aimcpgate 0.2.0

package/README.md

@@ -0,0 +1,19 @@
+# aimcpgate (npm wrapper)
+
+npm wrapper for [aiMCPGate](https://github.com/akomyagin/aiMCPGate) — an MCP
+gateway/proxy written in Go: one MCP endpoint that multiplexes calls across
+several upstream MCP servers, aggregates their tool catalogs, and logs every
+call.
+
+This package contains no code of its own: on install it downloads the
+prebuilt `mcp-gate` binary for your platform from the project's GitHub
+Releases and verifies its SHA256 checksum.
+
+```bash
+npx aimcpgate serve -c ./config.yaml
+```
+
+Full documentation, configuration reference, and sources:
+<https://github.com/akomyagin/aiMCPGate>.
+
+License: MIT.

package/bin/mcp-gate.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// Thin shim around the real mcp-gate Go binary: makes sure it is present
+// (postinstall normally fetched it; installs done with --ignore-scripts get a
+// lazy download on first run) and then execs it with stdio inherited — the
+// gateway talks MCP over stdin/stdout, so the pipes must pass through
+// untouched.
+'use strict';
+
+const { spawn } = require('child_process');
+const { ensureBinary, binaryPath, isValidBinary } = require('../install.js');
+
+async function main() {
+  let bin = binaryPath();
+  if (!isValidBinary(bin)) {
+    // Missing OR truncated to zero bytes (interrupted install) — (re)download.
+    bin = await ensureBinary();
+  }
+
+  const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' });
+  child.on('error', (err) => {
+    console.error(`mcp-gate: failed to start ${bin}: ${err.message}`);
+    process.exit(1);
+  });
+  child.on('exit', (code, signal) => {
+    if (signal) {
+      // Re-raise the signal so callers observe the same termination cause.
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code === null ? 1 : code);
+  });
+}
+
+main().catch((err) => {
+  console.error(`mcp-gate: ${String(err.message || err)}`);
+  process.exit(1);
+});

