hive-intelligence 1.1.3 → 1.1.4

package/build/server.js

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import {
+  executeToolByName
+} from "./chunk-CEWCB5YS.js";
 import {
   AUTH_COMPATIBILITY,
   CategoryEndpoints,
+  HIVE_AUTH_SUBJECT_ARG,
+  HIVE_AUTH_USER_ARG,
   HIVE_PROMPTS,
   HIVE_RESOURCES,
   RUNTIME_STATUSES,
-  SERVER_NAME,
-  SERVER_VERSION,
   TASK_TOOLSETS,
   TASK_TOOLSET_RUNTIME_STATUSES,
   ToolRegistry,
@@ -15,9 +18,8 @@ import {
   buildToolCatalogEntry,
   classifyRuntimeStatusFromError,
   createHiveMcpServer,
-  createToolNotFoundResult,
   dynamicTools,
-  executeEndpoint,
+  generateSubjectSigningSecret,
   getAllWrappedEndpoints,
   getCorsAllowedOrigins,
   getCsvEnv,
@@ -27,27 +29,35 @@ import {
   getProviderList,
   getRateLimitMax,
   getRedisClient,
-  getRequiredEnvVar,
   getRootVisibleToolCount,
-  getSharedClients,
+  getSupabaseAdmin,
+  getSupabaseAuthClient,
   getTaskCanaryCatalog,
   getTaskCanaryHistory,
-  hasEnvVars,
+  hasSubjectSigningSecret,
+  isB2BSubjectsEnabled,
   isProduction,
   isRedisAvailable,
-  resolveEndpoint,
+  isSupabaseConfigured,
+  recordSubjectAuditEvent,
+  resolveSubjectContext,
   runSelfTestFull,
   runSelfTestProvider,
   runSelfTestQuick,
   runTaskCanariesQuick,
   runTaskCanary,
+  sanitizeKeyMeta,
   secureLogger,
   trackServerEvent
-} from "./chunk-2X3U4DFK.js";
+} from "./chunk-JTUKQWIO.js";
 import {
   HIVE_AGENT_SKILLS
-} from "./chunk-B6G222LS.js";
-import "./chunk-KBVPIZS4.js";
+} from "./chunk-VBOKVQ74.js";
+import {
+  SERVER_NAME,
+  SERVER_VERSION
+} from "./chunk-ZCU7XQKF.js";
+import "./chunk-3WYWXTNN.js";
 
 // src/server.ts
 import dotenv from "dotenv";
@@ -1048,46 +1058,6 @@ import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
 
 // src/services/unkey-service.ts
 import { Unkey } from "@unkey/api";
-
-// src/db/supabase.ts
-import { createClient } from "@supabase/supabase-js";
-var _supabaseAdmin = null;
-var _supabaseAuth = null;
-function isSupabaseConfigured() {
-  return hasEnvVars("SUPABASE_URL", "SUPABASE_SERVICE_ROLE_KEY");
-}
-function getSupabaseAdmin() {
-  if (!_supabaseAdmin) {
-    if (!isSupabaseConfigured()) {
-      throw new Error(
-        "Supabase not configured. Set SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY."
-      );
-    }
-    _supabaseAdmin = createClient(
-      getRequiredEnvVar("SUPABASE_URL"),
-      getRequiredEnvVar("SUPABASE_SERVICE_ROLE_KEY"),
-      { auth: { persistSession: false, autoRefreshToken: false } }
-    );
-  }
-  return _supabaseAdmin;
-}
-function getSupabaseAuthClient() {
-  if (!_supabaseAuth) {
-    if (!hasEnvVars("SUPABASE_URL", "SUPABASE_ANON_KEY")) {
-      throw new Error(
-        "Supabase auth client not configured. Set SUPABASE_URL and SUPABASE_ANON_KEY."
