mcp-api-translator 0.1.0

package/dist/chunk-KSWSDM52.js

@@ -0,0 +1,2330 @@
+#!/usr/bin/env node
+
+// src/ir/validate.ts
+var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "PUT", "POST", "DELETE", "PATCH", "OPTIONS", "HEAD", "TRACE"]);
+var PARAM_LOCATIONS = /* @__PURE__ */ new Set(["path", "query", "header", "cookie"]);
+var SCHEME_TYPES = /* @__PURE__ */ new Set(["apiKey", "http", "oauth2", "openIdConnect", "mutualTLS"]);
+var TOOL_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var MAX_TOOL_NAME_LENGTH = 64;
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateApiModel(model) {
+  const issues = [];
+  if (typeof model.title !== "string" || model.title.trim() === "") {
+    issues.push("title must be a non-empty string");
+  }
+  if (typeof model.version !== "string") {
+    issues.push("version must be a string");
+  }
+  if (!Array.isArray(model.servers)) {
+    issues.push("servers must be an array");
+  } else {
+    model.servers.forEach((s, i) => {
+      if (typeof s !== "string" || s.trim() === "")
+        issues.push(`servers[${i}] must be a non-empty string`);
+    });
+  }
+  if (!Array.isArray(model.securitySchemes)) {
+    issues.push("securitySchemes must be an array");
+  } else {
+    model.securitySchemes.forEach((s, i) => {
+      const at = `securitySchemes[${i}]`;
+      if (!s || typeof s.name !== "string" || s.name === "")
+        issues.push(`${at}.name must be a non-empty string`);
+      if (!SCHEME_TYPES.has(s?.type))
+        issues.push(`${at}.type "${s?.type}" is not a known security scheme type`);
+      if (!Array.isArray(s?.envVars) || s.envVars.length === 0) {
+        issues.push(`${at}.envVars must be a non-empty array`);
+      } else if (!s.envVars.every((v) => typeof v === "string" && v !== "")) {
+        issues.push(`${at}.envVars must contain only non-empty strings`);
+      }
+    });
+  }
+  if (!Array.isArray(model.operations)) {
+    issues.push("operations must be an array");
+  } else {
+    model.operations.forEach((op, i) => {
+      const at = `operations[${i}]`;
+      if (typeof op?.toolName !== "string" || !TOOL_NAME_RE.test(op.toolName)) {
+        issues.push(
+          `${at}.toolName "${op?.toolName}" is not a valid identifier (^[A-Za-z_][A-Za-z0-9_]*$)`
+        );
+      } else if (op.toolName.length > MAX_TOOL_NAME_LENGTH) {
+        issues.push(`${at}.toolName exceeds ${MAX_TOOL_NAME_LENGTH} characters`);
+      }
+      if (typeof op?.method !== "string" || !HTTP_METHODS.has(op.method)) {
+        issues.push(`${at}.method "${op?.method}" is not a supported HTTP method`);
+      }
+      if (typeof op?.path !== "string" || !op.path.startsWith("/")) {
+        issues.push(`${at}.path "${op?.path}" must be a string starting with "/"`);
+      }
+      if (op?.summary !== void 0 && typeof op.summary !== "string") {
+        issues.push(`${at}.summary must be a string when present`);
+      }
+      if (op?.description !== void 0 && typeof op.description !== "string") {
+        issues.push(`${at}.description must be a string when present`);
+      }
+      if (!Array.isArray(op?.parameters)) {
+        issues.push(`${at}.parameters must be an array`);
+      } else {
+        op.parameters.forEach((p, j) => {
+          const pat = `${at}.parameters[${j}]`;
+          if (typeof p?.name !== "string" || p.name === "")
+            issues.push(`${pat}.name must be a non-empty string`);
+          if (!PARAM_LOCATIONS.has(p?.in))
+            issues.push(`${pat}.in "${p?.in}" is not a valid parameter location`);
+          if (!isPlainObject(p?.schema)) issues.push(`${pat}.schema must be an object`);
+        });
+      }
+      if (op?.requestBody !== void 0 && !isPlainObject(op.requestBody?.schema)) {
+        issues.push(`${at}.requestBody.schema must be an object`);
+      }
+      if (!Array.isArray(op?.security)) {
+        issues.push(`${at}.security must be an array`);
+      }
+    });
+  }
+  return issues;
+}
+function assertValidApiModel(model) {
+  const issues = validateApiModel(model);
+  if (issues.length > 0) {
+    throw new Error(
+      `Parsed API model failed validation:
+${issues.map((i) => `  - ${i}`).join("\n")}`
+    );
+  }
+}
+
+// src/parsers/index.ts
+import { readFile } from "fs/promises";
+import { parse as parseYaml } from "yaml";
+
+// src/parsers/openapi.ts
+import { dereference } from "@readme/openapi-parser";
+
+// src/curation/naming.ts
+var MAX_NAME_LENGTH = 64;
+function sanitizeToolName(raw) {
+  let name = raw.replace(/[^a-zA-Z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+  if (name.length === 0) name = "operation";
+  if (/^[0-9]/.test(name)) name = `op_${name}`;
+  if (name.length > MAX_NAME_LENGTH) name = name.slice(0, MAX_NAME_LENGTH).replace(/_+$/, "");
+  return name;
+}
+function nameFromMethodPath(method, path3) {
+  const segments = path3.split("/").filter(Boolean).map((seg) => {
+    const m = seg.match(/^\{(.+)\}$/);
+    return m ? `by_${m[1]}` : seg;
+  });
+  return sanitizeToolName(`${method.toLowerCase()}_${segments.join("_")}`);
+}
+function uniqueToolName(base, taken) {
+  const sanitized = sanitizeToolName(base);
+  if (!taken.has(sanitized)) {
+    taken.add(sanitized);
+    return sanitized;
+  }
+  let i = 2;
+  while (taken.has(`${sanitized}_${i}`)) i++;
+  const result = `${sanitized}_${i}`;
+  taken.add(result);
+  return result;
+}
+
+// src/parsers/security.ts
+function envPrefix(schemeName) {
+  return schemeName.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase() || "AUTH";
+}
+function envNamespace(source) {
+  return source.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase() || "API";
+}
+function friendlyEnvVars(raw) {
+  if (raw.type === "http" && raw.scheme?.toLowerCase() === "basic") {
+    return ["API_USERNAME", "API_PASSWORD"];
+  }
+  if (raw.tokenUrl && (raw.type === "oauth2" || raw.type === "openIdConnect")) {
+    return ["API_CLIENT_ID", "API_CLIENT_SECRET"];
+  }
+  if (raw.type === "http") return ["API_TOKEN"];
+  if (raw.type === "oauth2" || raw.type === "openIdConnect") return ["API_TOKEN"];
+  return ["API_KEY"];
+}
+function assignEnvVars(rawSchemes) {
+  const used = /* @__PURE__ */ new Set();
+  return rawSchemes.map((raw) => {
+    const friendly = friendlyEnvVars(raw);
+    const collides = friendly.some((v) => used.has(v));
+    const envVars = collides ? friendly.map((v) => `${envPrefix(raw.name)}_${v.replace(/^API_/, "")}`) : friendly;
+    for (const v of envVars) used.add(v);
+    return {
+      name: raw.name,
+      type: raw.type,
+      in: raw.in,
+      paramName: raw.paramName,
+      scheme: raw.scheme,
+      tokenUrl: raw.tokenUrl,
+      envVars
+    };
+  });
+}
+
+// src/parsers/openapi.ts
+var HTTP_METHODS2 = ["get", "put", "post", "delete", "patch", "options", "head", "trace"];
+function normalizeSchema(schema, isV30) {
+  if (!schema || typeof schema !== "object") return schema ?? {};
+  const out = Array.isArray(schema) ? [...schema] : { ...schema };
+  if (isV30 && out.nullable === true) {
+    if (typeof out.type === "string") out.type = [out.type, "null"];
+    else if (Array.isArray(out.type) && !out.type.includes("null"))
+      out.type = [...out.type, "null"];
+    delete out.nullable;
+  } else if (isV30 && out.nullable === false) {
+    delete out.nullable;
+  }
+  if (out.properties && typeof out.properties === "object") {
+    const props = {};
+    for (const [k, v] of Object.entries(out.properties)) props[k] = normalizeSchema(v, isV30);
+    out.properties = props;
+  }
+  if (out.items) out.items = normalizeSchema(out.items, isV30);
+  if (out.additionalProperties && typeof out.additionalProperties === "object") {
+    out.additionalProperties = normalizeSchema(out.additionalProperties, isV30);
+  }
+  for (const key of ["allOf", "anyOf", "oneOf"]) {
+    if (Array.isArray(out[key])) out[key] = out[key].map((s) => normalizeSchema(s, isV30));
+  }
+  return out;
+}
+function serversFrom(doc) {
+  if (Array.isArray(doc.servers) && doc.servers.length > 0) {
+    return doc.servers.map((s) => String(s.url)).filter(Boolean);
+  }
+  if (doc.host) {
+    const scheme = Array.isArray(doc.schemes) && doc.schemes.length > 0 ? doc.schemes[0] : "https";
+    return [`${scheme}://${doc.host}${doc.basePath ?? ""}`];
+  }
+  return [];
+}
+function paramFrom(p, isV30) {
+  const schema = p.schema ? normalizeSchema(p.schema, isV30) : normalizeSchema(
+    {
+      type: p.type,
+      format: p.format,
+      enum: p.enum,
+      items: p.items,
+      default: p.default
+    },
+    isV30
+  );
+  return {
+    name: String(p.name),
+    in: p.in ?? "query",
+    required: Boolean(p.required) || p.in === "path",
+    description: p.description,
+    schema
+  };
+}
+function requestBodyFrom(op, params, isV30) {
+  if (op.requestBody?.content) {
+    const content = op.requestBody.content;
+    const contentType = Object.keys(content).find((c) => c.includes("json")) ?? Object.keys(content)[0];
+    if (contentType) {
+      return {
+        required: Boolean(op.requestBody.required),
+        contentType,
+        description: op.requestBody.description,
+        schema: normalizeSchema(content[contentType]?.schema ?? {}, isV30)
+      };
+    }
+  }
+  const body = params.find((p) => p.in === "body");
+  if (body?.schema) {
+    return {
+      required: Boolean(body.required),
+      contentType: "application/json",
+      description: body.description,
+      schema: normalizeSchema(body.schema, isV30)
+    };
+  }
+  return void 0;
+}
+function securitySchemesFrom(doc) {
+  const defs = doc.components?.securitySchemes ?? doc.securityDefinitions ?? {};
+  const raw = Object.entries(defs).map(([name, def]) => {
+    const d = def;
+    let type = d.type;
+    let scheme = d.scheme;
+    if (d.type === "basic") {
+      type = "http";
+      scheme = "basic";
+    }
+    const tokenUrl = typeof d.flows?.clientCredentials?.tokenUrl === "string" ? d.flows.clientCredentials.tokenUrl : d.flow === "application" && typeof d.tokenUrl === "string" ? d.tokenUrl : void 0;
