brewpage-mcp 1.14.4 → 1.15.0

package/README.md

@@ -17,7 +17,7 @@ Choosing a host? See how BrewPage compares with GitHub Pages, Netlify Drop, Tiin
 ## Quick Start
 
 ```bash
-npx -y brewpage-mcp@1.14.4
+npx -y brewpage-mcp@1.15.0
 ```
 
 Requires Node.js 20 or newer. This starts the stdio server for an MCP client.
@@ -33,7 +33,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.14.4"]
+      "args": ["-y", "brewpage-mcp@1.15.0"]
     }
   }
 }
@@ -44,7 +44,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 Register a project-scoped stdio server:
 
 ```bash
-claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.14.4
+claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.15.0
 ```
 
 This writes `.mcp.json` in the project root. Use `--scope user` for user-scoped registration. See the [official Claude Code MCP guide](https://code.claude.com/docs/en/mcp).
@@ -58,7 +58,7 @@ Open **Settings > MCP** and add:
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.14.4"]
+      "args": ["-y", "brewpage-mcp@1.15.0"]
     }
   }
 }
@@ -72,7 +72,7 @@ Open the Cline MCP settings panel and add:
 {
   "brewpage": {
     "command": "npx",
-    "args": ["-y", "brewpage-mcp@1.14.4"]
+    "args": ["-y", "brewpage-mcp@1.15.0"]
   }
 }
 ```
@@ -80,7 +80,7 @@ Open the Cline MCP settings panel and add:
 ### Global Install
 
 ```bash
-npm install -g brewpage-mcp@1.14.4
+npm install -g brewpage-mcp@1.15.0
 brewpage-mcp
 ```
 
@@ -215,7 +215,7 @@ publish_file(url="https://example.com/diagram.png")
 
 Publish a single-page or multi-file HTML site. Pass `entryContent` for a single page or `files` (array of `{path, content}`) for a multi-file site. Supports password protection, TTL, and owner token grouping.
 
-Limits (current values from `get_limits`): a request is at most 25 MB; a site at most 200 files, 5 MB per file and 20 MB in total; each path at most 380 characters. System files such as `.DS_Store` and `__MACOSX/` are skipped and never count; files with an unsupported extension or a too-long path are skipped and reported in notices. Entry: `entry`, else root `index.html`, else the shallowest HTML file. A site limit hit answers 400 with a message naming the limit; 413 means the request is over 25 MB, has too many files and form fields, or a file name/path is too long; 422 means no servable file is left.
+Limits (current values from `get_limits`): a request is at most 25 MB; a site at most 200 files, 5 MB per file and 20 MB in total; each path at most 380 characters. System files such as `.DS_Store` and `__MACOSX/` are skipped and never count; files with an unsupported extension or a too-long path are skipped and reported in notices. Entry: `entry`, else root `index.html`, else the shallowest HTML file. A site limit hit answers 400 with a message naming the limit, as does a PDF/Office file that is unreadable, password-protected or too complex; 413 means the request is over 25 MB, has too many files and form fields, or a file name/path is too long; 422 means no servable file is left; 503 means busy: retry after `Retry-After` seconds (failed publish tools print it).
 
 Parameters: exactly one of `entryContent` (string) or non-empty `files` (array of `{path, content}`), `entry` (optional entry file path, default `index.html`), `namespace` (optional -- omit for private, unlisted content; `public` lists the site in the gallery and sitemap for Google, Bing and AI search; a site always gets its own subdomain), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `ownerToken` (optional, groups site under an existing owner), `deliveryMode` (optional; fresh sites require `subdomain`).
 
@@ -513,6 +513,14 @@ Every publish response includes an **owner token** -- the only credential that a
 
 ## Changelog
 
+## 1.15.0 -- 2026-10-27
+
+- Supports MCP protocol 2026-07-28 (SDK v2).
+
+## 1.14.5 -- 2026-10-27
+
+- Site publish hints add 400 for an unreadable, password-protected or too complex PDF/Office file and 503 when busy; a failed publish on 503 prints `Retry-After`.
