fa-mcp-sdk 0.4.16 → 0.4.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/cli-template/deploy/srv.sh.readme.md +19 -4
- package/cli-template/package.json +1 -1
- package/config/_local.yaml +304 -148
- package/config/default.yaml +302 -212
- package/config/local.yaml +3 -0
- package/package.json +1 -1
|
@@ -66,10 +66,10 @@ node deploy/srv.cjs <command> [options]
|
|
|
66
66
|
./deploy/srv.cjs delete -n custom-service
|
|
67
67
|
|
|
68
68
|
# With a specific port
|
|
69
|
-
./deploy/srv.cjs delete -p
|
|
69
|
+
./deploy/srv.cjs delete -p 1234
|
|
70
70
|
|
|
71
71
|
# Combined params
|
|
72
|
-
./deploy/srv.cjs d -n custom-service -p
|
|
72
|
+
./deploy/srv.cjs d -n custom-service -p 1234
|
|
73
73
|
```
|
|
74
74
|
|
|
75
75
|
**What happens:**
|
|
@@ -88,7 +88,7 @@ node deploy/srv.cjs <command> [options]
|
|
|
88
88
|
./deploy/srv.cjs r
|
|
89
89
|
|
|
90
90
|
# With params
|
|
91
|
-
./deploy/srv.cjs r -n custom-service -v 22.17.1 -p
|
|
91
|
+
./deploy/srv.cjs r -n custom-service -v 22.17.1 -p 1234
|
|
92
92
|
```
|
|
93
93
|
|
|
94
94
|
**What happens:**
|
|
@@ -206,5 +206,20 @@ journalctl -u <serviceName> --since "1 hour ago"
|
|
|
206
206
|
### Manual control
|
|
207
207
|
|
|
208
208
|
```bash
|
|
209
|
-
|
|
209
|
+
systemctl start|stop|restart|disable|status <serviceName>
|
|
210
210
|
```
|
|
211
|
+
|
|
212
|
+
```bash
|
|
213
|
+
# Show all loaded service units
|
|
214
|
+
systemctl list-units --type=service
|
|
215
|
+
|
|
216
|
+
# Show only running services
|
|
217
|
+
systemctl list-units --type=service --state=running
|
|
218
|
+
|
|
219
|
+
# Show all loaded service units and their status
|
|
220
|
+
systemctl list-units --type=service --state=active,inactive,failed
|
|
221
|
+
|
|
222
|
+
# Show all services, including inactive and disabled
|
|
223
|
+
systemctl list-unit-files --type=service
|
|
224
|
+
```
|
|
225
|
+
|
package/config/_local.yaml
CHANGED
|
@@ -1,148 +1,304 @@
|
|
|
1
|
-
# Copy this file to local.yaml and update with your database credentials
|
|
2
|
-
# local.yaml is gitignored and won't be committed
|
|
3
|
-
---
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
#
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
1
|
+
# Copy this file to local.yaml and update with your database credentials
|
|
2
|
+
# local.yaml is gitignored and won't be committed
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
#> ========================================================================
|
|
6
|
+
#> Outbound access points — connection settings for remote services this MCP talks to.
|
|
7
|
+
#> Each entry under accessPoints is keyed by a logical alias used in code to look up host/port/token.
|
|
8
|
+
#> By default, hosts/ports are resolved via Consul; the fields below let you override that or
|
|
9
|
+
#> describe a service that is not registered in Consul at all.
|
|
10
|
+
#> ========================================================================
|
|
11
|
+
# accessPoints:
|
|
12
|
+
# myService:
|
|
13
|
+
# #> Human-readable title shown in diagnostics and admin pages
|
|
14
|
+
# title: 'My remote service'
|
|
15
|
+
# #> Remote service host (used when noConsul=true or as a fallback)
|
|
16
|
+
# host: <host>
|
|
17
|
+
# #> Remote service TCP port
|
|
18
|
+
# port: 9999
|
|
19
|
+
# #> Auth token sent to the remote service
|
|
20
|
+
# token: '***'
|
|
21
|
+
# #> Use if the service developers do not provide registration in consul —
|
|
22
|
+
# #> disables Consul lookup and forces use of the host/port above
|
|
23
|
+
# noConsul: true
|
|
24
|
+
# #> Override the Consul service name to look up (defaults to the alias key)
|
|
25
|
+
# consulServiceName: <consulServiceName>
|
|
26
|
+
|
|
27
|
+
#> Active Directory / LDAP settings.
|
|
28
|
+
#> Used for authentication/authorization (e.g., NTLM in admin panel) and checking user membership in AD groups.
|
|
29
|
+
ad:
|
|
30
|
+
#> Map of domains. Key is a domain name
|
|
31
|
+
domains:
|
|
32
|
+
MYDOMAIN:
|
|
33
|
+
#> Marks this domain as default one
|
|
34
|
+
default: true
|
|
35
|
+
#> List of LDAP controllers (can be multiple for failover).
|
|
36
|
+
#> Use ldap:// for plain LDAP or ldaps:// for LDAP over TLS.
