kiku-agent 1.3.2 → 1.3.4

package/server/mcp/data/discography.js

@@ -12,7 +12,7 @@ export const discographyData = [
   { id: "stay-with-me", titleEn: "Stay With Me", titleCn: "伴", year: 2024, category: "ost", duration: "3:30", youtubeId: "N7pWFylNQDM", work: "I Want to Go Against the Wind" },
   { id: "wu-chang-sheng", titleEn: "Longevity By Mistake", titleCn: "误长生", year: 2023, category: "ost", duration: "3:50", youtubeId: "GSZqFPkBMws", work: "Beauty of Resilience" },
   { id: "reng-xun", titleEn: "Still Searching", titleCn: "仍寻", year: 2023, category: "ost", duration: "5:01", youtubeId: "nsTL6g_UOqE", work: "Beauty of Resilience" },
-  { id: "dew-before-dawn", titleEn: "Dew Before Dawn (Dewdrops)", titleCn: "露珠在晨曦前消散", year: 2026, category: "ost", duration: "4:42", youtubeId: "D-vEPdasbLo", work: "Veil of Shadows", aliases: ["Dewdrops", "Dewdrops Dissipate Before Dawn", "Dew Before Dawn", "露珠在晨曦前消散"] },
+  { id: "dew-before-dawn", titleEn: "Dew Before Dawn (Dewdrops)", titleCn: "露珠在晨曦前消散", year: 2026, category: "ost", duration: "4:42", youtubeId: "D-vEPdasbLo", work: "Veil of Shadows / In Blossom", aliases: ["Dewdrops", "Dewdrops Dissipate Before Dawn", "Dew Before Dawn", "露珠在晨曦前消散", "In Blossom", "花间令", "露水"] },
   { id: "tu-hei-su", titleEn: "Melatonin", titleCn: "褪黑素", year: 2024, category: "stage", duration: "3:22", youtubeId: "1t0E5bVqGIQ" },
   { id: "you-shan-lian", titleEn: "You Shan Lian", titleCn: "游山恋", year: 2024, category: "stage", duration: "4:06", youtubeId: "ZaGQuDsN0pc" },
   { id: "mo-nu-da-mao-xian", titleEn: "The Witch's Great Adventure", titleCn: "魔女大冒险", year: 2024, category: "stage", duration: "5:59", youtubeId: "rzn_nqmBV-M" },
@@ -29,7 +29,7 @@ export const discographyData = [
   { id: "thousand-years", titleEn: "A Millennium's Wait", titleCn: "千年等一回", year: 2019, category: "ost", duration: "4:05", youtubeId: "-vf6jU96WI4", work: "The Legend of White Snake" },
   { id: "du-qing", titleEn: "Du Qing", titleCn: "渡情", year: 2019, category: "ost", duration: "3:30", youtubeId: "1dmp3hUhVBI", work: "The Legend of White Snake" },
   { id: "qing-cheng-shan-xia", titleEn: "Bai Suzhen under Mount Qingcheng", titleCn: "青城山下白素贞", year: 2019, category: "ost", duration: "3:22", youtubeId: "wVZbHrI0q24", work: "The Legend of White Snake" },
-  { id: "love-emergency", titleEn: "Love Emergency", titleCn: "恋爱告急", year: 2019, category: "single", duration: "3:35", youtubeId: "5MLPdCmnlmE" },
+  { id: "love-emergency", titleEn: "Love Emergency", titleCn: "恋爱告急", year: 2019, category: "single", duration: "3:35", youtubeId: "5MLPdCmnlmE", aliases: ["Heartbeat Alert", "Love Emergency", "恋爱告急"] },
   { id: "tan-yun-xi", titleEn: "Sigh of Yunxi", titleCn: "叹云兮", year: 2018, category: "ost", duration: "3:50", youtubeId: "oEgxqij58LQ", work: "Legend of Yunxi" },
   { id: "falling-flowers", titleEn: "Falling Flowers", titleCn: "落花成泥", year: 2018, category: "ost", duration: "3:42", youtubeId: "cWibu5ISTyw", work: "Legend of Yunxi" },
   { id: "hong-zhao-yuan", titleEn: "Hong Zhao Yuan", titleCn: "红昭愿", year: 2018, category: "stage", duration: "3:30", youtubeId: "6gFUB9eDFD0" },

