github-to-mcp-monorepo 1.0.0

package/apps/web/app/api/playground/connect/route.ts

@@ -0,0 +1,143 @@
+/**
+ * Playground Connect API Route - Establish MCP server connection
+ * @copyright 2024-2026 nirholas
+ * @license MIT
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { McpSandbox } from '@/lib/mcp-sandbox';
+
+interface ConnectRequestBody {
+  generatedCode: string;
+}
+
+interface ConnectResponse {
+  success: boolean;
+  sessionId: string;
+  tools: Array<{
+    name: string;
+    description?: string;
+    inputSchema?: {
+      type: string;
+      properties?: Record<string, unknown>;
+      required?: string[];
+    };
+  }>;
+  error?: string;
+}
+
+function validateRequest(body: unknown): body is ConnectRequestBody {
+  if (!body || typeof body !== 'object') return false;
+  const req = body as Record<string, unknown>;
+  return typeof req.generatedCode === 'string' && req.generatedCode.trim().length > 0;
+}
+
+/**
+ * POST /api/playground/connect
+ * Connect to an MCP server and return available tools
+ */
+export async function POST(request: NextRequest): Promise<NextResponse<ConnectResponse>> {
+  try {
+    const body = await request.json().catch(() => null);
+
+    if (!validateRequest(body)) {
+      return NextResponse.json(
+        {
+          success: false,
+          sessionId: '',
+          tools: [],
+          error: 'Invalid request body. Required: generatedCode (string)',
+        },
+        { status: 400 }
+      );
+    }
+
+    // Basic security: Check code size (max 1MB)
+    if (body.generatedCode.length > 1024 * 1024) {
+      return NextResponse.json(
+        {
+          success: false,
+          sessionId: '',
+          tools: [],
+          error: 'Generated code exceeds maximum size limit (1MB)',
+        },
+        { status: 400 }
+      );
+    }
+
+    // Basic security: Check for dangerous patterns
+    const dangerousPatterns = [
+      /require\s*\(\s*['"`]child_process['"`]\s*\)/i,
+      /import\s+.*from\s+['"`]child_process['"`]/i,
+      /execSync|spawnSync|exec\s*\(/i,
+      /fs\.rm|fs\.unlink|fs\.rmdir/i,
+      /process\.exit/i,
+      /eval\s*\(/i,
+      /Function\s*\(/i,
+    ];
+
+    for (const pattern of dangerousPatterns) {
+      if (pattern.test(body.generatedCode)) {
+        return NextResponse.json(
+          {
+            success: false,
+            sessionId: '',
+            tools: [],
+            error: 'Generated code contains potentially dangerous patterns',
+          },
+          { status: 400 }
+        );
+      }
+    }
+
+    // Create sandbox and connect
+    const sandbox = new McpSandbox();
+    const result = await sandbox.connect(body.generatedCode);
+
+    if (result.success) {
+      return NextResponse.json({
+        success: true,
+        sessionId: result.sessionId,
+        tools: result.tools || [],
+      });
+    } else {
+      return NextResponse.json(
+        {
+          success: false,
+          sessionId: '',
+          tools: [],
+          error: result.error || 'Failed to connect',
+        },
+        { status: 422 }
+      );
+    }
+  } catch (error) {
+    console.error('[Playground Connect] Error:', error);
+    const message = error instanceof Error ? error.message : 'Internal server error';
+
+    return NextResponse.json(
+      {
+        success: false,
+        sessionId: '',
+        tools: [],
+        error: message,
+      },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * OPTIONS /api/playground/connect
+ * Handle CORS preflight
+ */
+export async function OPTIONS(): Promise<NextResponse> {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'POST, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+    },
+  });
+}