|
|
37
|
+
controllers:
|
|
38
|
+
- 'ldap://c1.corp.com'
|
|
39
|
+
- 'ldap://c2.corp.com'
|
|
40
|
+
#> Service account (bind DN or username) used to connect to LDAP.
|
|
41
|
+
username: '***'
|
|
42
|
+
#> Service account password.
|
|
43
|
+
password: '***'
|
|
44
|
+
#> Base DN for LDAP searches. Auto-derived from controller URL if not set.
|
|
45
|
+
# baseDn: 'DC=corp,DC=com'
|
|
46
|
+
#> Cache TTL for group membership checks (default: 600000 = 10 min)
|
|
47
|
+
# groupCacheTtlMs: 600000
|
|
48
|
+
#> Cache TTL for user/group DN lookups (default: 86400000 = 24 hours)
|
|
49
|
+
# dnCacheTtlMs: 86400000
|
|
50
|
+
|
|
51
|
+
#> Built-in chat UI for testing MCP tools with an LLM.
|
|
52
|
+
agentTester:
|
|
53
|
+
#> Enables the Agent Tester UI at /agent-tester
|
|
54
|
+
enabled: true
|
|
55
|
+
#> true (default) — show Agent Tester link in home page footer; false — hide link without disabling tester
|
|
56
|
+
showFooterLink: true
|
|
57
|
+
#> true — protect Agent Tester with full multi-auth (permanentTokens/basic/JWT/custom);
|
|
58
|
+
#> browser users see a login dialog, headless clients pass Authorization header
|
|
59
|
+
useAuth: false
|
|
60
|
+
#> Browser login session lifetime in milliseconds. Default: 28800000 (8 hours).
|
|
61
|
+
#> Applies only when useAuth is true. Sessions are in-memory on the server — lost on restart.
|
|
62
|
+
sessionTtlMs: 28800000
|
|
63
|
+
#> true — emit structured JSON events (tool_call, tool_result, llm_response, response) to stdout during agent execution
|
|
64
|
+
logJson: false
|
|
65
|
+
#> OpenAI-compatible LLM credentials used by Agent Tester to drive tool calls
|
|
66
|
+
openAi:
|
|
67
|
+
#> API key for LLM provider (OpenAI and compatible)
|
|
68
|
+
apiKey: ''
|
|
69
|
+
#> Key name (for logging and debugging)
|
|
70
|
+
apiKeyName: '***'
|
|
71
|
+
#> Override base URL for OpenAI-compatible providers (Azure, local LLMs, proxies)
|
|
72
|
+
# baseURL: ''
|
|
73
|
+
#> Key-value pairs for HTTP requests that should be auto-populated in agentTester
|
|
74
|
+
#> Example: X-User-Id: 12345
|
|
75
|
+
httpHeaders:
|
|
76
|
+
|
|
77
|
+
#> --------------------------------------------------
|
|
78
|
+
#> CACHING Reduces API calls by caching responses
|
|
79
|
+
#> --------------------------------------------------
|
|
80
|
+
cache:
|
|
81
|
+
#> Time in seconds to check all data and delete expired keys
|
|
82
|
+
checkPeriod: 1200
|
|
83
|
+
#> Default maximum number of cached items
|
|
84
|
+
maxItems: 1000
|
|
85
|
+
#> Default Cache TTL in seconds
|
|
86
|
+
ttlSeconds: 300
|
|
87
|
+
|
|
88
|
+
|
|
89
|
+
#> Consul service discovery and registration settings
|
|
90
|
+
consul:
|
|
91
|
+
#> Health check parameters reported to Consul for this service
|
|
92
|
+
check:
|
|
93
|
+
#> How often Consul invokes the health check
|
|
94
|
+
interval: '10s'
|
|
95
|
+
#> Per-attempt timeout for the health check
|
|
96
|
+
timeout: '5s'
|
|
97
|
+
#> Auto-deregister the service after it has been critical for this duration
|
|
98
|
+
deregistercriticalserviceafter: '3m'
|
|
99
|
+
agent:
|
|
100
|
+
#> Credentials for getting information about services in the DEV DC
|
|
101
|
+
dev:
|
|
102
|
+
#> DEV datacenter name
|
|
103
|
+
dc: '{{consul.agent.dev.dc}}'
|
|
104
|
+
#> DEV consul agent host
|
|
105
|
+
host: '{{consul.agent.dev.host}}'
|
|
106
|
+
#> DEV consul agent port
|
|
107
|
+
port: 443
|
|
108
|
+
#> Use HTTPS for the DEV consul agent
|
|
109
|
+
secure: true
|
|
110
|
+
#> Token for getting information about DEV services
|
|
111
|
+
token: '{{consul.agent.dev.token}}'
|
|
112
|
+
#> Credentials for getting information about services in the PROD DC
|
|
113
|
+
prd:
|
|
114
|
+
#> PROD datacenter name
|
|
115
|
+
dc: '{{consul.agent.prd.dc}}'
|
|
116
|
+
#> PROD consul agent host
|
|
117
|
+
host: '{{consul.agent.prd.host}}'
|
|
118
|
+
#> PROD consul agent port
|
|
119
|
+
port: 443
|
|
120
|
+
#> Use HTTPS for the PROD consul agent
|
|
121
|
+
secure: true
|
|
122
|
+
#> Token for obtaining information about PROD services
|
|
123
|
+
token: '{{consul.agent.prd.token}}'
|
|
124
|
+
#> Credentials for registering the service with Consul
|
|
125
|
+
reg:
|
|
126
|
+
#> The host of the consul agent where the service will be registered.