package/server/mcp/examples/antigravity.example.json

@@ -0,0 +1,17 @@
+{
+  "mcpServers": {
+    "kiku": {
+      "command": "npx",
+      "args": ["-y", "-p", "kiku-agent", "kiku-mcp"],
+      "env": {
+        "KIKU_MCP_ENABLE_WEB_TOOLS": "true"
+      }
+    },
+    "kiku-remote": {
+      "url": "https://jujingyi-kikuuu.vercel.app/mcp",
+      "headers": {
+        "X-API-Key": "YOUR_API_KEY"
+      }
+    }
+  }
+}

package/server/mcp/handler.js

@@ -28,7 +28,7 @@ export async function handleMcpMessage(req, res) {
 }
 
 export async function handleMcpHttp(req, res) {
-  const security = securityMiddleware(req, res);
+  const security = await securityMiddleware(req, res);
   if (security.blocked || !validateRequestSize(req, res)) return;
 
   if (req.method !== 'POST') {
@@ -40,12 +40,16 @@ export async function handleMcpHttp(req, res) {
     });
   }
 
-  const rate = checkRateLimit(`mcp-http:${req.socket?.remoteAddress || 'unknown'}`);
+  const auth = security.auth || await validateApiKey(req);
+  const rateBucket = auth.keyPrefix ? `mcp-key:${auth.keyPrefix}` : `mcp-http:${req.socket?.remoteAddress || 'unknown'}`;
+  const maxLimit = auth.rateLimit || 30;
+  const rate = checkRateLimit(rateBucket, maxLimit);
   if (!rate.allowed) return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
+  res.setHeader('X-RateLimit-Limit', String(maxLimit));
   res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
 
-  const authorized = !!process.env.MCP_API_KEY && validateApiKey(req).valid;
-  const server = createMcpServer({ transport: 'http', authorized });
+  const authorized = auth.valid && auth.authorized !== false;
+  const server = createMcpServer({ transport: 'http', authorized, tier: auth.tier });
   const transport = new StreamableHTTPServerTransport({
     sessionIdGenerator: undefined,
     enableJsonResponse: true,

package/server/mcp/security.js

@@ -1,7 +1,106 @@
-import { timingSafeEqual } from 'node:crypto';
+import { timingSafeEqual, createHmac, createHash } from 'node:crypto';
+
+function getSupabaseConfig() {
+  const url = process.env.SUPABASE_URL || '';
+  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY || '';
+  const anonKey = process.env.SUPABASE_ANON_KEY || '';
+  const isConfigured = Boolean(url && (serviceKey || anonKey));
+  return { url, serviceKey, anonKey, isConfigured };
+}
+
+const API_KEY_PEPPER = process.env.API_KEY_PEPPER || process.env.KIKU_KEY_PEPPER || 'kiku_mcp_pepper_secret_2026';
+
+function hashApiKey(rawKey) {
+  if (!rawKey || typeof rawKey !== 'string') return '';
+  return createHmac('sha256', API_KEY_PEPPER).update(rawKey.trim()).digest('hex');
+}
+
+function hashApiKeyLegacy(rawKey) {
+  if (!rawKey || typeof rawKey !== 'string') return '';
+  return createHash('sha256').update(rawKey.trim()).digest('hex');
+}
+
+function safeCompare(a, b) {
+  if (!a || !b || typeof a !== 'string' || typeof b !== 'string') return false;
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+
+const mcpApiKeyCache = new Map();
+const MCP_API_KEY_CACHE_MAX = 5000;
+
+export function setMcpApiKeyCache(hash, entry) {
+  if (mcpApiKeyCache.size >= MCP_API_KEY_CACHE_MAX) {
+    const oldest = mcpApiKeyCache.keys().next().value;
+    if (oldest) mcpApiKeyCache.delete(oldest);
+  }
+  mcpApiKeyCache.set(hash, entry);
+}
+
+export const dynamicMcpKeysStore = new Map();
+
+export async function saveMcpApiKeyToSupabase({ apiKey, tier = 'mcp_vip', rateLimit = 1000 }) {
+  const hash = hashApiKey(apiKey);
+  const keyPrefix = apiKey.slice(0, 16);
+  const entry = { apiKey, tier, rateLimit, isActive: true, validUntil: Date.now() + 300000, keyPrefix };
+  setMcpApiKeyCache(hash, entry);
+  dynamicMcpKeysStore.set(apiKey, { tier, rateLimit, keyPrefix });
+
+  const { url, serviceKey, isConfigured } = getSupabaseConfig();
+  if (!isConfigured || !serviceKey) {
+    return { stored: 'memory', keyPrefix, hash };
+  }
+
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 3000);
+    const payload = JSON.stringify({
+      key_prefix: keyPrefix,
+      key_hash: hash,
+      tier,
+      rate_limit_per_min: rateLimit,
+      is_active: true
+    });
+    const headers = {
+      'apikey': serviceKey,
+      'Authorization': `Bearer ${serviceKey}`,
+      'Content-Type': 'application/json',
+      'Prefer': 'return=representation'
+    };
+
+    let res = await fetch(`${url}/rest/v1/jujingyi_kikuuu_api_keys`, {
+      method: 'POST',
+      headers,
+      body: payload,
+      signal: controller.signal
+    });
+    if (res.status === 404) {
+      res = await fetch(`${url}/rest/v1/api_keys`, {
+        method: 'POST',
+        headers,
+        body: payload,
+        signal: controller.signal
+      });
+    }
+    clearTimeout(timeoutId);
+    return { stored: res.ok ? 'supabase' : 'memory', keyPrefix, hash };
+  } catch (err) {
+    return { stored: 'memory', keyPrefix, hash, error: err.message };
+  }
+}
 