+    return {
+      name,
+      type,
+      in: d.in,
+      paramName: d.name,
+      scheme,
+      tokenUrl
+    };
+  });
+  return assignEnvVars(raw);
+}
+async function parseOpenApi(raw) {
+  const doc = await dereference(
+    raw,
+    { resolve: { external: false } }
+  );
+  const isV30 = typeof doc.openapi === "string" ? doc.openapi.startsWith("3.0") : !!doc.swagger;
+  const securitySchemes = securitySchemesFrom(doc);
+  const rootSecurity = securityNames(doc.security);
+  const operations = [];
+  const paths = doc.paths ?? {};
+  for (const [path3, pathItemRaw] of Object.entries(paths)) {
+    const pathItem = pathItemRaw;
+    const pathLevelParams = Array.isArray(pathItem.parameters) ? pathItem.parameters : [];
+    for (const method of HTTP_METHODS2) {
+      const op = pathItem[method];
+      if (!op) continue;
+      const rawParams = [
+        ...pathLevelParams,
+        ...Array.isArray(op.parameters) ? op.parameters : []
+      ];
+      const parameters = rawParams.filter((p) => p.in && p.in !== "body" && p.in !== "formData").map((p) => paramFrom(p, isV30));
+      const baseName = op.operationId ? sanitizeToolName(op.operationId) : nameFromMethodPath(method, path3);
+      operations.push({
+        toolName: baseName,
+        operationId: op.operationId,
+        method: method.toUpperCase(),
+        path: path3,
+        summary: typeof op.summary === "string" ? op.summary : void 0,
+        description: typeof op.description === "string" ? op.description : void 0,
+        tags: Array.isArray(op.tags) ? op.tags.map(String) : [],
+        parameters,
+        requestBody: requestBodyFrom(op, rawParams, isV30),
+        security: op.security ? securityNames(op.security) : rootSecurity
+      });
+    }
+  }
+  return {
+    title: doc.info?.title ?? "API",
+    version: doc.info?.version ?? "0.0.0",
+    description: doc.info?.description,
+    servers: serversFrom(doc),
+    securitySchemes,
+    operations,
+    sourceFormat: "openapi"
+  };
+}
+function securityNames(security) {
+  if (!Array.isArray(security)) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const requirement of security) {
+    if (requirement && typeof requirement === "object") {
+      for (const key of Object.keys(requirement)) names.add(key);
+    }
+  }
+  return [...names];
+}
+
+// src/parsers/postman.ts
+var SKIP_HEADERS = /* @__PURE__ */ new Set(["content-type", "accept", "authorization"]);
+function asDescription(value) {
+  if (typeof value === "string") return value;
+  if (value && typeof value === "object" && typeof value.content === "string") {
+    return value.content;
+  }
+  return void 0;
+}
+function inferSchema(value) {
+  if (value === null) return {};
+  if (Array.isArray(value)) return { type: "array", items: inferSchema(value[0] ?? {}) };
+  switch (typeof value) {
+    case "string":
+      return { type: "string" };
+    case "number":
+      return { type: Number.isInteger(value) ? "integer" : "number" };
+    case "boolean":
+      return { type: "boolean" };
+    case "object": {
+      const properties = {};
+      for (const [k, v] of Object.entries(value)) properties[k] = inferSchema(v);
+      return { type: "object", properties };
+    }
+    default:
+      return {};
+  }
+}
+function rawUrl(url) {
+  if (typeof url === "string") {
+    return { path: normalizePath(url), pathVars: [], query: [] };
+  }
+  const segments = Array.isArray(url?.path) ? url.path.map(String) : [];
+  const path3 = normalizePath("/" + segments.join("/"));
+  return {
+    path: path3,
+    pathVars: Array.isArray(url?.variable) ? url.variable : [],
+    query: Array.isArray(url?.query) ? url.query : []
+  };
+}
+function normalizePath(p) {
+  let path3 = p.replace(/^https?:\/\/[^/]+/i, "");
+  path3 = path3.replace(/\?.*$/, "");
+  path3 = path3.replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
+  if (!path3.startsWith("/")) path3 = "/" + path3;
+  return path3 || "/";
+}
+function pathParamNames(path3) {
+  return [...path3.matchAll(/\{([^}]+)\}/g)].map((m) => m[1]);
+}
+function mapAuth(auth) {
+  if (!auth?.type) return null;
+  switch (auth.type) {
+    case "bearer":
+      return { name: "bearerAuth", type: "http", scheme: "bearer" };
+    case "basic":
+      return { name: "basicAuth", type: "http", scheme: "basic" };
+    case "apikey": {
+      const entries = Array.isArray(auth.apikey) ? auth.apikey : [];
+      const keyEntry = entries.find((e) => e.key === "key");
+      const inEntry = entries.find((e) => e.key === "in");
+      return {
+        name: "apiKeyAuth",
+        type: "apiKey",
+        in: inEntry?.value ?? "header",
+        paramName: keyEntry?.value ?? "X-API-Key"
+      };
+    }
+    case "oauth2":
+      return { name: "oauth2", type: "oauth2" };
+    default:
+      return null;
+  }
+}
+function parsePostman(raw) {
+  const doc = raw;
+  const operations = [];
+  const rawSchemes = /* @__PURE__ */ new Map();
+  const collectionAuth = mapAuth(doc.auth);
+  if (collectionAuth) rawSchemes.set(collectionAuth.name, collectionAuth);
+  const walk = (items, tags) => {
+    for (const item of items ?? []) {
+      if (Array.isArray(item.item)) {
+        walk(item.item, [...tags, String(item.name)]);
+        continue;
+      }
+      const req = item.request;
+      if (!req) continue;
+      const method = String(req.method ?? "GET").toUpperCase();
+      const { path: path3, pathVars, query } = rawUrl(req.url);
+      const effectiveAuth = mapAuth(req.auth) ?? collectionAuth;
+      if (req.auth) {
+        const s = mapAuth(req.auth);
+        if (s) rawSchemes.set(s.name, s);
+      }
+      const parameters = [];
+      for (const name2 of pathParamNames(path3)) {
+        const v = pathVars.find((pv) => pv.key === name2);
+        parameters.push({
+          name: name2,
+          in: "path",
+          required: true,
+          description: v?.description,
+          schema: { type: "string" }
+        });
+      }
+      for (const q of query) {
+        if (q.disabled) continue;
+        parameters.push({
+          name: String(q.key),
+          in: "query",
+          required: false,
+          description: q.description,
+          schema: { type: "string" }
+        });
+      }
+      for (const h of Array.isArray(req.header) ? req.header : []) {
+        if (h.disabled || SKIP_HEADERS.has(String(h.key).toLowerCase())) continue;
+        parameters.push({
+          name: String(h.key),
+          in: "header",
+          required: false,
+          description: h.description,
+          schema: { type: "string" }
+        });
+      }
+      const requestBody = bodyFrom(req.body);
+      const name = item.name ? sanitizeToolName(String(item.name)) : nameFromMethodPath(method, path3);
+      operations.push({
+        toolName: name,
+        operationId: item.name ? String(item.name) : void 0,
+        method,
+        path: path3,
+        summary: typeof item.name === "string" ? item.name : void 0,
+        description: asDescription(req.description) ?? asDescription(item.description),
+        tags,
+        parameters,
+        requestBody,
+        security: effectiveAuth ? [effectiveAuth.name] : []
+      });
+    }
+  };
+  walk(Array.isArray(doc.item) ? doc.item : [], []);
+  const securitySchemes = assignEnvVars(
+    [...rawSchemes.values()].filter((s) => s !== null)
+  );
+  return {
+    title: doc.info?.name ?? "API",
+    version: "1.0.0",
+    description: typeof doc.info?.description === "string" ? doc.info.description : void 0,
+    servers: [],
+    // Postman base URLs typically use {{variables}}; resolved via API_BASE_URL.
+    securitySchemes,
+    operations,
+    sourceFormat: "postman"
+  };
+}
+function bodyFrom(body) {
+  if (!body || !body.mode) return void 0;
+  if (body.mode === "raw" && typeof body.raw === "string" && body.raw.trim()) {
+    try {
+      return {
+        required: false,
+        contentType: "application/json",
+        schema: inferSchema(JSON.parse(body.raw))
+      };
+    } catch {
+      return { required: false, contentType: "text/plain", schema: { type: "string" } };
+    }
+  }
+  if (body.mode === "urlencoded" || body.mode === "formdata") {
+    const entries = Array.isArray(body[body.mode]) ? body[body.mode] : [];
+    const properties = {};
+    for (const e of entries) if (e.key) properties[String(e.key)] = { type: "string" };
+    return {
+      required: false,
+      contentType: body.mode === "urlencoded" ? "application/x-www-form-urlencoded" : "multipart/form-data",
+      schema: { type: "object", properties }
+    };
+  }
+  return void 0;
+}
+
+// src/parsers/index.ts
+var MAX_SPEC_BYTES = 16 * 1024 * 1024;
+async function loadRawSpec(input) {
+  let text2;
+  if (input.spec && input.spec.trim().length > 0) {
+    text2 = input.spec;
+  } else if (input.specPath) {
+    text2 = await readFile(input.specPath, "utf8");
+  } else {
+    throw new Error("Provide either `spec` (inline text) or `specPath` (a local file path).");
+  }
+  const bytes = Buffer.byteLength(text2, "utf8");
+  if (bytes > MAX_SPEC_BYTES) {
+    throw new Error(
+      `Spec is ${bytes} bytes, exceeding the ${MAX_SPEC_BYTES}-byte limit. Split it or raise MAX_SPEC_BYTES.`
+    );
+  }
+  try {
+    return parseYaml(text2);
+  } catch (err) {
+    throw new Error(`Could not parse spec as JSON or YAML: ${err.message}`);
+  }
+}
+function detectFormat(raw) {
+  if (raw && typeof raw === "object") {
+    const obj = raw;
+    if ("openapi" in obj || "swagger" in obj) return "openapi";
+    const info = obj.info;
+    const schema = typeof info?.schema === "string" ? info.schema : "";
+    if (schema.includes("getpostman.com") || "_postman_id" in (info ?? {}) || Array.isArray(obj.item)) {
+      return "postman";
+    }
+  }
+  throw new Error(
+    'Could not detect the spec format. Pass `format: "openapi"` or `format: "postman"` explicitly.'