package/apps/web/app/api/playground/disconnect/route.ts

@@ -0,0 +1,78 @@
+/**
+ * Playground Disconnect API Route - Close MCP server session
+ * @copyright 2024-2026 nirholas
+ * @license MIT
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { McpSandbox } from '@/lib/mcp-sandbox';
+
+interface DisconnectRequestBody {
+  sessionId: string;
+}
+
+interface DisconnectResponse {
+  success: boolean;
+  message: string;
+}
+
+function validateRequest(body: unknown): body is DisconnectRequestBody {
+  if (!body || typeof body !== 'object') return false;
+  const req = body as Record<string, unknown>;
+  return typeof req.sessionId === 'string' && req.sessionId.trim().length > 0;
+}
+
+/**
+ * POST /api/playground/disconnect
+ * Disconnect from an MCP server session
+ */
+export async function POST(request: NextRequest): Promise<NextResponse<DisconnectResponse>> {
+  try {
+    const body = await request.json().catch(() => null);
+
+    if (!validateRequest(body)) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Invalid request body. Required: sessionId (string)',
+        },
+        { status: 400 }
+      );
+    }
+
+    const deleted = McpSandbox.deleteSession(body.sessionId);
+
+    return NextResponse.json({
+      success: true,
+      message: deleted 
+        ? `Session ${body.sessionId} disconnected successfully`
+        : `Session ${body.sessionId} not found (may have already expired)`,
+    });
+  } catch (error) {
+    console.error('[Playground Disconnect] Error:', error);
+    const message = error instanceof Error ? error.message : 'Internal server error';
+
+    return NextResponse.json(
+      {
+        success: false,
+        message,
+      },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * OPTIONS /api/playground/disconnect
+ * Handle CORS preflight
+ */
+export async function OPTIONS(): Promise<NextResponse> {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'POST, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+    },
+  });
+}

package/apps/web/app/api/playground/execute/route.ts

@@ -0,0 +1,135 @@
+/**
+ * Playground Execute API Route - Execute tools in MCP sandbox
+ * @copyright 2024-2026 nirholas
+ * @license MIT
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { McpSandbox, ExecuteToolRequest, ExecuteToolResponse } from '@/lib/mcp-sandbox';
+
+// Request body schema
+interface ExecuteRequestBody {
+  generatedCode: string;
+  toolName: string;
+  toolParams: Record<string, unknown>;
+  sessionId?: string;
+}
+
+// Validate request body
+function validateRequest(body: unknown): body is ExecuteRequestBody {
+  if (!body || typeof body !== 'object') return false;
+  
+  const req = body as Record<string, unknown>;
+  
+  if (typeof req.generatedCode !== 'string' || !req.generatedCode.trim()) {
+    return false;
+  }
+  
+  if (typeof req.toolName !== 'string' || !req.toolName.trim()) {
+    return false;
+  }
+  
+  if (typeof req.toolParams !== 'object' || req.toolParams === null) {
+    return false;
+  }
+  
+  if (req.sessionId !== undefined && typeof req.sessionId !== 'string') {
+    return false;
+  }
+  
+  return true;
+}
+
+/**
+ * POST /api/playground/execute
+ * Execute a tool in the MCP sandbox
+ */
+export async function POST(request: NextRequest): Promise<NextResponse<ExecuteToolResponse | { error: string }>> {
+  try {
+    // Parse request body
+    const body = await request.json().catch(() => null);
+    
+    if (!validateRequest(body)) {
+      return NextResponse.json(
+        { error: 'Invalid request body. Required fields: generatedCode (string), toolName (string), toolParams (object)' },
+        { status: 400 }
+      );
+    }
+
+    // Basic security: Check code size (max 1MB)
+    if (body.generatedCode.length > 1024 * 1024) {
+      return NextResponse.json(
+        { error: 'Generated code exceeds maximum size limit (1MB)' },
+        { status: 400 }
+      );
+    }
+
+    // Basic security: Check for obviously dangerous patterns
+    const dangerousPatterns = [
+      /require\s*\(\s*['"`]child_process['"`]\s*\)/i,
+      /import\s+.*from\s+['"`]child_process['"`]/i,
+      /execSync|spawnSync|exec\s*\(/i,
+      /fs\.rm|fs\.unlink|fs\.rmdir/i,
+      /process\.exit/i,
+      /eval\s*\(/i,
+      /Function\s*\(/i,
+    ];
+
+    for (const pattern of dangerousPatterns) {
+      if (pattern.test(body.generatedCode)) {
+        return NextResponse.json(
+          { error: 'Generated code contains potentially dangerous patterns' },
+          { status: 400 }
+        );
+      }
+    }
+
+    // Create sandbox and execute
+    const sandbox = new McpSandbox();
+    
+    const executeRequest: ExecuteToolRequest = {
+      generatedCode: body.generatedCode,
+      toolName: body.toolName,
+      toolParams: body.toolParams,
+      sessionId: body.sessionId,
+    };
+
+    const result = await sandbox.executeTool(executeRequest);
+
+    // Return appropriate status code based on success
+    if (result.success) {
+      return NextResponse.json(result);
+    } else {
+      return NextResponse.json(result, { status: 422 });
+    }
+  } catch (error) {
+    console.error('[Playground Execute] Unexpected error:', error);
+    
+    const message = error instanceof Error ? error.message : 'Internal server error';
+    
+    return NextResponse.json(
+      { 
+        error: message,
+        success: false,
+        sessionId: '',
+        executionTime: 0,
+      } as ExecuteToolResponse,
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * OPTIONS /api/playground/execute
+ * Handle CORS preflight
+ */
+export async function OPTIONS(): Promise<NextResponse> {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'POST, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+    },
+  });
+}