 const SECURITY_CONFIG = {
-  apiKeyRequired: Boolean(process.env.MCP_API_KEY || process.env.NODE_ENV === 'production'),
+  get apiKeyRequired() {
+    return Boolean(
+      process.env.MCP_API_KEY ||
+      process.env.MCP_API_KEYS ||
+      process.env.KIKU_MASTER_KEYS ||
+      process.env.KIKU_MASTER_KEY ||
+      process.env.NODE_ENV === 'production'
+    );
+  },
 
   rateLimitWindowMs: 60_000,
   rateLimitMaxRequests: 30,
@@ -16,9 +115,7 @@ const SECURITY_CONFIG = {
 
 export const MAX_REQUEST_BODY_SIZE = SECURITY_CONFIG.maxRequestBodyBytes;
 
-export function validateApiKey(req) {
-  if (!SECURITY_CONFIG.apiKeyRequired) return { valid: true };
-
+export async function validateApiKey(req) {
   let key = req?.headers?.['x-api-key'];
   if (!key) {
     const authHeader = req?.headers?.['authorization'];
@@ -26,35 +123,132 @@ export function validateApiKey(req) {
       key = authHeader.slice(7).trim();
     }
   }
-  if (!process.env.MCP_API_KEY) {
-    return { valid: false, error: 'MCP API key is not configured on the server. Please set MCP_API_KEY.' };
+
+  if (!key) {
+    if (!SECURITY_CONFIG.apiKeyRequired) {
+      return { valid: true, authorized: false, tier: 'anonymous', rateLimit: SECURITY_CONFIG.rateLimitMaxRequests };
+    }
+    return { valid: false, error: 'Missing API key. Set X-API-Key header or Authorization: Bearer <key>.' };
+  }
+
+  const trimmed = String(key).trim();
+
+  if (process.env.MCP_API_KEY && safeCompare(trimmed, process.env.MCP_API_KEY.trim())) {
+    return { valid: true, authorized: true, tier: 'mcp_vip', rateLimit: 1000, keyPrefix: 'mcp_env' };
   }
-  if (!key) return { valid: false, error: 'Missing API key. Set X-API-Key header or Authorization: Bearer <key>.' };
-  const expected = Buffer.from(process.env.MCP_API_KEY || '');
-  const received = Buffer.from(String(key));
-  if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
-    return { valid: false, error: 'Invalid API key.' };
+
+  if (process.env.MCP_API_KEYS) {
+    const envKeys = process.env.MCP_API_KEYS.split(',').map(s => s.trim()).filter(Boolean);
+    for (const ek of envKeys) {
+      if (safeCompare(trimmed, ek)) {
+        return { valid: true, authorized: true, tier: 'mcp_vip', rateLimit: 1000, keyPrefix: 'mcp_env' };
+      }
+    }
+  }
+
+
+  const masterKeys = [
+    ...(process.env.KIKU_MASTER_KEYS || '').split(',').map(s => s.trim()).filter(Boolean),
+    ...(process.env.KIKU_MASTER_KEY ? [process.env.KIKU_MASTER_KEY.trim()] : [])
+  ];
+  for (const mk of masterKeys) {
+    if (safeCompare(trimmed, mk)) {
+      return { valid: true, authorized: true, tier: 'master_vip', rateLimit: 2000, keyPrefix: 'kiku_master' };
+    }
+  }
+
+ 
+  const memoryKey = dynamicMcpKeysStore.get(trimmed);
+  if (memoryKey) {
+    return {
+      valid: true,
+      authorized: true,
+      tier: memoryKey.tier || 'mcp_vip',
+      rateLimit: memoryKey.rateLimit || 1000,
+      keyPrefix: memoryKey.keyPrefix || trimmed.slice(0, 16)
+    };
   }
