corent-mcp 0.6.0 → 0.8.0

package/README.md

@@ -1,6 +1,6 @@
 # Corent MCP Server
 
-Give any AI agent the ability to generate images, videos, voice, and text through the [Corent](https://corent.tech) API — one key, automatic model routing, provider fallback built in.
+Give any AI agent the ability to generate images, videos, voice, and text through the [Corent](https://corent.tech) API, one key, automatic model routing, provider fallback built in.
 
 ## Tools
 
@@ -8,18 +8,54 @@ Give any AI agent the ability to generate images, videos, voice, and text throug
 |---|---|
 | `plan` | Describe a request in plain language; Corent returns the plan (image vs video, tier, settings) + cost estimate, without generating |
 | `create` | Describe what you want + a spend ceiling; Corent decides everything and generates it (the "zero decisions" path) |
-| `generate_image` | Text → image, synchronous, returns a permanent URL |
+| `generate_image` | Text → image, synchronous, returns a permanent URL. Takes `reference_image_urls` for character and product consistency |
 | `generate_video` | Text (or image) → video, async job |
 | `generate_speech` | Text → spoken audio, synchronous |
-| `generate_text` | Prompt → text from a frontier language model, synchronous, billed per token |
-| `list_models` | The direct-access menu: every model that can be pinned by name, with quality and live status |
+| `generate_text` | Prompt or full conversation → text from a frontier language model. Supports tool calling and JSON mode |
+| `generate_image_batch` | Up to 50 images in one call, async |
+| `generate_video_batch` | Up to 50 clips in one call, async |
+| `get_batch` | Progress of a submitted batch |
+| `list_models` | The direct-access menu: every model that can be pinned by name (`corent-*`), with quality and live status |
+| `list_tiers` | The tier menu: prices, shapes, video resolutions, and which tiers accept reference images or render sound |
+| `list_voices` | The voices `generate_speech` accepts, with previews and descriptors |
+| `cancel_job` | Stop a running job and release its money hold. Costs nothing |
 | `get_job` | Poll a job until completed |
-| `get_balance` | Remaining account balance |
+| `get_balance` | Balance, holds, and what a new request can actually spend |
 | `get_status` | Live tier health |
+| `upscale_image` | Make an existing image bigger and sharper. Flat price, no tier |
+| `remove_background` | Cut the subject out, returns a PNG with a real transparent background |
+| `inpaint_image` | Regenerate only the white region of a mask; every pixel outside it stays byte-for-byte unchanged |
+| `list_media` | What the account already made: the last 100 jobs, filtered by type and prompt keyword, so a result can be reused instead of paid for again |
+| `upload_image` | Base64 in, public https URL out. Use it as `image_url`, `mask_url`, or a reference in the other tools (max 25 MB) |
+
+Every tool description is under 400 characters and every tool carries
+`readOnlyHint` / `destructiveHint` / `openWorldHint` annotations plus the
+ChatGPT `openai/toolInvocation` status strings, so the server can be listed
+as a ChatGPT app as well as a Claude connector.
+
+## Prompts (recipes)
+
+The server also registers five MCP prompts. Each is a step list over the
+tools above: plan, confirm the budget with the user, stills with references,
+clips, narration, poll. Hosts that support prompts show them as slash
+commands; the same five ship as markdown in [`skills/`](skills/) for
+publication as a skills repo.
+
+| Prompt | Arguments | What it makes |
+|---|---|---|
+| `product-ugc-reel` | `product_url`, `brief`, `budget_usd` | Vertical creator-style reel for one product |
+| `character-series` | `character`, `scenes`, `budget_usd` | One consistent character across many scenes |
+| `storyboard-to-clip` | `storyboard`, `style`, `budget_usd` | Numbered storyboard to stills, clips and narration |
+| `ad-variations` | `concept`, `count`, `product_url` | Many versions of one ad visual, in a single batch |
+| `faceless-explainer` | `topic`, `duration_s`, `budget_usd` | Narrated explainer with no presenter |
+
+Prices the recipes quote before spending: image premium ~7c, video premium
+~52c per clip, pro ~84c per clip, speech ~25-30c per started block of 1,000
+characters.
 
