kiku-agent 1.0.0 → 1.0.4

package/server/mcp/examples/opencode.example.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "kiku": {
+      "type": "local",
+      "command": ["npx", "-y", "-p", "kiku-agent", "kiku-mcp"],
+      "environment": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      },
+      "enabled": true
+    },
+    "kiku-remote": {
+      "type": "remote",
+      "url": "https://jujingyi-kikuuu.vercel.app/mcp",
+      "headers": {
+        "X-API-Key": "YOUR_API_KEY"
+      },
+      "enabled": true
+    }
+  }
+}

package/server/mcp/examples/vscode.example.json

@@ -0,0 +1,19 @@
+{
+  "servers": {
+    "kiku": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "type": "http",
+      "url": "https://jujingyi-kikuuu.vercel.app/mcp",
+      "headers": {
+        "X-API-Key": "YOUR_API_KEY"
+      }
+    }
+  }
+}

package/server/mcp/examples/windsurf.example.json

@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "serverUrl": "https://jujingyi-kikuuu.vercel.app/mcp"
+    }
+  }
+}

package/server/mcp/handler.js

@@ -1,159 +1,85 @@
-import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { createMcpServer } from './server.js';
-import { checkRateLimit, validateSessionId, securityMiddleware, MAX_REQUEST_BODY_SIZE } from './security.js';
-
-const sessions = new Map();
-const SESSION_TTL_MS = 30 * 60_000;
-const MAX_SESSIONS = 100;
-
-function sendJson(res, statusCode, payload, headers = {}) {
-  if (res.headersSent) return;
-  res.statusCode = statusCode;
-  res.setHeader('Content-Type', 'application/json; charset=utf-8');
-  for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
-  res.end(JSON.stringify(payload));
-}
-
-async function closeSession(sessionId) {
-  const session = sessions.get(sessionId);
-  if (!session) return;
-  sessions.delete(sessionId);
-  clearInterval(session.heartbeat);
-  await Promise.allSettled([session.transport.close(), session.server.close()]);
-}
-
-function cleanupSessions() {
-  const now = Date.now();
-  for (const [id, session] of sessions) {
-    if (now - session.lastSeen > SESSION_TTL_MS) void closeSession(id);
-  }
-  if (sessions.size > MAX_SESSIONS) {
-    const excess = [...sessions.entries()]
-      .sort((a, b) => a[1].lastSeen - b[1].lastSeen)
-      .slice(0, sessions.size - MAX_SESSIONS);
-    for (const [id] of excess) void closeSession(id);
-  }
-}
-
-function validateRequestSize(req, res) {
-  const contentLength = Number.parseInt(req.headers['content-length'] || '0', 10);
-  if (Number.isFinite(contentLength) && contentLength > MAX_REQUEST_BODY_SIZE) {
-    sendJson(res, 413, { error: 'Request body too large.' }, { 'Retry-After': '60' });
-    return false;
-  }
-  return true;
-}
-
-export async function handleMcpSse(req, res) {
-  cleanupSessions();
-  const security = securityMiddleware(req, res);
-  if (security.blocked) return;
-
-  const transport = new SSEServerTransport('/api/v1/mcp/message', res);
-  const sessionId = transport.sessionId;
-  const server = createMcpServer();
-  const session = {
-    server,
-    transport,
-    createdAt: Date.now(),
-    lastSeen: Date.now(),
-    messageCount: 0,
-    heartbeat: null,
-  };
-
-  sessions.set(sessionId, session);
-  transport.onclose = () => { void closeSession(sessionId); };
-  transport.onerror = error => console.error(`MCP SSE transport [${sessionId}]: ${error.message}`);
-
-  try {
-    await server.connect(transport);
-    session.heartbeat = setInterval(() => {
-      if (!res.writableEnded) res.write(': keep-alive\n\n');
-    }, 15_000);
-    session.heartbeat.unref?.();
-  } catch (error) {
-    await closeSession(sessionId);
-    if (!res.headersSent) sendJson(res, 500, { error: 'Unable to establish MCP SSE transport.' });
-    throw error;
-  }
-}
-
-export async function handleMcpMessage(req, res) {
-  const security = securityMiddleware(req, res);
-  if (security.blocked || !validateRequestSize(req, res)) return;
-
-  const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-  const sessionId = url.searchParams.get('sessionId');
-  if (!sessionId || !validateSessionId(sessionId)) {
-    return sendJson(res, 400, { error: 'Invalid or missing sessionId.' });
-  }
-
-  const session = sessions.get(sessionId);
-  if (!session) {
-    return sendJson(res, 404, { error: 'Session not found or expired. Reconnect through /api/v1/mcp/sse.' });
-  }
-
-  const rate = checkRateLimit(`mcp:${sessionId}`);
-  if (!rate.allowed) {
-    return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
-  }
-  res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
-
-  session.messageCount++;