-  return { valid: true };
+
+ 
+  const hash = hashApiKey(trimmed);
+  const legacyHash = hashApiKeyLegacy(trimmed);
+  const cached = mcpApiKeyCache.get(hash) || mcpApiKeyCache.get(legacyHash);
+  if (cached && Date.now() < cached.validUntil) {
+    if (cached.isActive) {
+      return {
+        valid: true,
+        authorized: true,
+        tier: cached.tier || 'mcp_vip',
+        rateLimit: cached.rateLimit || 1000,
+        keyPrefix: cached.keyPrefix || trimmed.slice(0, 16)
+      };
+    }
+    return { valid: false, error: 'API key has been revoked or expired.' };
+  }
+
+ 
+  const { url, serviceKey, anonKey, isConfigured } = getSupabaseConfig();
+  if (isConfigured) {
+    try {
+      const apiKeyHeader = serviceKey || anonKey;
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 2500);
+      const headers = {
+        'apikey': apiKeyHeader,
+        'Authorization': `Bearer ${apiKeyHeader}`,
+        'Content-Type': 'application/json'
+      };
+      let res = await fetch(`${url}/rest/v1/jujingyi_kikuuu_api_keys?or=(key_hash.eq.${hash},key_hash.eq.${legacyHash})&is_active=eq.true&select=tier,rate_limit_per_min,expires_at`, {
+        headers,
+        signal: controller.signal
+      });
+      if (res.status === 404) {
+        res = await fetch(`${url}/rest/v1/api_keys?or=(key_hash.eq.${hash},key_hash.eq.${legacyHash})&is_active=eq.true&select=tier,rate_limit_per_min,expires_at`, {
+          headers,
+          signal: controller.signal
+        });
+      }
+      clearTimeout(timeoutId);
+
+      if (res.ok) {
+        const rows = await res.json();
+        if (Array.isArray(rows) && rows.length > 0) {
+          const row = rows[0];
+          if (row.expires_at && new Date(row.expires_at).getTime() < Date.now()) {
+            setMcpApiKeyCache(hash, { isActive: false, validUntil: Date.now() + 60000 });
+            return { valid: false, error: 'API key has expired.' };
+          }
+          const tier = row.tier || 'mcp_vip';
+          const rateLimit = Number(row.rate_limit_per_min) || 1000;
+          const keyPrefix = trimmed.slice(0, 16);
+          const result = { valid: true, authorized: true, tier, rateLimit, keyPrefix };
+          setMcpApiKeyCache(hash, { ...result, isActive: true, validUntil: Date.now() + 300000 });
+          return result;
+        }
+      }
+    } catch {}
+  }
+
+  return { valid: false, error: 'Invalid API key.' };
 }
 
 const rateLimitStore = new Map();
 
-export function checkRateLimit(sessionId) {
+export function checkRateLimit(sessionId, maxRequests = SECURITY_CONFIG.rateLimitMaxRequests) {
   const now = Date.now();
   const entry = rateLimitStore.get(sessionId);
 
   if (!entry || now - entry.windowStart > SECURITY_CONFIG.rateLimitWindowMs) {
     rateLimitStore.set(sessionId, { count: 1, windowStart: now });
-    return { allowed: true, remaining: SECURITY_CONFIG.rateLimitMaxRequests - 1 };
+    return { allowed: true, remaining: maxRequests - 1, limit: maxRequests };
   }
 