 The **`plan`** and **`create`** tools are the agent-native path: an agent says
 what it wants ("a 10s vertical clip of a sunrise for TikTok") and Corent picks
-image-vs-video, the tier, aspect ratio, and duration — the agent never manages
+image-vs-video, the tier, aspect ratio, and duration, the agent never manages
 models. `create` enforces a per-call spend ceiling so an autonomous agent can't
 overspend.
 
@@ -28,12 +64,66 @@ overspend.
 All four `generate_*` tools also take an optional **`model`**: pin an exact
 model from `list_models` and Corent runs that one, never a substitute (if it
 can't deliver, the call fails and nothing is billed). Use it only when the user
-asked for a particular model by name — otherwise omit it and let Corent route
+asked for a particular model by name, otherwise omit it and let Corent route
 to the best fit for the prompt, which is what the tiers are for.
 
+Every name in the menu is spelled `corent-*`: `corent-flux-schnell`,
+`corent-seedance-2.0`, `corent-eleven-multilingual-v2`,
+`corent-claude-opus-5`, and that is the name the receipt echoes back. Pass one
+back verbatim.
+
 `generate_text` is the language-model lane: it puts every frontier lab on the
 same key and the same bill, so an agent can get a named model's answer or a
 second opinion from another lab without the user holding that lab's account.
+Pass `messages` instead of `prompt` to continue a conversation or feed tool
+results back, and `tools` / `response_format` for function calling and JSON.
+
+### Keeping a character or product consistent
+
+`generate_image` takes **`reference_image_urls`**: 1 to 4 public https images
+that the prompt is applied as an *edit* of, so the same face, character, or
+product survives into a new scene. Use it whenever the user wants "the same
+person again", a product placed somewhere, or a matching series. Edit-capable
+models sit at premium and up, so pass `tier` `premium` / `pro` / `max_pro`, or
+no tier at all: `air` and `lite` are refused with a message saying so.
+
+### What the generate tools can ask for
+
+`generate_image` takes a `seed` (so a picture can be re-rendered and tweaked),
+a `negative_prompt`, a `source_image_url` with `strength` to start from an
+existing picture, `transparent` for logos and cutouts, an explicit `width` and
+`height`, `output_format`, and `n` for several versions at once. `n` is n real
+renders at full price, so confirm before spending on more than a couple.
+
+`generate_video` takes `audio` for native sound (true routes only to models
+that actually render it, so a silent model can never quietly serve the ask),
+`end_image_url` for the frame to finish on, a `camera` move, `negative_prompt`,
+`seed` and `fps`.
+
+`generate_speech` takes `stability`, `similarity`, `style`, `speed` and
+`language`. Call `list_voices` first whenever the user wants a particular
+sounding narrator: `voice_id` cannot be guessed.
+
+Anything the chosen model could not honour comes back in
+`meta.unsupported_options`, so an ignored setting never reads as an applied
+one. `enhance_prompt: false` sends the user's wording verbatim.
+
+### Editing what already exists
+
+`upscale_image` and `remove_background` take a public https URL and return a
+new one. `inpaint_image` takes the image, a same-size black-and-white mask
+(white = regenerate, black = keep) and a prompt for the masked region; unlike
+`reference_image_urls`, which re-creates a likeness, the pixels outside the
+mask are your own file, unchanged. `upload_image` turns a local file into a
+URL any of these accept, and `list_media` finds an earlier result by prompt
+keyword ("the beach one") so it can be reused rather than re-generated.
+
+### Spending safety
+
+Every money-spending call carries an `Idempotency-Key`, and a 429 or 5xx is
+retried under that same key, so a retry replays the original job instead of
+buying a second one. Batches bill per item: a 30-item image batch costs 30
+generations, so check `get_balance` first.
 