|
|
127
|
+
#> If not specified, the server on which the service is running is used
|
|
128
|
+
host: '{{consul.agent.reg.host}}'
|
|
129
|
+
#> Consul agent port for registration
|
|
130
|
+
port: 8500
|
|
131
|
+
#> Use HTTPS when calling the registration agent
|
|
132
|
+
secure: false
|
|
133
|
+
#> Token for registering the service in the consul agent
|
|
134
|
+
token: '{{consul.agent.reg.token}}'
|
|
135
|
+
service:
|
|
136
|
+
#> true — Allows registration of the service with the consul
|
|
137
|
+
enable: {{consul.service.enable}}
|
|
138
|
+
#> Here you can specify an alternative name for the service.
|
|
139
|
+
#> String "<name>" will be replaced by env SERVICE_NAME | <package.json>.name at initialization
|
|
140
|
+
name: <name>
|
|
141
|
+
#> This value will be specified as a suffix in the id of the service
|
|
142
|
+
instance: '{{SERVICE_INSTANCE}}'
|
|
143
|
+
#> String "<version>" will be replaced by <package.json>.version at initialization
|
|
144
|
+
version: <version>
|
|
145
|
+
#> Here you can specify an alternative name description.
|
|
146
|
+
#> String "<description>" will be replaced by <package.json>.description at initialization
|
|
147
|
+
description: <description>
|
|
148
|
+
#> If null or empty array — Will be pulled up from package.keywords at initialization
|
|
149
|
+
tags: [ ]
|
|
150
|
+
#> Arbitrary metadata published with the service registration
|
|
151
|
+
meta:
|
|
152
|
+
#> "Home" page link template
|
|
153
|
+
who: 'http://{address}:{port}/'
|
|
154
|
+
#> Used to generate the service ID
|
|
155
|
+
envCode:
|
|
156
|
+
#> Production environment code
|
|
157
|
+
prod: '{{consul.envCode.prod}}'
|
|
158
|
+
#> Development environment code
|
|
159
|
+
dev: '{{consul.envCode.dev}}'
|
|
160
|
+
|
|
161
|
+
#> Database connections used by the service
|
|
162
|
+
db:
|
|
163
|
+
#> PostgreSQL connection pool definitions
|
|
164
|
+
postgres:
|
|
165
|
+
#> Map of named PostgreSQL databases (key is a logical alias used in code)
|
|
166
|
+
dbs:
|
|
167
|
+
main:
|
|
168
|
+
#> Human-readable label shown in diagnostics and admin pages
|
|
169
|
+
label: 'Your Database Label'
|
|
170
|
+
#> To exclude the use of the database, you need to set host = ''
|
|
171
|
+
host: ''
|
|
172
|
+
#> PostgreSQL server port
|
|
173
|
+
port: 5432
|
|
174
|
+
#> Database name
|
|
175
|
+
database: your_database
|
|
176
|
+
#> Database user
|
|
177
|
+
user: your_user
|
|
178
|
+
#> Database password
|
|
179
|
+
password: your_password
|
|
180
|
+
#> List of PostgreSQL extensions required by the service (e.g., 'pgvector', 'uuid-ossp')
|
|
181
|
+
usedExtensions: []
|
|
182
|
+
# - pgvector
|
|
183
|
+
|
|
184
|
+
|
|
185
|
+
#> Logging configuration (tslog-based)
|
|
186
|
+
logger:
|
|
187
|
+
#> Minimum log level: silly | trace | debug | info | warn | error | fatal
|
|
188
|
+
level: info
|
|
189
|
+
#> To use or not to use logging to a file
|
|
190
|
+
useFileLogger: {{logger.useFileLogger}}
|
|
191
|
+
#> Absolute path to the folder where logs will be written. Default <proj_root>/../logs
|
|
192
|
+
dir: '{{logger.dir}}'
|
|
193
|
+
|
|
194
|
+
#> MCP (Model Context Protocol) server settings
|
|
195
|
+
mcp:
|
|
196
|
+
#> Transport for the MCP server: stdio | http
|
|
197
|
+
transportType: http
|
|
198
|
+
#> Response format configuration.
