block. */
-    content: unknown;
-    isError: boolean;
-}
-/**
- * Bridges the MCP server to a tool backend (in the CLI, the `ToolRegistry`).
- * Kept narrow so the protocol core has no dependency on `@wrongstack/core`.
- */
-export interface MCPServerToolHost {
-    listTools(): MCPServerTool[] | Promise<MCPServerTool[]>;
-    callTool(name: string, args: Record<string, unknown>, opts?: {
-        signal?: AbortSignal | undefined;
-    }): Promise<MCPServerCallResult>;
-}
-export interface MCPServerResource {
-    uri: string;
-    name: string;
-    title?: string | undefined;
-    description?: string | undefined;
-    mimeType?: string | undefined;
-    size?: number | undefined;
-    contents: MCPResourceContents[];
-}
-export interface MCPServerPrompt {
-    name: string;
-    title?: string | undefined;
-    description?: string | undefined;
-    arguments?: MCPPromptArgument[] | undefined;
-    /** Static rich messages, or a text template using {{argument}} placeholders. */
-    messages?: MCPPromptMessage[] | undefined;
-    template?: string | undefined;
-}
-export interface MCPServerLogger {
-    warn?(msg: string): void;
-    info?(msg: string): void;
-}
-export interface MCPServerOptions {
-    host: MCPServerToolHost;
-    /** Advertised in the `initialize` handshake. Defaults to the wrongstack identity. */
-    serverInfo?: {
-        name: string;
-        version: string;
-    };
-    logger?: MCPServerLogger | undefined;
-    /** Explicit allowlist only; omitted means this server exposes no resources. */
-    resources?: MCPServerResource[] | undefined;
-    /** Explicit allowlist only; omitted means this server exposes no prompts. */
-    prompts?: MCPServerPrompt[] | undefined;
-    /**
-     * `InitializeResult.instructions`: how and when to use this server. Clients
-     * that honour it (Claude Code does) put it in front of the model.
-     */
-    instructions?: string | undefined;
-}
-export declare class MCPServer {
-    private readonly host;
-    private readonly serverInfo;
-    private readonly logger?;
-    private readonly resources;
-    private readonly prompts;
-    private readonly instructions;
-    private readonly inFlightRequests;
-    constructor(opts: MCPServerOptions);
-    /**
-     * Handle one raw JSON-RPC line. Returns the response JSON string for
-     * requests, or `null` for notifications (no `id`) and for blank input —
-     * the caller should write the string to its output stream when non-null.
-     */
-    handleMessage(raw: string): Promise<string | null>;
-    private dispatch;
-    /**
-     * WS-026: enforce the `inputSchema` this server advertises on `tools/list`.
-     *
-     * `tools/call` used to forward `params.arguments` to the host verbatim after
-     * checking only that it was a non-array object — so every `enum`, `required`,
-     * `additionalProperties: false`, and numeric bound in the published schema
-     * was advisory. A client (or an attacker who reached the transport) could
-     * send `{mode: "../../etc"}` to a tool whose schema declares
-     * `enum: ["read","write"]` and the tool would receive it. Publishing a
-     * contract and not enforcing it is worse than publishing none: downstream
-     * tools are written against the schema they declared.
-     *
-     * SCOPE: `validateAgainstSchema` is the shared validator that also gates the
-     * agent's own tool executor. It checks `type`, `enum`, `required`, recurses
-     * through `properties`/`items`, enforces numeric bounds
-     * (`minimum`/`maximum`), rejects unknown keys on strict-closed objects
-     * (`additionalProperties: false`), validates the `additionalProperties`
-     * subschema form against unknown-key values, applies `patternProperties`
-     * to matching keys, enforces string lengths (`minLength`/`maxLength`) and
-     * `pattern`, array lengths (`minItems`/`maxItems`/`uniqueItems`), and the
-     * combinators `allOf`/`anyOf`/`oneOf` (all landed 2026-09-11). Still
-     * advisory per the 2026-09-11 usage survey: `const` and `$ref` — declared
-     * only in the techstack rulebook, which validates with its own
-     * `validateRulebook`, not this validator.
-     *
-     * Unknown tool names are left alone — the host owns that error, and
-     * answering "no such tool" here would fork the message for no benefit.
-     */
-    private assertArgumentsMatchSchema;
-    private encodeError;
-}
-/**
- * Marks a `tools/call` rejected by {@link MCPServer.assertArgumentsMatchSchema}
- * so `handleMessage` can answer with JSON-RPC `-32602 Invalid params` rather
- * than the generic internal-error code every other throw maps to.
- */
-export declare class InvalidToolArgumentsError extends Error {
-    readonly name = "InvalidToolArgumentsError";
-}
-/** Normalize a host result's content into MCP content blocks. */
-export declare function toContentBlocks(content: unknown): Array<{
-    type: string;
-    [key: string]: unknown;
-}>;
-export interface ServeStdioHandle {
-    /** Stop reading and detach listeners. Does not exit the process. */
-    close(): void;
-    /** Resolves when the input stream ends (EOF). */
-    done: Promise<void>;
-}
-export interface ServeStdioOptions {
-    stdin?: NodeJS.ReadableStream | undefined;
-    stdout?: NodeJS.WritableStream | undefined;
-}
-/**
- * Run an `MCPServer` over stdio: newline-delimited JSON-RPC in on stdin,
- * responses out on stdout. CRITICAL: nothing else may write to stdout while
- * this runs — it is the JSON-RPC channel. Route all logging to stderr.
- */
-export declare function serveStdio(server: MCPServer, opts?: ServeStdioOptions): ServeStdioHandle;
-export interface ServeHttpOptions {
-    /** TCP port. 0 picks an ephemeral port (resolved in the handle). Default 0. */
-    port?: number | undefined;
-    /** Bind address. Default '127.0.0.1' (loopback only). */
-    host?: string | undefined;
-    /**
-     * Bearer token required on every request (`Authorization: Bearer <token>`).
-     * REQUIRED when binding to a non-loopback host — `serveHttp` refuses to
-     * expose tools to the network without one.
-     */
-    token?: string | undefined;
-    logger?: MCPServerLogger | undefined;
-}
-export interface ServeHttpHandle {
-    port: number;
-    host: string;
-    url: string;
-    close(): Promise<void>;
-}
-/**
- * Run an `MCPServer` over HTTP: POST a single JSON-RPC request, get the JSON
- * response (notifications → 202 with no body). Reuses `handleMessage`, so the
- * protocol is identical to the stdio transport.
- *
- * Security: binds to loopback by default. Binding to any other host (e.g.
- * `0.0.0.0`) REQUIRES a `token` — otherwise this rejects, because it would
- * otherwise expose tool execution to the whole network unauthenticated.
- */
-export declare function serveHttp(server: MCPServer, opts?: ServeHttpOptions): Promise<ServeHttpHandle>;
-export declare function handleHttpRequest(server: MCPServer, req: IncomingMessage, res: ServerResponse, token: string | undefined, log: MCPServerLogger | undefined, boundHost: string): Promise<void>;
+export type { MCPServerCallResult, MCPServerLogger, MCPServerOptions, MCPServerPrompt, MCPServerResource, MCPServerTool, MCPServerToolHost, } from './server-dispatch.js';
+export { InvalidToolArgumentsError, MCPServer, toContentBlocks } from './server-dispatch.js';
+export type { ServeHttpHandle, ServeHttpOptions } from './server-http.js';
+export { handleHttpRequest, serveHttp } from './server-http.js';
+export type { ServeStdioHandle, ServeStdioOptions } from './server-stdio.js';
+export { serveStdio } from './server-stdio.js';
 //# sourceMappingURL=server.d.ts.map