 ## Setup
 
@@ -57,7 +147,7 @@ For Claude Code: `claude mcp add corent -e CORENT_API_KEY=co_live_... -- npx -y
 
 The hosted server at `https://mcp.corent.tech/mcp` uses the Streamable HTTP
 transport and supports **OAuth**: in claude.ai (Settings → Connectors → Add
-custom connector) just enter the URL with no key — you'll be sent to a Corent
+custom connector) just enter the URL with no key, you'll be sent to a Corent
 page to approve access. Your API key is verified once, sealed into an encrypted
 connection token, and never shown to the client. Revoking the key in your
 dashboard disconnects the client instantly.
@@ -79,7 +169,7 @@ Non-OAuth clients can instead pass an API key in the **Authorization header**:
 
 > **Smithery note:** for compatibility with Smithery, the hosted server also
 > accepts the key via query parameters (`?corent_api_key=...` or Smithery's
-> base64 `?config=`). Avoid this form anywhere else — URLs can be logged by
+> base64 `?config=`). Avoid this form anywhere else, URLs can be logged by
 > proxies, gateways, and access logs, which would expose your key. Prefer the
 > Authorization header.
 
@@ -92,5 +182,7 @@ CORENT_API_KEY=... node dist/index.js
 ```
 
 The hosted entrypoint (`dist/http.js`) additionally needs `MCP_TOKEN_SECRET`
-(random string; encrypts OAuth tokens — rotating it logs every connector out)
+(random string; encrypts OAuth tokens, rotating it logs every connector out)
 and optionally `MCP_PUBLIC_URL` (defaults to `https://mcp.corent.tech`).
+Set `OPENAI_APPS_CHALLENGE_TOKEN` to serve the ChatGPT Apps domain
+verification at `/.well-known/openai-apps-challenge` (404 while unset).

package/dist/http-app.js

@@ -0,0 +1,227 @@
+/**
+ * The hosted server's request handler, split out of http.ts so tests can mount
+ * it on an ephemeral port. Everything about auth, OAuth and the /mcp endpoint
+ * is unchanged from the original entrypoint; see http.ts for the overview.
+ */
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createCorentServer, SERVER_VERSION } from "./server.js";
+import { handleOauth, isOauthToken, apiKeyFromAccessToken } from "./oauth.js";
+// upload_image carries a whole file as base64 inside one JSON-RPC call: a
+// 25 MB file is ~34 MB of base64. Below this cap the hosted transport would
+// refuse an upload the API itself accepts (the previous 4 MB cap predates
+// uploads). Anything larger is still cut off before it is buffered whole.
+const MAX_BODY_BYTES = 36_000_000;
+function extractApiKey(req, url) {
+    const auth = req.headers["authorization"];
+    if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
+        const v = auth.slice(7).trim();
+        // OAuth access tokens (coa_...) wrap the real API key; anything else is
+        // treated as a raw Corent key. Expired/forged tokens resolve to nothing,
+        // which falls through to the 401 + WWW-Authenticate below.
+        if (v && isOauthToken(v))
+            return apiKeyFromAccessToken(v) ?? undefined;
+        if (v)
+            return v;
+    }
+    const header = req.headers["x-corent-api-key"];
+    if (typeof header === "string" && header.trim())
+        return header.trim();
+    for (const k of ["corent_api_key", "corentApiKey", "api_key", "apiKey"]) {
+        const v = url.searchParams.get(k);
+        if (v)
+            return v;
+    }
+    // Smithery encodes the configSchema object as base64 JSON in ?config=
+    const cfg = url.searchParams.get("config");
+    if (cfg) {
+        try {
+            const decoded = JSON.parse(Buffer.from(cfg, "base64").toString("utf8"));
+            if (decoded && typeof decoded.corentApiKey === "string")
+                return decoded.corentApiKey;
+            if (decoded && typeof decoded.CORENT_API_KEY === "string")
+                return decoded.CORENT_API_KEY;
+        }
+        catch {
+            /* ignore malformed config */
+        }
+    }
+    return undefined;
+}
+// Query params may carry the caller's API key (Smithery compatibility), so a
+// raw req.url must NEVER be logged. Any request-level logging — now or added