-      );
-    }
-    _supabaseAuth = createClient(
-      getRequiredEnvVar("SUPABASE_URL"),
-      getRequiredEnvVar("SUPABASE_ANON_KEY"),
-      { auth: { persistSession: false, autoRefreshToken: false } }
-    );
-  }
-  return _supabaseAuth;
-}
-
-// src/services/unkey-service.ts
 var _unkey = null;
 function getAuthBackendMode() {
   const mode = (process.env.HIVE_AUTH_BACKEND ?? "auto").trim().toLowerCase();
@@ -1155,13 +1125,22 @@ async function createApiKey(opts) {
       `Key limit reached. Your ${plan.name} plan allows ${plan.max_api_keys} keys.`
     );
   }
+  const subjectSigningSecret = opts.b2bSubjectsEnabled ? generateSubjectSigningSecret() : void 0;
+  const meta = {
+    plan: opts.planId,
+    name: opts.name,
+    ...opts.b2bSubjectsEnabled ? {
+      b2b_subjects_enabled: true,
+      subject_signing_secret: subjectSigningSecret
+    } : {}
+  };
   const result = await getUnkey().keys.createKey({
     apiId: getApiId(),
     prefix: "hive_live",
     name: opts.name,
     byteLength: 24,
     externalId: opts.userId,
-    meta: { plan: opts.planId, name: opts.name },
+    meta,
     ratelimits: [
       {
         name: "requests",
@@ -1177,7 +1156,11 @@ async function createApiKey(opts) {
     });
     throw new Error("Failed to create API key");
   }
-  return { keyId: result.data.keyId, key: result.data.key };
+  return {
+    keyId: result.data.keyId,
+    key: result.data.key,
+    subjectSigningSecret
+  };
 }
 async function verifyApiKey(rawKey, analyticsTags = []) {
   const tags = normalizeAnalyticsTags(analyticsTags);
@@ -1207,6 +1190,7 @@ async function verifyApiKey(rawKey, analyticsTags = []) {
     planId: d.meta?.plan,
     name: d.name,
     credits: d.credits ?? void 0,
+    meta: d.meta ?? void 0,
     ratelimit: rl ? { remaining: rl.remaining, limit: rl.limit, reset: rl.reset } : void 0
   };
 }
@@ -1225,7 +1209,7 @@ async function listKeys(userId) {
     enabled: k.enabled ?? true,
     credits: k.credits?.remaining ?? void 0,
     externalId: k.identity?.externalId ?? void 0,
-    meta: k.meta ?? void 0
+    meta: sanitizeKeyMeta(k.meta ?? void 0)
   }));
 }
 async function revokeKey(keyId) {
@@ -3564,7 +3548,8 @@ async function handleRedisLookup(key, res, next) {
 // src/routes/keys.ts
 var router3 = Router3();
 var CreateKeySchema = z2.object({
-  name: z2.string().min(1).max(100).optional()
+  name: z2.string().min(1).max(100).optional(),
+  b2b_subjects_enabled: z2.boolean().optional()
 });
 router3.post(
   "/",
@@ -3582,7 +3567,7 @@ router3.post(
         )
       );
     }
-    const { name } = parseResult.data;
+    const { name, b2b_subjects_enabled } = parseResult.data;
     const { data: profile } = await getSupabaseAdmin().from("user_profiles").select("plan_id").eq("id", user.id).single();
     const planId = profile?.plan_id ?? "demo";
     await ensureWallet(user.id, planId);
@@ -3590,7 +3575,8 @@ router3.post(
       const result = await createApiKey({
         userId: user.id,
         name: name ?? "Default",
-        planId
+        planId,
+        b2bSubjectsEnabled: b2b_subjects_enabled ?? false
       });
       return res.status(201).json({
         ok: true,
@@ -3599,6 +3585,8 @@ router3.post(
           key: result.key,
           name: name ?? "Default",
           plan: planId,
+          b2b_subjects_enabled: b2b_subjects_enabled ?? false,
+          ...result.subjectSigningSecret ? { subject_signing_secret: result.subjectSigningSecret } : {},
           warning: "Save this key \u2014 it will not be shown again."
