mcp-compress-router 1.5.4 → 1.5.5

package/build/services/discovery.js

@@ -1,6 +1,7 @@
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { getDownstreamTimeoutMs } from '../utils/index.js';
 /** JSON-RPC error code for "Method not found". */
 const METHOD_NOT_FOUND = -32601;
 /**
@@ -21,12 +22,14 @@ function isMethodNotFound(err) {
  * propagated as a connection failure.
  *
  * @param client - A connected MCP client.
+ * @param options - Optional {@link RequestOptions} (e.g. `timeout`)
+ *   forwarded to `client.listTools()`.
  * @returns The list-tools result (possibly empty).
  * @throws Any non-"Method not found" error from `listTools()`.
  */
-export async function listToolsOrEmpty(client) {
+export async function listToolsOrEmpty(client, options) {
     try {
-        return await client.listTools();
+        return await client.listTools(undefined, options);
     }
     catch (err) {
         if (isMethodNotFound(err)) {
@@ -59,9 +62,14 @@ export async function discoverSingleServer(server, logger, getAuthProvider) {
         type: server.type,
     });
     const transport = createTransport(server, getAuthProvider);
+    // Cap the initialize handshake and tools/list call so a server that
+    // accepts the connection but never replies surfaces a clear error
+    // instead of hanging the command indefinitely (the SDK's own default
+    // is 60s; we use a shorter, configurable budget).
+    const requestOptions = { timeout: getDownstreamTimeoutMs() };
     try {
-        await client.connect(transport);
-        const listResult = await listToolsOrEmpty(client);
+        await client.connect(transport, requestOptions);
+        const listResult = await listToolsOrEmpty(client, requestOptions);
         logger.info(`Connected to "${server.name}" — ${listResult.tools.length} tools discovered`, {
             server: server.name,
             toolCount: listResult.tools.length,

package/build/services/oauth-discovery.js

@@ -1,3 +1,4 @@
+import { createTimeoutFetch, getAuthDiscoveryTimeoutMs } from '../utils/index.js';
 /**
  * Discovers OAuth metadata for a downstream MCP server following the
  * MCP 2025-06-18 authorization spec two-step flow:
@@ -29,6 +30,10 @@
  */
 export async function discoverAuth(serverUrl) {
     const { discoverOAuthProtectedResourceMetadata, discoverAuthorizationServerMetadata } = await import('@modelcontextprotocol/sdk/client/auth.js');
+    // The SDK discovery helpers use a raw fetch with no timeout; a server
+    // that hangs its well-known endpoint would trap discovery forever. Pass
+    // a fetch that aborts after a short, configurable budget.
+    const fetchFn = createTimeoutFetch(getAuthDiscoveryTimeoutMs());
     // Tracks the last error seen across all candidates so the caller can be
     // notified when discovery failed entirely (vs. cleanly finding nothing).
     let lastError;
@@ -36,7 +41,7 @@ export async function discoverAuth(serverUrl) {
     // recorded and treated as "not found" so the next candidate is tried.
     const safeDiscoverAs = async (url) => {
         try {
-            return await discoverAuthorizationServerMetadata(url);
+            return await discoverAuthorizationServerMetadata(url, { fetchFn });
         }
         catch (err) {
             lastError = err;
@@ -49,7 +54,7 @@ export async function discoverAuth(serverUrl) {
     // legacy-server path, not a probe failure.
     let resourceMetadata;
     try {
-        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl);
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, fetchFn);
     }
     catch {
         // No PRM published; fall through to direct AS discovery below.

package/build/services/server-connection.js

@@ -3,6 +3,7 @@ import { createTransport, listToolsOrEmpty } from './discovery.js';
 import { OAuthCredentialManager } from './oauth.js';
 import { saveToolCache, loadToolCache } from './tool-cache.js';
 import { isAuthError } from './index.js';
+import { getDownstreamTimeoutMs } from '../utils/index.js';
 /**
  * 30-second cooldown after a failed reconnect attempt. Subsequent
  * `invokeWithRecovery` calls within this window return the cached
@@ -218,8 +219,12 @@ export class ServerConnection {
             ? (_s) => this.authProvider
             : undefined;
         const transport = createTransport(this.server, getAuthProvider);
-        await this.client.connect(transport);
-        const listResult = await listToolsOrEmpty(this.client);
+        // Cap the initialize handshake and tools/list call so a hung
+        // downstream server fails fast instead of stalling startup (or
+        // self-recovery) for the SDK's 60s default.
+        const requestOptions = { timeout: getDownstreamTimeoutMs() };
+        await this.client.connect(transport, requestOptions);
+        const listResult = await listToolsOrEmpty(this.client, requestOptions);
         return listResult.tools.map((t) => ({
             name: t.name,
             description: t.description,

