kiku-agent 1.0.0 → 1.0.3

package/server/mcp/claude-desktop-config.example.json

@@ -1,6 +1,6 @@
 {
   "mcpServers": {
-    "kiku-mcp": {
+    "kiku": {
       "command": "kiku-mcp",
       "args": [],
       "description": "Ju Jingyi (Kiku) Fan Portal MCP Server — Filmography, Discography, Gallery, Timeline, Awards, Brands, and Career Data via MCP protocol."

package/server/mcp/data/discography.js

@@ -1,36 +1,36 @@
-export const discographyData = [
-  { id: "find-the-way", titleEn: "FIND THE WAY", titleCn: "FIND THE WAY", year: 2026, category: "single", duration: "3:30", youtubeId: "9AeErG03SZw" },
-  { id: "set-fire", titleEn: "Set Fire to the Silent World", titleCn: "着火的沉默世界", year: 2026, category: "ost", duration: "3:55", youtubeId: "7FXGhAmHIAo", work: "Wanhua Sin" },
-  { id: "not-suffering", titleEn: "Not Suffering", titleCn: "不苦", year: 2026, category: "ost", duration: "3:50", youtubeId: "DafSXZZo9AI", work: "Veil of Shadows" },
-  { id: "eternal-fragrance-song", titleEn: "The Eternal Fragrance", titleCn: "千香", year: 2026, category: "ost", duration: "3:46", youtubeId: "vIanAvWb_HU", work: "The Eternal Fragrance" },
-  { id: "rain-love", titleEn: "Yu Ai (Rain Love)", titleCn: "雨爱", year: 2026, category: "cover", duration: "4:10", youtubeId: "OMLpNyp8T7Q" },
-  { id: "rosa", titleEn: "Rosa", titleCn: "Rosa", year: 2025, category: "single", duration: "3:20", youtubeId: "jZDzOLbd9OU" },
-  { id: "sleepless-sunset", titleEn: "Sleepless Sunset", titleCn: "落日未眠", year: 2025, category: "single", duration: "3:45", youtubeId: "mYYD2JqZ1tE" },
-  { id: "fall", titleEn: "Fall", titleCn: "落", year: 2024, category: "single", duration: "3:36", youtubeId: "8Nh4ZPhYKEc" },
-  { id: "view-from-wall", titleEn: "View From The Wall", titleCn: "壁上观", year: 2024, category: "single", duration: "3:50", youtubeId: "Lge5XhVl9Fc" },
-  { id: "ru-sha", titleEn: "Ru Sha", titleCn: "如纱", year: 2024, category: "ost", duration: "3:42", youtubeId: "lzDP2MfP3eA", work: "Sword and Fairy 4" },
-  { id: "in-blossom-ost", titleEn: "In Blossom Main Theme", titleCn: "花间令", year: 2024, category: "ost", youtubeId: null, work: "In Blossom" },
-  { id: "thoughts-of-joy", titleEn: "Thoughts of Joy", titleCn: "念思凡", year: 2023, category: "ost", duration: "4:05", youtubeId: "D-vEPdasbLo", work: "Beauty of Resilience" },
-  { id: "dew-before-dawn", titleEn: "Dew Before Dawn", titleCn: "露珠在晨曦前消散", year: 2023, category: "ost", youtubeId: null, work: "Beauty of Resilience" },
-  { id: "0.2s", titleEn: "0.2s", titleCn: "0.2s", year: 2022, category: "single", duration: "3:20", youtubeId: null },
-  { id: "mo-li", titleEn: "Mo Li", titleCn: "莫离", year: 2021, category: "ost", duration: "4:12", youtubeId: "7VSAArsR-go", work: "Rebirth for You" },
-  { id: "qing-cheng-shan-xia", titleEn: "Qing Cheng Shan Xia", titleCn: "青城山下", year: 2021, category: "single", youtubeId: null },
-  { id: "fu-rong", titleEn: "Fu Rong", titleCn: "芙蓉", year: 2020, category: "ost", duration: "3:58", youtubeId: "9ke3efb9U7A", work: "The Blooms at Ruyi Pavilion" },
-  { id: "ancient-painting", titleEn: "Ancient Painting", titleCn: "古画", year: 2020, category: "ost", youtubeId: null, work: "The Blooms at Ruyi Pavilion" },
-  { id: "thousand-years", titleEn: "A Millennium's Wait", titleCn: "千年等一回", year: 2019, category: "ost", duration: "3:44", youtubeId: "-vf6jU96WI4", work: "The Legend of White Snake" },