         }
       });
@@ -3743,6 +3731,176 @@ router4.get(
 );
 var usage_default = router4;
 
+// src/routes/b2b.ts
+import { Router as Router5 } from "express";
+var router5 = Router5();
+var SIGNED_SUBJECT_HEADERS = [
+  "X-Hive-Tenant-Id",
+  "X-Hive-End-User-Id",
+  "X-Hive-Subject-Timestamp",
+  "X-Hive-Subject-Signature"
+];
+var SIGNATURE_PAYLOAD = 'METHOD + "\\n" + PATH + "\\n" + TENANT_ID + "\\n" + END_USER_ID + "\\n" + TIMESTAMP';
+function buildB2BReadinessPayload(args) {
+  const meta = args.verifyResult?.meta;
+  const b2bEnabled = args.authBackend === "unkey" ? isB2BSubjectsEnabled(meta) : false;
+  const secretConfigured = args.authBackend === "unkey" && b2bEnabled ? hasSubjectSigningSecret(meta) : false;
+  const warnings = [];
+  let mode;
+  if (args.authBackend === "static") {
+    mode = "static_key";
+    warnings.push(
+      "Static HIVE_API_KEYS authentication does not provide a Hive owner user_id or per-key B2B subject metadata. Use Unkey-backed Hive keys for partner/end-user state isolation."
+    );
+  } else if (b2bEnabled) {
+    mode = "b2b_enabled";
+    if (!secretConfigured) {
+      warnings.push(
+        "This API key has B2B subjects enabled but no subject signing secret is configured. Stateful writes with signed subject headers will fail."
+      );
+    }
+  } else {
+    mode = "direct_user";
+    warnings.push(
+      "This key is valid for direct-user state, but B2B subjects are not enabled. A partner using this key without signed subject headers will share one default subject across downstream customers."
+    );
+  }
+  return {
+    b2b_adapter_ready: args.authBackend === "unkey" && b2bEnabled && secretConfigured,
+    mode,
+    auth_backend: args.authBackend,
+    api_key: {
+      valid: true,
+      ...args.verifyResult?.keyId ? { key_id: args.verifyResult.keyId } : {},
+      ...args.verifyResult?.userId ? { owner_user_id: args.verifyResult.userId } : {},
+      ...args.verifyResult?.planId ? { plan_id: args.verifyResult.planId } : {},
+      ...args.verifyResult?.name ? { name: args.verifyResult.name } : {},
+      b2b_subjects_enabled: b2bEnabled,
+      subject_signing_secret_configured: secretConfigured,
+      ...args.verifyResult?.ratelimit ? { ratelimit_remaining: args.verifyResult.ratelimit.remaining } : {}
+    },
+    state: {
+      stateful_tools_supported: args.authBackend === "unkey",
+      direct_user_subject: "default_self",
+      signed_subjects_required_for_stateful_writes: b2bEnabled,
+      isolation_boundary: "owner_user_id + subject_id"
+    },
+    signed_subject_headers: SIGNED_SUBJECT_HEADERS,
+    signature_payload: SIGNATURE_PAYLOAD,
+    signature_algorithm: "HMAC-SHA256",
+    timestamp_skew_seconds: 300,
+    endpoints: {
+      mcp: "/mcp",
+      rest_execute: "/api/v1/execute",
+      readiness: "/api/v1/b2b/readiness"
+    },
+    smoke: {
+      command: "npm run smoke:b2b-partner",
+      required_env: ["HIVE_API_KEY", "HIVE_SUBJECT_SIGNING_SECRET"]
+    },
+    warnings
+  };
+}
+function getRequestApiKey(req) {
+  const xApiKey = req.headers["x-api-key"];
+  if (typeof xApiKey === "string" && xApiKey.trim()) return xApiKey.trim();
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ")) {
+    const token = auth.slice("Bearer ".length).trim();
+    return token || void 0;
+  }
+  return void 0;
+}
+router5.get(
+  "/readiness",
+  asyncHandler(async (req, res) => {
+    const key = getRequestApiKey(req);
+    if (!key) {
+      return res.status(401).json(
+        apiError(
+          "authentication_error",
+          "AUTH_REQUIRED",
+          "API key required. Set x-api-key header or Authorization: Bearer <key>.",
+          { requestId: req.requestId }
+        )
+      );
+    }
+    if (isUnkeyRequired() && !isUnkeyConfigured()) {
+      return res.status(503).json(
+        apiError(
+          "internal_error",
+          "AUTH_NOT_CONFIGURED",