package/build/utils/index.js

@@ -6,3 +6,4 @@ export { expandEnvField } from './expand-env.js';
 export { Logger } from './logger.js';
 export { parseJsonc } from './parse-jsonc.js';
 export { VALID_COMPRESSION_LEVELS, isCompressionLevel } from './compression-level.js';
+export { getDownstreamTimeoutMs, getAuthDiscoveryTimeoutMs, createTimeoutFetch, } from './timeout.js';

package/build/utils/timeout.js

@@ -0,0 +1,75 @@
+import process from 'node:process';
+/**
+ * Default timeout (ms) for a downstream server's `initialize` request and
+ * `tools/list` call during discovery. The MCP SDK's own default is 60s;
+ * we cap these fast handshake operations sooner so a server that accepts
+ * the TCP/TLS connection but never replies (a real-world hang observed on
+ * some Streamable HTTP servers behind CDNs) surfaces a clear error instead
+ * of blocking the `tools` command or router startup indefinitely.
+ *
+ * @internal Exported for tests only; not part of the public module API.
+ */
+export const DEFAULT_DOWNSTREAM_TIMEOUT_MS = 30_000;
+/**
+ * Default timeout (ms) for OAuth metadata discovery probes (RFC 9728 /
+ * RFC 8414 well-known endpoint fetches). These are best-effort probes;
+ * a server that hangs its well-known endpoint must not stall startup.
+ *
+ * @internal Exported for tests only; not part of the public module API.
+ */
+export const DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS = 10_000;
+/**
+ * Reads a positive-integer environment variable, returning `undefined`
+ * when unset or invalid (non-integer or non-positive). Invalid values
+ * silently fall back to the default rather than aborting startup.
+ */
+function readPositiveIntEnv(name) {
+    const raw = process.env[name];
+    if (raw === undefined) {
+        return undefined;
+    }
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value <= 0) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Resolves the downstream connect/listTools timeout in milliseconds.
+ * Override with `MCP_COMPRESS_ROUTER_DOWNSTREAM_TIMEOUT_MS` (a positive
+ * integer); invalid values fall back to
+ * {@link DEFAULT_DOWNSTREAM_TIMEOUT_MS}.
+ */
+export function getDownstreamTimeoutMs() {
+    return (readPositiveIntEnv('MCP_COMPRESS_ROUTER_DOWNSTREAM_TIMEOUT_MS') ?? DEFAULT_DOWNSTREAM_TIMEOUT_MS);
+}
+/**
+ * Resolves the OAuth discovery probe timeout in milliseconds. Override
+ * with `MCP_COMPRESS_ROUTER_AUTH_DISCOVERY_TIMEOUT_MS` (a positive
+ * integer); invalid values fall back to
+ * {@link DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS}.
+ */
+export function getAuthDiscoveryTimeoutMs() {
+    return (readPositiveIntEnv('MCP_COMPRESS_ROUTER_AUTH_DISCOVERY_TIMEOUT_MS') ??
+        DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS);
+}
+/**
+ * Wraps the global `fetch` so each request aborts after `timeoutMs`.
+ * The caller's own `init.signal` (if any) is honored alongside the
+ * timeout signal via `AbortSignal.any`.
+ *
+ * Used to add a request-level timeout to SDK helpers (OAuth metadata
+ * discovery) that accept a custom `fetchFn` but expose no timeout option
+ * of their own — without it, a server that hangs the well-known endpoint
+ * traps discovery forever.
+ *
+ * @param timeoutMs - Per-request timeout in milliseconds.
+ * @returns A fetch-compatible function that aborts on timeout.
+ */
+export function createTimeoutFetch(timeoutMs) {
+    return (input, init) => {
+        const timeoutSignal = AbortSignal.timeout(timeoutMs);
+        const signal = init?.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
+        return fetch(input, { ...init, signal });
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-compress-router",
-  "version": "1.5.4",
+  "version": "1.5.5",
   "description": "Compress all connected MCP servers into a single router MCP to save tokens",
   "license": "MIT",
   "type": "module",