-  { id: "du-qing", titleEn: "Du Qing", titleCn: "渡情", year: 2019, category: "ost", youtubeId: null, work: "The Legend of White Snake" },
-  { id: "wudaoying", titleEn: "Wu Dao Ying", titleCn: "舞导演", year: 2019, category: "single", youtubeId: null },
-  { id: "gufeng-shanshui", titleEn: "Gufeng Shanshui", titleCn: "古风山水", year: 2019, category: "single", youtubeId: null },
-  { id: "meng-lu", titleEn: "Meng Lu (Dream Road)", titleCn: "梦路", year: 2018, category: "single", youtubeId: null },
-  { id: "zui-chi-luo", titleEn: "Zui Chi Luo", titleCn: "最赤裸", year: 2018, category: "single", youtubeId: null },
-];
-
-export const musicVideos = [
-  { id: "mv-find-the-way", titleEn: "FIND THE WAY MV", titleCn: "FIND THE WAY", year: 2026, category: "Official MV", youtubeId: "9AeErG03SZw", duration: "3:30" },
-  { id: "mv-not-suffering", titleEn: "Not Suffering MV", titleCn: "不苦", year: 2026, category: "OST MV", youtubeId: "DafSXZZo9AI", duration: "3:50", work: "Veil of Shadows" },
-  { id: "mv-rain-love", titleEn: "Yu Ai (Rain Love) Stage", titleCn: "雨爱", year: 2026, category: "Stage Performance", youtubeId: "OMLpNyp8T7Q", duration: "4:10" },
-  { id: "mv-set-fire", titleEn: "Set Fire to the Silent World MV", titleCn: "着火的沉默世界", year: 2026, category: "OST MV", youtubeId: "7FXGhAmHIAo", duration: "3:55", work: "Wanhua Sin" },
-  { id: "mv-rosa", titleEn: "Rosa MV", titleCn: "Rosa", year: 2025, category: "Official MV", youtubeId: "jZDzOLbd9OU", duration: "3:20" },
-  { id: "mv-fall", titleEn: "Fall MV", titleCn: "落", year: 2024, category: "Official MV", youtubeId: "8Nh4ZPhYKEc", duration: "3:36" },
-  { id: "mv-ru-sha", titleEn: "Ru Sha MV", titleCn: "如纱", year: 2024, category: "OST MV", youtubeId: "lzDP2MfP3eA", duration: "3:42", work: "Sword and Fairy 4" },
-];
+export const discographyData = [
+  { id: "find-the-way", titleEn: "FIND THE WAY", titleCn: "FIND THE WAY", year: 2026, category: "single", duration: "3:30", youtubeId: "9AeErG03SZw" },
+  { id: "set-fire", titleEn: "Set Fire to the Silent World", titleCn: "着火的沉默世界", year: 2026, category: "ost", duration: "3:55", youtubeId: "7FXGhAmHIAo", work: "Wanhua Sin" },
+  { id: "not-suffering", titleEn: "Not Suffering", titleCn: "不苦", year: 2026, category: "ost", duration: "3:50", youtubeId: "DafSXZZo9AI", work: "Veil of Shadows" },
+  { id: "eternal-fragrance-song", titleEn: "The Eternal Fragrance", titleCn: "千香", year: 2026, category: "ost", duration: "3:46", youtubeId: "vIanAvWb_HU", work: "The Eternal Fragrance" },
+  { id: "rain-love", titleEn: "Yu Ai (Rain Love)", titleCn: "雨爱", year: 2026, category: "cover", duration: "4:10", youtubeId: "OMLpNyp8T7Q" },
+  { id: "rosa", titleEn: "Rosa", titleCn: "Rosa", year: 2025, category: "single", duration: "3:20", youtubeId: "jZDzOLbd9OU" },
+  { id: "sleepless-sunset", titleEn: "Sleepless Sunset", titleCn: "落日未眠", year: 2025, category: "single", duration: "3:45", youtubeId: "mYYD2JqZ1tE" },
+  { id: "fall", titleEn: "Fall", titleCn: "落", year: 2024, category: "single", duration: "3:36", youtubeId: "8Nh4ZPhYKEc" },
+  { id: "view-from-wall", titleEn: "View From The Wall", titleCn: "壁上观", year: 2024, category: "single", duration: "3:50", youtubeId: "Lge5XhVl9Fc" },