+          "Unkey authentication is selected but not configured. Set UNKEY_ROOT_KEY and UNKEY_API_ID, or set HIVE_AUTH_BACKEND=static with HIVE_API_KEYS.",
+          { requestId: req.requestId }
+        )
+      );
+    }
+    if (isUnkeyConfigured()) {
+      const result = await verifyApiKey(key, [
+        "service=hive",
+        "transport=rest",
+        "route=/api/v1/b2b/readiness"
+      ]);
+      if (!result.valid) {
+        const statusCode = result.code === "RATE_LIMITED" ? 429 : 403;
+        const errorCode = result.code === "RATE_LIMITED" ? "RATE_LIMITED" : "INVALID_API_KEY";
+        if (result.code === "RATE_LIMITED") res.setHeader("Retry-After", "60");
+        return res.status(statusCode).json(
+          apiError(
+            "authentication_error",
+            errorCode,
+            result.code === "RATE_LIMITED" ? "Rate limit exceeded." : "Invalid API key.",
+            { requestId: req.requestId }
+          )
+        );
+      }
+      if (!result.userId) {
+        return res.status(403).json(
+          apiError(
+            "authentication_error",
+            "INVALID_API_KEY",
+            "Invalid API key.",
+            { requestId: req.requestId }
+          )
+        );
+      }
+      return res.json({
+        ok: true,
+        data: buildB2BReadinessPayload({
+          authBackend: "unkey",
+          verifyResult: result
+        })
+      });
+    }
+    const staticKeys = getCsvEnv("HIVE_API_KEYS");
+    if (staticKeys.length === 0) {
+      return res.status(503).json(
+        apiError(
+          "internal_error",
+          "AUTH_NOT_CONFIGURED",
+          "API key authentication is not configured. Set HIVE_API_KEYS or configure Unkey.",
+          { requestId: req.requestId }
+        )
+      );
+    }
+    if (!staticKeys.includes(key)) {
+      return res.status(403).json(
+        apiError(
+          "authentication_error",
+          "INVALID_API_KEY",
+          "Invalid API key.",
+          { requestId: req.requestId }
+        )
+      );
+    }
+    return res.json({
+      ok: true,
+      data: buildB2BReadinessPayload({ authBackend: "static" })
+    });
+  })
+);
+var b2b_default = router5;
+
 // src/middleware/request-id.ts
 import { randomUUID as randomUUID2 } from "crypto";
 function requestIdMiddleware(req, res, next) {
@@ -4075,64 +4233,6 @@ function generateOpenApiSpec() {
   return _cachedSpec;
 }
 
-// src/services/tool-execution.ts
-async function executeToolByName(toolName, args) {
-  const allEndpoints = getAllWrappedEndpoints();
-  const lookup = resolveEndpoint(allEndpoints, toolName);
-  if (!lookup.ok) {
-    const result2 = createToolNotFoundResult(toolName);
-    secureLogger.toolCall(toolName, false, result2.durationMs, {
-      transport: "rest",
-      runtimeStatus: "failing",
-      errorClass: "not_found"
-    });
-    return {
-      ok: false,
-      error: result2.error,
-      durationMs: result2.durationMs,
-      meta: result2.hive
-    };
-  }
-  const result = await executeEndpoint(lookup.endpoint, args, {
-    transport: "rest",
-    clients: getSharedClients()
-  });
-  if (result.validationErrors) {
-    return {
-      ok: false,
-      error: result.error,
-      validationErrors: result.validationErrors,
-      durationMs: result.durationMs,
-      meta: result.hive
-    };
-  }
-  if (result.ok) {
-    return {
-      ok: true,
-      data: result.data,
-      durationMs: result.durationMs,
-      meta: result.hive
-    };
-  }
-  if (result.error?.code === "PROVIDER_UNAVAILABLE") {
-    return {
-      ok: false,
-      error: result.error,
-      durationMs: result.durationMs,
-      meta: result.hive
-    };
-  }
-  if (result.error?.code === "INTERNAL_ERROR") {
-    secureLogger.error(`[tool-execution] ${toolName} threw`, result.error, {});
-  }
-  return {
-    ok: false,
-    error: result.error,
-    durationMs: result.durationMs,
-    meta: result.hive
-  };
-}
-
 // src/utils/mcpHttp.ts
 function isMcpPath(path) {