-  session.lastSeen = Date.now();
-  if (session.messageCount > 500) {
-    await closeSession(sessionId);
-    return sendJson(res, 429, { error: 'Session message limit reached. Reconnect to create a new session.' });
-  }
-
-  await session.transport.handlePostMessage(req, res);
-}
-
-export async function handleMcpHttp(req, res) {
-  const security = securityMiddleware(req, res);
-  if (security.blocked || !validateRequestSize(req, res)) return;
-
-  if (req.method !== 'POST') {
-    res.setHeader('Allow', 'POST, OPTIONS');
-    return sendJson(res, 405, {
-      jsonrpc: '2.0',
-      error: { code: -32000, message: 'Method not allowed. Use POST for Streamable HTTP.' },
-      id: null,
-    });
-  }
-
-  const rate = checkRateLimit(`mcp-http:${req.socket?.remoteAddress || 'unknown'}`);
-  if (!rate.allowed) return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
-  res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
-
-  const server = createMcpServer();
-  const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: undefined,
-    enableJsonResponse: true,
-  });
-
-  try {
-    await server.connect(transport);
-    await transport.handleRequest(req, res);
-  } catch (error) {
-    console.error(`MCP Streamable HTTP: ${error.message}`);
-    sendJson(res, 500, {
-      jsonrpc: '2.0',
-      error: { code: -32603, message: 'Internal MCP server error.' },
-      id: null,
-    });
-  } finally {
-    await Promise.allSettled([transport.close(), server.close()]);
-  }
-}
-
-export function getMcpSessionStats() {
-  return { activeSessions: sessions.size, maxSessions: MAX_SESSIONS, ttlMs: SESSION_TTL_MS };
-}
-
-export function isMcpRoute(pathname) {
-  return pathname === '/api/v1/mcp'
-    || pathname === '/api/v1/mcp/sse'
-    || pathname === '/api/v1/mcp/message';
-}
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createMcpServer } from './server.js';
+import { checkRateLimit, securityMiddleware, MAX_REQUEST_BODY_SIZE } from './security.js';
+
+function sendJson(res, statusCode, payload, headers = {}) {
+  if (res.headersSent) return;
+  res.statusCode = statusCode;
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  for (const [name, value] of Object.entries(headers)) res.setHeader(name, value);
+  res.end(JSON.stringify(payload));
+}
+
+function validateRequestSize(req, res) {
+  const contentLength = Number.parseInt(req.headers['content-length'] || '0', 10);
+  if (Number.isFinite(contentLength) && contentLength > MAX_REQUEST_BODY_SIZE) {
+    sendJson(res, 413, { error: 'Request body too large.' }, { 'Retry-After': '60' });
+    return false;
+  }
+  return true;
+}
+
+export async function handleMcpSse(req, res) {
+  sendJson(res, 410, { error: 'Legacy SSE transport removed. Use POST /mcp.' });
+}
+
+export async function handleMcpMessage(req, res) {
+  sendJson(res, 410, { error: 'Legacy SSE transport removed. Use POST /mcp.' });
+}
+
+export async function handleMcpHttp(req, res) {
+  const security = securityMiddleware(req, res);
+  if (security.blocked || !validateRequestSize(req, res)) return;
+
+  if (req.method === 'OPTIONS') {
+    res.statusCode = 204;
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, X-API-Key, Accept');
+    res.end();
+    return;
+  }
+
+  if (req.method !== 'POST') {
+    res.setHeader('Allow', 'GET, POST, OPTIONS');
+    return sendJson(res, 405, {
+      jsonrpc: '2.0',
+      error: { code: -32000, message: 'Method not allowed. Use POST for Streamable HTTP JSON-RPC, or GET /mcp for server discovery.' },
+      id: null,
+    });
+  }
+
+  const rate = checkRateLimit(`mcp-http:${req.socket?.remoteAddress || 'unknown'}`);
+  if (!rate.allowed) return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
+  res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
+
+  const server = createMcpServer();
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: undefined,
+    enableJsonResponse: true,
+  });
+
+  try {
+    await server.connect(transport);
+    await transport.handleRequest(req, res);
+  } catch (error) {
+    console.error(`MCP Streamable HTTP: ${error.message}`);
+    sendJson(res, 500, {
+      jsonrpc: '2.0',
+      error: { code: -32603, message: 'Internal MCP server error.' },
+      id: null,
+    });
+  } finally {
+    await Promise.allSettled([transport.close(), server.close()]);
+  }
+}
+
+export function getMcpSessionStats() {
+  return { mode: 'stateless', transport: 'streamable-http' };
+}
+
+export function isMcpRoute(pathname) {
+  return pathname === '/mcp'
+    || pathname === '/mcp/sse'
+    || pathname === '/mcp/message';
+}

