@youdotcom-oss/mcp 2.0.3 → 2.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdotcom-oss/mcp",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "description": "You.com API Model Context Protocol Server - For programmatic API access, use @youdotcom-oss/api",
   "license": "MIT",
   "engines": {
@@ -56,13 +56,13 @@
   },
   "mcpName": "io.github.youdotcom-oss/mcp",
   "dependencies": {
-    "@youdotcom-oss/api": "0.2.2",
+    "@youdotcom-oss/api": "0.3.1",
     "zod": "^4.3.6",
     "@hono/mcp": "^0.2.3",
     "@modelcontextprotocol/sdk": "^1.25.3",
     "hono": "^4.11.7"
   },
   "devDependencies": {
-    "@modelcontextprotocol/inspector": "0.19.0"
+    "@modelcontextprotocol/inspector": "0.20.0"
   }
 }

package/src/http.ts

@@ -17,19 +17,20 @@ const extractBearerToken = (authHeader: string | null): string | null => {
 const handleMcpRequest = async (c: Context) => {
   const authHeader = c.req.header('Authorization')
 
-  if (!authHeader) {
-    c.status(401)
-    c.header('Content-Type', 'text/plain')
-    return c.text('Unauthorized: Authorization header required')
-  }
+  let YDC_API_KEY: string | undefined
+
+  if (authHeader) {
+    const token = extractBearerToken(authHeader)
 
-  const YDC_API_KEY = extractBearerToken(authHeader)
+    if (!token) {
+      c.status(401)
+      c.header('Content-Type', 'text/plain')
+      return c.text('Unauthorized: Invalid Bearer token format')
+    }
 
-  if (!YDC_API_KEY) {
-    c.status(401)
-    c.header('Content-Type', 'text/plain')
-    return c.text('Unauthorized: Bearer token required')
+    YDC_API_KEY = token
   }
+
   const mcp = getMCpServer()
   const getUserAgent = useGetClientVersion(mcp)
 

package/src/tests/http.spec.ts

@@ -76,23 +76,39 @@ describe('HTTP Server Endpoints', () => {
     expect(typeof data.version).toBe('string')
   })
 
-  test('mcp endpoint requires authorization header', async () => {
+  test('mcp endpoint allows requests without authorization (free tier)', async () => {
     const response = await fetch(`${baseUrl}/mcp`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
       },
-      body: JSON.stringify({}),
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        method: 'initialize',
+        id: 1,
+        params: {
+          protocolVersion: '2024-11-05',
+          capabilities: {},
+          clientInfo: {
+            name: 'test-client',
+            version: '1.0.0',
+          },
+        },
+      }),
     })
 
-    expect(response.status).toBe(401)
-    expect(response.headers.get('content-type')).toContain('text/plain')
+    // Should succeed without auth header (free tier)
+    expect(response.status).toBe(200)
+    expect(response.headers.get('content-type')).toContain('text/event-stream')
 
     const text = await response.text()
-    expect(text).toBe('Unauthorized: Authorization header required')
+    expect(text).toContain('data:')
+    expect(text).toContain('jsonrpc')
+    expect(text).toContain('result')
   })
 
-  test('mcp endpoint requires Bearer token format', async () => {
+  test('mcp endpoint requires Bearer token format when auth header provided', async () => {
     const response = await fetch(`${baseUrl}/mcp`, {
       method: 'POST',
       headers: {
@@ -106,7 +122,7 @@ describe('HTTP Server Endpoints', () => {
     expect(response.headers.get('content-type')).toContain('text/plain')
 
     const text = await response.text()
-    expect(text).toBe('Unauthorized: Bearer token required')
+    expect(text).toBe('Unauthorized: Invalid Bearer token format')
   })
 
   test('mcp endpoint accepts valid Bearer token', async () => {
@@ -178,20 +194,35 @@ describe('HTTP Server Endpoints', () => {
     expect(text).toContain('capabilities')
   })
 
-  test('mcp endpoint with trailing slash requires authorization', async () => {
+  test('mcp endpoint with trailing slash allows requests without authorization', async () => {
     const response = await fetch(`${baseUrl}/mcp/`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
       },
-      body: JSON.stringify({}),
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        method: 'initialize',
+        id: 1,
+        params: {
+          protocolVersion: '2024-11-05',
+          capabilities: {},
+          clientInfo: {
+            name: 'test-client',
+            version: '1.0.0',
+          },
+        },
+      }),
     })
 
-    expect(response.status).toBe(401)
-    expect(response.headers.get('content-type')).toContain('text/plain')
+    // Should succeed without auth header (free tier)
+    expect(response.status).toBe(200)
+    expect(response.headers.get('content-type')).toContain('text/event-stream')
 
     const text = await response.text()
-    expect(text).toBe('Unauthorized: Authorization header required')
+    expect(text).toContain('data:')
+    expect(text).toContain('jsonrpc')
   })
 })