   entry.count++;
-  const remaining = SECURITY_CONFIG.rateLimitMaxRequests - entry.count;
+  const remaining = maxRequests - entry.count;
   if (remaining < 0) {
-    return { allowed: false, error: `Rate limit exceeded. Max ${SECURITY_CONFIG.rateLimitMaxRequests} requests per minute.` };
+    return { allowed: false, remaining: 0, limit: maxRequests, error: `Rate limit exceeded. Max ${maxRequests} requests per minute.` };
   }
-  return { allowed: true, remaining };
+  return { allowed: true, remaining, limit: maxRequests };
 }
 
 const rateLimitCleanupTimer = setInterval(() => {
@@ -64,6 +258,11 @@ const rateLimitCleanupTimer = setInterval(() => {
       rateLimitStore.delete(id);
     }
   }
+  for (const [hash, entry] of mcpApiKeyCache) {
+    if (entry.validUntil && entry.validUntil < now) {
+      mcpApiKeyCache.delete(hash);
+    }
+  }
 }, 60_000);
 rateLimitCleanupTimer.unref?.();
 
@@ -121,7 +320,7 @@ export function setCorsHeaders(res, origin) {
   return isAllowed;
 }
 
-export function securityMiddleware(req, res) {
+export async function securityMiddleware(req, res) {
   const origin = req.headers.origin || '';
   const corsOk = setCorsHeaders(res, origin);
 
@@ -138,7 +337,7 @@ export function securityMiddleware(req, res) {
     return { blocked: true };
   }
 
-  const auth = validateApiKey(req);
+  const auth = await validateApiKey(req);
   if (!auth.valid) {
     res.statusCode = 401;
     res.setHeader('Content-Type', 'application/json; charset=utf-8');
@@ -146,7 +345,7 @@ export function securityMiddleware(req, res) {
     return { blocked: true };
   }
 
-  return { blocked: false };
+  return { blocked: false, auth };
 }
 
 export function getSecurityConfig() {

package/server/mcp/server.js

@@ -9,13 +9,14 @@ const WRITE_TOOLS = new Set([
   'manage_skill',
   'play_music', 'stop_music', 'pause_music', 'resume_music',
   'mute_music', 'unmute_music', 'next_track', 'prev_track',
+  'set_volume', 'seek_music', 'set_repeat_mode', 'set_shuffle_mode', 'toggle_video_mode',
   'add_to_queue', 'remove_from_queue', 'clear_queue',
 ]);
 
-  
 const NON_IDEMPOTENT_TOOLS = new Set([
   'manage_skill', 'play_music', 'add_to_queue', 'remove_from_queue',
   'clear_queue', 'next_track', 'prev_track', 'run_quiz',
+  'set_volume', 'seek_music', 'set_repeat_mode', 'set_shuffle_mode', 'toggle_video_mode',
 ]);
 
 const OPEN_WORLD_TOOLS = new Set([

package/server/mcp/tests/connection.test.js

@@ -8,8 +8,8 @@ import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { handleMcpHttp } from '../handler.js';
 import sseHandler from '../../../api/mcp/sse.js';
-import messageHandler from '../../../api/mcp/message.js';
-import { PACKAGE_VERSION } from '../../agent/version.js';
+import messageHandler from '../../../api/mcp/message.js';
+import { PACKAGE_VERSION } from '../../agent/version.js';
 
 const stdioServerPath = fileURLToPath(new URL('../stdio.js', import.meta.url));
 
@@ -20,7 +20,7 @@ test('MCP client connects over stdio and exercises tools, resources, and prompts
     cwd: process.cwd(),
     stderr: 'pipe',
   });
-  const client = new Client({ name: 'kiku-mcp-integration-test', version: PACKAGE_VERSION }, { capabilities: {} });
+  const client = new Client({ name: 'kiku-mcp-integration-test', version: PACKAGE_VERSION }, { capabilities: {} });
 
   try {
     await client.connect(transport);
@@ -62,6 +62,8 @@ test('MCP client connects over stdio and exercises tools, resources, and prompts
 });
 