   return path === "/mcp" || path === "/mcp/" || /\/mcp\/?$/.test(path);
@@ -4145,6 +4245,7 @@ function hasRequiredStreamableHttpAcceptHeader(acceptHeader) {
 }
 
 // src/serverCard.ts
+import { LATEST_PROTOCOL_VERSION } from "@modelcontextprotocol/sdk/types.js";
 function buildServerCard() {
   const underlyingToolCount = getAllWrappedEndpoints().length;
   const visibleToolCount = getRootVisibleToolCount();
@@ -4153,8 +4254,8 @@ function buildServerCard() {
     name: "Hive Intelligence",
     id: "io.github.sharpe-labs/hive-mcp",
     version: SERVER_VERSION,
-    protocolVersion: "2025-06-18",
-    description: "Institutional-grade crypto market infrastructure for AI \u2014 live prices, DeFi, wallets, and token risk through a managed MCP, REST API, or CLI.",
+    protocolVersion: LATEST_PROTOCOL_VERSION,
+    description: "Managed crypto market infrastructure for AI agents \u2014 live prices, DeFi, wallets, and token risk through MCP, REST API, or CLI.",
     author: {
       name: "Hive Intelligence",
       url: "https://www.hiveintelligence.xyz",
@@ -4164,7 +4265,7 @@ function buildServerCard() {
     documentation: "https://www.hiveintelligence.xyz/crypto-mcp",
     repository: {
       type: "git",
-      url: "https://github.com/sharpe-labs/hive-mcp2"
+      url: "https://github.com/hive-intel/hive-sdk"
     },
     license: "MIT",
     categories: ["finance", "crypto", "defi", "web3", "ai-agents"],
@@ -4211,6 +4312,18 @@ function buildServerCard() {
         Authorization: "Bearer <YOUR_HIVE_API_KEY>",
         "x-api-key": "<YOUR_HIVE_API_KEY>"
       },
+      b2bSubjectHeaders: {
+        note: "B2B-enabled API keys may isolate downstream customer state by sending signed subject headers from a trusted backend adapter. Stateful writes require these headers when b2b_subjects_enabled=true.",
+        readinessUrl: "https://mcp.hiveintelligence.xyz/api/v1/b2b/readiness",
+        headers: [
+          "X-Hive-Tenant-Id",
+          "X-Hive-End-User-Id",
+          "X-Hive-Subject-Timestamp",
+          "X-Hive-Subject-Signature"
+        ],
+        signaturePayload: 'METHOD + "\\n" + PATH + "\\n" + TENANT_ID + "\\n" + END_USER_ID + "\\n" + TIMESTAMP',
+        algorithm: "HMAC-SHA256"
+      },
       signupUrl: "https://www.hiveintelligence.xyz/login?next=/dashboard/keys",
       freeTier: {
         monthlyCredits: 1e4,
@@ -4266,9 +4379,13 @@ function buildServerCard() {
         setupUrl: "https://hiveintelligence.xyz/install/claude-code"
       },
       {
-        name: "ChatGPT Desktop",
+        name: "OpenAI Responses API",
         setupUrl: "https://hiveintelligence.xyz/install/chatgpt"
       },
+      {
+        name: "Codex CLI",
+        setupUrl: "https://hiveintelligence.xyz/install/codex"
+      },
       {
         name: "Cursor",
         setupUrl: "https://hiveintelligence.xyz/install/cursor"
@@ -4363,13 +4480,16 @@ app.use(
   (req, res, next) => {
     if (req.method === "POST" && (req.path === "/mcp" || req.path.endsWith("/mcp"))) {
       const origin = req.headers.origin;
-      if (origin && !LOCALHOST_RE.test(origin) && ALLOWED_MCP_ORIGINS.length > 0 && !ALLOWED_MCP_ORIGINS.includes(origin)) {
-        res.status(403).json({
-          jsonrpc: "2.0",
-          error: { code: -32600, message: "Origin not allowed" },
-          id: null
-        });
-        return;
+      if (origin && !LOCALHOST_RE.test(origin)) {
+        const enforce = isProduction() || ALLOWED_MCP_ORIGINS.length > 0;
+        if (enforce && !ALLOWED_MCP_ORIGINS.includes(origin)) {
+          res.status(403).json({
+            jsonrpc: "2.0",
+            error: { code: -32600, message: "Origin not allowed" },
+            id: null
+          });
+          return;
+        }
       }
     }
     next();
@@ -4435,7 +4555,7 @@ function buildMcpDiscoveryDescriptor() {
     name: "Hive Intelligence",
     id: SERVER_NAME,
     version: SERVER_VERSION,