+  );
+}
+async function parseSource(input) {
+  const raw = await loadRawSpec(input);
+  const format = !input.format || input.format === "auto" ? detectFormat(raw) : input.format;
+  let model;
+  switch (format) {
+    case "openapi":
+      model = await parseOpenApi(raw);
+      break;
+    case "postman":
+      model = parsePostman(raw);
+      break;
+    default:
+      throw new Error(`Unsupported format: ${format}`);
+  }
+  assertValidApiModel(model);
+  return model;
+}
+var SUPPORTED_FORMATS = ["openapi", "postman"];
+
+// src/emitters/project.ts
+import { mkdir, writeFile as writeFile2, readFile as readFile3, readdir, access } from "fs/promises";
+import path2 from "path";
+
+// src/curation/describe.ts
+var MAX_DESCRIPTION_LENGTH = 1024;
+function truncate(text2, max) {
+  if (text2.length <= max) return text2;
+  return `${text2.slice(0, max - 1).trimEnd()}\u2026`;
+}
+function buildDescription(op) {
+  const parts = [];
+  const headline = op.summary?.trim() || op.description?.trim();
+  if (headline) parts.push(headline);
+  else parts.push(`${op.method} ${op.path}`);
+  if (op.description && op.description.trim() && op.description.trim() !== headline) {
+    parts.push(op.description.trim());
+  }
+  parts.push(`Calls ${op.method} ${op.path}.`);
+  const documentedParams = op.parameters.filter((p) => p.description?.trim());
+  if (documentedParams.length > 0) {
+    const lines = documentedParams.map(
+      (p) => `- ${p.name} (${p.in}${p.required ? ", required" : ""}): ${p.description.trim()}`
+    );
+    parts.push(`Parameters:
+${lines.join("\n")}`);
+  }
+  return truncate(parts.join("\n\n"), MAX_DESCRIPTION_LENGTH);
+}
+
+// src/curation/filter.ts
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const pattern = escaped.replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").replace(//g, ".*");
+  return new RegExp(`^${pattern}$`);
+}
+function applyFilters(operations, opts) {
+  const includeTags = opts.includeTags?.map((t) => t.toLowerCase());
+  const exclude = opts.excludeOperations?.map((t) => t.toLowerCase());
+  const methods = opts.methods?.map((m) => m.toUpperCase());
+  const pathRe = opts.pathGlob ? globToRegExp(opts.pathGlob) : void 0;
+  return operations.filter((op) => {
+    if (methods && !methods.includes(op.method.toUpperCase())) return false;
+    if (pathRe && !pathRe.test(op.path)) return false;
+    if (includeTags && includeTags.length > 0) {
+      const opTags = op.tags.map((t) => t.toLowerCase());
+      if (!opTags.some((t) => includeTags.includes(t))) return false;
+    }
+    if (exclude && exclude.length > 0) {
+      const candidates = [op.operationId, op.toolName, ...op.tags].filter((v) => Boolean(v)).map((v) => v.toLowerCase());
+      if (candidates.some((c) => exclude.includes(c))) return false;
+    }
+    return true;
+  });
+}
+
+// src/curation/index.ts
+var TOOL_COUNT_WARN_THRESHOLD = 40;
+function curate(model, filters, reservedNames = /* @__PURE__ */ new Set()) {
+  const before = model.operations.length;
+  const kept = applyFilters(model.operations, filters);
+  kept.sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
+  for (const op of kept) {
+    op.toolName = uniqueToolName(op.toolName, reservedNames);
+  }
+  return { operations: kept, filteredOut: before - kept.length };
+}
+
+// src/manifest.ts
+import { readFile as readFile2, writeFile } from "fs/promises";
+import path from "path";
+var MANIFEST_FILENAME = ".mcp-translator.json";
+var MANIFEST_VERSION = 1;
+function manifestPath(projectDir) {
+  return path.join(projectDir, MANIFEST_FILENAME);
+}
+async function readManifest(projectDir) {
+  try {
+    const text2 = await readFile2(manifestPath(projectDir), "utf8");
+    return JSON.parse(text2);
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function operationKey(method, opPath) {
+  return `${method.toUpperCase()} ${opPath}`;
+}
+
+// src/version.ts
+var GENERATOR_VERSION = "0.1.0";
+var GENERATOR_NAME = "mcp-api-translator";
+
+// src/emitters/templates.ts
+var GENERATED_BANNER = `// Generated by ${GENERATOR_NAME} v${GENERATOR_VERSION}. Safe to edit: tool files are
+// preserved on re-generation/append unless --force is used.`;
+function packageJson(name, version, transport) {
+  const scripts = {
+    build: "tsc",
+    start: "node dist/index.js"
+  };
+  if (transport === "http" || transport === "both") {
+    scripts["start:http"] = "node dist/index.http.js";
+  }
+  const pkg = {
+    name,
+    version,
+    private: true,
+    type: "module",
+    bin: { [name]: "dist/index.js" },
+    scripts,
+    dependencies: { "@modelcontextprotocol/sdk": "^1.29.0" },
+    devDependencies: { typescript: "^5.6.0", "@types/node": "^22.0.0" }
+  };
+  return JSON.stringify(pkg, null, 2) + "\n";
+}
+function tsconfigJson() {
+  return JSON.stringify(
+    {
+      compilerOptions: {
+        target: "ES2022",
+        module: "NodeNext",
+        moduleResolution: "NodeNext",
+        lib: ["ES2022"],
+        strict: true,
+        esModuleInterop: true,
+        skipLibCheck: true,
+        outDir: "dist",
+        rootDir: "src",
+        declaration: false,
+        sourceMap: true
+      },
+      include: ["src"]
+    },
+    null,
+    2
+  ) + "\n";
+}
+function gitignore() {
+  return ["node_modules/", "dist/", ".env", "*.log", ""].join("\n");
+}
+function typesTs() {
+  return [
+    GENERATED_BANNER,
+    "",
+    "export interface ToolDef {",
+    "  name: string;",
+    "  description: string;",
+    "  inputSchema: Record<string, unknown>;",
+    "  handler: (args: Record<string, unknown>) => Promise<string>;",
+    "}",
+    ""
+  ].join("\n");
+}
+function configTs(defaultBaseUrl) {
+  return [
+    GENERATED_BANNER,
+    "",
+    "export const config = {",
+    `  baseUrl: process.env.API_BASE_URL ?? ${JSON.stringify(defaultBaseUrl)},`,
+    "};",
+    ""
+  ].join("\n");
+}
+function commentSafe(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function authBlock(scheme) {
+  const lines = [];
+  const guard = `  if (security.includes(${JSON.stringify(scheme.name)})) {`;
+  const label = commentSafe(
+    `${scheme.name} (${scheme.type}${scheme.scheme ? "/" + scheme.scheme : ""})`
+  );
+  lines.push(`  // ${label}`);
+  lines.push(guard);
+  if (scheme.type === "apiKey") {
+    const env = scheme.envVars[0];
+    const param = scheme.paramName ?? "X-API-Key";
+    lines.push(`    const value = process.env[${JSON.stringify(env)}];`);
+    lines.push("    if (value) {");
+    if (scheme.in === "query") {
+      lines.push(`      url.searchParams.set(${JSON.stringify(param)}, value);`);
+    } else if (scheme.in === "cookie") {
+      lines.push(
+        `      headers["cookie"] = (headers["cookie"] ? headers["cookie"] + "; " : "") + ${JSON.stringify(
+          param + "="
+        )} + value;`
+      );
+    } else {
+      lines.push(`      headers[${JSON.stringify(param)}] = value;`);
+    }
+    lines.push("    }");
+  } else if (scheme.type === "http" && scheme.scheme?.toLowerCase() === "basic") {
+    const [u, p] = scheme.envVars;
+    lines.push(`    const user = process.env[${JSON.stringify(u)}];`);
+    lines.push(`    const pass = process.env[${JSON.stringify(p)}];`);
+    lines.push("    if (user && pass) {");
+    lines.push(
+      '      headers["authorization"] = "Basic " + Buffer.from(user + ":" + pass).toString("base64");'
+    );
+    lines.push("    }");
+  } else if (scheme.tokenUrl) {
+    const [id, secret] = scheme.envVars;
+    lines.push(`    const clientId = process.env[${JSON.stringify(id)}];`);
+    lines.push(`    const clientSecret = process.env[${JSON.stringify(secret)}];`);
+    lines.push("    if (clientId && clientSecret) {");
+    lines.push(
+      `      const token = await getClientCredentialsToken(${JSON.stringify(scheme.tokenUrl)}, clientId, clientSecret);`
+    );
+    lines.push('      headers["authorization"] = "Bearer " + token;');
+    lines.push("    }");
+  } else {
+    const env = scheme.envVars[0];
+    lines.push(`    const value = process.env[${JSON.stringify(env)}];`);
+    lines.push('    if (value) headers["authorization"] = "Bearer " + value;');
+  }
+  lines.push("  }");
+  return lines;
+}
+function oauthHelperTs() {
+  return [
+    "const _tokenCache = new Map<string, { token: string; expiresAt: number }>();",
+    "",
+    "async function getClientCredentialsToken(",
+    "  tokenUrl: string,",
+    "  clientId: string,",
+    "  clientSecret: string,",
+    "): Promise<string> {",
+    '    const key = tokenUrl + "|" + clientId;',
+    "    const hit = _tokenCache.get(key);",
+    "    if (hit && hit.expiresAt > Date.now()) return hit.token;",
+    "    const body = new URLSearchParams({",
+    '      grant_type: "client_credentials",',
+    "      client_id: clientId,",
+    "      client_secret: clientSecret,",
+    "    }).toString();",
+    "    const res = await fetch(tokenUrl, {",
+    '      method: "POST",',
+    '      headers: { "content-type": "application/x-www-form-urlencoded" },',
+    "      body,",
+    "    });",
+    "    const text = await res.text();",
+    "    if (!res.ok)",
+    '      throw new Error("OAuth token request failed: HTTP " + res.status + " " + text.slice(0, 300));',
+    "    const json = JSON.parse(text) as { access_token?: string; expires_in?: number };",
+    '    if (!json.access_token) throw new Error("OAuth token response had no access_token");',
+    '    const ttl = typeof json.expires_in === "number" ? json.expires_in : 3600;',
+    "    _tokenCache.set(key, { token: json.access_token, expiresAt: Date.now() + ttl * 1000 - 30000 });",
+    "    return json.access_token;",
+    "}",
+    ""
+  ];
+}
+function authTs(schemes) {
+  const body = schemes.flatMap(authBlock);
+  const hasOAuth = schemes.some((s) => s.tokenUrl);
+  const signature = hasOAuth ? [
+    "export async function applyAuth(",
+    "  headers: Record<string, string>,",
+    "  url: URL,",
+    "  security: string[],",
+    "): Promise<void> {"
+  ] : [
+    "export function applyAuth(",
+    "  headers: Record<string, string>,",
+    "  url: URL,",
+    "  security: string[],",
+    "): void {"
+  ];
+  return [
+    GENERATED_BANNER,
+    "",
+    "// Injects credentials read from the environment. Secrets are never embedded.",
+    ...hasOAuth ? oauthHelperTs() : [],
+    ...signature,
+    ...body.length > 0 ? body : ["  // No security schemes detected on the source API."],
+    "}",
+    ""
+  ].join("\n");
+}
+function httpClientTs() {
+  return [
+    GENERATED_BANNER,
+    "",
+    'import { config } from "../config.js";',
+    'import { applyAuth } from "../auth.js";',
+    "",
+    "export interface RequestPlan {",
