ebay-mcp 1.18.0 → 1.18.3

package/build/auth/oauthMiddleware.js

@@ -8,7 +8,7 @@ import { Effect, Either } from 'effect';
  * Create Bearer token authentication middleware
  *
  * @param config - Token verifier and RFC 6750 challenge settings.
- * @returns Express middleware that verifies bearer tokens and attaches `req.auth`.
+ * @returns Express middleware that verifies bearer tokens and attaches `request.auth`.
  *
  * @example
  * ```ts
@@ -17,11 +17,11 @@ import { Effect, Either } from 'effect';
  */
 export const createBearerAuthMiddleware = (config) => {
     const realm = config.realm || 'mcp';
-    return async (req, res, next) => {
+    return async (request, response, next) => {
         // Extract token from Authorization header
-        const authHeader = req.headers.authorization;
+        const authHeader = request.headers.authorization;
         if (!authHeader) {
-            sendUnauthorized(res, realm, config.resourceMetadataUrl, {
+            sendUnauthorized(response, realm, config.resourceMetadataUrl, {
                 error: 'invalid_token',
                 error_description: 'No authorization header provided',
             });
@@ -30,7 +30,7 @@ export const createBearerAuthMiddleware = (config) => {
         // Check Bearer scheme
         const parts = authHeader.split(' ');
         if (parts.length !== 2 || parts[0] !== 'Bearer') {
-            sendUnauthorized(res, realm, config.resourceMetadataUrl, {
+            sendUnauthorized(response, realm, config.resourceMetadataUrl, {
                 error: 'invalid_token',
                 error_description: 'Invalid authorization header format. Expected: Bearer <token>',
             });
@@ -40,20 +40,20 @@ export const createBearerAuthMiddleware = (config) => {
         const verified = await Effect.runPromise(Effect.either(config.verifier.verifyToken(token)));
         if (Either.isLeft(verified)) {
             const errorMessage = getErrorMessage(verified.left, 'Token verification failed');
-            sendUnauthorized(res, realm, config.resourceMetadataUrl, {
+            sendUnauthorized(response, realm, config.resourceMetadataUrl, {
                 error: 'invalid_token',
                 error_description: errorMessage,
             });
             return;
         }
-        req.auth = verified.right;
+        request.auth = verified.right;
         next();
     };
 };
 /**
  * Send 401 Unauthorized response with RFC 6750 compliant WWW-Authenticate header
  */
-const sendUnauthorized = (res, realm, resourceMetadataUrl, challenge) => {
+const sendUnauthorized = (response, realm, resourceMetadataUrl, challenge) => {
     // Build WWW-Authenticate header per RFC 6750
     let authenticateValue = `Bearer realm="${realm}", resource_metadata="${resourceMetadataUrl}"`;
     if (challenge.error) {
@@ -65,8 +65,8 @@ const sendUnauthorized = (res, realm, resourceMetadataUrl, challenge) => {
     if (challenge.scope) {
         authenticateValue += `, scope="${challenge.scope}"`;
     }
-    res.setHeader('WWW-Authenticate', authenticateValue);
-    res.status(401).json({
+    response.setHeader('WWW-Authenticate', authenticateValue);
+    response.status(401).json({
         error: challenge.error || 'unauthorized',
         error_description: challenge.error_description || 'Authorization required',
     });
@@ -82,21 +82,21 @@ const sendUnauthorized = (res, realm, resourceMetadataUrl, challenge) => {
  * app.get('/admin', requireScopes(['mcp:admin']), handler);
  * ```
  */
-export const requireScopes = (requiredScopes) => (req, res, next) => {
-    if (!req.auth) {
-        res.status(401).json({
+export const requireScopes = (requiredScopes) => (request, response, next) => {
+    if (!request.auth) {
+        response.status(401).json({
             error: 'unauthorized',
             error_description: 'No authentication information found',
         });
         return;
     }
-    const hasRequiredScopes = requiredScopes.every((scope) => req.auth.scopes.includes(scope));
+    const hasRequiredScopes = requiredScopes.every((scope) => request.auth.scopes.includes(scope));
     if (!hasRequiredScopes) {
-        res.status(403).json({
+        response.status(403).json({
             error: 'insufficient_scope',
             error_description: `Missing required scopes: ${requiredScopes.join(', ')}`,
             required_scopes: requiredScopes,
-            provided_scopes: req.auth.scopes,
+            provided_scopes: request.auth.scopes,
         });
         return;
     }

package/build/auth/scopeUtils.js

@@ -28,7 +28,7 @@ const optionalConsent = (tools, scope, description) => Object.fromEntries(tools.