+  { id: "ru-sha", titleEn: "Ru Sha", titleCn: "如纱", year: 2024, category: "ost", duration: "3:42", youtubeId: "lzDP2MfP3eA", work: "Sword and Fairy 4" },
+  { id: "in-blossom-ost", titleEn: "In Blossom Main Theme", titleCn: "花间令", year: 2024, category: "ost", youtubeId: null, work: "In Blossom" },
+  { id: "thoughts-of-joy", titleEn: "Thoughts of Joy", titleCn: "念思凡", year: 2023, category: "ost", duration: "4:05", youtubeId: "D-vEPdasbLo", work: "Beauty of Resilience" },
+  { id: "dew-before-dawn", titleEn: "Dew Before Dawn", titleCn: "露珠在晨曦前消散", year: 2023, category: "ost", youtubeId: null, work: "Beauty of Resilience" },
+  { id: "0.2s", titleEn: "0.2s", titleCn: "0.2s", year: 2022, category: "single", duration: "3:20", youtubeId: null },
+  { id: "mo-li", titleEn: "Mo Li", titleCn: "莫离", year: 2021, category: "ost", duration: "4:12", youtubeId: "7VSAArsR-go", work: "Rebirth for You" },
+  { id: "qing-cheng-shan-xia", titleEn: "Qing Cheng Shan Xia", titleCn: "青城山下", year: 2021, category: "single", youtubeId: null },
+  { id: "fu-rong", titleEn: "Fu Rong", titleCn: "芙蓉", year: 2020, category: "ost", duration: "3:58", youtubeId: "9ke3efb9U7A", work: "The Blooms at Ruyi Pavilion" },
+  { id: "ancient-painting", titleEn: "Ancient Painting", titleCn: "古画", year: 2020, category: "ost", youtubeId: null, work: "The Blooms at Ruyi Pavilion" },
+  { id: "thousand-years", titleEn: "A Millennium's Wait", titleCn: "千年等一回", year: 2019, category: "ost", duration: "3:44", youtubeId: "-vf6jU96WI4", work: "The Legend of White Snake" },
+  { id: "du-qing", titleEn: "Du Qing", titleCn: "渡情", year: 2019, category: "ost", youtubeId: null, work: "The Legend of White Snake" },
+  { id: "wudaoying", titleEn: "Wu Dao Ying", titleCn: "舞导演", year: 2019, category: "single", youtubeId: null },
+  { id: "gufeng-shanshui", titleEn: "Gufeng Shanshui", titleCn: "古风山水", year: 2019, category: "single", youtubeId: null },
+  { id: "meng-lu", titleEn: "Meng Lu (Dream Road)", titleCn: "梦路", year: 2018, category: "single", youtubeId: null },
+  { id: "zui-chi-luo", titleEn: "Zui Chi Luo", titleCn: "最赤裸", year: 2018, category: "single", youtubeId: null },
+];
+
+export const musicVideos = [
+  { id: "mv-find-the-way", titleEn: "FIND THE WAY MV", titleCn: "FIND THE WAY", year: 2026, category: "Official MV", youtubeId: "9AeErG03SZw", duration: "3:30" },
+  { id: "mv-not-suffering", titleEn: "Not Suffering MV", titleCn: "不苦", year: 2026, category: "OST MV", youtubeId: "DafSXZZo9AI", duration: "3:50", work: "Veil of Shadows" },
+  { id: "mv-rain-love", titleEn: "Yu Ai (Rain Love) Stage", titleCn: "雨爱", year: 2026, category: "Stage Performance", youtubeId: "OMLpNyp8T7Q", duration: "4:10" },
+  { id: "mv-set-fire", titleEn: "Set Fire to the Silent World MV", titleCn: "着火的沉默世界", year: 2026, category: "OST MV", youtubeId: "7FXGhAmHIAo", duration: "3:55", work: "Wanhua Sin" },
+  { id: "mv-rosa", titleEn: "Rosa MV", titleCn: "Rosa", year: 2025, category: "Official MV", youtubeId: "jZDzOLbd9OU", duration: "3:20" },
+  { id: "mv-fall", titleEn: "Fall MV", titleCn: "落", year: 2024, category: "Official MV", youtubeId: "8Nh4ZPhYKEc", duration: "3:36" },
+  { id: "mv-ru-sha", titleEn: "Ru Sha MV", titleCn: "如纱", year: 2024, category: "OST MV", youtubeId: "lzDP2MfP3eA", duration: "3:42", work: "Sword and Fairy 4" },
+];