+    "  method: string;",
+    "  pathTemplate: string;",
+    "  pathParams: string[];",
+    "  queryParams: string[];",
+    "  headerParams: string[];",
+    "  cookieParams: string[];",
+    "  bodyParam: string | null;",
+    "  contentType: string | null;",
+    "  security: string[];",
+    "}",
+    "",
+    "function joinUrl(base: string, path: string): string {",
+    '  if (!base) throw new Error("API base URL is not set. Set API_BASE_URL in the environment.");',
+    '  return base.replace(/\\/+$/, "") + "/" + path.replace(/^\\/+/, "");',
+    "}",
+    "",
+    "export async function callOperation(",
+    "  plan: RequestPlan,",
+    "  args: Record<string, unknown>,",
+    "): Promise<string> {",
+    "  let path = plan.pathTemplate;",
+    "  for (const name of plan.pathParams) {",
+    "    const value = args[name];",
+    '    path = path.split("{" + name + "}").join(encodeURIComponent(String(value ?? "")));',
+    "  }",
+    "  const url = new URL(joinUrl(config.baseUrl, path));",
+    "  for (const name of plan.queryParams) {",
+    "    const value = args[name];",
+    "    if (value === undefined || value === null) continue;",
+    "    // Array query values are repeated (?k=1&k=2), the OpenAPI default (form/explode).",
+    "    if (Array.isArray(value)) {",
+    "      for (const v of value) {",
+    "        if (v !== undefined && v !== null) url.searchParams.append(name, String(v));",
+    "      }",
+    "    } else {",
+    "      url.searchParams.set(name, String(value));",
+    "    }",
+    "  }",
+    "  const headers: Record<string, string> = {};",
+    "  for (const name of plan.headerParams) {",
+    "    const value = args[name];",
+    "    if (value === undefined || value === null) continue;",
+    '    headers[name] = Array.isArray(value) ? value.map(String).join(",") : String(value);',
+    "  }",
+    "  const cookies: string[] = [];",
+    "  for (const name of plan.cookieParams) {",
+    "    const value = args[name];",
+    "    if (value !== undefined && value !== null) {",
+    '      cookies.push(name + "=" + encodeURIComponent(String(value)));',
+    "    }",
+    "  }",
+    "  if (cookies.length > 0) {",
+    '    headers["cookie"] = (headers["cookie"] ? headers["cookie"] + "; " : "") + cookies.join("; ");',
+    "  }",
+    "  let body: string | undefined;",
+    "  if (plan.bodyParam && args[plan.bodyParam] !== undefined) {",
+    "    const raw = args[plan.bodyParam];",
+    '    if (plan.contentType && plan.contentType.indexOf("json") >= 0) {',
+    '      headers["content-type"] = "application/json";',
+    "      body = JSON.stringify(raw);",
+    "    } else {",
+    '      if (plan.contentType) headers["content-type"] = plan.contentType;',
+    '      body = typeof raw === "string" ? raw : JSON.stringify(raw);',
+    "    }",
+    "  }",
+    "  await applyAuth(headers, url, plan.security);",
+    "  const response = await fetch(url, { method: plan.method, headers, body });",
+    "  const text = await response.text();",
+    "  if (!response.ok) {",
+    '    throw new Error("HTTP " + response.status + " " + response.statusText + ": " + text.slice(0, 800));',
+    "  }",
+    "  return text;",
+    "}",
+    ""
+  ].join("\n");
+}
+function toolFileTs(tool) {
+  return [
+    GENERATED_BANNER,
+    "",
+    'import type { ToolDef } from "../types.js";',
+    'import { callOperation } from "../http/client.js";',
+    "",
+    `const inputSchema = ${JSON.stringify(tool.inputSchema, null, 2)} as Record<string, unknown>;`,
+    "",
+    `const plan = ${JSON.stringify(tool.plan, null, 2)};`,
+    "",
+    `export const ${tool.name}: ToolDef = {`,
+    `  name: ${JSON.stringify(tool.name)},`,
+    `  description: ${JSON.stringify(tool.description)},`,
+    "  inputSchema,",
+    "  handler: (args) => callOperation(plan, args),",
+    "};",
+    ""
+  ].join("\n");
+}
+function toolsIndexTs(toolNames) {
+  const imports = toolNames.map((n) => `import { ${n} } from "./${n}.js";`);
+  return [
+    GENERATED_BANNER,
+    "",
+    'import type { ToolDef } from "../types.js";',
+    ...imports,
+    "",
+    `export const tools: ToolDef[] = [${toolNames.join(", ")}];`,
+    ""
+  ].join("\n");
+}
+function serverTs(name, version) {
+  return [
+    GENERATED_BANNER,
+    "",
+    'import { Server } from "@modelcontextprotocol/sdk/server/index.js";',
+    "import {",
+    "  ListToolsRequestSchema,",
+    "  CallToolRequestSchema,",
+    '} from "@modelcontextprotocol/sdk/types.js";',
+    'import { tools } from "./tools/index.js";',
+    "",
+    "export function createServer(): Server {",
+    "  const server = new Server(",
+    `    { name: ${JSON.stringify(name)}, version: ${JSON.stringify(version)} },`,
+    "    { capabilities: { tools: {} } },",
+    "  );",
+    "",
+    "  server.setRequestHandler(ListToolsRequestSchema, async () => ({",
+    "    tools: tools.map((t) => ({",
+    "      name: t.name,",
+    "      description: t.description,",
+    "      inputSchema: t.inputSchema,",
+    "    })),",
+    "  }));",
+    "",
+    "  server.setRequestHandler(CallToolRequestSchema, async (request) => {",
+    "    const tool = tools.find((t) => t.name === request.params.name);",
+    "    if (!tool) {",
+    "      return {",
+    '        content: [{ type: "text", text: "Unknown tool: " + request.params.name }],',
+    "        isError: true,",
+    "      };",
+    "    }",
+    "    try {",
+    "      const text = await tool.handler(",
+    "        (request.params.arguments ?? {}) as Record<string, unknown>,",
+    "      );",
+    '      return { content: [{ type: "text", text }] };',
+    "    } catch (err) {",
+    "      return {",
+    '        content: [{ type: "text", text: "Error: " + (err instanceof Error ? err.message : String(err)) }],',
+    "        isError: true,",
+    "      };",
+    "    }",
+    "  });",
+    "",
+    "  return server;",
+    "}",
+    ""
+  ].join("\n");
+}
+function indexStdioTs(name) {
+  return [
+    GENERATED_BANNER,
+    "",
+    'import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";',
+    'import { createServer } from "./server.js";',
+    "",
+    "async function main(): Promise<void> {",
+    "  const server = createServer();",
+    "  const transport = new StdioServerTransport();",
+    "  await server.connect(transport);",
+    `  console.error(${JSON.stringify(name + " MCP server running on stdio")});`,
+    "}",
+    "",
+    "main().catch((err) => {",
+    "  console.error(err);",
+    "  process.exit(1);",
+    "});",
+    ""
+  ].join("\n");
+}
+function indexHttpTs(name) {
+  return [
+    GENERATED_BANNER,
+    "",
+    'import { createServer as createHttpServer } from "node:http";',
+    'import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";',
+    'import { createServer } from "./server.js";',
+    "",
+    "const port = Number(process.env.PORT ?? 3000);",
+    "",
+    "// DNS-rebinding protection: only accept requests whose Host header is in this allowlist, so a",
+    "// malicious web page cannot rebind to localhost and drive this server. Override for non-local",
+    "// deployments via MCP_ALLOWED_HOSTS (comma-separated host[:port] values).",
+    'const defaultHosts = "127.0.0.1:" + port + ",localhost:" + port;',
+    "const allowedHostList = (process.env.MCP_ALLOWED_HOSTS ?? defaultHosts)",
+    '  .split(",")',
+    "  .map((h) => h.trim())",
+    "  .filter(Boolean);",
+    "",
+    "// Stateless Streamable HTTP: a fresh server+transport per request.",
+    "createHttpServer(async (req, res) => {",
+    '  if (!req.url || !req.url.startsWith("/mcp")) {',
+    "    res.statusCode = 404;",
+    '    res.end("Not found");',
+    "    return;",
+    "  }",
+    "  const server = createServer();",
+    "  const transport = new StreamableHTTPServerTransport({",
+    "    sessionIdGenerator: undefined,",
+    "    enableDnsRebindingProtection: true,",
+    "    allowedHosts: allowedHostList,",
+    "  });",
+    '  res.on("close", () => {',
+    "    void transport.close();",
+    "    void server.close();",
+    "  });",
+    "  await server.connect(transport);",
+    "  await transport.handleRequest(req, res);",
+    "}).listen(port, () => {",
+    `  console.error(${JSON.stringify(name + " MCP server on http://localhost:")} + port + "/mcp");`,
+    "});",
+    ""
+  ].join("\n");
+}
+function envExample(baseUrl, schemes) {
+  const lines = ["# Environment for the generated MCP server.", ""];
+  lines.push("# Base URL of the upstream API.");
+  lines.push(`API_BASE_URL=${baseUrl || "https://api.example.com"}`);
+  if (schemes.length > 0) {
+    lines.push("");
+    lines.push("# Credentials (read at runtime; never commit real values).");
+    for (const s of schemes) {
+      for (const v of s.envVars) lines.push(`${v}=`);
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function serverJson(name, version, description) {
+  const manifest = {
+    $schema: "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
+    name: `io.github.OWNER/${name}`,
+    description,
+    version,
+    packages: [
+      {
+        registryType: "npm",
+        identifier: name,
+        version,
+        transport: { type: "stdio" }
+      }
+    ]
+  };
+  return JSON.stringify(manifest, null, 2) + "\n";
+}
+function clientConfigMd(name) {
+  return [
+    "# Add this server to an MCP client",
+    "",
+    "After `npm install && npm run build`, register the server.",
+    "",
+    "## Claude Desktop / Claude Code (`mcp.json` or `claude_desktop_config.json`)",
+    "",
+    "```json",
+    "{",
+    '  "mcpServers": {',
+    `    "${name}": {`,
+    '      "command": "node",',
+    `      "args": ["./dist/index.js"],`,
+    '      "env": {',
+    '        "API_BASE_URL": "https://api.example.com"',
+    "      }",
+    "    }",
+    "  }",
+    "}",
+    "```",
+    "",
+    "## Cursor (`.cursor/mcp.json`) and Codex use the same `mcpServers` shape.",
+    "",
+    "Set any required credential env vars (see `.env.example`).",
+    ""
+  ].join("\n");
+}
+function readmeMd(data) {
+  const envLines = data.schemes.flatMap((s) => s.envVars).map((v) => "- `" + v + "`");
+  const lines = [
+    `# ${data.serverName}`,
+    "",
+    `An MCP server for **${data.apiTitle}**, generated by [${GENERATOR_NAME}](https://github.com/krishgok/mcp-api-translator).`,
+    `It exposes ${data.toolCount} tool(s) that call the upstream API directly.`,
+    "",
+    "## Quickstart",
+    "",
+    "```bash",
+    "npm install",
+    "npm run build",
+    "cp .env.example .env   # then fill in values",
+    "npm start              # runs over stdio",
+    "```",
+    "",