+
 ## 1.14.4 -- 2026-10-26
 
 - Remote mode: a request keeps its slot until the tool finishes, and a client disconnect cancels its backend calls and source download; backend calls time out after 60 s. Separate pools for light, write and large calls queue briefly instead of refusing; request body up to 32 MiB. `BREWPAGE_SHARED_EGRESS_CIDRS` and `BREWPAGE_SHARED_EGRESS_LIST_URLS` exempt platform egress from per-IP caps. Tools are unchanged.

package/dist/http.js

@@ -5,9 +5,8 @@ import { lookup as dnsLookup } from "node:dns";
 import { BlockList, isIP } from "node:net";
 import { realpathSync } from "node:fs";
 import { pathToFileURL } from "node:url";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createMcpHandler, InMemoryTransport, isLegacyRequest, LATEST_PROTOCOL_VERSION } from "@modelcontextprotocol/server";
+import { NodeStreamableHTTPServerTransport, toWebRequest } from "@modelcontextprotocol/node";
 import { createServer, OWNER_TOKEN_ENV, USER_AGENT } from "./tools.js";
 const MIB = 1024 * 1024;
 /** Fits the largest site (25 MiB backend request: 20 MiB of inline text plus JSON escaping).
@@ -54,6 +53,7 @@ const VERSION = USER_AGENT.split("/")[1];
 const REMOTE_USER_AGENT = `${USER_AGENT} (remote)`;
 const PARSE_ERROR = -32700;
 const INVALID_REQUEST = -32600;
+const METHOD_NOT_FOUND = -32601;
 const SERVER_ERROR = -32000;
 /** One JSON line per event on stdout; callers never pass arguments, tokens or IPs. */
 function log(fields) {
@@ -342,18 +342,40 @@ function readBody(req, limit, onLarge) {
             finish("aborted");
     });
 }
-/** Tool names from an in-memory handshake; logs name only these. */
+/** Tool names from an in-memory 2025 handshake (raw JSON-RPC, no client package); logs name only these. */
 async function registeredToolNames() {
     const [clientSide, serverSide] = InMemoryTransport.createLinkedPair();
     const server = createServer({ baseUrl: "http://127.0.0.1:9" });
-    const client = new Client({ name: "startup", version: VERSION });
+    const answers = new Map();
+    clientSide.onmessage = (message) => {
+        if ("id" in message && typeof message.id === "number")
+            answers.get(message.id)?.(message);
+    };
+    const call = (id, method, params) => new Promise((resolve) => {
+        answers.set(id, resolve);
+        void clientSide.send({ jsonrpc: "2.0", id, method, params });
+    });
     await server.connect(serverSide);
-    await client.connect(clientSide);
-    const { tools } = await client.listTools();
-    await client.close();
+    await clientSide.start();
+    await call(1, "initialize", { protocolVersion: LATEST_PROTOCOL_VERSION, capabilities: {}, clientInfo: { name: "startup", version: VERSION } });
+    await clientSide.send({ jsonrpc: "2.0", method: "notifications/initialized" });
+    const listed = await call(2, "tools/list", {});
+    await clientSide.close();
     await server.close();
+    const tools = ("result" in listed ? listed.result.tools : undefined) ?? [];
+    if (tools.length === 0)
+        throw new Error("tools/list returned no tools");
     return new Set(tools.map(({ name }) => name));
 }
+/** Tool-level outcome of one JSON-RPC answer; undefined = success. */
+function rpcOutcome(outgoing) {
+    if (outgoing === null || typeof outgoing !== "object")
+        return undefined;
+    if ("error" in outgoing)
+        return "rpc_error";
+    const result = outgoing.result;
+    return result?.isError === true ? "tool_error" : undefined;
+}
 /** Slot pool: global limit with a FIFO wait queue, plus a per-client cap (client undefined = shared egress, no cap). */
 class Pool {
     limit;
@@ -540,6 +562,15 @@ async function main() {
             const toolName = rpc.method === "tools/call" ? rpc.params?.name : undefined;
             entry.method = typeof rpc.method === "string" ? rpc.method.slice(0, MAX_LOGGED_METHOD) : null;
             entry.tool = rpc.method === "tools/call" ? (typeof toolName === "string" && toolNames.has(toolName) ? toolName : "unknown") : null;
+            // Stateless: no server-push streams, as the 2025 GET stream (405); a refused auto-open never fails a connect.