  *
  * @example
  * ```ts
- * const result = validateScopesDetailed(scopes, 'production');
+ * const scopeValidation = validateScopesDetailed(scopes, 'production');
  * ```
  */
 export const validateScopesDetailed = (scopes, environment) => {
@@ -381,7 +381,7 @@ export const getReadonlyScope = (writeScope) => {
         'commerce.feedback',
     ];
     const scopeType = writeScope.split('/').pop();
-    if (scopeType && hasReadonly.some((s) => scopeType.includes(s))) {
+    if (scopeType && hasReadonly.some((readonlyMarker) => scopeType.includes(readonlyMarker))) {
         return `${writeScope}.readonly`;
     }
     return null;

package/build/auth/tokenVerifier.js

@@ -93,7 +93,7 @@ export class TokenVerifier {
         }
         // Prepare introspection request. Client credentials authenticate via HTTP
         // Basic (RFC 7662 §2.1) rather than form body fields.
-        const requestData = {
+        const introspectionRequest = {
             token,
             token_type_hint: 'access_token',
         };
@@ -104,17 +104,17 @@ export class TokenVerifier {
             headers.Authorization = `Basic ${Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64')}`;
         }
         const params = new URLSearchParams({
-            token: requestData.token,
+            token: introspectionRequest.token,
         });
         // Make introspection request
-        const data = yield* this.requestVerifierData('verifyViaIntrospection', 'introspectionRequest', 'Token introspection failed', {
+        const introspection = yield* this.requestVerifierData('verifyViaIntrospection', 'introspectionRequest', 'Token introspection failed', {
             method: 'POST',
             url: introspectionEndpoint,
             body: params,
             headers,
         });
         // Check if token is active
-        if (!data.active) {
+        if (!introspection.active) {
             return yield* Effect.fail(tokenVerifierError({
                 operation: 'verifyViaIntrospection',
                 reason: 'inactiveToken',
@@ -122,15 +122,15 @@ export class TokenVerifier {
             }));
         }
         // Validate audience
-        if (!this.validateAudience(data.aud)) {
+        if (!this.validateAudience(introspection.aud)) {
             return yield* Effect.fail(tokenVerifierError({
                 operation: 'verifyViaIntrospection',
                 reason: 'invalidAudience',
-                message: `Invalid audience. Expected: ${this.config.expectedAudience}, Got: ${data.aud}`,
+                message: `Invalid audience. Expected: ${this.config.expectedAudience}, Got: ${introspection.aud}`,
             }));
         }
         // Validate scopes
-        const scopes = data.scope ? data.scope.split(' ') : [];
+        const scopes = introspection.scope ? introspection.scope.split(' ') : [];
         if (this.config.requiredScopes) {
             const hasRequiredScopes = this.config.requiredScopes.every((scope) => scopes.includes(scope));
             if (!hasRequiredScopes) {
@@ -143,11 +143,11 @@ export class TokenVerifier {
         }
         return {
             token,
-            clientId: data.client_id || 'missing-client-id',
+            clientId: introspection.client_id || 'missing-client-id',
             scopes,
-            expiresAt: data.exp,
-            audience: data.aud,
-            subject: data.sub,
+            expiresAt: introspection.exp,
+            audience: introspection.aud,
+            subject: introspection.sub,
         };
     });
     /**
@@ -179,7 +179,7 @@ export class TokenVerifier {
                 cause,
             }),
         });
-        const { payload } = yield* Effect.tryPromise({
+        const { payload: claims } = yield* Effect.tryPromise({
             try: () => jwtVerify(token, JWKS, {
                 issuer: metadata.issuer,
                 audience: this.config.expectedAudience,
@@ -192,11 +192,11 @@ export class TokenVerifier {
             }),
         });
         let scopes = [];