 test('MCP client connects through the real Streamable HTTP handler at /mcp', { timeout: 30_000 }, async () => {
+  const previousApiKey = process.env.MCP_API_KEY;
+  process.env.MCP_API_KEY = 'kiku-mcp-test-key';
   const { handleApiRequest } = await import('../../apiRouter.js');
   const httpServer = createServer((req, res) => {
     void handleApiRequest(req, res).catch(error => {
@@ -80,15 +82,17 @@ test('MCP client connects through the real Streamable HTTP handler at /mcp', { t
   const discoveryRes = await fetch(`${baseUrl}/mcp`);
   assert.equal(discoveryRes.status, 200);
   const discoveryData = await discoveryRes.json();
-  assert.equal(discoveryData.status, 'success');
-  assert.equal(discoveryData.name, 'kiku');
-  assert.equal(discoveryData.version, PACKAGE_VERSION);
+  assert.equal(discoveryData.status, 'success');
+  assert.equal(discoveryData.name, 'kiku');
+  assert.equal(discoveryData.version, PACKAGE_VERSION);
   assert.equal(discoveryData.endpoints.http, `${baseUrl}/mcp`);
   assert.equal(discoveryData.endpoints.sse, undefined);
   assert.equal(discoveryData.endpoints.message, undefined);
 
-  const transport = new StreamableHTTPClientTransport(new URL(`${baseUrl}/mcp`));
-  const client = new Client({ name: 'kiku-http-mcp-test', version: PACKAGE_VERSION }, { capabilities: {} });
+  const transport = new StreamableHTTPClientTransport(new URL(`${baseUrl}/mcp`), {
+    requestInit: { headers: { 'X-API-Key': 'kiku-mcp-test-key' } },
+  });
+  const client = new Client({ name: 'kiku-http-mcp-test', version: PACKAGE_VERSION }, { capabilities: {} });
 
   try {
     await client.connect(transport);
@@ -101,6 +105,8 @@ test('MCP client connects through the real Streamable HTTP handler at /mcp', { t
   } finally {
     await client.close().catch(() => {});
     await new Promise(resolve => httpServer.close(resolve));
+    if (previousApiKey === undefined) delete process.env.MCP_API_KEY;
+    else process.env.MCP_API_KEY = previousApiKey;
   }
 });
 