+            if (rpc.method === "subscriptions/listen") {
+                const id = message.id;
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ jsonrpc: "2.0", id: typeof id === "string" || typeof id === "number" ? id : null,
+                    error: { code: METHOD_NOT_FOUND, message: "subscriptions/listen is not supported by this stateless endpoint." } }));
+                entry.outcome = "rpc_error";
+                return;
+            }
             const isLight = rpc.method !== "tools/call" || (typeof toolName === "string" && LIGHT_TOOLS.has(toolName));
             if (toolName === "publish_file" && slot !== heavy && !(await acquire(heavy)))
                 return busy();
@@ -559,13 +590,34 @@ async function main() {
                     : Promise.reject(new Error("Download limit reached for this address; try again in a few minutes.")),
                 fetch: callBackend,
             });
-            const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+            const request = await toWebRequest(req, message, { signal: abort.signal });
+            if (!(await isLegacyRequest(request, message))) {
+                // 2026-07-28 envelope: one exchange through the SDK entry; any SSE body is read to its end.
+                const modern = createMcpHandler(() => server, { legacy: "reject" });
+                try {
+                    const response = await modern.fetch(request, { parsedBody: message });
+                    const text = await response.text();
+                    if ((response.headers.get("content-type") ?? "").startsWith("application/json")) {
+                        try {
+                            entry.outcome = rpcOutcome(JSON.parse(text)) ?? null;
+                        }
+                        catch {
+                            entry.outcome = null;
+                        }
+                    }
+                    res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+                    res.end(text);
+                }
+                finally {
+                    await modern.close();
+                    await server.close();
+                }
+                return;
+            }
+            const transport = new NodeStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
             const send = transport.send.bind(transport);
             transport.send = (outgoing, options) => {
-                if ("error" in outgoing)
-                    entry.outcome = "rpc_error";
-                else if ("result" in outgoing && outgoing.result.isError === true)
-                    entry.outcome = "tool_error";
+                entry.outcome = rpcOutcome(outgoing) ?? entry.outcome;
                 return send(outgoing, options);
             };
             try {

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { createServer, DEFAULT_BASE_URL, OWNER_TOKEN_ENV } from "./tools.js";
 const OWNER_TOKEN_SHAPE = /^[A-Za-z0-9]{32}$/;
 /** Optional default owner token for every call; a malformed value is ignored with one stderr line. */
@@ -12,12 +12,5 @@ const ENV_OWNER_TOKEN = (() => {
     console.error(`${OWNER_TOKEN_ENV} ignored: expected 32 letters/digits.`);
     return undefined;
 })();
-async function main() {
-    const server = createServer({ baseUrl: process.env.BREWPAGE_URL || DEFAULT_BASE_URL, ownerToken: ENV_OWNER_TOKEN });
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
-}
-main().catch((error) => {
-    console.error("Fatal error:", error);
-    process.exit(1);
-});
+/** Serves 2026-07-28 (server/discover) and 2025-era initialize openings from one factory. */
+serveStdio(() => createServer({ baseUrl: process.env.BREWPAGE_URL || DEFAULT_BASE_URL, ownerToken: ENV_OWNER_TOKEN }));

package/dist/tools.d.ts

@@ -1,6 +1,6 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer } from "@modelcontextprotocol/server";
 export declare const DEFAULT_BASE_URL = "https://brewpage.app";
-export declare const USER_AGENT = "brewpage-mcp/1.14.4";
+export declare const USER_AGENT = "brewpage-mcp/1.15.0";