|
|
199
|
+
#> - structuredContent — default — the response in result.structuredContent returns JSON
|
|
200
|
+
#> - text — in the response, serialized JSON is returned in result.content[0].text
|
|
201
|
+
toolAnswerAs: text
|
|
202
|
+
#> Per-client request rate limiting for the MCP endpoint
|
|
203
|
+
rateLimit:
|
|
204
|
+
#> Maximum number of requests allowed within windowMs
|
|
205
|
+
maxRequests: 100
|
|
206
|
+
#> Rate limit window length in milliseconds (1 minute)
|
|
207
|
+
windowMs: 60000
|
|
208
|
+
|
|
209
|
+
#> Swagger / OpenAPI documentation settings
|
|
210
|
+
swagger:
|
|
211
|
+
#> An array of servers that will be added to swagger docs
|
|
212
|
+
servers:
|
|
213
|
+
# - url: http://localhost:{{port}}
|
|
214
|
+
# description: "Development server (localhost)"
|
|
215
|
+
# - url: http://0.0.0.0:{{port}}
|
|
216
|
+
# description: "Development server (all interfaces)"
|
|
217
|
+
# - url: http://<prod_server_host_or_ip>:{{port}}
|
|
218
|
+
# description: "PROD server"
|
|
219
|
+
- url: http://localhost:{{port}}
|
|
220
|
+
description: "Local server"
|
|
221
|
+
|
|
222
|
+
#> Service home page (`/`) customization
|
|
223
|
+
homePage:
|
|
224
|
+
#> Optional help link rendered in the home page footer
|
|
225
|
+
helpLink:
|
|
226
|
+
#> If empty — help link is not shown in footer
|
|
227
|
+
url: ''
|
|
228
|
+
#> Link text (default: "Help")
|
|
229
|
+
label: 'Help'
|
|
230
|
+
|
|
231
|
+
#> UI theme overrides for built-in pages (home, admin, agent-tester)
|
|
232
|
+
uiColor:
|
|
233
|
+
#> Font color of the header and a number of interface elements on the HOME page
|
|
234
|
+
primary: '#0f65dc'
|
|
235
|
+
|
|
236
|
+
#> HTTP server hosting MCP, admin panel, agent tester, swagger and health endpoints
|
|
237
|
+
webServer:
|
|
238
|
+
#> Bind address for the HTTP server
|
|
239
|
+
host: '0.0.0.0'
|
|
240
|
+
#> TCP port for the HTTP server
|
|
241
|
+
port: {{port}}
|
|
242
|
+
#> Array of hosts that CORS skips
|
|
243
|
+
originHosts: [ 'localhost', '0.0.0.0' ]
|
|
244
|
+
#> ========================================================================
|
|
245
|
+
#> Authentication is configured here only when accessing the MCP server.
|
|
246
|
+
#> Authentication in services that enable tools, resources, and prompts
|
|
247
|
+
#> is implemented more deeply. To do this, you need to use the information passed in HTTP headers.
|
|
248
|
+
#> You can also use a custom authorization function.
|
|
249
|
+
#> ========================================================================
|
|
250
|
+
auth:
|
|
251
|
+
#> Enables/disables authorization
|
|
252
|
+
enabled: {{webServer.auth.enabled}}
|
|
253
|
+
#> ========================================================================
|
|
254
|
+
#> PERMANENT SERVER TOKENS
|
|
255
|
+
#> Static tokens for server-to-server communication
|
|
256
|
+
#> CPU cost: O(1) — fastest authentication method
|
|
257
|
+
#>
|
|
258
|
+
#> To enable this authentication, you need to set auth.enabled = true
|
|
259
|
+
#> and set one token of at least 20 characters in length
|
|
260
|
+
#> ========================================================================
|
|
261
|
+
#> Add your server tokens here: ['token1', 'token2']
|
|
262
|
+
permanentServerTokens: [ ]
|
|
263
|
+
|
|
264
|
+
#> ========================================================================
|
|
265
|
+
#> JWT TOKEN WITH SYMMETRIC ENCRYPTION
|
|
266
|
+
#> Custom JWT tokens with AES-256 encryption
|
|
267
|
+
#> CPU cost: Medium — decryption + JSON parsing
|
|
268
|
+
#>
|
|
269
|
+
#> To enable this authentication, you need to set auth.enabled = true and set
|
|
270
|
+
#> encryptKey to at least 20 characters
|
|
271
|
+
#> ========================================================================
|
|
272
|
+
jwtToken:
|
|
273
|
+
#> Symmetric encryption key to generate a token for this MCP (minimum 8 chars)
|
|
274
|
+
encryptKey: '{{webServer.auth.token.encryptKey}}'
|
|
275
|
+
#> If webServer.auth.enabled and the parameter true, the service name and the service specified in the token will be checked
|
|
276
|
+
checkMCPName: {{webServer.auth.token.checkMCPName}}
|
|
277
|
+
#> If true and JWT token contains non-empty 'ip' field,
|
|
278
|
+
#> the client IP will be checked against the allowed list in the token
|
|
279
|
+
isCheckIP: false
|
|
280
|
+
|
|
281
|
+
#> ========================================================================
|
|
282
|
+
#> Basic Authentication — Base64 encoded username:password
|
|
283
|
+
#> CPU cost: Medium — Base64 decoding + string comparison
|
|
284
|
+
#> To enable this authentication, you need to set auth.enabled = true
|
|
285
|
+
#> and set username and password to valid values
|
|
286
|
+
#> ========================================================================
|
|
287
|
+
basic:
|
|
288
|
+
#> Username for HTTP Basic auth
|
|
289
|
+
username: ''
|
|
290
|
+
#> Password for HTTP Basic auth
|
|
291
|
+
password: '***'
|
|
292
|
+
|
|
293
|
+
#> ========================================================================
|
|
294
|
+
#> ADMIN PANEL AUTHENTICATION
|
|
295
|
+
#> Token generation page available at /admin endpoint
|
|
296
|
+
#> Supports 4 authentication methods: permanentServerTokens, basic, jwtToken, ntlm
|
|
297
|
+
#> ========================================================================
|
|
298
|
+
adminAuth:
|
|
299
|
+
#> Enable/disable admin panel
|
|
300
|
+
enabled: true
|
|
301
|
+
#> Authentication type for admin panel: 'permanentServerTokens' | 'basic' | 'jwtToken' | 'ntlm'
|
|
302
|
+
#> For permanentServerTokens, basic, jwtToken — uses credentials from webServer.auth section
|
|
303
|
+
#> For ntlm — uses AD configuration from ad.domains section (no additional credentials needed)
|
|
304
|
+
type: 'basic'
|
package/config/default.yaml
CHANGED
|
@@ -1,212 +1,302 @@
|
|
|
1
|
-
---
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
#
|
|
10
|
-
#
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
1
|
+
---
|
|
2
|
+
|
|
3
|
+
#> ========================================================================
|
|
4
|
+
#> Outbound access points — connection settings for remote services this MCP talks to.