-        if (typeof payload.scope === 'string') {
-            scopes = payload.scope.split(' ');
+        if (typeof claims.scope === 'string') {
+            scopes = claims.scope.split(' ');
         }
-        else if (Array.isArray(payload.scope)) {
-            scopes = payload.scope.filter((scope) => typeof scope === 'string');
+        else if (Array.isArray(claims.scope)) {
+            scopes = claims.scope.filter((scope) => typeof scope === 'string');
         }
         if (this.config.requiredScopes) {
             const hasRequiredScopes = this.config.requiredScopes.every((scope) => scopes.includes(scope));
@@ -209,19 +209,19 @@ export class TokenVerifier {
             }
         }
         let clientId = 'missing-client-id';
-        if (typeof payload.client_id === 'string') {
-            clientId = payload.client_id;
+        if (typeof claims.client_id === 'string') {
+            clientId = claims.client_id;
         }
-        else if (typeof payload.azp === 'string') {
-            clientId = payload.azp;
+        else if (typeof claims.azp === 'string') {
+            clientId = claims.azp;
         }
         return {
             token,
             clientId,
             scopes,
-            expiresAt: payload.exp,
-            audience: payload.aud,
-            subject: payload.sub,
+            expiresAt: claims.exp,
+            audience: claims.aud,
+            subject: claims.sub,
         };
     });
     /**

package/build/config/environment.js

@@ -1,17 +1,13 @@
 import { config } from 'dotenv';
-import { existsSync, readFileSync } from 'fs';
+import { existsSync } from 'fs';
 import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
 import { CREDENTIAL_ENV_PATH } from '../config/credentialFile.js';
 import { getToolGatingConfigError } from '../config/toolFamilies.js';
 import { getMediaAccessConfig } from '../config/mediaAccess.js';
-import { getErrorMessage } from '../utils/errors.js';
+import { productionScopes, sandboxScopes } from '../config/oauthScopes.js';
 import { getVersion } from '../utils/version.js';
 import { Effect, Either } from 'effect';
 import process from 'node:process';
-// Get the current directory for loading scope files and .env
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
 // Load .env from the package root (two levels up from src/config/), not process.cwd().
 // MCP servers inherit cwd from the host (e.g. Claude Code's project dir), so
 // process.cwd() may point to an unrelated project with a different .env.
@@ -46,40 +42,6 @@ export const getLoggingConfig = () => ({
 export const getUiRuntimeConfig = () => ({
     enabled: process.env.EBAY_MCP_UI !== 'off',
 });
-/** Loads and parses scopes from one checked-in scope JSON file. */
-const loadScopes = (fileName, label) => {
-    const loaded = Effect.runSync(Effect.either(Effect.try({
-        try: () => {
-            const scopesPath = join(__dirname, '../../docs/auth', fileName);
-            const scopesData = readFileSync(scopesPath, 'utf-8');
-            const scopes = JSON.parse(scopesData);
-            // Filter out empty objects and extract unique scope strings
-            const uniqueScopes = new Set();
-            scopes.forEach((item) => {
-                if (item.Scope) {
-                    uniqueScopes.add(item.Scope);
-                }
-            });
-            return Array.from(uniqueScopes);
-        },
-        catch: (error) => error,
-    })));
-    if (Either.isLeft(loaded)) {
-        const error = loaded.left;
-        writeConfigDiagnostic(`Failed to load ${label} scopes: ${getErrorMessage(error)}`);
-        // Return a minimal set of core scopes as fallback
-        return ['https://api.ebay.com/oauth/api_scope'];
-    }
-    return loaded.right;
-};
-/**
- * Loads and parses production scopes from the checked-in eBay scope table.
- */
-const getProductionScopes = () => loadScopes('production_scopes.json', 'production');
-/**
- * Loads and parses sandbox scopes from the checked-in eBay scope table.