package/server/mcp/dataAdapter.js

@@ -0,0 +1,102 @@
+import { profileData } from '../../src/data/profileData.js';
+import { worksData } from '../../src/data/worksData.js';
+import { discographyData } from '../../src/data/discographyData.js';
+import { musicVideoData } from '../../src/data/musicVideoData.js';
+import { brandsData } from '../../src/data/brandsData.js';
+import { socialUpdatesData } from '../../src/data/socialUpdatesData.js';
+import { galleryData } from '../../src/data/galleryData.js';
+import { awardsData } from '../../src/data/awardsData.js';
+import { timelineData } from '../../src/data/timelineData.js';
+
+export function getUnifiedProfile() {
+  return {
+    ...profileData,
+    nameEn: profileData.nameEn || 'Ju Jingyi',
+    nameCn: profileData.nameCn || '鞠婧祎',
+    nameTh: profileData.nameTh || 'จวีจิ้งอี',
+    fandomName: profileData.fandomName || 'Miju (蜜橘)',
+    slogan: profileData.slogan || '鞠世无双，婧然倾心',
+  };
+}
+
+export function getUnifiedWorks() {
+  return worksData.map(w => ({
+    id: w.id,
+    titleEn: w.titleEn || w.titleTh || w.titleCn,
+    titleCn: w.titleCn,
+    titleTh: w.titleTh,
+    year: w.year,
+    role: w.role,
+    characterName: w.role,
+    genre: w.genre || w.type || 'Drama',
+    featured: Boolean(w.featured),
+    synopsis: w.synopsis || '',
+    platform: w.platform || '',
+  }));
+}
+
+export function getUnifiedDiscography() {
+  const songs = [
+    ...(discographyData.latestReleases || []),
+    ...(discographyData.ostList || []),
+    ...(discographyData.singles || []),
+  ];
+
+  const map = new Map();
+  for (const s of songs) {
+    const key = s.titleCn || s.titleTh || s.titleEn || s.id;
+    if (!map.has(key)) {
+      map.set(key, {
+        id: s.id,
+        titleEn: s.titleEn || s.titleTh || s.titleCn,
+        titleCn: s.titleCn,
+        titleTh: s.titleTh,
+        year: s.year,
+        type: s.type || 'Single',
+        category: s.work ? 'ost' : 'single',
+        work: s.work || null,
+        youtubeId: s.youtubeId || null,
+      });
+    }
+  }
+  return Array.from(map.values()).sort((a, b) => (b.year || 0) - (a.year || 0));
+}
+
+export function getUnifiedAwards() {
+  return awardsData.map(a => ({
+    id: a.id,
+    title: a.title,
+    titleCn: a.titleCn || a.title,
+    year: a.year,
+    ceremony: a.ceremony || a.organization || '',
+    category: a.category || 'General',
+  })).sort((a, b) => (b.year || 0) - (a.year || 0));
+}
+
+export function getUnifiedBrands() {
+  return brandsData.map(b => ({
+    id: b.id,
+    brandNameEn: b.brand || b.nameEn || '',
+    brandNameCn: b.brandCn || b.nameCn || b.brand || '',
+    title: b.title || 'Brand Ambassador',
+    year: b.year,
+    isGlobal: Boolean(b.isGlobal),
+    category: b.category || 'Beauty / Fashion',
+  })).sort((a, b) => (b.year || 0) - (a.year || 0));
+}
+
+export function getUnifiedTimeline() {
+  return timelineData.map(m => ({
+    id: m.id,
+    year: m.year,
+    period: m.period || String(m.year),
+    title: m.title,
+    titleCn: m.titleCn || m.title,
+    description: m.description || '',
+    era: m.era || 'Solo Career',
+  })).sort((a, b) => (b.year || 0) - (a.year || 0));
+}
+
+export function getUnifiedGallery() {
+  return galleryData;
+}