|
|
5
|
+
#> Each entry under accessPoints is keyed by a logical alias used in code to look up host/port/token.
|
|
6
|
+
#> By default, hosts/ports are resolved via Consul; the fields below let you override that or
|
|
7
|
+
#> describe a service that is not registered in Consul at all.
|
|
8
|
+
#> ========================================================================
|
|
9
|
+
# accessPoints:
|
|
10
|
+
# myService:
|
|
11
|
+
# #> Human-readable title shown in diagnostics and admin pages
|
|
12
|
+
# title: 'My remote service'
|
|
13
|
+
# #> Remote service host (used when noConsul=true or as a fallback)
|
|
14
|
+
# host: <host>
|
|
15
|
+
# #> Remote service TCP port
|
|
16
|
+
# port: 9999
|
|
17
|
+
# #> Auth token sent to the remote service
|
|
18
|
+
# token: '***'
|
|
19
|
+
# #> Use if the service developers do not provide registration in consul —
|
|
20
|
+
# #> disables Consul lookup and forces use of the host/port above
|
|
21
|
+
# noConsul: true
|
|
22
|
+
# #> Override the Consul service name to look up (defaults to the alias key)
|
|
23
|
+
# consulServiceName: <consulServiceName>
|
|
24
|
+
|
|
25
|
+
#> Active Directory / LDAP settings.
|
|
26
|
+
#> Used for authentication/authorization (e.g., NTLM in admin panel) and checking user membership in AD groups.
|
|
27
|
+
ad:
|
|
28
|
+
#> Map of domains. Key is a domain name
|
|
29
|
+
domains:
|
|
30
|
+
MYDOMAIN:
|
|
31
|
+
#> Marks this domain as default one
|
|
32
|
+
default: true
|
|
33
|
+
#> List of LDAP controllers (can be multiple for failover).
|
|
34
|
+
#> Use ldap:// for plain LDAP or ldaps:// for LDAP over TLS.
|
|
35
|
+
controllers:
|
|
36
|
+
- 'ldap://c1.corp.com'
|
|
37
|
+
- 'ldap://c2.corp.com'
|
|
38
|
+
#> Service account (bind DN or username) used to connect to LDAP.
|
|
39
|
+
username: '***'
|
|
40
|
+
#> Service account password.
|
|
41
|
+
password: '***'
|
|
42
|
+
#> Base DN for LDAP searches. Auto-derived from controller URL if not set.
|
|
43
|
+
# baseDn: 'DC=corp,DC=com'
|
|
44
|
+
#> Cache TTL for group membership checks (default: 600000 = 10 min)
|
|
45
|
+
# groupCacheTtlMs: 600000
|
|
46
|
+
#> Cache TTL for user/group DN lookups (default: 86400000 = 24 hours)
|
|
47
|
+
# dnCacheTtlMs: 86400000
|
|
48
|
+
|
|
49
|
+
#> Built-in chat UI for testing MCP tools with an LLM.
|
|
50
|
+
agentTester:
|
|
51
|
+
#> Enables the Agent Tester UI at /agent-tester
|
|
52
|
+
enabled: true
|
|
53
|
+
#> true (default) — show Agent Tester link in home page footer; false — hide link without disabling tester
|
|
54
|
+
showFooterLink: true
|
|
55
|
+
#> true — protect Agent Tester with full multi-auth (permanentTokens/basic/JWT/custom);
|
|
56
|
+
#> browser users see a login dialog, headless clients pass Authorization header
|
|
57
|
+
useAuth: false
|
|
58
|
+
#> Browser login session lifetime in milliseconds. Default: 28800000 (8 hours).
|
|
59
|
+
#> Applies only when useAuth is true. Sessions are in-memory on the server — lost on restart.