-    description: "Institutional-grade crypto market infrastructure for AI \u2014 unified API for crypto market data, DeFi, wallets, security, DEX flows, NFTs, and prediction markets",
+    description: "Managed crypto market infrastructure for AI agents \u2014 unified API for crypto market data, DeFi, wallets, security, DEX flows, NFTs, and prediction markets",
     endpoints: {
       mcp: "/mcp",
       rest: "/api/v1",
@@ -4464,7 +4584,11 @@ app.get(["/.well-known/mcp.json", "/mcp.json"], (_req, res) => {
   res.json(buildMcpDiscoveryDescriptor());
 });
 app.get(
-  ["/.well-known/mcp/server-card.json", "/server-card.json", "/mcp/server-card.json"],
+  [
+    "/.well-known/mcp/server-card.json",
+    "/server-card.json",
+    "/mcp/server-card.json"
+  ],
   (_req, res) => {
     setDiscoveryHeaders(res);
     res.json(buildServerCard());
@@ -4489,6 +4613,7 @@ app.use(health_default);
 app.use("/auth", auth_default);
 app.use("/api/v1/keys", keys_default);
 app.use("/api/v1/usage", usage_default);
+app.use("/api/v1/b2b", b2b_default);
 var mcpIpRateLimiter = createIpRateLimiter();
 var restIpRateLimiter = createIpRateLimiter();
 var mcpMiddlewares = [mcpIpRateLimiter];
@@ -4526,42 +4651,127 @@ function extractApiKey(req) {
 async function validateMcpApiKey(req) {
   const key = extractApiKey(req);
   if (isUnkeyRequired() && !isUnkeyConfigured()) {
-    return "Unkey authentication is selected but not configured. Set UNKEY_ROOT_KEY and UNKEY_API_ID, or set HIVE_AUTH_BACKEND=static with HIVE_API_KEYS.";
+    return {
+      ok: false,
+      error: "Unkey authentication is selected but not configured. Set UNKEY_ROOT_KEY and UNKEY_API_ID, or set HIVE_AUTH_BACKEND=static with HIVE_API_KEYS."
+    };
   }
   if (isUnkeyConfigured()) {
     if (!key)
-      return `API key required. Get a free key at https://hiveintelligence.xyz/dashboard/keys then pass it as 'Authorization: Bearer <key>' or 'x-api-key: <key>'. Claude Code: claude mcp add --transport http hive https://mcp.hiveintelligence.xyz/mcp --header "Authorization: Bearer <key>".`;
+      return {
+        ok: false,
+        error: `API key required. Get a free key at https://hiveintelligence.xyz/dashboard/keys then pass it as 'Authorization: Bearer <key>' or 'x-api-key: <key>'. Claude Code: claude mcp add --transport http hive https://mcp.hiveintelligence.xyz/mcp --header "Authorization: Bearer <key>".`
+      };
     let result;
     try {
-      result = await withTimeout(verifyApiKey(key, getMcpAnalyticsTags(req)), 500);
+      result = await withTimeout(
+        verifyApiKey(key, getMcpAnalyticsTags(req)),
+        500
+      );
     } catch (err) {
       secureLogger.warn("MCP Unkey verifyApiKey timeout/failure", {
         error: err instanceof Error ? err.message : String(err)
       });
-      return "Authentication service temporarily unavailable. Please retry in a moment.";
+      return {
+        ok: false,
+        error: "Authentication service temporarily unavailable. Please retry in a moment."
+      };
     }
     if (!result.valid) {
-      if (result.code === "RATE_LIMITED") return "Rate limit exceeded.";
-      return "Invalid API key.";
+      if (result.code === "RATE_LIMITED") {
+        return { ok: false, error: "Rate limit exceeded." };
+      }
+      return { ok: false, error: "Invalid API key." };
     }
     if (!result.userId) {
-      return "Invalid API key.";
+      return { ok: false, error: "Invalid API key." };
     }
     void debitCreditsAsync({
       userId: result.userId,
       keyId: result.keyId,
       requestId: req.requestId
     });
-    return null;
+    return {
+      ok: true,
+      userId: result.userId,
+      keyId: result.keyId,
+      keyMeta: result.meta
+    };
   }
   const validKeys = (process.env.HIVE_API_KEYS || "").split(",").filter(Boolean);
   if (validKeys.length === 0) {
-    return "API key authentication is not configured on this server.";
+    return {
+      ok: false,
+      error: "API key authentication is not configured on this server."