+    "## Configuration",
+    "",
+    "- `API_BASE_URL` \u2014 base URL of the upstream API.",
+    ...envLines.length > 0 ? ["", "Credentials:", ...envLines] : [],
+    "",
+    "## Connecting a client",
+    "",
+    "See `client-config.md` for ready-to-paste Claude / Cursor / Codex config.",
+    "",
+    ...data.transport === "http" || data.transport === "both" ? [
+      "## HTTP transport",
+      "",
+      "```bash",
+      "npm run start:http   # Streamable HTTP on PORT (default 3000) at /mcp",
+      "```",
+      ""
+    ] : [],
+    "## Publishing for discovery",
+    "",
+    "Edit `server.json` (set your owner/namespace) and publish to the official MCP Registry",
+    "so AI clients can discover this server.",
+    "",
+    "## Regenerating / extending",
+    "",
+    "This project carries a `.mcp-translator.json` manifest. Point mcp-api-translator's",
+    "`extend_mcp_server` tool at this directory with another spec to add more tools; your",
+    "hand-edited tool files are preserved.",
+    ""
+  ];
+  return lines.join("\n");
+}
+function dockerfile() {
+  return [
+    "# Build stage: needs devDependencies (typescript) to compile.",
+    "FROM node:20-alpine AS build",
+    "WORKDIR /app",
+    "COPY package*.json ./",
+    "RUN npm install",
+    "COPY . .",
+    "RUN npm run build",
+    "",
+    "# Runtime stage: production deps only, runs as the non-root 'node' user.",
+    "FROM node:20-alpine",
+    "ENV NODE_ENV=production",
+    "WORKDIR /app",
+    "COPY package*.json ./",
+    "RUN npm install --omit=dev && npm cache clean --force",
+    "COPY --from=build /app/dist ./dist",
+    "USER node",
+    'CMD ["node", "dist/index.js"]',
+    ""
+  ].join("\n");
+}
+
+// src/emitters/python.ts
+var BANNER = `# Generated by ${GENERATOR_NAME} v${GENERATOR_VERSION}. Safe to edit.`;
+function commentSafe2(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function toPackageModule(serverName) {
+  let mod = serverName.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  if (mod.length === 0) mod = "api_mcp";
+  if (/^[0-9]/.test(mod)) mod = `pkg_${mod}`;
+  return mod;
+}
+function pyprojectToml(name, version, pkg) {
+  return [
+    "[project]",
+    `name = ${JSON.stringify(name)}`,
+    `version = ${JSON.stringify(version)}`,
+    'requires-python = ">=3.10"',
+    'dependencies = ["mcp>=1.2.0", "anyio>=4.0"]',
+    "",
+    "[project.scripts]",
+    `${name} = "${pkg}.__main__:run"`,
+    "",
+    "[build-system]",
+    'requires = ["hatchling"]',
+    'build-backend = "hatchling.build"',
+    "",
+    "[tool.hatch.build.targets.wheel]",
+    `packages = ["${pkg}"]`,
+    ""
+  ].join("\n");
+}
+function gitignorePy() {
+  return ["__pycache__/", "*.pyc", ".venv/", ".env", "dist/", "*.egg-info/", ""].join("\n");
+}
+function initPy() {
+  return `${BANNER}
+"""Generated MCP server package."""
+`;
+}
+function configPy(defaultBaseUrl) {
+  return [
+    BANNER,
+    "import os",
+    "",
+    `BASE_URL = os.environ.get("API_BASE_URL", ${JSON.stringify(defaultBaseUrl)})`,
+    ""
+  ].join("\n");
+}
+function authBlockPy(scheme) {
+  const lines = [];
+  const label = commentSafe2(
+    `${scheme.name} (${scheme.type}${scheme.scheme ? "/" + scheme.scheme : ""})`
+  );
+  lines.push(`    # ${label}`);
+  lines.push(`    if ${JSON.stringify(scheme.name)} in security:`);
+  if (scheme.type === "apiKey") {
+    const env = scheme.envVars[0];
+    const param = scheme.paramName ?? "X-API-Key";
+    lines.push(`        value = os.environ.get(${JSON.stringify(env)})`);
+    lines.push("        if value:");
+    if (scheme.in === "query") {
+      lines.push(`            query[${JSON.stringify(param)}] = value`);
+    } else if (scheme.in === "cookie") {
+      lines.push(
+        `            headers["cookie"] = (headers["cookie"] + "; " if headers.get("cookie") else "") + ${JSON.stringify(
+          param + "="
+        )} + value`
+      );
+    } else {
+      lines.push(`            headers[${JSON.stringify(param)}] = value`);
+    }
+  } else if (scheme.type === "http" && scheme.scheme?.toLowerCase() === "basic") {
+    const [u, p] = scheme.envVars;
+    lines.push(`        user = os.environ.get(${JSON.stringify(u)})`);
+    lines.push(`        password = os.environ.get(${JSON.stringify(p)})`);
+    lines.push("        if user and password:");
+    lines.push('            token = base64.b64encode((user + ":" + password).encode()).decode()');
+    lines.push('            headers["authorization"] = "Basic " + token');
+  } else if (scheme.tokenUrl) {
+    const [id, secret] = scheme.envVars;
+    lines.push(`        client_id = os.environ.get(${JSON.stringify(id)})`);
+    lines.push(`        client_secret = os.environ.get(${JSON.stringify(secret)})`);
+    lines.push("        if client_id and client_secret:");
+    lines.push(
+      `            token = _get_token(${JSON.stringify(scheme.tokenUrl)}, client_id, client_secret)`
+    );
+    lines.push('            headers["authorization"] = "Bearer " + token');
+  } else {
+    const env = scheme.envVars[0];
+    lines.push(`        value = os.environ.get(${JSON.stringify(env)})`);
+    lines.push("        if value:");
+    lines.push('            headers["authorization"] = "Bearer " + value');
+  }
+  return lines;
+}
+function oauthHelperPy() {
+  return [
+    "_token_cache = {}",
+    "",
+    "",
+    "def _get_token(token_url, client_id, client_secret):",
+    "    key = token_url + '|' + client_id",
+    "    cached = _token_cache.get(key)",
+    "    if cached and cached[1] > time.time():",
+    "        return cached[0]",
+    "    data = urllib.parse.urlencode(",
+    '        {"grant_type": "client_credentials", "client_id": client_id, "client_secret": client_secret}',
+    "    ).encode()",
+    "    req = urllib.request.Request(",
+    "        token_url,",
+    "        data=data,",
+    '        headers={"content-type": "application/x-www-form-urlencoded"},',
+    '        method="POST",',
+    "    )",
+    "    with urllib.request.urlopen(req) as resp:",
+    "        payload = json.loads(resp.read().decode())",
+    '    token = payload.get("access_token")',
+    "    if not token:",
+    '        raise RuntimeError("OAuth token response had no access_token")',
+    '    ttl = payload.get("expires_in", 3600)',
+    "    _token_cache[key] = (token, time.time() + ttl - 30)",
+    "    return token",
+    ""
+  ];
+}
+function authPy(schemes) {
+  const body = schemes.flatMap(authBlockPy);
+  const hasOAuth = schemes.some((s) => s.tokenUrl);
+  const imports = hasOAuth ? [
+    "import base64",
+    "import json",
+    "import os",
+    "import time",
+    "import urllib.parse",
+    "import urllib.request"
+  ] : ["import base64", "import os"];
+  return [
+    BANNER,
+    ...imports,
+    "",
+    "",
+    ...hasOAuth ? oauthHelperPy() : [],
+    ...hasOAuth ? [""] : [],
+    "def apply_auth(headers, query, security):",
+    '    """Inject env-backed credentials. Secrets are never embedded."""',
+    ...body.length > 0 ? body : ["    # No security schemes detected on the source API.", "    pass"],
+    ""
+  ].join("\n");
+}
+function httpClientPy() {
+  return [
+    BANNER,
+    "import json",
+    "import urllib.error",
+    "import urllib.parse",
+    "import urllib.request",
+    "",
+    "from .auth import apply_auth",
+    "from .config import BASE_URL",
+    "",
+    "",
+    "def call_operation(plan, args):",
+    "    if not BASE_URL:",
+    '        raise RuntimeError("API base URL is not set. Set API_BASE_URL in the environment.")',
+    '    path = plan["pathTemplate"]',
+    '    for name in plan["pathParams"]:',
+    "        value = args.get(name)",
+    '        encoded = urllib.parse.quote(str(value if value is not None else ""), safe="")',
+    '        path = path.replace("{" + name + "}", encoded)',
+    "    query = {}",
+    '    for name in plan["queryParams"]:',
+    "        value = args.get(name)",
+    "        if value is not None:",
+    "            query[name] = str(value)",
+    "    headers = {}",
+    '    for name in plan["headerParams"]:',
+    "        value = args.get(name)",
+    "        if value is not None:",
+    "            headers[name] = str(value)",
+    "    data = None",
+    '    body_param = plan.get("bodyParam")',
+    "    if body_param and args.get(body_param) is not None:",
+    "        raw = args[body_param]",
+    '        content_type = plan.get("contentType")',
+    '        if content_type and "json" in content_type:',
+    '            headers["content-type"] = "application/json"',
+    "            data = json.dumps(raw).encode()",
+    "        else:",
+    "            if content_type:",
+    '                headers["content-type"] = content_type',
+    "            data = raw.encode() if isinstance(raw, str) else json.dumps(raw).encode()",
+    '    apply_auth(headers, query, plan["security"])',
+    '    url = BASE_URL.rstrip("/") + "/" + path.lstrip("/")',
+    "    if query:",
+    '        url += "?" + urllib.parse.urlencode(query)',
+    '    request = urllib.request.Request(url, data=data, headers=headers, method=plan["method"])',
+    "    try:",
+    "        with urllib.request.urlopen(request) as response:",
+    "            return response.read().decode()",
+    "    except urllib.error.HTTPError as error:",
+    "        detail = error.read().decode()[:800]",
+    '        raise RuntimeError("HTTP " + str(error.code) + ": " + detail)',
+    ""
+  ].join("\n");
+}
+function toolsPy() {
+  return [
+    BANNER,
+    "import json",
+    "import pathlib",
+    "",
+    'TOOLS = json.loads((pathlib.Path(__file__).parent / "tools.json").read_text())',
+    ""
+  ].join("\n");
+}
+function serverPy(name) {
+  return [
+    BANNER,
+    "import mcp.types as types",
+    "from mcp.server.lowlevel import Server",
+    "",
+    "from .http_client import call_operation",
+    "from .tools import TOOLS",
+    "",
+    `server = Server(${JSON.stringify(name)})`,
+    "",
+    "",
+    "@server.list_tools()",
+    "async def list_tools():",
+    "    return [",
+    '        types.Tool(name=t["name"], description=t["description"], inputSchema=t["inputSchema"])',
+    "        for t in TOOLS",
+    "    ]",
+    "",
+    "",
+    "@server.call_tool()",
+    "async def call_tool(name, arguments):",
+    '    tool = next((t for t in TOOLS if t["name"] == name), None)',
+    "    if tool is None:",
+    '        return [types.TextContent(type="text", text="Unknown tool: " + name)]',
+    "    try:",
+    '        text = call_operation(tool["plan"], arguments or {})',
+    '        return [types.TextContent(type="text", text=text)]',