 export declare const OWNER_TOKEN_ENV = "BREWPAGE_OWNER_TOKEN";
 export interface ServerOptions {
     /** BrewPage origin for API calls; default https://brewpage.app. */

package/dist/tools.js

@@ -1,7 +1,7 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer } from "@modelcontextprotocol/server";
 import { z } from "zod";
 export const DEFAULT_BASE_URL = "https://brewpage.app";
-export const USER_AGENT = "brewpage-mcp/1.14.4";
+export const USER_AGENT = "brewpage-mcp/1.15.0";
 export const OWNER_TOKEN_ENV = "BREWPAGE_OWNER_TOKEN";
 const READ_ONLY = { readOnlyHint: true };
 const DESTRUCTIVE = { readOnlyHint: false, destructiveHint: true };
@@ -46,9 +46,14 @@ function maskToken(token) {
 function textResult(text, isError = false) {
     return isError ? { content: [{ type: "text", text }], isError: true } : { content: [{ type: "text", text }] };
 }
+/** ` Retry-After: <value>.` for a busy 503 that sends the header, else empty. */
+function retryAfterText(status, headers) {
+    const after = status === 503 ? headers?.get("retry-after") : null;
+    return after ? ` Retry-After: ${after}.` : "";
+}
 /** Owner-tool failure: the server answer verbatim plus a hint for a plain wrong-token 403 or a frozen old publication. */
-function ownerFailure(operation, status, data, fromEnv) {
-    const lines = [`Failed to ${operation} (${status}): ${JSON.stringify(data)}`];
+function ownerFailure(operation, status, data, fromEnv, headers) {
+    const lines = [`Failed to ${operation} (${status}): ${JSON.stringify(data)}${retryAfterText(status, headers)}`];
     const code = data?.code;
     if (status === 403 && (code === undefined || code === "OWNER_AUTHORIZATION_FAILED")) {
         lines.push(`Wrong owner token for this publication. Use ownerToken from create.${fromEnv ? ` Sent: ${OWNER_TOKEN_ENV}.` : ""}`);
@@ -106,8 +111,9 @@ const DELIVERY_MODE_SCHEMA = z.enum(["path", "subdomain"]).optional().describe("
 const SITE_LIMITS_TEXT = "Default limits (current values: GET /api/limits): a request is at most 25 MB; a site at most 200 files, 5 MB per file and 20 MB in total; " +
     "each path at most 380 characters. System files (.DS_Store, __MACOSX/ and similar) are skipped and never count; files with an unsupported extension " +
     "or a too-long path are skipped and listed in notices. Entry: `entry`, else root index.html, else the shallowest HTML file. " +
-    "Errors: 400 = a site limit exceeded (the message names it), invalid path or no HTML file; 413 = request over 25 MB, " +
-    "too many files and form fields, or a file name/path too long; 422 = no servable file left.";
+    "Errors: 400 = a site limit exceeded (the message names it), invalid path, no HTML file, or a PDF/Office file unreadable, " +
+    "password-protected or too complex; 413 = request over 25 MB, too many files and form fields, or a file name/path too long; " +
+    "422 = no servable file left; 503 = busy, retry after Retry-After seconds.";
 function hostingResponseLines(data) {
     const fields = ["routingCohort", "deliveryMode", "requestedDeliveryMode", "effectiveDeliveryMode",
         "deliveryModeMatched", "modeLocked", "hostingVersion", "access", "managementLink"];
@@ -182,7 +188,7 @@ export function createServer(options = {}) {
     const apiFetch = options.fetch ?? fetch;
     const server = new McpServer({
         name: "brewpage-mcp",
-        version: "1.14.4",
+        version: "1.15.0",
     });
     /** Caller argument first, then the configured default; `fromEnv` marks the configured one. */
     function ownerTokenFor(argument) {
@@ -300,13 +306,13 @@ export function createServer(options = {}) {
         const owner = ownerTokenFor(ownerToken).token;
         if (owner)
             headers["X-Owner-Token"] = owner;
-        const { ok, data } = await apiRequest("POST", path, body, headers);
+        const { ok, status, data, headers: answerHeaders } = await apiRequest("POST", path, body, headers);
         if (!ok) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: `Failed to publish: ${JSON.stringify(data)}`,