package/apps/web/app/api/playground/sessions/route.ts

@@ -0,0 +1,103 @@
+/**
+ * Playground Sessions API Route - Manage MCP sandbox sessions
+ * @copyright 2024-2026 nirholas
+ * @license MIT
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { McpSandbox } from '@/lib/mcp-sandbox';
+
+// Response types
+interface SessionInfo {
+  id: string;
+  createdAt: string;
+  lastUsed: string;
+  initialized: boolean;
+}
+
+interface ListSessionsResponse {
+  sessions: SessionInfo[];
+  count: number;
+}
+
+interface DeleteSessionResponse {
+  success: boolean;
+  message: string;
+  deletedCount?: number;
+}
+
+/**
+ * GET /api/playground/sessions
+ * List all active sessions
+ */
+export async function GET(): Promise<NextResponse<ListSessionsResponse>> {
+  const sessions = McpSandbox.getAllSessions();
+  
+  return NextResponse.json({
+    sessions: sessions.map(session => ({
+      id: session.id,
+      createdAt: session.createdAt.toISOString(),
+      lastUsed: session.lastUsed.toISOString(),
+      initialized: session.initialized,
+    })),
+    count: sessions.length,
+  });
+}
+
+/**
+ * DELETE /api/playground/sessions
+ * Delete one or all sessions
+ * 
+ * Query params:
+ *   - id: Session ID to delete (optional, if not provided deletes all)
+ */
+export async function DELETE(request: NextRequest): Promise<NextResponse<DeleteSessionResponse>> {
+  const { searchParams } = new URL(request.url);
+  const sessionId = searchParams.get('id');
+  
+  if (sessionId) {
+    // Delete specific session
+    const deleted = McpSandbox.deleteSession(sessionId);
+    
+    if (deleted) {
+      return NextResponse.json({
+        success: true,
+        message: `Session ${sessionId} deleted successfully`,
+        deletedCount: 1,
+      });
+    } else {
+      return NextResponse.json(
+        {
+          success: false,
+          message: `Session ${sessionId} not found`,
+          deletedCount: 0,
+        },
+        { status: 404 }
+      );
+    }
+  } else {
+    // Delete all sessions
+    const count = McpSandbox.deleteAllSessions();
+    
+    return NextResponse.json({
+      success: true,
+      message: `All sessions deleted successfully`,
+      deletedCount: count,
+    });
+  }
+}
+
+/**
+ * OPTIONS /api/playground/sessions
+ * Handle CORS preflight
+ */
+export async function OPTIONS(): Promise<NextResponse> {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'GET, DELETE, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+    },
+  });
+}