+    "    except Exception as error:  # noqa: BLE001",
+    '        return [types.TextContent(type="text", text="Error: " + str(error))]',
+    ""
+  ].join("\n");
+}
+function mainPy() {
+  return [
+    BANNER,
+    "import anyio",
+    "from mcp.server.stdio import stdio_server",
+    "",
+    "from .server import server",
+    "",
+    "",
+    "async def main():",
+    "    async with stdio_server() as (read_stream, write_stream):",
+    "        await server.run(read_stream, write_stream, server.create_initialization_options())",
+    "",
+    "",
+    "def run():",
+    "    anyio.run(main)",
+    "",
+    "",
+    'if __name__ == "__main__":',
+    "    run()",
+    ""
+  ].join("\n");
+}
+function dockerfilePy(pkg) {
+  return [
+    "FROM python:3.12-slim",
+    "WORKDIR /app",
+    "COPY . .",
+    "RUN pip install --no-cache-dir .",
+    `CMD ["python", "-m", "${pkg}"]`,
+    ""
+  ].join("\n");
+}
+function readmePy(data) {
+  const envLines = data.schemes.flatMap((s) => s.envVars).map((v) => "- `" + v + "`");
+  return [
+    `# ${data.serverName}`,
+    "",
+    `A Python MCP server for **${data.apiTitle}**, generated by ${GENERATOR_NAME}.`,
+    `It exposes ${data.toolCount} tool(s) that call the upstream API directly.`,
+    "",
+    "## Quickstart",
+    "",
+    "```bash",
+    "python -m venv .venv && source .venv/bin/activate",
+    "pip install -e .",
+    "cp .env.example .env   # then fill in values",
+    `python -m ${data.pkg}   # runs over stdio`,
+    "```",
+    "",
+    "## Configuration",
+    "",
+    "- `API_BASE_URL` \u2014 base URL of the upstream API.",
+    ...envLines.length > 0 ? ["", "Credentials:", ...envLines] : [],
+    "",
+    "## Connecting a client",
+    "",
+    "```json",
+    "{",
+    '  "mcpServers": {',
+    `    "${data.serverName}": {`,
+    '      "command": "python",',
+    `      "args": ["-m", "${data.pkg}"],`,
+    '      "env": { "API_BASE_URL": "https://api.example.com" }',
+    "    }",
+    "  }",
+    "}",
+    "```",
+    ""
+  ].join("\n");
+}
+
+// src/emitters/project.ts
+var FileWriter = class {
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  written = [];
+  async write(relPath, content) {
+    const full = path2.join(this.root, relPath);
+    await mkdir(path2.dirname(full), { recursive: true });
+    await writeFile2(full, content, "utf8");
+    this.written.push(relPath);
+  }
+  async writeIfAbsent(relPath, content, force) {
+    if (!force && await exists(path2.join(this.root, relPath))) return false;
+    await this.write(relPath, content);
+    return true;
+  }
+};
+async function exists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isEmptyDir(dir) {
+  try {
+    const entries = await readdir(dir);
+    return entries.length === 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return true;
+    throw err;
+  }
+}
+var MAX_GENERATED_TOOLS = 1e3;
+function assertToolCount(count) {
+  if (count > MAX_GENERATED_TOOLS) {
+    throw new Error(
+      `Refusing to generate ${count} tools (limit ${MAX_GENERATED_TOOLS}). Narrow the spec with includeTags / methods / pathGlob / excludeOperations.`
+    );
+  }
+}
+function toPackageName(title) {
+  const base = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return (base || "api") + "-mcp";
+}
+function operationToToolEmit(op, sourceTitle) {
+  const properties = {};
+  const required = [];
+  for (const p of op.parameters) {
+    const schema = { ...p.schema };
+    if (p.description && !("description" in schema)) schema.description = p.description;
+    properties[p.name] = schema;
+    if (p.required) required.push(p.name);
+  }
+  const pathTokens = [...op.path.matchAll(/\{([^}]+)\}/g)].map((m) => m[1]);
+  for (const token of pathTokens) {
+    if (!(token in properties)) {
+      properties[token] = { type: "string" };
+      if (!required.includes(token)) required.push(token);
+    }
+  }
+  let bodyParam = null;
+  if (op.requestBody) {
+    bodyParam = "body" in properties ? "requestBody" : "body";
+    const bodySchema = { ...op.requestBody.schema };
+    if (op.requestBody.description && !("description" in bodySchema)) {
+      bodySchema.description = op.requestBody.description;
+    }
+    properties[bodyParam] = bodySchema;
+    if (op.requestBody.required) required.push(bodyParam);
+  }
+  const inputSchema = {
+    type: "object",
+    properties,
+    ...required.length > 0 ? { required } : {}
+  };
+  return {
+    name: op.toolName,
+    method: op.method,
+    path: op.path,
+    description: buildDescription(op),
+    inputSchema,
+    sourceTitle,
+    plan: {
+      method: op.method,
+      pathTemplate: op.path,
+      pathParams: pathTokens,
+      queryParams: op.parameters.filter((p) => p.in === "query").map((p) => p.name),
+      headerParams: op.parameters.filter((p) => p.in === "header").map((p) => p.name),
+      cookieParams: op.parameters.filter((p) => p.in === "cookie").map((p) => p.name),
+      bodyParam,
+      contentType: op.requestBody?.contentType ?? null,
+      security: op.security
+    }
+  };
+}
+async function emitShared(fw, serverName, serverVersion, description, servers, schemes, transport, allToolNames, toolCount) {
+  const baseUrl = servers[0] ?? "";
+  await fw.write("package.json", packageJson(serverName, serverVersion, transport));
+  await fw.write("tsconfig.json", tsconfigJson());
+  await fw.write(".gitignore", gitignore());
+  await fw.write(".env.example", envExample(baseUrl, schemes));
+  await fw.write("Dockerfile", dockerfile());
+  await fw.write("server.json", serverJson(serverName, serverVersion, description));
+  await fw.write("client-config.md", clientConfigMd(serverName));
+  await fw.write(
+    "README.md",
+    readmeMd({ serverName, apiTitle: description, toolCount, schemes, transport })
+  );
+  await fw.write("src/types.ts", typesTs());
+  await fw.write("src/config.ts", configTs(baseUrl));
+  await fw.write("src/auth.ts", authTs(schemes));
+  await fw.write("src/http/client.ts", httpClientTs());
+  await fw.write("src/server.ts", serverTs(serverName, serverVersion));
+  await fw.write("src/index.ts", indexStdioTs(serverName));
+  if (transport === "http" || transport === "both") {
+    await fw.write("src/index.http.ts", indexHttpTs(serverName));
+  }
+  await fw.write("src/tools/index.ts", toolsIndexTs(allToolNames));
+}
+function toPyToolRecord(tool) {
+  return {
+    name: tool.name,
+    description: tool.description,
+    inputSchema: tool.inputSchema,
+    plan: tool.plan
+  };
+}
+function pythonToolsJsonPath(serverName) {
+  return `${toPackageModule(serverName)}/tools.json`;
+}
+async function emitPythonShared(fw, serverName, serverVersion, description, servers, schemes, toolCount) {
+  const baseUrl = servers[0] ?? "";
+  const pkg = toPackageModule(serverName);
+  await fw.write("pyproject.toml", pyprojectToml(serverName, serverVersion, pkg));
+  await fw.write(".gitignore", gitignorePy());
+  await fw.write(".env.example", envExample(baseUrl, schemes));
+  await fw.write("Dockerfile", dockerfilePy(pkg));
+  await fw.write("server.json", serverJson(serverName, serverVersion, description));
+  await fw.write(
+    "README.md",
+    readmePy({ serverName, pkg, apiTitle: description, toolCount, schemes })
+  );
+  await fw.write(`${pkg}/__init__.py`, initPy());
+  await fw.write(`${pkg}/config.py`, configPy(baseUrl));
+  await fw.write(`${pkg}/auth.py`, authPy(schemes));
+  await fw.write(`${pkg}/http_client.py`, httpClientPy());
+  await fw.write(`${pkg}/server.py`, serverPy(serverName));
+  await fw.write(`${pkg}/__main__.py`, mainPy());
+  await fw.write(`${pkg}/tools.py`, toolsPy());
+}
+async function generateProject(model, options) {
+  const dir = path2.resolve(options.outputDir);
+  const existingManifest = await readManifest(dir);
+  if (existingManifest && !options.force) {
+    throw new Error(
+      `${dir} is already a generated project. Use extend_mcp_server to add tools, or pass force: true to overwrite.`
+    );
+  }
+  if (!existingManifest && !options.force && !await isEmptyDir(dir)) {
+    throw new Error(`${dir} is not empty. Pass force: true to overwrite.`);
+  }
+  const serverName = options.serverName ?? toPackageName(model.title);
+  const serverVersion = options.serverVersion ?? model.version ?? "0.1.0";
+  const transport = options.transport ?? "stdio";
+  const language = options.language ?? "typescript";
+  const description = model.title + (model.version ? ` (v${model.version})` : "");
+  const { operations, filteredOut } = curate(model, options.filters ?? {});
+  assertToolCount(operations.length);
+  const tools = operations.map((op) => operationToToolEmit(op, model.title));
+  const fw = new FileWriter(dir);
+  if (language === "python") {
+    await emitPythonShared(
+      fw,
+      serverName,
+      serverVersion,
+      description,
+      model.servers,
+      model.securitySchemes,
+      tools.length
+    );
+    await fw.write(
+      pythonToolsJsonPath(serverName),
+      JSON.stringify(tools.map(toPyToolRecord), null, 2) + "\n"
+    );
+  } else {
+    await emitShared(
+      fw,
+      serverName,
+      serverVersion,
+      description,
+      model.servers,
+      model.securitySchemes,
+      transport,
+      tools.map((tool) => tool.name),
+      tools.length
+    );
+    for (const tool of tools) {
+      await fw.write(`src/tools/${tool.name}.ts`, toolFileTs(tool));
+    }
+  }
+  const manifest = {
+    manifestVersion: MANIFEST_VERSION,
+    generator: GENERATOR_NAME,
+    generatorVersion: GENERATOR_VERSION,
+    serverName,
+    serverVersion,
+    description,
+    language,
+    transport,
+    servers: model.servers,
+    securitySchemes: model.securitySchemes,
+    sources: [
+      {
+        format: model.sourceFormat,
+        title: model.title,
+        version: model.version,
+        addedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    ],
+    tools: tools.map(
+      (tool) => ({
+        name: tool.name,
+        method: tool.method,
+        path: tool.path,
+        sourceTitle: tool.sourceTitle
+      })
+    )
+  };
+  await fw.write(MANIFEST_FILENAME, JSON.stringify(manifest, null, 2) + "\n");
+  return {
+    projectDir: dir,
+    serverName,
+    toolsAdded: tools.length,
+    toolsSkipped: filteredOut,
+    totalTools: tools.length,
+    files: fw.written,
+    warnings: toolCountWarnings(tools.length)
+  };
+}
+async function appendToProject(model, options) {
+  const dir = path2.resolve(options.projectDir);
+  const manifest = await readManifest(dir);
+  if (!manifest) {
+    throw new Error(
+      `${dir} has no ${MANIFEST_FILENAME}; it is not a generated project. Use generate_mcp_server instead.`