package/server/mcp/security.js

@@ -1,138 +1,140 @@
-import { timingSafeEqual } from 'node:crypto';
-
-const SECURITY_CONFIG = {
-  apiKeyRequired: !!process.env.MCP_API_KEY,
-
-  rateLimitWindowMs: 60_000,
-  rateLimitMaxRequests: 30,
-
-  maxConcurrentSessions: 100,
-  sessionTtlMs: 30 * 60_000,
-  maxMessagesPerSession: 500,
-
-  corsAllowedOrigins: (process.env.MCP_CORS_ORIGINS || '*').split(',').map(s => s.trim()),
-  maxRequestBodyBytes: 1_048_576,
-};
-
-export const MAX_REQUEST_BODY_SIZE = SECURITY_CONFIG.maxRequestBodyBytes;
-
-export function validateApiKey(req) {
-  if (!SECURITY_CONFIG.apiKeyRequired) return { valid: true };
-
-  let key = req.headers['x-api-key'];
-  if (!key) {
-    try {
-      const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-      key = url.searchParams.get('key') || url.searchParams.get('apiKey');
-    } catch {
-    }
-  }
-  if (!key) return { valid: false, error: 'Missing API key. Set X-API-Key header or ?key= query parameter.' };
-  const expected = Buffer.from(process.env.MCP_API_KEY || '');
-  const received = Buffer.from(String(key));
-  if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
-    return { valid: false, error: 'Invalid API key.' };
-  }
-  return { valid: true };
-}
-
-const rateLimitStore = new Map();
-
-export function checkRateLimit(sessionId) {
-  const now = Date.now();
-  const entry = rateLimitStore.get(sessionId);
-
-  if (!entry || now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs) {
-    rateLimitStore.set(sessionId, { count: 1, windowStart: now });
-    return { allowed: true, remaining: SECURITY_CONFIG.rateLimitMaxRequests - 1 };
-  }
-
-  entry.count++;
-  const remaining = SECURITY_CONFIG.rateLimitMaxRequests - entry.count;
-  if (remaining < 0) {
-    return { allowed: false, error: `Rate limit exceeded. Max ${SECURITY_CONFIG.rateLimitMaxRequests} requests per minute.` };
-  }
-  return { allowed: true, remaining };
-}
-
-const rateLimitCleanupTimer = setInterval(() => {
-  const now = Date.now();
-  for (const [id, entry] of rateLimitStore) {
-    if (now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs * 2) {
-      rateLimitStore.delete(id);
-    }
-  }
-}, 60_000);
-rateLimitCleanupTimer.unref?.();
-
-export function sanitizeInput(input) {
-  if (typeof input === 'string') {
-    return input
-      .replace(/[<>]/g, '')
-      .replace(/\x00/g, '')
-      .slice(0, 1000);
-  }
-  if (typeof input === 'object' && input !== null) {
-    const sanitized = {};
-    for (const [key, value] of Object.entries(input)) {
-      if (typeof key === 'string' && key.length <= 100) {
-        sanitized[key] = sanitizeInput(value);
-      }
-    }
-    return sanitized;
-  }
-  return input;
-}
-
-export function validateSessionId(sessionId) {
-  if (!sessionId || typeof sessionId !== 'string') return false;
-  return /^[a-zA-Z0-9_-]{1,100}$/.test(sessionId);
-}
-
-export function setCorsHeaders(res, origin) {
-  const allowed = SECURITY_CONFIG.corsAllowedOrigins;
-  const isAllowed = allowed.includes('*') || allowed.includes(origin);
-
-  if (isAllowed) {
-    res.setHeader('Access-Control-Allow-Origin', origin || '*');
-  } else {
-    res.setHeader('Access-Control-Allow-Origin', '');
-  }
-  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-API-Key');
-  res.setHeader('Access-Control-Max-Age', '86400');
-
-  return isAllowed;
-}
-
-export function securityMiddleware(req, res) {
-  const origin = req.headers.origin || '';
-  const corsOk = setCorsHeaders(res, origin);
-
-  if (req.method === 'OPTIONS') {
-    res.statusCode = 204;
-    res.end();
-    return { blocked: true };
-  }
-
-  if (!corsOk) {
-    res.statusCode = 403;
-    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-    res.end(JSON.stringify({ error: 'Origin not allowed by CORS policy.' }));
-    return { blocked: true };
-  }
-
-  const auth = validateApiKey(req);
-  if (!auth.valid) {
-    res.statusCode = 401;
-    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-    res.end(JSON.stringify({ error: auth.error }));
-    return { blocked: true };
-  }
-
-  return { blocked: false };
-}
-
-export function getSecurityConfig() {
-  return { ...SECURITY_CONFIG, apiKeyRequired: SECURITY_CONFIG.apiKeyRequired };