|
|
60
|
+
sessionTtlMs: 28800000
|
|
61
|
+
#> true — emit structured JSON events (tool_call, tool_result, llm_response, response) to stdout during agent execution
|
|
62
|
+
logJson: false
|
|
63
|
+
#> OpenAI-compatible LLM credentials used by Agent Tester to drive tool calls
|
|
64
|
+
openAi:
|
|
65
|
+
#> API key for LLM provider (OpenAI and compatible)
|
|
66
|
+
apiKey: '***'
|
|
67
|
+
#> Key name (for logging and debugging)
|
|
68
|
+
apiKeyName: '***'
|
|
69
|
+
#> Override base URL for OpenAI-compatible providers (Azure, local LLMs, proxies)
|
|
70
|
+
# baseURL: ''
|
|
71
|
+
#> Key-value pairs for HTTP requests that should be auto-populated in agentTester
|
|
72
|
+
#> Example: X-User-Id: 12345
|
|
73
|
+
httpHeaders:
|
|
74
|
+
|
|
75
|
+
#> --------------------------------------------------
|
|
76
|
+
#> CACHING Reduces API calls by caching responses
|
|
77
|
+
#> --------------------------------------------------
|
|
78
|
+
cache:
|
|
79
|
+
#> Time in seconds to check all data and delete expired keys
|
|
80
|
+
checkPeriod: 1200
|
|
81
|
+
#> Default maximum number of cached items
|
|
82
|
+
maxItems: 1000
|
|
83
|
+
#> Default Cache TTL in seconds
|
|
84
|
+
ttlSeconds: 300
|
|
85
|
+
|
|
86
|
+
|
|
87
|
+
#> Consul service discovery and registration settings
|
|
88
|
+
consul:
|
|
89
|
+
#> Health check parameters reported to Consul for this service
|
|
90
|
+
check:
|
|
91
|
+
#> How often Consul invokes the health check
|
|
92
|
+
interval: '10s'
|
|
93
|
+
#> Per-attempt timeout for the health check
|
|
94
|
+
timeout: '5s'
|
|
95
|
+
#> Auto-deregister the service after it has been critical for this duration
|
|
96
|
+
deregistercriticalserviceafter: '3m'
|
|
97
|
+
agent:
|
|
98
|
+
#> Credentials for getting information about services in the DEV DC
|
|
99
|
+
dev:
|
|
100
|
+
#> DEV datacenter name
|
|
101
|
+
dc: '{{consul.agent.dev.dc}}'
|
|
102
|
+
#> DEV consul agent host
|
|
103
|
+
host: '{{consul.agent.dev.host}}'
|
|
104
|
+
#> DEV consul agent port
|
|
105
|
+
port: 443
|
|
106
|
+
#> Use HTTPS for the DEV consul agent
|
|
107
|
+
secure: true
|
|
108
|
+
#> Token for getting information about DEV services
|
|
109
|
+
token: '***'
|
|
110
|
+
#> Credentials for getting information about services in the PROD DC
|
|
111
|
+
prd:
|
|
112
|
+
#> PROD datacenter name
|
|
113
|
+
dc: '{{consul.agent.prd.dc}}'
|
|
114
|
+
#> PROD consul agent host
|
|
115
|
+
host: '{{consul.agent.prd.host}}'
|
|
116
|
+
#> PROD consul agent port
|
|
117
|
+
port: 443
|
|
118
|
+
#> Use HTTPS for the PROD consul agent
|
|
119
|
+
secure: true
|
|
120
|
+
#> Token for obtaining information about PROD services
|
|
121
|
+
token: '***'
|
|
122
|
+
#> Credentials for registering the service with Consul
|
|
123
|
+
reg:
|
|
124
|
+
#> The host of the consul agent where the service will be registered.
|
|
125
|
+
#> If not specified, the server on which the service is running is used
|
|
126
|
+
host: null
|
|
127
|
+
#> Consul agent port for registration
|
|
128
|
+
port: 8500
|
|
129
|
+
#> Use HTTPS when calling the registration agent
|
|
130
|
+
secure: false
|
|
131
|
+
#> Token for registering the service in the consul agent
|
|
132
|
+
token: '***'
|
|
133
|
+
service:
|
|
134
|
+
#> true — Allows registration of the service with the consul
|
|
135
|
+
enable: {{consul.service.enable}}
|
|
136
|
+
#> Here you can specify an alternative name for the service.
|
|
137
|
+
#> String "<name>" will be replaced by env SERVICE_NAME | <package.json>.name at initialization
|
|
138
|
+
name: <name>
|
|
139
|
+
#> This value will be specified as a suffix in the id of the service
|
|
140
|
+
instance: '{{SERVICE_INSTANCE}}'
|
|
141
|
+
#> String "<version>" will be replaced by <package.json>.version at initialization
|
|
142
|
+
version: <version>
|
|
143
|
+
#> Here you can specify an alternative name description.