+    );
+  }
+  if ((manifest.manifestVersion ?? 1) > MANIFEST_VERSION) {
+    throw new Error(
+      `${MANIFEST_FILENAME} is schema version ${manifest.manifestVersion}, newer than this generator supports (${MANIFEST_VERSION}). Upgrade mcp-api-translator.`
+    );
+  }
+  const language = manifest.language ?? "typescript";
+  const servers = [.../* @__PURE__ */ new Set([...manifest.servers, ...model.servers])];
+  const schemeMap = /* @__PURE__ */ new Map();
+  for (const s of manifest.securitySchemes) schemeMap.set(s.name, s);
+  for (const s of model.securitySchemes) if (!schemeMap.has(s.name)) schemeMap.set(s.name, s);
+  const schemes = assignEnvVars([...schemeMap.values()]);
+  const existingKeys = new Set(manifest.tools.map((tool) => operationKey(tool.method, tool.path)));
+  const reserved = new Set(manifest.tools.map((tool) => tool.name));
+  const filtered = applyFilters(model.operations, options.filters ?? {});
+  const newOps = filtered.filter((op) => !existingKeys.has(operationKey(op.method, op.path)));
+  newOps.sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
+  for (const op of newOps) op.toolName = uniqueToolName(op.toolName, reserved);
+  const newTools = newOps.map((op) => operationToToolEmit(op, model.title));
+  const allToolNames = [
+    ...manifest.tools.map((tool) => tool.name),
+    ...newTools.map((tl) => tl.name)
+  ];
+  assertToolCount(allToolNames.length);
+  const fw = new FileWriter(dir);
+  const description = manifest.description ?? manifest.serverName;
+  let skippedFiles = 0;
+  if (language === "python") {
+    const toolsJson = pythonToolsJsonPath(manifest.serverName);
+    let existingRecords;
+    try {
+      existingRecords = JSON.parse(
+        await readFile3(path2.join(dir, toolsJson), "utf8")
+      );
+    } catch {
+      throw new Error(
+        `${path2.join(dir, toolsJson)} is missing or unreadable; cannot extend this Python project.`
+      );
+    }
+    const allRecords = [...existingRecords, ...newTools.map(toPyToolRecord)];
+    await emitPythonShared(
+      fw,
+      manifest.serverName,
+      manifest.serverVersion,
+      description,
+      servers,
+      schemes,
+      allRecords.length
+    );
+    await fw.write(toolsJson, JSON.stringify(allRecords, null, 2) + "\n");
+  } else {
+    await emitShared(
+      fw,
+      manifest.serverName,
+      manifest.serverVersion,
+      description,
+      servers,
+      schemes,
+      manifest.transport,
+      allToolNames,
+      allToolNames.length
+    );
+    for (const tool of newTools) {
+      const wrote = await fw.writeIfAbsent(
+        `src/tools/${tool.name}.ts`,
+        toolFileTs(tool),
+        options.force ?? false
+      );
+      if (!wrote) skippedFiles++;
+    }
+  }
+  const merged = {
+    ...manifest,
+    manifestVersion: MANIFEST_VERSION,
+    generatorVersion: GENERATOR_VERSION,
+    servers,
+    securitySchemes: schemes,
+    sources: [
+      ...manifest.sources,
+      {
+        format: model.sourceFormat,
+        title: model.title,
+        version: model.version,
+        addedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    ],
+    tools: [
+      ...manifest.tools,
+      ...newTools.map(
+        (tool) => ({
+          name: tool.name,
+          method: tool.method,
+          path: tool.path,
+          sourceTitle: tool.sourceTitle
+        })
+      )
+    ]
+  };
+  await fw.write(MANIFEST_FILENAME, JSON.stringify(merged, null, 2) + "\n");
+  return {
+    projectDir: dir,
+    serverName: manifest.serverName,
+    toolsAdded: newTools.length,
+    toolsSkipped: filtered.length - newOps.length + skippedFiles,
+    totalTools: allToolNames.length,
+    files: fw.written,
+    warnings: toolCountWarnings(allToolNames.length)
+  };
+}
+function toolCountWarnings(count) {
+  if (count > TOOL_COUNT_WARN_THRESHOLD) {
+    return [
+      `This server exposes ${count} tools (> ${TOOL_COUNT_WARN_THRESHOLD}). Large tool counts hurt model tool-selection. Consider narrowing with includeTags / methods / pathGlob / excludeOperations.`
+    ];
+  }
+  return [];
+}
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/tools.ts
+import { z } from "zod";
+var sourceShape = {
+  spec: z.string().optional().describe("Inline spec text (OpenAPI or Postman; JSON or YAML)."),
+  specPath: z.string().optional().describe("Path to a local spec file (JSON or YAML)."),
+  format: z.enum(["openapi", "postman", "auto"]).optional().describe("Force a format; defaults to auto-detect.")
+};
+var filterShape = {
+  includeTags: z.array(z.string()).optional().describe("Keep only operations with these tags."),
+  excludeOperations: z.array(z.string()).optional().describe("Drop operations by operationId, tool name, or tag."),
+  methods: z.array(z.string()).optional().describe("Keep only these HTTP methods, e.g. [GET, POST]."),
+  pathGlob: z.string().optional().describe('Keep only matching paths, e.g. "/v1/**".')
+};
+function text(value) {
+  return { content: [{ type: "text", text: value }] };
+}
+function filtersFrom(args) {
+  return {
+    includeTags: args.includeTags,
+    excludeOperations: args.excludeOperations,
+    methods: args.methods,
+    pathGlob: args.pathGlob
+  };
+}
+function sourceFrom(args) {
+  return {
+    spec: args.spec,
+    specPath: args.specPath,
+    format: args.format
+  };
+}
+function summaryText(verb, s) {
+  const lines = [
+    `${verb} MCP server "${s.serverName}" at ${s.projectDir}`,
+    `Tools added: ${s.toolsAdded} | skipped: ${s.toolsSkipped} | total now: ${s.totalTools}`,
+    "",
+    "Files written:",
+    ...s.files.map((f) => `  - ${f}`)
+  ];
+  if (s.warnings.length > 0) lines.push("", "Warnings:", ...s.warnings.map((w) => `  ! ${w}`));
+  lines.push(
+    "",
+    "Next steps:",
+    `  cd ${s.projectDir}`,
+    "  npm install && npm run build",
+    "  cp .env.example .env   # fill in API_BASE_URL and any credentials",
+    "  npm start",
+    "  # See client-config.md to add it to Claude / Cursor / Codex."
+  );
+  return lines.join("\n");
+}
+function registerTools(server) {
+  server.registerTool(
+    "analyze_spec",
+    {
+      title: "Analyze API spec (preview)",
+      description: "Parse an OpenAPI or Postman spec and preview the MCP tools that would be generated, without writing any files. Use this to curate (filter/inspect) before generating.",
+      inputSchema: { ...sourceShape, ...filterShape }
+    },
+    async (args) => {
+      const model = await parseSource(sourceFrom(args));
+      const { operations, filteredOut } = curate(model, filtersFrom(args));
+      const report = {
+        title: model.title,
+        version: model.version,
+        sourceFormat: model.sourceFormat,
+        servers: model.servers,
+        authSchemes: model.securitySchemes.map((s) => ({
+          name: s.name,
+          type: s.type,
+          envVars: s.envVars
+        })),
+        operationsTotal: model.operations.length,
+        operationsKept: operations.length,
+        operationsFilteredOut: filteredOut,
+        proposedTools: operations.map((op) => ({
+          name: op.toolName,
+          method: op.method,
+          path: op.path,
+          summary: op.summary ?? ""
+        }))
+      };
+      const warn = operations.length > TOOL_COUNT_WARN_THRESHOLD ? `
+
+! ${operations.length} tools exceed the ${TOOL_COUNT_WARN_THRESHOLD}-tool guideline; consider includeTags / methods / pathGlob.` : "";
+      return text(JSON.stringify(report, null, 2) + warn);
+    }
+  );
+  server.registerTool(
+    "generate_mcp_server",
+    {
+      title: "Generate MCP server",
+      description: "Generate a complete, runnable TypeScript MCP server project from an OpenAPI or Postman spec. Writes the project to outputDir. Use force to overwrite a non-empty directory.",
+      inputSchema: {
+        ...sourceShape,
+        outputDir: z.string().describe("Directory to write the generated project into."),
+        serverName: z.string().optional().describe("npm/package name; defaults from the API title."),
+        serverVersion: z.string().optional(),
+        language: z.enum(["typescript", "python"]).optional().describe("Output language. Defaults to typescript."),
+        transport: z.enum(["stdio", "http", "both"]).optional().describe("Transport(s) to generate (TypeScript only). Defaults to stdio."),
+        force: z.boolean().optional().describe("Overwrite a non-empty / existing project."),
+        ...filterShape
+      }
+    },
+    async (args) => {
+      const model = await parseSource(sourceFrom(args));
+      const summary = await generateProject(model, {
+        outputDir: args.outputDir,
+        serverName: args.serverName,
+        serverVersion: args.serverVersion,
+        language: args.language,
+        transport: args.transport,
+        force: args.force,
+        filters: filtersFrom(args)
+      });
+      return text(summaryText("Generated", summary));
+    }
+  );
+  server.registerTool(
+    "extend_mcp_server",
+    {
+      title: "Extend an existing generated MCP server",
+      description: "Append the operations from another spec to an already-generated project (identified by its .mcp-translator.json manifest). Idempotent: operations already present are skipped, and hand-edited tool files are preserved unless force is set. Enables aggregating multiple APIs into one MCP server.",
+      inputSchema: {
+        projectDir: z.string().describe("Path to an existing generated project."),
+        ...sourceShape,
+        force: z.boolean().optional().describe("Overwrite existing tool files of the same name."),
+        ...filterShape
+      }
+    },
+    async (args) => {
+      const model = await parseSource(sourceFrom(args));
+      const summary = await appendToProject(model, {
+        projectDir: args.projectDir,
+        force: args.force,
+        filters: filtersFrom(args)
+      });
+      return text(summaryText("Extended", summary));
+    }
+  );
+  server.registerTool(
+    "list_supported_features",
+    {
+      title: "List supported features",
+      description: "Report the input formats, auth schemes, transports, and limits this tool supports.",
+      inputSchema: {}
+    },
+    async () => {
+      const features = {
+        inputFormats: SUPPORTED_FORMATS,
+        outputLanguages: ["typescript", "python"],
+        modes: {
+          generate: "Scaffold an ownable TypeScript MCP-server project (generate_mcp_server).",
+          serve: "Run a live runtime proxy, no codegen: `mcp-api-translator serve --spec <path>` mounts the spec's operations as MCP tools in-process (repeat --spec to aggregate multiple APIs)."