+                        text: `Failed to publish: ${JSON.stringify(data)}${retryAfterText(status, answerHeaders)}`,
                     },
                 ],
                 isError: true,
@@ -357,7 +363,7 @@ export function createServer(options = {}) {
                 content: [
                     {
                         type: "text",
-                        text: `Failed to upload file: ${JSON.stringify(data)}`,
+                        text: `Failed to upload file: ${JSON.stringify(data)}${retryAfterText(res.status, res.headers)}`,
                     },
                 ],
                 isError: true,
@@ -577,7 +583,7 @@ export function createServer(options = {}) {
                 content: [
                     {
                         type: "text",
-                        text: `Failed to publish site: ${JSON.stringify(data)}`,
+                        text: `Failed to publish site: ${JSON.stringify(data)}${retryAfterText(res.status, res.headers)}`,
                     },
                 ],
                 isError: true,
@@ -673,7 +679,7 @@ export function createServer(options = {}) {
         const res = await bpFetch(url, { method: "PUT", headers, body: formData });
         const data = await res.json().catch(() => null);
         if (!res.ok)
-            return ownerFailure("republish site", res.status, data, auth.fromEnv);
+            return ownerFailure("republish site", res.status, data, auth.fromEnv, res.headers);
         const site = data;
         const lines = [
             `Site republished successfully (full replace)!`,
@@ -744,7 +750,7 @@ export function createServer(options = {}) {
         inputSchema: {
             deliveryMode: DELIVERY_MODE_SCHEMA,
             json: z
-                .union([z.string(), z.record(z.unknown()), z.array(z.unknown())])
+                .union([z.string(), z.record(z.string(), z.unknown()), z.array(z.unknown())])
                 .describe("JSON document to publish (object, array, or JSON-encoded string)"),
             namespace: z
                 .string()
@@ -843,7 +849,7 @@ export function createServer(options = {}) {
             namespace: z.string().describe("Document namespace"),
             id: z.string().describe("Document ID"),
             json: z
-                .union([z.string(), z.record(z.unknown()), z.array(z.unknown())])
+                .union([z.string(), z.record(z.string(), z.unknown()), z.array(z.unknown())])
                 .describe("New JSON document (object, array, or JSON-encoded string)"),
             ownerToken: z.string().optional().describe(OWNER_TOKEN_DESCRIPTION),
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brewpage-mcp",
-  "version": "1.14.4",
+  "version": "1.15.0",
   "mcpName": "io.github.kochetkov-ma/brewpage-mcp",
   "description": "MCP server for BrewPage — publish and manage HTML, sites, KV, JSON and files from AI assistants",
   "type": "module",
@@ -22,7 +22,7 @@
     "start": "node dist/index.js",
     "start:http": "node dist/http.js",
     "dev": "tsx src/index.ts",
-    "test": "npm run build && node --import tsx --test test/smoke.test.ts test/http.test.ts",
+    "test": "npm run build && node --import tsx --test test/smoke.test.ts test/http.test.ts test/protocol.test.ts",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -54,21 +54,18 @@
     "url": "https://github.com/kochetkov-ma/brewpage-openapi/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "zod": "3.25.76"
+    "@modelcontextprotocol/node": "2.1.2",
+    "@modelcontextprotocol/server": "2.4.0",
+    "zod": "4.6.7"
   },
   "devDependencies": {
+    "@modelcontextprotocol/client": "2.4.0",
     "@types/node": "22.19.15",
     "tsx": "4.22.0",
     "typescript": "5.9.3"
   },
   "overrides": {
     "@hono/node-server": "1.19.15",
-    "body-parser": "2.3.0",
-    "fast-uri": "3.1.8",
-    "hono": "4.13.7",
-    "ip-address": "10.7.1",
-    "proxy-addr": "2.0.8",
-    "qs": "6.16.0"
+    "hono": "4.13.14"
   }
 }