+// later — MUST go through this helper, which strips every param that can
+// carry a key.
+const SENSITIVE_PARAMS = ["corent_api_key", "corentApiKey", "api_key", "apiKey", "config"];
+function redactedPath(url) {
+    const clean = new URL(url.toString());
+    for (const k of SENSITIVE_PARAMS) {
+        if (clean.searchParams.has(k))
+            clean.searchParams.set(k, "[redacted]");
+    }
+    return clean.pathname + clean.search;
+}
+function setCors(res) {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Corent-Api-Key, Mcp-Session-Id, Mcp-Protocol-Version");
+    res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        req.on("data", (chunk) => {
+            data += chunk;
+            if (data.length > MAX_BODY_BYTES)
+                reject(new Error("body too large"));
+        });
+        req.on("end", () => {
+            if (!data)
+                return resolve(undefined);
+            try {
+                resolve(JSON.parse(data));
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        req.on("error", reject);
+    });
+}
+// Method-level request logging for diagnosing client behavior (which methods a
+// host calls, whether it advertises the MCP Apps ui extension). Never logs
+// prompts, arguments, keys, or results.
+function logMcpRequest(body) {
+    for (const msg of Array.isArray(body) ? body : [body]) {
+        const m = msg;
+        if (!m || typeof m.method !== "string")
+            continue;
+        if (m.method === "initialize") {
+            const client = m.params?.clientInfo?.name ?? "unknown";
+            const uiCap = m.params?.capabilities?.extensions?.["io.modelcontextprotocol/ui"];
+            console.error(`[mcp] initialize from ${client} v${m.params?.clientInfo?.version ?? "?"} proto=${m.params?.protocolVersion} ui-extension=${uiCap ? JSON.stringify(uiCap) : "NOT advertised"}`);
+        }
+        else if (m.method === "resources/read") {
+            console.error(`[mcp] resources/read ${m.params?.uri ?? "?"}`);
+        }
+        else if (m.method === "tools/call") {
+            console.error(`[mcp] tools/call ${m.params?.name ?? "?"}`);
+        }
+        else if (m.method === "resources/list" || m.method === "tools/list") {
+            console.error(`[mcp] ${m.method}`);
+        }
+    }
+}
+export function createHttpApp(config) {
+    const API_URL = config.apiUrl;
+    const PUBLIC_URL = config.publicUrl;
+    return async (req, res) => {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        setCors(res);
+        // ChatGPT Apps domain verification: OpenAI fetches this path and expects the
+        // plain-text token from the developer console. Unset token = 404, so nothing
+        // is ever served by accident. Auth-free by design; the token is not a secret.
+        if (req.method === "GET" && url.pathname === "/.well-known/openai-apps-challenge") {
+            const token = process.env.OPENAI_APPS_CHALLENGE_TOKEN?.trim();
+            if (!token) {
+                res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("not found");
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+            res.end(token);
+            return;
+        }
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        // Favicon: some clients derive a connector icon from the server origin.
+        if (req.method === "GET" && url.pathname === "/favicon.ico") {
+            res.writeHead(302, {
+                Location: "https://corent.tech/brand/intro-mark.png",
+                "Cache-Control": "public, max-age=86400",
+            });
+            res.end();
+            return;
+        }
+        // Health check — used by Fly and easy to eyeball.
+        if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/health")) {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                status: "ok",
+                service: "corent-mcp",
+                transport: "streamable-http",
+                version: SERVER_VERSION,
+                endpoint: "/mcp",
+            }));
+            return;
+        }
+        // OAuth endpoints (discovery, registration, consent page, token exchange).