- */
-const getSandboxScopes = () => loadScopes('sandbox_scopes.json', 'sandbox');
 /**
  * Gets default OAuth scopes for the specified eBay environment.
  *
@@ -91,10 +53,7 @@ const getSandboxScopes = () => loadScopes('sandbox_scopes.json', 'sandbox');
  * ```
  */
 export const getDefaultScopes = (environment) => {
-    if (environment === 'production') {
-        return getProductionScopes();
-    }
-    return getSandboxScopes();
+    return [...(environment === 'production' ? productionScopes : sandboxScopes)];
 };
 /** Optional scope requiring keyset eligibility and fresh user consent. */
 export const POST_ORDER_DOCUMENT_SCOPE = 'https://api.ebay.com/oauth/api_scope/commerce.post_order.document';
@@ -159,7 +118,7 @@ export const getRequestedScopes = (environment, env = process.env) => {
  * @returns Requested scopes plus warnings for environment-only or unknown scopes.
  * @example
  * ```ts
- * const result = validateScopes(scopes, 'sandbox');
+ * const scopeValidation = validateScopes(scopes, 'sandbox');
  * ```
  */
 export const validateScopes = (scopes, environment) => {

package/build/config/oauthScopes.js

@@ -0,0 +1,132 @@
+/**
+ * OAuth scopes eBay grants to seller apps, copied from the developer portal scope tables.
+ * Each comment is eBay's description of the scope below it.
+ */
+/** Scopes available to apps in the eBay production environment. */
+export const productionScopes = [
+    // View public data from eBay
+    'https://api.ebay.com/oauth/api_scope',
+    // View your eBay marketing activities, such as ad campaigns and listing promotions
+    'https://api.ebay.com/oauth/api_scope/sell.marketing.readonly',
+    // View and manage your eBay marketing activities, such as ad campaigns and listing promotions
+    'https://api.ebay.com/oauth/api_scope/sell.marketing',
+    // View your inventory and offers
+    'https://api.ebay.com/oauth/api_scope/sell.inventory.readonly',
+    // View and manage your inventory and offers
+    'https://api.ebay.com/oauth/api_scope/sell.inventory',
+    // View your account settings
+    'https://api.ebay.com/oauth/api_scope/sell.account.readonly',
+    // View and manage your account settings
+    'https://api.ebay.com/oauth/api_scope/sell.account',
+    // View your order fulfillments
+    'https://api.ebay.com/oauth/api_scope/sell.fulfillment.readonly',
+    // View and manage your order fulfillments
+    'https://api.ebay.com/oauth/api_scope/sell.fulfillment',
+    // View your selling analytics data, such as performance reports
+    'https://api.ebay.com/oauth/api_scope/sell.analytics.readonly',
+    // View and manage your payment and order information to display this information to you and allow you to initiate refunds using the third party application
+    'https://api.ebay.com/oauth/api_scope/sell.finances',
+    // View and manage disputes and related details (including payment and order information).
+    'https://api.ebay.com/oauth/api_scope/sell.payment.dispute',
+    // View a user's basic information, such as username or business account details, from their eBay member account
+    'https://api.ebay.com/oauth/api_scope/commerce.identity.readonly',
+    // View and manage your reputation data, such as feedback.
+    'https://api.ebay.com/oauth/api_scope/sell.reputation',
+    // View your reputation data, such as feedback.
+    'https://api.ebay.com/oauth/api_scope/sell.reputation.readonly',
+    // View and manage your event notification subscriptions
+    'https://api.ebay.com/oauth/api_scope/commerce.notification.subscription',
+    // View your event notification subscriptions
+    'https://api.ebay.com/oauth/api_scope/commerce.notification.subscription.readonly',
+    // View and manage eBay stores
+    'https://api.ebay.com/oauth/api_scope/sell.stores',
+    // View eBay stores
+    'https://api.ebay.com/oauth/api_scope/sell.stores.readonly',
+    // Allows access to eDelivery International Shipping APIs.
+    'https://api.ebay.com/oauth/scope/sell.edelivery',
+    // Allows access to APIs that are related to eBay's Verified Rights Owner (VeRO) program.