|
|
144
|
+
#> String "<description>" will be replaced by <package.json>.description at initialization
|
|
145
|
+
description: <description>
|
|
146
|
+
#> If null or empty array — Will be pulled up from package.keywords at initialization
|
|
147
|
+
tags: [ ]
|
|
148
|
+
#> Arbitrary metadata published with the service registration
|
|
149
|
+
meta:
|
|
150
|
+
#> "Home" page link template
|
|
151
|
+
who: 'http://{address}:{port}/'
|
|
152
|
+
#> Used to generate the service ID
|
|
153
|
+
envCode:
|
|
154
|
+
#> Production environment code
|
|
155
|
+
prod: '{{consul.envCode.prod}}'
|
|
156
|
+
#> Development environment code
|
|
157
|
+
dev: '{{consul.envCode.dev}}'
|
|
158
|
+
|
|
159
|
+
#> Database connections used by the service
|
|
160
|
+
db:
|
|
161
|
+
#> PostgreSQL connection pool definitions
|
|
162
|
+
postgres:
|
|
163
|
+
#> Map of named PostgreSQL databases (key is a logical alias used in code)
|
|
164
|
+
dbs:
|
|
165
|
+
main:
|
|
166
|
+
#> Human-readable label shown in diagnostics and admin pages
|
|
167
|
+
label: 'My Database'
|
|
168
|
+
#> To exclude the use of the database, you need to set host = ''
|
|
169
|
+
host: ''
|
|
170
|
+
#> PostgreSQL server port
|
|
171
|
+
port: 5432
|
|
172
|
+
#> Database name
|
|
173
|
+
database: <database>
|
|
174
|
+
#> Database user
|
|
175
|
+
user: <user>
|
|
176
|
+
#> Database password
|
|
177
|
+
password: <password>
|
|
178
|
+
#> List of PostgreSQL extensions required by the service (e.g., 'pgvector', 'uuid-ossp')
|
|
179
|
+
usedExtensions: []
|
|
180
|
+
# - pgvector
|
|
181
|
+
|
|
182
|
+
|
|
183
|
+
#> Logging configuration (tslog-based)
|
|
184
|
+
logger:
|
|
185
|
+
#> Minimum log level: silly | trace | debug | info | warn | error | fatal
|
|
186
|
+
level: info
|
|
187
|
+
#> To use or not to use logging to a file
|
|
188
|
+
useFileLogger: {{logger.useFileLogger}}
|
|
189
|
+
#> Absolute path to the folder where logs will be written. Default <proj_root>/../logs
|
|
190
|
+
dir: '{{logger.dir}}'
|
|
191
|
+
|
|
192
|
+
#> MCP (Model Context Protocol) server settings
|
|
193
|
+
mcp:
|
|
194
|
+
#> Transport for the MCP server: stdio | http
|
|
195
|
+
transportType: http
|
|
196
|
+
#> Response format configuration.
|
|
197
|
+
#> - structuredContent — default — the response in result.structuredContent returns JSON
|
|
198
|
+
#> - text — in the response, serialized JSON is returned in result.content[0].text
|
|
199
|
+
toolAnswerAs: text
|
|
200
|
+
#> Per-client request rate limiting for the MCP endpoint
|
|
201
|
+
rateLimit:
|
|
202
|
+
#> Maximum number of requests allowed within windowMs
|
|
203
|
+
maxRequests: 100
|
|
204
|
+
#> Rate limit window length in milliseconds (1 minute)
|
|
205
|
+
windowMs: 60000
|
|
206
|
+
|
|
207
|
+
#> Swagger / OpenAPI documentation settings
|
|
208
|
+
swagger:
|
|
209
|
+
#> An array of servers that will be added to swagger docs
|
|
210
|
+
servers:
|
|
211
|
+
# - url: http://localhost:{{port}}
|
|
212
|
+
# description: "Development server (localhost)"
|
|
213
|
+
# - url: http://0.0.0.0:{{port}}
|
|
214
|
+
# description: "Development server (all interfaces)"
|
|
215
|
+
# - url: http://<prod_server_host_or_ip>:{{port}}
|
|
216
|
+
# description: "PROD server"
|
|
217
|
+
- url: https://{{mcp.domain}}
|
|
218
|
+
description: "PROD server"
|
|
219
|
+
|
|
220
|
+
#> Service home page (`/`) customization
|
|
221
|
+
homePage:
|
|
222
|
+
#> Optional help link rendered in the home page footer
|
|
223
|
+
helpLink:
|
|
224
|
+
#> If empty — help link is not shown in footer
|
|
225
|
+
url: ''
|
|
226
|
+
#> Link text (default: "Help")
|
|
227
|
+
label: 'Help'
|
|
228
|
+
|
|
229
|
+
#> UI theme overrides for built-in pages (home, admin, agent-tester)
|
|
230
|
+
uiColor:
|
|
231
|
+
#> Font color of the header and a number of interface elements on the HOME page
|
|
232
|
+
primary: '#0f65dc'
|
|
233
|
+
|
|
234
|
+
#> HTTP server hosting MCP, admin panel, agent tester, swagger and health endpoints
|
|
235
|
+
webServer:
|
|
236
|
+
#> Bind address for the HTTP server
|
|
237
|
+
host: '0.0.0.0'
|
|
238
|
+
#> TCP port for the HTTP server
|
|
239
|
+
port: {{port}}
|
|
240
|
+
#> Array of hosts that CORS skips
|
|
241
|
+
originHosts: [ 'localhost', '0.0.0.0' ]
|
|
242
|
+
#> ========================================================================
|
|
243
|
+
#> Authentication is configured here only when accessing the MCP server.