+    };
   }
   if (!key)
-    return "API key required. Set x-api-key header or Authorization: Bearer <key>.";
-  if (!validKeys.includes(key)) return "Invalid API key.";
-  return null;
+    return {
+      ok: false,
+      error: "API key required. Set x-api-key header or Authorization: Bearer <key>."
+    };
+  if (!validKeys.includes(key)) return { ok: false, error: "Invalid API key." };
+  return { ok: true };
+}
+var STATEFUL_WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "hive_create_monitor",
+  "hive_update_monitor",
+  "hive_archive_monitor",
+  "hive_update_alert_status",
+  "hive_remember_fact",
+  "hive_forget_memory_fact"
+]);
+function getMcpHiveToolName(body) {
+  if (body?.method !== "tools/call") return void 0;
+  const toolName = body.params?.name;
+  const toolArgs = body.params?.arguments;
+  if (!toolName || typeof toolName !== "string") return void 0;
+  if (toolName === "invoke_api_endpoint") {
+    const endpointName = typeof toolArgs?.endpoint_name === "string" ? toolArgs.endpoint_name : typeof toolArgs?.args?.endpoint_name === "string" ? toolArgs.args.endpoint_name : void 0;
+    return endpointName?.startsWith("hive_") ? endpointName : void 0;
+  }
+  return toolName.startsWith("hive_") ? toolName : void 0;
+}
+function removeHiddenHiveAuthArgs(args) {
+  if (!args || typeof args !== "object" || Array.isArray(args)) return;
+  delete args[HIVE_AUTH_USER_ARG];
+  delete args[HIVE_AUTH_SUBJECT_ARG];
+}
+function getRestHiveToolName(toolName, args) {
+  if (toolName.startsWith("hive_")) return toolName;
+  if (toolName !== "invoke_api_endpoint") return void 0;
+  const endpointName = typeof args.endpoint_name === "string" ? args.endpoint_name : typeof args.args?.endpoint_name === "string" ? args.args.endpoint_name : void 0;
+  return endpointName?.startsWith("hive_") ? endpointName : void 0;
+}
+function injectMcpAuthContext(body, context) {
+  if (body?.method !== "tools/call") return;
+  const toolName = body.params?.name;
+  if (!toolName || typeof toolName !== "string") return;
+  if (toolName !== "invoke_api_endpoint" && !toolName.startsWith("hive_")) {
+    return;
+  }
+  if (!body.params.arguments || typeof body.params.arguments !== "object") {
+    body.params.arguments = {};
+  }
+  const toolArgs = body.params.arguments;
+  if (toolName === "invoke_api_endpoint") {
+    removeHiddenHiveAuthArgs(toolArgs);
+    removeHiddenHiveAuthArgs(toolArgs.args);
+    const endpointName = typeof toolArgs.endpoint_name === "string" ? toolArgs.endpoint_name : typeof toolArgs.args?.endpoint_name === "string" ? toolArgs.args.endpoint_name : void 0;
+    if (!endpointName?.startsWith("hive_") || !context) return;
+    if (!toolArgs.args || typeof toolArgs.args !== "object") {
+      toolArgs.args = {};
+    }
+    toolArgs.args[HIVE_AUTH_USER_ARG] = context.userId;
+    toolArgs.args[HIVE_AUTH_SUBJECT_ARG] = context.subjectId;
+    return;
+  }
+  removeHiddenHiveAuthArgs(toolArgs);
+  if (typeof toolName === "string" && toolName.startsWith("hive_")) {
+    if (!context) return;
+    toolArgs[HIVE_AUTH_USER_ARG] = context.userId;
+    toolArgs[HIVE_AUTH_SUBJECT_ARG] = context.subjectId;
+  }
 }
 function getMcpAnalyticsTags(req) {
   const body = req.body;
@@ -4582,11 +4792,11 @@ function getMcpAnalyticsTags(req) {
 function createStatelessMcpHandler(scope) {
   return async (req, res) => {
     const sessionCorrelationId = req.requestId;
-    const authError = await validateMcpApiKey(req);
-    if (authError) {
+    const auth = await validateMcpApiKey(req);
+    if (!auth.ok) {
       res.status(200).json({
         jsonrpc: "2.0",
-        error: { code: -32001, message: authError },
+        error: { code: -32001, message: auth.error },