package/install.js

@@ -0,0 +1,172 @@
+// aimcpgate npm installer: downloads the prebuilt `mcp-gate` binary for this
+// platform from GitHub Releases and verifies its SHA256 checksum against the
+// release's SHA256SUMS before extracting it into npm/bin/.
+//
+// Runs as the package's postinstall script; the bin/mcp-gate.js shim also
+// requires ensureBinary() from here, so an install done with --ignore-scripts
+// still self-heals lazily on first run.
+//
+// Zero external dependencies by design: only Node's standard library.
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const https = require('https');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const REPO = 'akomyagin/aiMCPGate';
+
+// VERSION_PLACEHOLDER is what package.json carries in the repo checkout; the
+// release workflow stamps the real tag version before `npm publish`. Seeing it
+// at install time means a dev checkout, where there is no release to download.
+const VERSION_PLACEHOLDER = '0.0.0-dev';
+
+// binaryPath returns where the downloaded binary lives (or will live).
+function binaryPath() {
+  const exe = process.platform === 'win32' ? 'mcp-gate.exe' : 'mcp-gate';
+  return path.join(__dirname, 'bin', exe);
+}
+
+// isValidBinary reports whether the binary at p looks installed: it must exist
+// and be non-empty. An interrupted install (killed process, full disk) can
+// leave a truncated/zero-size file behind — treating it as "not installed"
+// lets ensureBinary re-download it, keeping the lazy self-heal promise. No
+// full checksum here by design: that would cost a network round-trip on every
+// CLI invocation; this only guards against an obviously broken empty file.
+function isValidBinary(p) {
+  try {
+    return fs.statSync(p).size > 0;
+  } catch {
+    return false; // missing (or unreadable) — not installed
+  }
+}
+
+// assetName maps the Node platform/arch to the goreleaser archive name
+// (name_template in .goreleaser.yaml: mcp-gate_<version>_<os>_<arch>, tar.gz
+// everywhere except a zip override for windows).
+function assetName(version) {
+  const goos = { linux: 'linux', darwin: 'darwin', win32: 'windows' }[process.platform];
+  const goarch = { x64: 'amd64', arm64: 'arm64' }[process.arch];
+  if (!goos || !goarch) {
+    throw new Error(
+      `aimcpgate: no prebuilt mcp-gate binary for ${process.platform}/${process.arch}; ` +
+      `build from source: https://github.com/${REPO}`
+    );
+  }
+  const ext = goos === 'windows' ? 'zip' : 'tar.gz';
+  return `mcp-gate_${version}_${goos}_${goarch}.${ext}`;
+}
+
+// download GETs a URL (following redirects — GitHub release assets redirect to
+// a CDN) and resolves with the response body as a Buffer.
+function download(url, redirectsLeft = 5) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, { headers: { 'User-Agent': 'aimcpgate-npm-installer' } }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        if (redirectsLeft <= 0) return reject(new Error(`too many redirects fetching ${url}`));
+        return resolve(download(res.headers.location, redirectsLeft - 1));
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error(`GET ${url}: HTTP ${res.statusCode}`));
+      }
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve(Buffer.concat(chunks)));
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+  });
+}
+
+// verifyChecksum checks the archive against its SHA256SUMS entry
+// ("<hex>  <asset>" per line) and throws on any mismatch or missing entry.
+function verifyChecksum(archive, asset, sumsText) {
+  let expected = null;
+  for (const line of sumsText.split('\n')) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length === 2 && fields[1] === asset) {
+      expected = fields[0].toLowerCase();
+      break;
+    }
+  }
+  if (!expected) {
+    throw new Error(`SHA256SUMS has no entry for ${asset}`);
+  }
+  const actual = crypto.createHash('sha256').update(archive).digest('hex');
+  if (actual !== expected) {
+    throw new Error(`checksum mismatch for ${asset}: expected ${expected}, got ${actual}`);
+  }
+}
+
+// extract unpacks the verified archive into npm/bin/. It shells out to the
+// system `tar` rather than hand-rolling a tar/zip parser: with zero allowed
+// npm dependencies a correct parser is the riskier path, while `tar` ships on
+// every platform this package supports — Linux, macOS, and Windows 10+ (whose
+// bundled bsdtar extracts .zip archives too, covering the windows asset).
+function extract(archive, asset) {
+  const binDir = path.join(__dirname, 'bin');
+  fs.mkdirSync(binDir, { recursive: true });
+  const tmp = path.join(os.tmpdir(), `aimcpgate-${process.pid}-${asset}`);
+  fs.writeFileSync(tmp, archive);
+  try {
+    execFileSync('tar', ['-xf', tmp, '-C', binDir], { stdio: 'inherit' });
+  } finally {
+    fs.rmSync(tmp, { force: true });
+  }
+}
+
+// ensureBinary downloads, verifies, and extracts the binary if it is not
+// already present. Returns the binary path. Exported for the bin shim's lazy
+// path (installs done with --ignore-scripts).
+async function ensureBinary() {
+  const bin = binaryPath();
+  if (isValidBinary(bin)) return bin;
+
+  const version = require('./package.json').version;
+  if (version === VERSION_PLACEHOLDER) {
+    throw new Error(
+      'aimcpgate: package.json still carries the dev placeholder version — ' +
+      'this is a repo checkout, not a published package; build mcp-gate from source instead'
+    );
+  }
+
+  const asset = assetName(version);
+  const base = `https://github.com/${REPO}/releases/download/v${version}`;
+  console.log(`aimcpgate: downloading ${asset} ...`);
+  const [archive, sums] = await Promise.all([
+    download(`${base}/${asset}`),
+    download(`${base}/SHA256SUMS`),
+  ]);
+  verifyChecksum(archive, asset, sums.toString('utf8'));
+  extract(archive, asset);
+
+  if (!fs.existsSync(bin)) {
+    throw new Error(`archive ${asset} did not contain ${path.basename(bin)}`);
+  }
+  if (process.platform !== 'win32') {
+    fs.chmodSync(bin, 0o755);
+  }
+  console.log(`aimcpgate: installed ${bin}`);
+  return bin;
+}
+
+module.exports = { ensureBinary, binaryPath, isValidBinary };
+
+if (require.main === module) {
+  // postinstall entry point. In a dev checkout (placeholder version) there is
+  // nothing to download — skip quietly instead of failing `npm install` on the
+  // repo itself; the real version is stamped in CI before publishing.
+  const version = require('./package.json').version;
+  if (version === VERSION_PLACEHOLDER) {
+    console.log('aimcpgate: dev checkout (placeholder version), skipping binary download');
+    process.exit(0);
+  }
+  ensureBinary().catch((err) => {
+    console.error(String(err.message || err));
+    process.exit(1);
+  });
+}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "aimcpgate",
+  "version": "0.2.0",
+  "description": "MCP gateway/proxy: one MCP endpoint multiplexing several upstream MCP servers, with an aggregated tool catalog and a call log. npm wrapper that downloads the prebuilt mcp-gate Go binary from GitHub Releases.",
+  "bin": {
+    "mcp-gate": "bin/mcp-gate.js"
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/akomyagin/aiMCPGate.git"
+  },
+  "homepage": "https://github.com/akomyagin/aiMCPGate",
+  "bugs": {
+    "url": "https://github.com/akomyagin/aiMCPGate/issues"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "gateway",
+    "proxy",
+    "multiplexer"
+  ],
+  "author": "Alexander Komyagin",
+  "license": "MIT"
+}