package/server/mcp/examples/claude-code.mcp.example.json

@@ -0,0 +1,19 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "type": "http",
+      "url": "https://jujingyi-kikuuu.vercel.app/mcp",
+      "headers": {
+        "X-API-Key": "YOUR_API_KEY"
+      }
+    }
+  }
+}

package/server/mcp/examples/claude-desktop.example.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    }
+  }
+}

package/server/mcp/examples/cline.example.json

@@ -0,0 +1,13 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      },
+      "disabled": false,
+      "alwaysAllow": []
+    }
+  }
+}

package/server/mcp/examples/cursor.example.json

@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "url": "https://jujingyi-kikuuu.vercel.app/mcp"
+    }
+  }
+}

package/server/mcp/examples/gemini-cli.example.json

@@ -0,0 +1,17 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "httpUrl": "https://jujingyi-kikuuu.vercel.app/mcp",
+      "headers": {
+        "X-API-Key": "YOUR_API_KEY"
+      }
+    }
+  }
+}

package/server/mcp/examples/opencode.example.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "kiku": {
+      "type": "local",
+      "command": ["npx", "-y", "-p", "kiku-agent", "kiku-mcp"],
+      "environment": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      },
+      "enabled": true
+    },
+    "kiku-remote": {
+      "type": "remote",
+      "url": "https://jujingyi-kikuuu.vercel.app/mcp",
+      "headers": {
+        "X-API-Key": "YOUR_API_KEY"
+      },
+      "enabled": true
+    }
+  }
+}

package/server/mcp/examples/vscode.example.json

@@ -0,0 +1,19 @@
+{
+  "servers": {
+    "kiku": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "type": "http",
+      "url": "https://jujingyi-kikuuu.vercel.app/mcp",
+      "headers": {
+        "X-API-Key": "YOUR_API_KEY"
+      }
+    }
+  }
+}

package/server/mcp/examples/windsurf.example.json

@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "serverUrl": "https://jujingyi-kikuuu.vercel.app/mcp"
+    }
+  }
+}