+    'https://api.ebay.com/oauth/api_scope/commerce.vero',
+    // Enables applications to manage and enhance inventory listings through the Inventory Mapping Public API.
+    'https://api.ebay.com/oauth/api_scope/sell.inventory.mapping',
+    // Allows access to eBay Message APIs.
+    'https://api.ebay.com/oauth/api_scope/commerce.message',
+    // Allows access to Feedback APIs.
+    'https://api.ebay.com/oauth/api_scope/commerce.feedback',
+    // View and manage shipping information
+    'https://api.ebay.com/oauth/api_scope/commerce.shipping',
+    // Allows readonly access to Feedback APIs.
+    'https://api.ebay.com/oauth/api_scope/commerce.feedback.readonly',
+];
+/** Scopes available to apps in the eBay sandbox environment. */
+export const sandboxScopes = [
+    // View public data from eBay
+    'https://api.ebay.com/oauth/api_scope',
+    // View your order details
+    'https://api.ebay.com/oauth/api_scope/buy.order.readonly',
+    // Purchase eBay items off eBay
+    'https://api.ebay.com/oauth/api_scope/buy.guest.order',
+    // View your eBay marketing activities, such as ad campaigns and listing promotions
+    'https://api.ebay.com/oauth/api_scope/sell.marketing.readonly',
+    // View and manage your eBay marketing activities, such as ad campaigns and listing promotions
+    'https://api.ebay.com/oauth/api_scope/sell.marketing',
+    // View your inventory and offers
+    'https://api.ebay.com/oauth/api_scope/sell.inventory.readonly',
+    // View and manage your inventory and offers
+    'https://api.ebay.com/oauth/api_scope/sell.inventory',
+    // View your account settings
+    'https://api.ebay.com/oauth/api_scope/sell.account.readonly',
+    // View and manage your account settings
+    'https://api.ebay.com/oauth/api_scope/sell.account',
+    // View your order fulfillments
+    'https://api.ebay.com/oauth/api_scope/sell.fulfillment.readonly',
+    // View and manage your order fulfillments
+    'https://api.ebay.com/oauth/api_scope/sell.fulfillment',
+    // View your selling analytics data, such as performance reports
+    'https://api.ebay.com/oauth/api_scope/sell.analytics.readonly',
+    // This scope would allow signed in users read only access to marketplace insights.
+    'https://api.ebay.com/oauth/api_scope/sell.marketplace.insights.readonly',
+    // This scope would allow signed in user to read catalog data.
+    'https://api.ebay.com/oauth/api_scope/commerce.catalog.readonly',
+    // This scope would allow signed in user to access shopping carts
+    'https://api.ebay.com/oauth/api_scope/buy.shopping.cart',
+    // View and manage bidding activities for auctions
+    'https://api.ebay.com/oauth/api_scope/buy.offer.auction',
+    // View a user's basic information, such as username or business account details, from their eBay member account
+    'https://api.ebay.com/oauth/api_scope/commerce.identity.readonly',
+    // View a user's personal email information from their eBay member account
+    'https://api.ebay.com/oauth/api_scope/commerce.identity.email.readonly',
+    // View a user's personal telephone information from their eBay member account
+    'https://api.ebay.com/oauth/api_scope/commerce.identity.phone.readonly',
+    // View a user's personal address information from their eBay member account
+    'https://api.ebay.com/oauth/api_scope/commerce.identity.address.readonly',
+    // View a user's first and last name from their eBay member account
+    'https://api.ebay.com/oauth/api_scope/commerce.identity.name.readonly',
+    // View a user's eBay member account status
+    'https://api.ebay.com/oauth/api_scope/commerce.identity.status.readonly',
+    // View and manage your payment and order information to display this information to you and allow you to initiate refunds using the third party application
+    'https://api.ebay.com/oauth/api_scope/sell.finances',
+    // View and manage disputes and related details (including payment and order information).
+    'https://api.ebay.com/oauth/api_scope/sell.payment.dispute',
+    // View and manage your item drafts.
+    'https://api.ebay.com/oauth/api_scope/sell.item.draft',
+    // View and manage your item information.