package/dist/sse-reader.d.ts

@@ -1,6 +1,8 @@
 export declare class SSEReader {
     private buffer;
+    private skipLeadingLF;
     private dataLines;
+    private dataLength;
     private eventName;
     private endpointListeners;
     /**

package/dist/transport-sse.d.ts

@@ -13,6 +13,8 @@ export declare class SSETransport extends BaseHTTPTransport {
     private _nextId;
     private readerDone;
     private closed;
+    private toolCatalogVersion;
+    private toolCatalogRevision;
     private readLoopAbort?;
     private reader?;
     /** POST target announced by the server's `endpoint` event. */

package/dist/transport-streamable.d.ts

@@ -8,6 +8,8 @@ import { BaseHTTPTransport, type HttpTransportOptions } from './transport-base.j
 export declare class StreamableHTTPTransport extends BaseHTTPTransport {
     private _nextId;
     private closed;
+    private toolCatalogVersion;
+    private toolCatalogRevision;
     private sessionId?;
     constructor(opts: HttpTransportOptions);
     protected genId(): number;

package/dist/wrap-tool.d.ts

@@ -16,5 +16,5 @@ export interface MCPToolCallObserver {
         ok: boolean;
     }, caller?: ElicitationRequester | undefined): void;
 }
-export declare function wrapMCPTool(serverName: string, mcpTool: MCPTool, client: MCPClientResolver, permission?: Permission, observer?: MCPToolCallObserver | undefined): Tool;
+export declare function wrapMCPTool(serverName: string, mcpTool: MCPTool, client: MCPClientResolver, permission?: Permission, sandboxTrust?: boolean, observer?: MCPToolCallObserver | undefined): Tool;
 //# sourceMappingURL=wrap-tool.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/mcp",
-  "version": "1.0.29",
+  "version": "1.0.33",
   "license": "MIT",
   "description": "WrongStack Model Context Protocol client and registry: stdio, SSE, and streamable HTTP transports.",
   "repository": {
@@ -26,7 +26,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "1.0.29",
+    "@wrongstack/core": "1.0.33",
     "undici": "^8.10.2"
   },
   "devDependencies": {