-}
+import { timingSafeEqual } from 'node:crypto';
+
+const SECURITY_CONFIG = {
+  apiKeyRequired: !!process.env.MCP_API_KEY,
+
+  rateLimitWindowMs: 60_000,
+  rateLimitMaxRequests: 30,
+
+  maxConcurrentSessions: 100,
+  sessionTtlMs: 30 * 60_000,
+  maxMessagesPerSession: 500,
+
+  corsAllowedOrigins: (process.env.MCP_CORS_ORIGINS || '*').split(',').map(s => s.trim()),
+  maxRequestBodyBytes: 1_048_576,
+};
+
+export const MAX_REQUEST_BODY_SIZE = SECURITY_CONFIG.maxRequestBodyBytes;
+
+export function validateApiKey(req) {
+  if (!SECURITY_CONFIG.apiKeyRequired) return { valid: true };
+
+  let key = req.headers['x-api-key'];
+  if (!key) {
+    try {
+      const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+      key = url.searchParams.get('key') || url.searchParams.get('apiKey');
+    } catch {
+    }
+  }
+  if (!key) return { valid: false, error: 'Missing API key. Set X-API-Key header or ?key= query parameter.' };
+  const expected = Buffer.from(process.env.MCP_API_KEY || '');
+  const received = Buffer.from(String(key));
+  if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
+    return { valid: false, error: 'Invalid API key.' };
+  }
+  return { valid: true };
+}
+
+const rateLimitStore = new Map();
+
+export function checkRateLimit(sessionId) {
+  const now = Date.now();
+  const entry = rateLimitStore.get(sessionId);
+
+  if (!entry || now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs) {
+    rateLimitStore.set(sessionId, { count: 1, windowStart: now });
+    return { allowed: true, remaining: SECURITY_CONFIG.rateLimitMaxRequests - 1 };
+  }
+
+  entry.count++;
+  const remaining = SECURITY_CONFIG.rateLimitMaxRequests - entry.count;
+  if (remaining < 0) {
+    return { allowed: false, error: `Rate limit exceeded. Max ${SECURITY_CONFIG.rateLimitMaxRequests} requests per minute.` };
+  }
+  return { allowed: true, remaining };
+}
+
+const rateLimitCleanupTimer = setInterval(() => {
+  const now = Date.now();
+  for (const [id, entry] of rateLimitStore) {
+    if (now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs * 2) {
+      rateLimitStore.delete(id);
+    }
+  }
+}, 60_000);
+rateLimitCleanupTimer.unref?.();
+
+export function sanitizeInput(input) {
+  if (typeof input === 'string') {
+    return input
+      .replace(/[<>]/g, '')
+      .replace(/\x00/g, '')
+      .slice(0, 1000);
+  }
+  if (typeof input === 'object' && input !== null) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(input)) {
+      if (typeof key === 'string' && key.length <= 100) {
+        sanitized[key] = sanitizeInput(value);
+      }
+    }
+    return sanitized;
+  }
+  return input;
+}
+
+export function validateSessionId(sessionId) {
+  if (!sessionId || typeof sessionId !== 'string') return false;
+  return /^[a-zA-Z0-9_-]{1,100}$/.test(sessionId);
+}
+
+export function setCorsHeaders(res, origin) {
+  const allowed = SECURITY_CONFIG.corsAllowedOrigins;
+  const isAllowed = allowed.includes('*') || allowed.includes(origin);
+
+  if (isAllowed) {
+    res.setHeader('Access-Control-Allow-Origin', origin || '*');
+  } else {
+    res.setHeader('Access-Control-Allow-Origin', '');
+  }
+  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, X-API-Key, Accept');
+  res.setHeader('Access-Control-Max-Age', '86400');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  return isAllowed;
+}
+
+export function securityMiddleware(req, res) {
+  const origin = req.headers.origin || '';
+  const corsOk = setCorsHeaders(res, origin);
+
+  if (req.method === 'OPTIONS') {
+    res.statusCode = 204;
+    res.end();
+    return { blocked: true };
+  }
+
+  if (!corsOk) {
+    res.statusCode = 403;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.end(JSON.stringify({ error: 'Origin not allowed by CORS policy.' }));
+    return { blocked: true };
+  }
+
+  const auth = validateApiKey(req);
+  if (!auth.valid) {
+    res.statusCode = 401;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.end(JSON.stringify({ error: auth.error }));
+    return { blocked: true };
+  }
+
+  return { blocked: false };
+}
+
+export function getSecurityConfig() {
+  return { ...SECURITY_CONFIG, apiKeyRequired: SECURITY_CONFIG.apiKeyRequired };
+}