+    'https://api.ebay.com/oauth/api_scope/sell.item',
+    // View and manage your reputation data, such as feedback.
+    'https://api.ebay.com/oauth/api_scope/sell.reputation',
+    // View your reputation data, such as feedback.
+    'https://api.ebay.com/oauth/api_scope/sell.reputation.readonly',
+    // View and manage your event notification subscriptions
+    'https://api.ebay.com/oauth/api_scope/commerce.notification.subscription',
+    // View your event notification subscriptions
+    'https://api.ebay.com/oauth/api_scope/commerce.notification.subscription.readonly',
+    // View and manage eBay stores
+    'https://api.ebay.com/oauth/api_scope/sell.stores',
+    // View eBay stores
+    'https://api.ebay.com/oauth/api_scope/sell.stores.readonly',
+    // Allows access to APIs that are related to eBay's Verified Rights Owner (VeRO) program.
+    'https://api.ebay.com/oauth/api_scope/commerce.vero',
+    // Allows access to Feedback APIs.
+    'https://api.ebay.com/oauth/api_scope/commerce.feedback',
+    // Enables applications to manage and enhance inventory listings through the Inventory Mapping Public API.
+    'https://api.ebay.com/oauth/api_scope/sell.inventory.mapping',
+];

package/build/index.js

@@ -12,13 +12,13 @@ import { Effect, Either } from 'effect';
 import process from 'node:process';
 const args = process.argv.slice(2);
 const runCliCommand = async (label, command) => {
-    const result = await Effect.runPromise(Effect.either(Effect.tryPromise({
+    const commandOutcome = await Effect.runPromise(Effect.either(Effect.tryPromise({
         try: command,
         catch: (error) => error,
     })));
-    if (Either.isLeft(result)) {
+    if (Either.isLeft(commandOutcome)) {
         serverLogger.error(`${label} failed`, {
-            error: getErrorMessage(result.left, String(result.left)),
+            error: getErrorMessage(commandOutcome.left, String(commandOutcome.left)),
         });
         process.exit(1);
     }
@@ -68,8 +68,8 @@ class EbayMcpServer {
         // Validate environment configuration
         const validation = validateEnvironmentConfig();
         // Log informational notices (e.g. proxy auth mode)
-        validation.infos.forEach((info) => {
-            serverLogger.info(info);
+        validation.infos.forEach((notice) => {
+            serverLogger.info(notice);
         });
         // Log warnings
         if (validation.warnings.length > 0) {

package/build/mcp/httpTransport.js

@@ -15,6 +15,17 @@ import { getErrorMessage } from '../utils/errors.js';
 import { serverLogger } from '../utils/logger.js';
 import { getVersion } from '../utils/version.js';
 import { Effect, Either } from 'effect';
+const LOOPBACK_ORIGIN = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/;
+const parseCorsOrigins = (value) => {
+    const origins = (value || '')
+        .split(',')
+        .map((origin) => origin.trim())
+        .filter(Boolean);
+    if (origins.length === 0) {
+        return [LOOPBACK_ORIGIN];
+    }
+    return origins;
+};
 const getProjectRoot = () => {
     const filename = fileURLToPath(import.meta.url);
     const directory = dirname(filename);
@@ -46,6 +57,7 @@ export const createHttpTransportConfigFromEnv = (env) => ({
         useIntrospection: env.OAUTH_USE_INTROSPECTION !== 'false',
     },
     authEnabled: env.OAUTH_ENABLED !== 'false',
+    corsOrigins: parseCorsOrigins(env.MCP_CORS_ORIGINS),
     projectRoot: getProjectRoot(),
     staticAuthToken: env.MCP_AUTH_TOKEN,
 });
@@ -114,12 +126,12 @@ async function createAuthMiddleware(config, serverUrl) {
     if (config.staticAuthToken) {
         const staticToken = config.staticAuthToken;
         serverLogger.info('Static bearer auth enabled via MCP_AUTH_TOKEN.');
-        return (req, res, next) => {
-            if (req.headers.authorization === `Bearer ${staticToken}`) {
+        return (request, response, next) => {
+            if (request.headers.authorization === `Bearer ${staticToken}`) {
                 next();
                 return;
             }
-            res.status(401).json({
+            response.status(401).json({