package/server/mcp/handler.js

@@ -1,159 +1,85 @@
-import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { createMcpServer } from './server.js';
-import { checkRateLimit, validateSessionId, securityMiddleware, MAX_REQUEST_BODY_SIZE } from './security.js';
-
-const sessions = new Map();
-const SESSION_TTL_MS = 30 * 60_000;
-const MAX_SESSIONS = 100;
-
-function sendJson(res, statusCode, payload, headers = {}) {
-  if (res.headersSent) return;
-  res.statusCode = statusCode;
-  res.setHeader('Content-Type', 'application/json; charset=utf-8');
-  for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
-  res.end(JSON.stringify(payload));
-}
-
-async function closeSession(sessionId) {
-  const session = sessions.get(sessionId);
-  if (!session) return;
-  sessions.delete(sessionId);
-  clearInterval(session.heartbeat);
-  await Promise.allSettled([session.transport.close(), session.server.close()]);
-}
-
-function cleanupSessions() {
-  const now = Date.now();
-  for (const [id, session] of sessions) {
-    if (now - session.lastSeen > SESSION_TTL_MS) void closeSession(id);
-  }
-  if (sessions.size > MAX_SESSIONS) {
-    const excess = [...sessions.entries()]
-      .sort((a, b) => a[1].lastSeen - b[1].lastSeen)
-      .slice(0, sessions.size - MAX_SESSIONS);
-    for (const [id] of excess) void closeSession(id);
-  }
-}
-
-function validateRequestSize(req, res) {
-  const contentLength = Number.parseInt(req.headers['content-length'] || '0', 10);
-  if (Number.isFinite(contentLength) && contentLength > MAX_REQUEST_BODY_SIZE) {
-    sendJson(res, 413, { error: 'Request body too large.' }, { 'Retry-After': '60' });
-    return false;
-  }
-  return true;
-}
-
-export async function handleMcpSse(req, res) {
-  cleanupSessions();
-  const security = securityMiddleware(req, res);
-  if (security.blocked) return;
-
-  const transport = new SSEServerTransport('/api/v1/mcp/message', res);
-  const sessionId = transport.sessionId;
-  const server = createMcpServer();
-  const session = {
-    server,
-    transport,
-    createdAt: Date.now(),
-    lastSeen: Date.now(),
-    messageCount: 0,
-    heartbeat: null,
-  };
-
-  sessions.set(sessionId, session);
-  transport.onclose = () => { void closeSession(sessionId); };
-  transport.onerror = error => console.error(`MCP SSE transport [${sessionId}]: ${error.message}`);
-
-  try {
-    await server.connect(transport);
-    session.heartbeat = setInterval(() => {
-      if (!res.writableEnded) res.write(': keep-alive\n\n');
-    }, 15_000);
-    session.heartbeat.unref?.();
-  } catch (error) {
-    await closeSession(sessionId);
-    if (!res.headersSent) sendJson(res, 500, { error: 'Unable to establish MCP SSE transport.' });
-    throw error;
-  }
-}
-
-export async function handleMcpMessage(req, res) {
-  const security = securityMiddleware(req, res);
-  if (security.blocked || !validateRequestSize(req, res)) return;
-
-  const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-  const sessionId = url.searchParams.get('sessionId');
-  if (!sessionId || !validateSessionId(sessionId)) {
-    return sendJson(res, 400, { error: 'Invalid or missing sessionId.' });
-  }
-
-  const session = sessions.get(sessionId);
-  if (!session) {
-    return sendJson(res, 404, { error: 'Session not found or expired. Reconnect through /api/v1/mcp/sse.' });
-  }
-
-  const rate = checkRateLimit(`mcp:${sessionId}`);
-  if (!rate.allowed) {
-    return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
-  }
-  res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
-
-  session.messageCount++;
-  session.lastSeen = Date.now();
-  if (session.messageCount > 500) {
-    await closeSession(sessionId);
-    return sendJson(res, 429, { error: 'Session message limit reached. Reconnect to create a new session.' });
-  }
-
-  await session.transport.handlePostMessage(req, res);
-}
-
-export async function handleMcpHttp(req, res) {
-  const security = securityMiddleware(req, res);
-  if (security.blocked || !validateRequestSize(req, res)) return;
-