+        },
+        transports: ["stdio", "http", "both"],
+        authSchemes: [
+          "apiKey (header/query/cookie)",
+          "http bearer",
+          "http basic",
+          "oauth2 (client-credentials grant, or pre-obtained token)"
+        ],
+        curation: ["includeTags", "excludeOperations", "methods", "pathGlob"],
+        append: true,
+        toolCountWarnThreshold: TOOL_COUNT_WARN_THRESHOLD,
+        limitations: [
+          "OAuth2 client-credentials grant is supported (token fetched + cached); no interactive authorization-code flows.",
+          "Generated handlers return JSON/text; no upstream streaming or auto-pagination.",
+          "Postman parameter types are inferred from examples.",
+          "Output quality tracks spec quality (operationIds, descriptions)."
+        ]
+      };
+      return text(JSON.stringify(features, null, 2));
+    }
+  );
+}
+
+// src/server.ts
+function createServer() {
+  const server = new McpServer({
+    name: GENERATOR_NAME,
+    version: GENERATOR_VERSION
+  });
+  registerTools(server);
+  return server;
+}
+
+// src/runtime/oauth.ts
+var cache = /* @__PURE__ */ new Map();
+var EARLY_REFRESH_MS = 3e4;
+var DEFAULT_TTL_SECONDS = 3600;
+async function getClientCredentialsToken(tokenUrl, clientId, clientSecret, fetchImpl, now = () => Date.now()) {
+  const key = `${tokenUrl}|${clientId}`;
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt > now()) return hit.token;
+  const body = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: clientId,
+    client_secret: clientSecret
+  }).toString();
+  const response = await fetchImpl(new URL(tokenUrl), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body
+  });
+  const text2 = await response.text();
+  if (!response.ok) {
+    throw new Error(`OAuth token request failed: HTTP ${response.status} ${text2.slice(0, 300)}`);
+  }
+  const json = JSON.parse(text2);
+  if (!json.access_token) throw new Error("OAuth token response had no access_token");
+  const ttl = typeof json.expires_in === "number" ? json.expires_in : DEFAULT_TTL_SECONDS;
+  cache.set(key, { token: json.access_token, expiresAt: now() + ttl * 1e3 - EARLY_REFRESH_MS });
+  return json.access_token;
+}
+
+// src/runtime/client.ts
+function joinUrl(base, path3) {
+  if (!base) throw new Error("API base URL is not set. Set API_BASE_URL in the environment.");
+  return base.replace(/\/+$/, "") + "/" + path3.replace(/^\/+/, "");
+}
+async function applyAuth(headers, url, security, ctx, fetchImpl) {
+  const readEnv = (name) => (ctx.sourceNamespace ? ctx.env[`${ctx.sourceNamespace}_${name}`] : void 0) ?? ctx.env[name];
+  for (const scheme of ctx.securitySchemes) {
+    if (!security.includes(scheme.name)) continue;
+    if (scheme.type === "apiKey") {
+      const value = readEnv(scheme.envVars[0]);
+      if (!value) continue;
+      const param = scheme.paramName ?? "X-API-Key";
+      if (scheme.in === "query") {
+        url.searchParams.set(param, value);
+      } else if (scheme.in === "cookie") {
+        headers["cookie"] = (headers["cookie"] ? headers["cookie"] + "; " : "") + param + "=" + value;
+      } else {
+        headers[param] = value;
+      }
+    } else if (scheme.type === "http" && scheme.scheme?.toLowerCase() === "basic") {
+      const [u, p] = scheme.envVars;
+      const user = readEnv(u);
+      const pass = readEnv(p);
+      if (user && pass) {
+        headers["authorization"] = "Basic " + Buffer.from(user + ":" + pass).toString("base64");
+      }
+    } else if (scheme.tokenUrl) {
+      const clientId = readEnv(scheme.envVars[0]);
+      const clientSecret = readEnv(scheme.envVars[1]);
+      if (clientId && clientSecret) {
+        const token = await getClientCredentialsToken(
+          scheme.tokenUrl,
+          clientId,
+          clientSecret,
+          fetchImpl
+        );
+        headers["authorization"] = "Bearer " + token;
+      }
+    } else {
+      const value = readEnv(scheme.envVars[0]);
+      if (value) headers["authorization"] = "Bearer " + value;
+    }
+  }
+}
+async function executePlan(plan, args, ctx, fetchImpl = fetch) {
+  let path3 = plan.pathTemplate;
+  for (const name of plan.pathParams) {
+    const value = args[name];
+    path3 = path3.split("{" + name + "}").join(encodeURIComponent(String(value ?? "")));
+  }
+  const url = new URL(joinUrl(ctx.baseUrl, path3));
+  for (const name of plan.queryParams) {
+    const value = args[name];
+    if (value === void 0 || value === null) continue;
+    if (Array.isArray(value)) {
+      for (const v of value) {
+        if (v !== void 0 && v !== null) url.searchParams.append(name, String(v));
+      }
+    } else {
+      url.searchParams.set(name, String(value));
+    }
+  }
+  const headers = {};
+  for (const name of plan.headerParams) {
+    const value = args[name];
+    if (value === void 0 || value === null) continue;
+    headers[name] = Array.isArray(value) ? value.map(String).join(",") : String(value);
+  }
+  const cookies = [];
+  for (const name of plan.cookieParams) {
+    const value = args[name];
+    if (value !== void 0 && value !== null) {
+      cookies.push(name + "=" + encodeURIComponent(String(value)));
+    }
+  }
+  if (cookies.length > 0) {
+    headers["cookie"] = (headers["cookie"] ? headers["cookie"] + "; " : "") + cookies.join("; ");
+  }
+  let body;
+  if (plan.bodyParam && args[plan.bodyParam] !== void 0) {
+    const raw = args[plan.bodyParam];
+    if (plan.contentType && plan.contentType.indexOf("json") >= 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(raw);
+    } else {
+      if (plan.contentType) headers["content-type"] = plan.contentType;
+      body = typeof raw === "string" ? raw : JSON.stringify(raw);
+    }
+  }
+  await applyAuth(headers, url, plan.security, ctx, fetchImpl);
+  const response = await fetchImpl(url, { method: plan.method, headers, body });
+  const text2 = await response.text();
+  if (!response.ok) {
+    throw new Error(
+      "HTTP " + response.status + " " + response.statusText + ": " + text2.slice(0, 800)
+    );
+  }
+  return text2;
+}
+
+// src/runtime/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+var ApiProxy = class {
+  tools = /* @__PURE__ */ new Map();
+  /** Curate a model's operations and register them as live tools (deduping names across mounts). */
+  mount(model, filters = {}) {
+    const reserved = new Set(this.tools.keys());
+    const { operations, filteredOut } = curate(model, filters, reserved);
+    const defaultBaseUrl = model.servers[0] ?? "";
+    const sourceNamespace = envNamespace(model.title);
+    const added = [];
+    for (const op of operations) {
+      const emit = operationToToolEmit(op, model.title);
+      this.tools.set(emit.name, {
+        name: emit.name,
+        description: emit.description,
+        inputSchema: emit.inputSchema,
+        plan: emit.plan,
+        defaultBaseUrl,
+        securitySchemes: model.securitySchemes,
+        sourceNamespace
+      });
+      added.push(emit.name);
+    }
+    const warnings = this.tools.size > TOOL_COUNT_WARN_THRESHOLD ? [
+      `This proxy now exposes ${this.tools.size} tools (> ${TOOL_COUNT_WARN_THRESHOLD}). Large tool counts hurt model tool-selection; narrow with includeTags / methods / pathGlob / excludeOperations, or rely on a client that supports dynamic tool discovery (e.g. Tool Search).`
+    ] : [];
+    const envVars = [
+      `${sourceNamespace}_API_BASE_URL`,
+      ...model.securitySchemes.flatMap((s) => s.envVars).map((v) => `${sourceNamespace}_${v}`)
+    ];
+    return {
+      mounted: added.length,
+      filteredOut,
+      toolNames: added,
+      warnings,
+      sourceNamespace,
+      envVars
+    };
+  }
+  /** Tool descriptors for an MCP `tools/list` response. */
+  listTools() {
+    return [...this.tools.values()].map((t) => ({
+      name: t.name,
+      description: t.description,
+      inputSchema: t.inputSchema
+    }));
+  }
+  get size() {
+    return this.tools.size;
+  }
+  /** Execute a mounted tool against the live upstream. */
+  async call(name, args, env, fetchImpl) {
+    const tool = this.tools.get(name);
+    if (!tool) throw new Error(`Unknown tool: ${name}`);
+    const baseUrl = env[`${tool.sourceNamespace}_API_BASE_URL`] ?? env.API_BASE_URL ?? tool.defaultBaseUrl;
+    const ctx = {
+      baseUrl,
+      securitySchemes: tool.securitySchemes,
+      env,
+      sourceNamespace: tool.sourceNamespace
+    };
+    return executePlan(tool.plan, args, ctx, fetchImpl);
+  }
+};
+function createProxyServer() {
+  const proxy = new ApiProxy();
+  const server = new Server(
+    { name: `${GENERATOR_NAME}-proxy`, version: GENERATOR_VERSION },
+    { capabilities: { tools: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: proxy.listTools() }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    try {
+      const text2 = await proxy.call(
+        request.params.name,
+        request.params.arguments ?? {},
+        process.env
+      );
+      return { content: [{ type: "text", text: text2 }] };
+    } catch (err) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "Error: " + (err instanceof Error ? err.message : String(err))
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+  return { server, proxy };
+}
+
+export {
+  validateApiModel,
+  assertValidApiModel,
+  detectFormat,
+  parseSource,
+  SUPPORTED_FORMATS,
+  generateProject,
+  appendToProject,
+  createServer,
+  executePlan,
+  ApiProxy,
+  createProxyServer
+};
+//# sourceMappingURL=chunk-KSWSDM52.js.map