+        try {
+            if (await handleOauth(req, res, url, {
+                publicUrl: PUBLIC_URL,
+                apiUrl: API_URL,
+                supabaseUrl: config.supabaseUrl,
+                supabaseAnonKey: config.supabaseAnonKey,
+            }))
+                return;
+        }
+        catch (err) {
+            console.error(`oauth request failed: ${req.method} ${url.pathname}:`, err instanceof Error ? err.message : err);
+            if (!res.headersSent) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "server_error" }));
+            }
+            return;
+        }
+        if (url.pathname !== "/mcp") {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "not found; MCP endpoint is /mcp" }));
+            return;
+        }
+        const apiKey = extractApiKey(req, url);
+        // No credentials -> standard OAuth challenge (RFC 9728). This is what makes
+        // claude.ai (and other remote MCP clients) open the Connect flow instead of
+        // silently failing tool calls later.
+        if (!apiKey) {
+            // Distinguish "no credentials at all" from "OAuth token present but bad".
+            const auth = req.headers["authorization"];
+            const hadOauthToken = typeof auth === "string" && isOauthToken(auth.replace(/^[Bb]earer\s+/, ""));
+            console.error(`[mcp] 401: ${hadOauthToken ? "oauth token invalid/expired" : "no credentials"}`);
+            res.writeHead(401, {
+                "Content-Type": "application/json",
+                "WWW-Authenticate": `Bearer resource_metadata="${PUBLIC_URL}/.well-known/oauth-protected-resource"`,
+            });
+            res.end(JSON.stringify({
+                error: "unauthorized",
+                error_description: "Authenticate via OAuth (connect this server in your MCP client), or pass a Corent API key as 'Authorization: Bearer co_live_...'. Keys: https://corent.tech/dashboard/api-keys",
+            }));
+            return;
+        }
+        const mcp = createCorentServer({ apiKey, apiUrl: API_URL });
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        res.on("close", () => {
+            transport.close().catch(() => { });
+            mcp.close().catch(() => { });
+        });
+        try {
+            await mcp.connect(transport);
+            const body = req.method === "POST" ? await readBody(req) : undefined;
+            logMcpRequest(body);
+            await transport.handleRequest(req, res, body);
+        }
+        catch (err) {
+            // Redacted path only — never req.url, which may carry an API key.
+            console.error(`request failed: ${req.method} ${redactedPath(url)}:`, err instanceof Error ? err.message : err);
+            if (!res.headersSent) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    jsonrpc: "2.0",
+                    error: { code: -32603, message: err instanceof Error ? err.message : "Internal server error" },
+                    id: null,
+                }));
+            }
+        }
+    };
+}

package/dist/http.js

@@ -18,207 +18,21 @@
  *
  * Stateless mode: a fresh server + transport is created for each request, so
  * there is no cross-user session state to leak.
+ *
+ * The request handler itself lives in http-app.ts (exported, so tests can
+ * drive it on an ephemeral port); this file only reads the environment and
+ * listens. `dist/http.js` stays the deployed entrypoint.
  */
 import http from "node:http";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { createCorentServer, SERVER_VERSION } from "./server.js";
-import { handleOauth, isOauthToken, apiKeyFromAccessToken } from "./oauth.js";
+import { createHttpApp } from "./http-app.js";
+import { SERVER_VERSION } from "./server.js";
 const PORT = Number(process.env.PORT ?? 8080);
-const API_URL = process.env.CORENT_API_URL ?? "https://api.corent.tech";
-const PUBLIC_URL = process.env.MCP_PUBLIC_URL ?? "https://mcp.corent.tech";
-function extractApiKey(req, url) {
-    const auth = req.headers["authorization"];
-    if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
-        const v = auth.slice(7).trim();