|
|
244
|
+
#> Authentication in services that enable tools, resources, and prompts
|
|
245
|
+
#> is implemented more deeply. To do this, you need to use the information passed in HTTP headers.
|
|
246
|
+
#> You can also use a custom authorization function.
|
|
247
|
+
#> ========================================================================
|
|
248
|
+
auth:
|
|
249
|
+
#> Enables/disables authorization
|
|
250
|
+
enabled: false
|
|
251
|
+
#> ========================================================================
|
|
252
|
+
#> PERMANENT SERVER TOKENS
|
|
253
|
+
#> Static tokens for server-to-server communication
|
|
254
|
+
#> CPU cost: O(1) — fastest authentication method
|
|
255
|
+
#>
|
|
256
|
+
#> To enable this authentication, you need to set auth.enabled = true
|
|
257
|
+
#> and set one token of at least 20 characters in length
|
|
258
|
+
#> ========================================================================
|
|
259
|
+
#> Add your server tokens here: ['token1', 'token2']
|
|
260
|
+
permanentServerTokens: [ ]
|
|
261
|
+
|
|
262
|
+
#> ========================================================================
|
|
263
|
+
#> JWT TOKEN WITH SYMMETRIC ENCRYPTION
|
|
264
|
+
#> Custom JWT tokens with AES-256 encryption
|
|
265
|
+
#> CPU cost: Medium — decryption + JSON parsing
|
|
266
|
+
#>
|
|
267
|
+
#> To enable this authentication, you need to set auth.enabled = true and set
|
|
268
|
+
#> encryptKey to at least 20 characters
|
|
269
|
+
#> ========================================================================
|
|
270
|
+
jwtToken:
|
|
271
|
+
#> Symmetric encryption key to generate a token for this MCP (minimum 8 chars)
|
|
272
|
+
encryptKey: '***'
|
|
273
|
+
#> If webServer.auth.enabled and the parameter true, the service name and the service specified in the token will be checked
|
|
274
|
+
checkMCPName: true
|
|
275
|
+
#> If true and JWT token contains non-empty 'ip' field,
|
|
276
|
+
#> the client IP will be checked against the allowed list in the token
|
|
277
|
+
isCheckIP: false
|
|
278
|
+
|
|
279
|
+
#> ========================================================================
|
|
280
|
+
#> Basic Authentication — Base64 encoded username:password
|
|
281
|
+
#> CPU cost: Medium — Base64 decoding + string comparison
|
|
282
|
+
#> To enable this authentication, you need to set auth.enabled = true
|
|
283
|
+
#> and set username and password to valid values
|
|
284
|
+
#> ========================================================================
|
|
285
|
+
basic:
|
|
286
|
+
#> Username for HTTP Basic auth
|
|
287
|
+
username: ''
|
|
288
|
+
#> Password for HTTP Basic auth
|
|
289
|
+
password: '***'
|
|
290
|
+
|
|
291
|
+
#> ========================================================================
|
|
292
|
+
#> ADMIN PANEL AUTHENTICATION
|
|
293
|
+
#> Token generation page available at /admin endpoint
|
|
294
|
+
#> Supports 4 authentication methods: permanentServerTokens, basic, jwtToken, ntlm
|
|
295
|
+
#> ========================================================================
|
|
296
|
+
adminAuth:
|
|
297
|
+
#> Enable/disable admin panel
|
|
298
|
+
enabled: true
|
|
299
|
+
#> Authentication type for admin panel: 'permanentServerTokens' | 'basic' | 'jwtToken' | 'ntlm'
|
|
300
|
+
#> For permanentServerTokens, basic, jwtToken — uses credentials from webServer.auth section
|
|
301
|
+
#> For ntlm — uses AD configuration from ad.domains section (no additional credentials needed)
|
|
302
|
+
type: 'basic'
|
package/config/local.yaml
CHANGED
|
@@ -95,6 +95,9 @@ webServer:
|
|
|
95
95
|
encryptKey: '66666666-7777-8888-9999-000000000000'
|
|
96
96
|
# If webServer.auth.enabled and the parameter true, the service name and the service specified in the token will be checked
|
|
97
97
|
checkMCPName: true
|
|
98
|
+
# If true and JWT token contains non-empty 'ip' field,
|
|
99
|
+
# the client IP will be checked against the allowed list in the token
|
|
100
|
+
isCheckIP: false
|
|
98
101
|
basic:
|
|
99
102
|
username: vpupkin
|
|
100
103
|
password: '1'
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "fa-mcp-sdk",
|
|
3
3
|
"productName": "FA MCP SDK",
|
|
4
|
-
"version": "0.4.
|
|
4
|
+
"version": "0.4.18",
|
|
5
5
|
"description": "Core infrastructure and templates for building Model Context Protocol (MCP) servers with TypeScript",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"main": "dist/core/index.js",
|