                 error: 'unauthorized',
                 error_description: 'Missing or invalid bearer token',
             });
@@ -154,17 +166,17 @@ async function createAuthMiddleware(config, serverUrl) {
     });
 }
 function createRequestLogger() {
-    return (req, res, next) => {
+    return (request, response, next) => {
         const start = Date.now();
-        res.on('finish', () => {
+        response.on('finish', () => {
             const duration = Date.now() - start;
-            serverLogger.http(`${req.method} ${req.path} -> ${res.statusCode} (${duration}ms)`);
+            serverLogger.http(`${request.method} ${request.path} -> ${response.statusCode} (${duration}ms)`);
         });
         next();
     };
 }
-function sendInvalidSession(res) {
-    res.status(400).json({
+function sendInvalidSession(response) {
+    response.status(400).json({
         error: 'invalid_session',
         error_description: 'Invalid or missing session ID',
     });
@@ -185,7 +197,7 @@ export const createHttpMcpApp = async (config) => {
     const serverUrl = getHttpServerUrl(config);
     const ebayConfig = config.ebayConfig ?? getEbayConfig();
     app.use(cors({
-        origin: '*',
+        origin: config.corsOrigins,
         exposedHeaders: ['Mcp-Session-Id'],
     }));
     app.use(express.json());
@@ -201,8 +213,8 @@ export const createHttpMcpApp = async (config) => {
         ebayEnvironment: ebayConfig.environment,
         ebayScopes: getDefaultScopes(ebayConfig.environment),
     }));
-    app.get('/health', (_req, res) => {
-        res.json({
+    app.get('/health', (_request, response) => {
+        response.json({
             status: 'healthy',
             timestamp: new Date().toISOString(),
             oauth_enabled: config.authEnabled,
@@ -210,14 +222,14 @@ export const createHttpMcpApp = async (config) => {
     });
     const authMiddleware = await createAuthMiddleware(config, serverUrl);
     const transports = new Map();
-    const mcpPostHandler = async (req, res) => {
-        const sessionHeader = req.headers['mcp-session-id'];
+    const mcpPostHandler = async (request, response) => {
+        const sessionHeader = request.headers['mcp-session-id'];
         const sessionId = typeof sessionHeader === 'string' ? sessionHeader : undefined;
         let transport;
         if (sessionId && transports.has(sessionId)) {
             transport = transports.get(sessionId);
         }
-        else if (!sessionId && isInitializeRequest(req.body)) {
+        else if (!sessionId && isInitializeRequest(request.body)) {
             transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: () => randomUUID(),
                 onsessioninitialized: (initializedSessionId) => {
@@ -235,7 +247,7 @@ export const createHttpMcpApp = async (config) => {
             await server.connect(transport);
         }
         else {
-            res.status(400).json({
+            response.status(400).json({
                 jsonrpc: '2.0',
                 error: {
                     code: -32_000,
@@ -245,17 +257,17 @@ export const createHttpMcpApp = async (config) => {
             });
             return;
         }
-        await transport.handleRequest(req, res, req.body);
+        await transport.handleRequest(request, response, request.body);
     };
-    const handleSessionRequest = async (req, res) => {
-        const sessionHeader = req.headers['mcp-session-id'];
+    const handleSessionRequest = async (request, response) => {
+        const sessionHeader = request.headers['mcp-session-id'];
         const sessionId = typeof sessionHeader === 'string' ? sessionHeader : undefined;
         if (!(sessionId && transports.has(sessionId))) {
-            sendInvalidSession(res);
+            sendInvalidSession(response);
             return;
         }
         const transport = transports.get(sessionId);
-        await transport.handleRequest(req, res);
+        await transport.handleRequest(request, response);
     };
     const mcpMiddleware = authMiddleware ? [authMiddleware, mcpPostHandler] : [mcpPostHandler];
     const sessionMiddleware = authMiddleware