         id: req.body?.id ?? null
       });
       return;
@@ -4606,6 +4816,43 @@ function createStatelessMcpHandler(scope) {
           }
         }
       }
+      const hiveToolName = getMcpHiveToolName(body);
+      let subjectContext;
+      if (hiveToolName && auth.userId) {
+        const subject = await resolveSubjectContext({
+          userId: auth.userId,
+          keyId: auth.keyId,
+          keyMeta: auth.keyMeta,
+          method: req.method,
+          path: req.path,
+          headers: req.headers,
+          requiresSubjectHeaders: STATEFUL_WRITE_TOOLS.has(hiveToolName)
+        });
+        if (!subject.ok) {
+          res.status(200).json({
+            jsonrpc: "2.0",
+            error: {
+              code: -32002,
+              message: subject.message,
+              data: { code: subject.code }
+            },
+            id: body?.id ?? null
+          });
+          return;
+        }
+        subjectContext = subject.data;
+        if (STATEFUL_WRITE_TOOLS.has(hiveToolName)) {
+          recordSubjectAuditEvent({
+            userId: subject.data.userId,
+            subjectId: subject.data.subjectId,
+            keyId: auth.keyId,
+            transport: "mcp",
+            toolName: hiveToolName,
+            requestId: req.requestId
+          });
+        }
+      }
+      injectMcpAuthContext(body, subjectContext);
       const server = createHiveMcpServer(scope).getServer();
       const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: void 0,
@@ -4787,7 +5034,53 @@ app.post(
         meta: { tool: toolName ?? null, duration_ms: 0 }
       });
     }
-    const result = await executeToolByName(toolName, args ?? {});
+    const endpointArgs = { ...args ?? {} };
+    removeHiddenHiveAuthArgs(endpointArgs);
+    removeHiddenHiveAuthArgs(endpointArgs.args);
+    const authReq = req;
+    const hiveToolName = getRestHiveToolName(toolName, endpointArgs);
+    if (hiveToolName && authReq.userId) {
+      const subject = await resolveSubjectContext({
+        userId: authReq.userId,
+        keyId: authReq.unkeyKeyId,
+        keyMeta: authReq.unkeyResult?.meta,
+        method: req.method,
+        path: req.path,
+        headers: req.headers,
+        requiresSubjectHeaders: STATEFUL_WRITE_TOOLS.has(hiveToolName)
+      });
+      if (!subject.ok) {
+        return res.status(subject.status).json(
+          apiError(
+            subject.status === 400 ? "invalid_request_error" : "authentication_error",
+            subject.code,
+            subject.message,
+            { requestId: req.requestId }
+          )
+        );
+      }
+      if (toolName === "invoke_api_endpoint") {
+        if (!endpointArgs.args || typeof endpointArgs.args !== "object") {
+          endpointArgs.args = {};
+        }
+        endpointArgs.args[HIVE_AUTH_USER_ARG] = subject.data.userId;
+        endpointArgs.args[HIVE_AUTH_SUBJECT_ARG] = subject.data.subjectId;
+      } else {
+        endpointArgs[HIVE_AUTH_USER_ARG] = subject.data.userId;
+        endpointArgs[HIVE_AUTH_SUBJECT_ARG] = subject.data.subjectId;
+      }
+      if (STATEFUL_WRITE_TOOLS.has(hiveToolName)) {
+        recordSubjectAuditEvent({
+          userId: subject.data.userId,
+          subjectId: subject.data.subjectId,
+          keyId: authReq.unkeyKeyId,
+          transport: "rest",
+          toolName: hiveToolName,
+          requestId: req.requestId
+        });
+      }
+    }
+    const result = await executeToolByName(toolName, endpointArgs);
     const meta = {
       tool: toolName,
       duration_ms: result.durationMs,
@@ -5017,4 +5310,3 @@ export {
   server_default as default,
   startHttpServer
 };
-//# sourceMappingURL=server.js.map