-        // OAuth access tokens (coa_...) wrap the real API key; anything else is
-        // treated as a raw Corent key. Expired/forged tokens resolve to nothing,
-        // which falls through to the 401 + WWW-Authenticate below.
-        if (v && isOauthToken(v))
-            return apiKeyFromAccessToken(v) ?? undefined;
-        if (v)
-            return v;
-    }
-    const header = req.headers["x-corent-api-key"];
-    if (typeof header === "string" && header.trim())
-        return header.trim();
-    for (const k of ["corent_api_key", "corentApiKey", "api_key", "apiKey"]) {
-        const v = url.searchParams.get(k);
-        if (v)
-            return v;
-    }
-    // Smithery encodes the configSchema object as base64 JSON in ?config=
-    const cfg = url.searchParams.get("config");
-    if (cfg) {
-        try {
-            const decoded = JSON.parse(Buffer.from(cfg, "base64").toString("utf8"));
-            if (decoded && typeof decoded.corentApiKey === "string")
-                return decoded.corentApiKey;
-            if (decoded && typeof decoded.CORENT_API_KEY === "string")
-                return decoded.CORENT_API_KEY;
-        }
-        catch {
-            /* ignore malformed config */
-        }
-    }
-    return undefined;
-}
-// Query params may carry the caller's API key (Smithery compatibility), so a
-// raw req.url must NEVER be logged. Any request-level logging — now or added
-// later — MUST go through this helper, which strips every param that can
-// carry a key.
-const SENSITIVE_PARAMS = ["corent_api_key", "corentApiKey", "api_key", "apiKey", "config"];
-function redactedPath(url) {
-    const clean = new URL(url.toString());
-    for (const k of SENSITIVE_PARAMS) {
-        if (clean.searchParams.has(k))
-            clean.searchParams.set(k, "[redacted]");
-    }
-    return clean.pathname + clean.search;
-}
-function setCors(res) {
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Corent-Api-Key, Mcp-Session-Id, Mcp-Protocol-Version");
-    res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
-}
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        let data = "";
-        req.on("data", (chunk) => {
-            data += chunk;
-            if (data.length > 4_000_000)
-                reject(new Error("body too large"));
-        });
-        req.on("end", () => {
-            if (!data)
-                return resolve(undefined);
-            try {
-                resolve(JSON.parse(data));
-            }
-            catch (e) {
-                reject(e);
-            }
-        });
-        req.on("error", reject);
-    });
-}
-// Method-level request logging for diagnosing client behavior (which methods a
-// host calls, whether it advertises the MCP Apps ui extension). Never logs
-// prompts, arguments, keys, or results.
-function logMcpRequest(body) {
-    for (const msg of Array.isArray(body) ? body : [body]) {
-        const m = msg;
-        if (!m || typeof m.method !== "string")
-            continue;
-        if (m.method === "initialize") {
-            const client = m.params?.clientInfo?.name ?? "unknown";
-            const uiCap = m.params?.capabilities?.extensions?.["io.modelcontextprotocol/ui"];
-            console.error(`[mcp] initialize from ${client} v${m.params?.clientInfo?.version ?? "?"} proto=${m.params?.protocolVersion} ui-extension=${uiCap ? JSON.stringify(uiCap) : "NOT advertised"}`);
-        }
-        else if (m.method === "resources/read") {
-            console.error(`[mcp] resources/read ${m.params?.uri ?? "?"}`);
-        }
-        else if (m.method === "tools/call") {
-            console.error(`[mcp] tools/call ${m.params?.name ?? "?"}`);
-        }
-        else if (m.method === "resources/list" || m.method === "tools/list") {
-            console.error(`[mcp] ${m.method}`);
-        }
-    }
-}
-const server = http.createServer(async (req, res) => {
-    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-    setCors(res);
-    if (req.method === "OPTIONS") {
-        res.writeHead(204);
-        res.end();
-        return;
-    }