package/apps/web/app/api/playground/tools/route.ts

@@ -0,0 +1,117 @@
+/**
+ * Playground Tools API Route - List available tools from MCP server
+ * @copyright 2024-2026 nirholas
+ * @license MIT
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { McpSandbox, ListToolsResponse } from '@/lib/mcp-sandbox';
+
+// Request body schema
+interface ListToolsRequestBody {
+  generatedCode: string;
+  sessionId?: string;
+}
+
+// Validate request body
+function validateRequest(body: unknown): body is ListToolsRequestBody {
+  if (!body || typeof body !== 'object') return false;
+  
+  const req = body as Record<string, unknown>;
+  
+  if (typeof req.generatedCode !== 'string' || !req.generatedCode.trim()) {
+    return false;
+  }
+  
+  if (req.sessionId !== undefined && typeof req.sessionId !== 'string') {
+    return false;
+  }
+  
+  return true;
+}
+
+/**
+ * POST /api/playground/tools
+ * List available tools from the MCP server
+ */
+export async function POST(request: NextRequest): Promise<NextResponse<ListToolsResponse | { error: string }>> {
+  try {
+    // Parse request body
+    const body = await request.json().catch(() => null);
+    
+    if (!validateRequest(body)) {
+      return NextResponse.json(
+        { error: 'Invalid request body. Required field: generatedCode (string)' },
+        { status: 400 }
+      );
+    }
+
+    // Basic security: Check code size (max 1MB)
+    if (body.generatedCode.length > 1024 * 1024) {
+      return NextResponse.json(
+        { error: 'Generated code exceeds maximum size limit (1MB)' },
+        { status: 400 }
+      );
+    }
+
+    // Basic security: Check for obviously dangerous patterns
+    const dangerousPatterns = [
+      /require\s*\(\s*['"`]child_process['"`]\s*\)/i,
+      /import\s+.*from\s+['"`]child_process['"`]/i,
+      /execSync|spawnSync|exec\s*\(/i,
+      /fs\.rm|fs\.unlink|fs\.rmdir/i,
+      /process\.exit/i,
+      /eval\s*\(/i,
+      /Function\s*\(/i,
+    ];
+
+    for (const pattern of dangerousPatterns) {
+      if (pattern.test(body.generatedCode)) {
+        return NextResponse.json(
+          { error: 'Generated code contains potentially dangerous patterns' },
+          { status: 400 }
+        );
+      }
+    }
+
+    // Create sandbox and list tools
+    const sandbox = new McpSandbox();
+    
+    const result = await sandbox.listTools(body.generatedCode, body.sessionId);
+
+    // Return appropriate status code based on success
+    if (result.success) {
+      return NextResponse.json(result);
+    } else {
+      return NextResponse.json(result, { status: 422 });
+    }
+  } catch (error) {
+    console.error('[Playground Tools] Unexpected error:', error);
+    
+    const message = error instanceof Error ? error.message : 'Internal server error';
+    
+    return NextResponse.json(
+      { 
+        error: message,
+        success: false,
+        sessionId: '',
+      } as ListToolsResponse,
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * OPTIONS /api/playground/tools
+ * Handle CORS preflight
+ */
+export async function OPTIONS(): Promise<NextResponse> {
+  return new NextResponse(null, {
+    status: 204,
+    headers: {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'POST, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+    },
+  });
+}

package/apps/web/app/api/playground/v2/connect/route.ts

@@ -0,0 +1,96 @@
+/**
+ * Connect API Route
+ *
+ * POST /api/playground/v2/connect
+ * Establishes a connection to an MCP server using the specified transport.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import {
+  handleApiError,
+  createSuccessResponse,
+  McpConnectionError,
+  validateConnectRequest,
+  applyMiddleware,
+  corsPreflightResponse,
+  createLogContext,
+  SessionManager,
+  withRequestId,
+} from '@/lib/api';
+import type { ConnectResponseData } from '@/lib/api';
+
+const PATH = '/api/playground/v2/connect';
+
+/**
+ * Handle CORS preflight request
+ */
+export async function OPTIONS(): Promise<NextResponse> {
+  return corsPreflightResponse({ methods: ['POST', 'OPTIONS'] });
+}
+
+/**
+ * POST /api/playground/v2/connect
+ *
+ * Establishes a connection to an MCP server.
+ *
+ * Request body:
+ * - transport: TransportConfig (required) - The transport configuration
+ * - generatedCode: string (optional) - Generated code to run as stdio server
+ *
+ * Response:
+ * - success: boolean
+ * - data: { sessionId, capabilities, serverInfo, tools }
+ */
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  // Apply middleware (rate limiting, etc.)
+  const middleware = await applyMiddleware(request);
+  if ('response' in middleware) {
+    return middleware.response;
+  }
+
+  const { context } = middleware;
+  const log = createLogContext('POST', PATH, context.requestId, context.clientId);
+
+  try {
+    // Parse and validate request body
+    const body = await request.json();
+    const { transport, generatedCode } = validateConnectRequest(body);
+
+    // Create session with MCP server
+    const sessionManager = SessionManager.getInstance();
+
+    let session;
+    try {
+      session = await sessionManager.createSession(transport, generatedCode);
+    } catch (error) {
+      throw new McpConnectionError(
+        `Failed to connect to MCP server: ${error instanceof Error ? error.message : 'Unknown error'}`,
+        {
+          transportType: transport.type,
+          cause: error instanceof Error ? error.message : undefined,
+        }
+      );
+    }
+
+    const responseData: ConnectResponseData = {
+      sessionId: session.id,
+      capabilities: session.capabilities,
+      serverInfo: session.serverInfo,
+      tools: session.tools,
+    };
+
+    log.log(200, session.id);
+
+    return createSuccessResponse(responseData, 200, {
+      ...context.rateLimitHeaders,
+      ...withRequestId({}, context.requestId),
+      'Access-Control-Allow-Origin': '*',
+    });
+  } catch (error) {
+    const status = error instanceof Error && 'statusCode' in error
+      ? (error as { statusCode: number }).statusCode
+      : 500;
+    log.log(status, undefined, error instanceof Error ? error.message : 'Unknown error');
+    return handleApiError(error);
+  }
+}