package/server/mcp/tests/mcpKeyAuth.test.js

@@ -0,0 +1,156 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { PACKAGE_VERSION } from '../../agent/version.js';
+import { handleApiRequest } from '../../apiRouter.js';
+import { MCP_QUIZ_CORRECT_ANSWERS } from '../../agent/mcpQuizData.js';
+
+test('Dynamic MCP API Key flow: challenge -> speedhack guard -> 12-question quiz claim -> Streamable HTTP authentication', { timeout: 35_000 }, async () => {
+  const previousEnvKey = process.env.MCP_API_KEY;
+  process.env.MCP_API_KEY = 'mcp-static-fallback-key';
+
+  const httpServer = createServer((req, res) => {
+    void handleApiRequest(req, res).catch(error => {
+      res.statusCode = 500;
+      res.end(error.message);
+    });
+  });
+
+  await new Promise((resolve, reject) => {
+    httpServer.once('error', reject);
+    httpServer.listen(0, '127.0.0.1', resolve);
+  });
+
+  const address = httpServer.address();
+  const baseUrl = `http://127.0.0.1:${address.port}`;
+
+  let client = null;
+  let transport = null;
+
+  try {
+   
+    const challengeRes = await fetch(`${baseUrl}/api/v1/mcp/quiz/challenge`);
+    assert.equal(challengeRes.status, 200);
+    const challengeJson = await challengeRes.json();
+    assert.equal(challengeJson.status, 'success');
+    assert.equal(challengeJson.data.totalQuestions, 12);
+    assert.equal(challengeJson.data.requiredScore, 12);
+    const challengeToken = challengeJson.data.challengeToken;
+    assert.ok(challengeToken && challengeToken.startsWith('kiku_mcp_chal_'));
+
+
+    const failNoTokenRes = await fetch(`${baseUrl}/api/v1/mcp/keys/claim`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ answers: [] })
+    });
+    assert.equal(failNoTokenRes.status, 403);
+
+    
+    const correctAnswers = MCP_QUIZ_CORRECT_ANSWERS.map((ans, idx) => ({
+      qIndex: idx,
+      answerIndex: ans
+    }));
+    const speedhackRes = await fetch(`${baseUrl}/api/v1/mcp/keys/claim`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        challengeToken,
+        answers: correctAnswers
+      })
+    });
+    assert.equal(speedhackRes.status, 403);
+
+   
+    await new Promise(r => setTimeout(r, 2600));
+
+   
+    const wrongAnswers = MCP_QUIZ_CORRECT_ANSWERS.map((ans, idx) => ({
+      qIndex: idx,
+      answerIndex: 99 
+    }));
+    const failWrongAnsRes = await fetch(`${baseUrl}/api/v1/mcp/keys/claim`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        challengeToken,
+        answers: wrongAnswers
+      })
+    });
+    assert.equal(failWrongAnsRes.status, 403);
+
+  
+    const claimRes = await fetch(`${baseUrl}/api/v1/mcp/keys/claim`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        challengeToken,
+        answers: correctAnswers
+      })
+    });
+    assert.equal(claimRes.status, 200);
+    const claimJson = await claimRes.json();
+    assert.equal(claimJson.status, 'success');
+    assert.equal(claimJson.data.tier, 'MCP VIP Tier');
+    assert.equal(claimJson.data.rateLimit, 1000);
+    const claimedKey = claimJson.data.apiKey;
+    assert.ok(claimedKey.startsWith('kiku_mcp_sk_'));
+    assert.ok(claimJson.data.claudeConfig?.mcpServers?.['kiku-remote']);
+
+   
+    const replayRes = await fetch(`${baseUrl}/api/v1/mcp/keys/claim`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        challengeToken,
+        answers: correctAnswers
+      })
+    });
+    assert.equal(replayRes.status, 403);
+
+   
+    transport = new StreamableHTTPClientTransport(new URL(`${baseUrl}/mcp`), {
+      requestInit: { headers: { 'X-API-Key': claimedKey } },
+    });
+    client = new Client({ name: 'kiku-dynamic-mcp-key-test', version: PACKAGE_VERSION }, { capabilities: {} });
+    await client.connect(transport);
+
+    const tools = await client.listTools();
+    assert.ok(tools.tools.length >= 10);
+    assert.ok(tools.tools.some(t => t.name === 'search_works'));
+
+    const callResult = await client.callTool({
+      name: 'search_works',
+      arguments: { year: 2026 }
+    });
+    assert.equal(callResult.isError, false);
+    const parsedContent = JSON.parse(callResult.content[0].text);
+    assert.equal(parsedContent.status, 'success');
+    assert.ok(parsedContent.count > 0);
+
+  
+    const badKeyRes = await fetch(`${baseUrl}/mcp`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-API-Key': 'kiku_mcp_sk_invalid_bogus_key'
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        method: 'initialize',
+        params: { protocolVersion: '2024-11-05', clientInfo: { name: 'bad-client', version: '1.0.0' } },
+        id: 1
+      })
+    });
+    assert.equal(badKeyRes.status, 401);
+
+  } finally {
+    process.env.MCP_API_KEY = previousEnvKey;
+    if (client) await client.close().catch(() => {});
+    if (transport) await transport.close().catch(() => {});
+    await new Promise(resolve => httpServer.close(resolve));
+  }
+});

package/server/mcp/tools.js

@@ -19,6 +19,7 @@ const PUBLIC_TOOL_NAMES = new Set([
   'global_search',
   'get_system_stats',
   'get_current_datetime',
+  'get_user_location',
   'get_youtube_transcript',
   'search_news',
   'fetch_rss',
@@ -32,7 +33,7 @@ const OPTIONAL_WEB_TOOL_NAMES = new Set(['web_search', 'fetch_webpage', 'fetch_a
 const webToolsEnabled = process.env.KIKU_MCP_ENABLE_WEB_TOOLS === 'true';
 
 const OPTIONAL_CN_TOOL_NAMES = new Set(['search_chinese_web', 'search_bilibili', 'search_web_images']);
-const cnToolsEnabled = process.env.KIKU_ENABLE_CN_WEB_TOOLS === 'true';
+const cnToolsEnabled = !['false', '0', 'off', 'no'].includes((process.env.KIKU_ENABLE_CN_WEB_TOOLS ?? '').trim().toLowerCase());
 
 const MUSIC_TOOL_NAMES = new Set([
   'search_youtube',
@@ -60,6 +61,11 @@ const PRIVILEGED_TOOL_NAMES = new Set([
   'resume_music',
   'next_track',
   'prev_track',
+  'set_volume',
+  'seek_music',
+  'set_repeat_mode',
+  'set_shuffle_mode',
+  'toggle_video_mode',
   'add_to_queue',
   'remove_from_queue',
   'clear_queue',