-  if (req.method !== 'POST') {
-    res.setHeader('Allow', 'POST, OPTIONS');
-    return sendJson(res, 405, {
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Method not allowed. Use POST for Streamable HTTP.' },
-      id: null,
-    });
-  }
-
-  const rate = checkRateLimit(`mcp-http:${req.socket?.remoteAddress || 'unknown'}`);
-  if (!rate.allowed) return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
-  res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
-
-  const server = createMcpServer();
-  const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: undefined,
-    enableJsonResponse: true,
-  });
-
-  try {
-    await server.connect(transport);
-    await transport.handleRequest(req, res);
-  } catch (error) {
-    console.error(`MCP Streamable HTTP: ${error.message}`);
-    sendJson(res, 500, {
-      jsonrpc: '2.0',
-      error: { code: -32603, message: 'Internal MCP server error.' },
-      id: null,
-    });
-  } finally {
-    await Promise.allSettled([transport.close(), server.close()]);
-  }
-}
-
-export function getMcpSessionStats() {
-  return { activeSessions: sessions.size, maxSessions: MAX_SESSIONS, ttlMs: SESSION_TTL_MS };
-}
-
-export function isMcpRoute(pathname) {
-  return pathname === '/api/v1/mcp'
-    || pathname === '/api/v1/mcp/sse'
-    || pathname === '/api/v1/mcp/message';
-}
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createMcpServer } from './server.js';
+import { checkRateLimit, securityMiddleware, MAX_REQUEST_BODY_SIZE } from './security.js';
+
+function sendJson(res, statusCode, payload, headers = {}) {
+  if (res.headersSent) return;
+  res.statusCode = statusCode;
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
+  res.end(JSON.stringify(payload));
+}
+
+function validateRequestSize(req, res) {
+  const contentLength = Number.parseInt(req.headers['content-length'] || '0', 10);
+  if (Number.isFinite(contentLength) && contentLength > MAX_REQUEST_BODY_SIZE) {
+    sendJson(res, 413, { error: 'Request body too large.' }, { 'Retry-After': '60' });
+    return false;
+  }
+  return true;
+}
+
+export async function handleMcpSse(req, res) {
+  sendJson(res, 410, { error: 'Legacy SSE transport removed. Use POST /mcp.' });
+}
+
+export async function handleMcpMessage(req, res) {
+  sendJson(res, 410, { error: 'Legacy SSE transport removed. Use POST /mcp.' });
+}
+
+export async function handleMcpHttp(req, res) {
+  const security = securityMiddleware(req, res);
+  if (security.blocked || !validateRequestSize(req, res)) return;
+
+  if (req.method === 'OPTIONS') {
+    res.statusCode = 204;
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, X-API-Key, Accept');
+    res.end();
+    return;
+  }
+
+  if (req.method !== 'POST') {
+    res.setHeader('Allow', 'GET, POST, OPTIONS');
+    return sendJson(res, 405, {
+      jsonrpc: '2.0',
+      error: { code: -32000, message: 'Method not allowed. Use POST for Streamable HTTP JSON-RPC, or GET /mcp for server discovery.' },
+      id: null,
+    });
+  }
+
+  const rate = checkRateLimit(`mcp-http:${req.socket?.remoteAddress || 'unknown'}`);
+  if (!rate.allowed) return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
+  res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
+
+  const server = createMcpServer();
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: undefined,
+    enableJsonResponse: true,
+  });
+
+  try {
+    await server.connect(transport);
+    await transport.handleRequest(req, res);
+  } catch (error) {
+    console.error(`MCP Streamable HTTP: ${error.message}`);
+    sendJson(res, 500, {
+      jsonrpc: '2.0',
+      error: { code: -32603, message: 'Internal MCP server error.' },
+      id: null,
+    });
+  } finally {
+    await Promise.allSettled([transport.close(), server.close()]);
+  }
+}
+
+export function getMcpSessionStats() {
+  return { mode: 'stateless', transport: 'streamable-http' };
+}
+
+export function isMcpRoute(pathname) {
+  return pathname === '/mcp'
+    || pathname === '/mcp/sse'
+    || pathname === '/mcp/message';
+}