-    // Favicon: some clients derive a connector icon from the server origin.
-    if (req.method === "GET" && url.pathname === "/favicon.ico") {
-        res.writeHead(302, { Location: "https://corent.tech/brand/intro-mark.png", "Cache-Control": "public, max-age=86400" });
-        res.end();
-        return;
-    }
-    // Health check — used by Fly and easy to eyeball.
-    if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/health")) {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({
-            status: "ok",
-            service: "corent-mcp",
-            transport: "streamable-http",
-            version: SERVER_VERSION,
-            endpoint: "/mcp",
-        }));
-        return;
-    }
-    // OAuth endpoints (discovery, registration, consent page, token exchange).
-    try {
-        if (await handleOauth(req, res, url, {
-            publicUrl: PUBLIC_URL,
-            apiUrl: API_URL,
-            supabaseUrl: process.env.SUPABASE_URL,
-            supabaseAnonKey: process.env.SUPABASE_ANON_KEY,
-        }))
-            return;
-    }
-    catch (err) {
-        console.error(`oauth request failed: ${req.method} ${url.pathname}:`, err instanceof Error ? err.message : err);
-        if (!res.headersSent) {
-            res.writeHead(500, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "server_error" }));
-        }
-        return;
-    }
-    if (url.pathname !== "/mcp") {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "not found; MCP endpoint is /mcp" }));
-        return;
-    }
-    const apiKey = extractApiKey(req, url);
-    // No credentials -> standard OAuth challenge (RFC 9728). This is what makes
-    // claude.ai (and other remote MCP clients) open the Connect flow instead of
-    // silently failing tool calls later.
-    if (!apiKey) {
-        // Distinguish "no credentials at all" from "OAuth token present but bad".
-        const auth = req.headers["authorization"];
-        const hadOauthToken = typeof auth === "string" && isOauthToken(auth.replace(/^[Bb]earer\s+/, ""));
-        console.error(`[mcp] 401: ${hadOauthToken ? "oauth token invalid/expired" : "no credentials"}`);
-        res.writeHead(401, {
-            "Content-Type": "application/json",
-            "WWW-Authenticate": `Bearer resource_metadata="${PUBLIC_URL}/.well-known/oauth-protected-resource"`,
-        });
-        res.end(JSON.stringify({
-            error: "unauthorized",
-            error_description: "Authenticate via OAuth (connect this server in your MCP client), or pass a Corent API key as 'Authorization: Bearer co_live_...'. Keys: https://corent.tech/dashboard/api-keys",
-        }));
-        return;
-    }
-    const mcp = createCorentServer({ apiKey, apiUrl: API_URL });
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
-    res.on("close", () => {
-        transport.close().catch(() => { });
-        mcp.close().catch(() => { });
-    });
-    try {
-        await mcp.connect(transport);
-        const body = req.method === "POST" ? await readBody(req) : undefined;
-        logMcpRequest(body);
-        await transport.handleRequest(req, res, body);
-    }
-    catch (err) {
-        // Redacted path only — never req.url, which may carry an API key.
-        console.error(`request failed: ${req.method} ${redactedPath(url)}:`, err instanceof Error ? err.message : err);
-        if (!res.headersSent) {
-            res.writeHead(500, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({
-                jsonrpc: "2.0",
-                error: { code: -32603, message: err instanceof Error ? err.message : "Internal server error" },
-                id: null,
-            }));
-        }
-    }
-});
+const server = http.createServer(createHttpApp({
+    apiUrl: process.env.CORENT_API_URL ?? "https://api.corent.tech",
+    publicUrl: process.env.MCP_PUBLIC_URL ?? "https://mcp.corent.tech",
+    supabaseUrl: process.env.SUPABASE_URL,
+    supabaseAnonKey: process.env.SUPABASE_ANON_KEY,
+}));
 server.listen(PORT, () => {
     console.error(`corent-mcp (streamable-http) v${SERVER_VERSION} listening on :${PORT}${"  ->  /mcp"}`);
 });