mcp-compress-router 1.5.4 → 1.5.6

package/build/cli/router-runner.js

@@ -112,11 +112,29 @@ export async function runRouter(configPath, verbose) {
     logger.info('Loading configuration', { path: resolved });
     const servers = await loadConfig(resolved);
     logger.info('Configuration loaded', { serverCount: servers.length });
-    await persistAuthRequirements(resolved, servers, logger);
+    // Refresh the cached OAuth auth requirements CONCURRENTLY with the
+    // downstream connects. Both phases are network-bound, so running them
+    // sequentially would stack their worst-case latencies; in parallel the
+    // startup time is bounded by the slower of the two — and each default
+    // timeout (see timeout.ts) stays well below the 30 s startup budget
+    // most MCP hosts allow, so even a hung server cannot blow it.
+    // `Promise.allSettled` avoids unhandled rejections when both phases
+    // fail; the connect failure is surfaced first because it is the one
+    // the host needs to act on.
     logger.info('Connecting to downstream servers', {
         servers: servers.map((s) => s.name),
     });
-    const { connections, discovered } = await connectAllServers(servers, resolved, logger);
+    const [authRefresh, connectResult] = await Promise.allSettled([
+        persistAuthRequirements(resolved, servers, logger),
+        connectAllServers(servers, resolved, logger),
+    ]);
+    if (connectResult.status === 'rejected') {
+        throw connectResult.reason;
+    }
+    if (authRefresh.status === 'rejected') {
+        throw authRefresh.reason;
+    }
+    const { connections, discovered } = connectResult.value;
     logger.info('Tools discovered', {
         servers: discovered.map((d) => ({
             name: d.name,

package/build/services/discovery.js

@@ -1,6 +1,7 @@
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { getDownstreamTimeoutMs } from '../utils/index.js';
 /** JSON-RPC error code for "Method not found". */
 const METHOD_NOT_FOUND = -32601;
 /**
@@ -21,12 +22,14 @@ function isMethodNotFound(err) {
  * propagated as a connection failure.
  *
  * @param client - A connected MCP client.
+ * @param options - Optional {@link RequestOptions} (e.g. `timeout`)
+ *   forwarded to `client.listTools()`.
  * @returns The list-tools result (possibly empty).
  * @throws Any non-"Method not found" error from `listTools()`.
  */
-export async function listToolsOrEmpty(client) {
+export async function listToolsOrEmpty(client, options) {
     try {
-        return await client.listTools();
+        return await client.listTools(undefined, options);
     }
     catch (err) {
         if (isMethodNotFound(err)) {
@@ -59,9 +62,14 @@ export async function discoverSingleServer(server, logger, getAuthProvider) {
         type: server.type,
     });
     const transport = createTransport(server, getAuthProvider);
+    // Cap the initialize handshake and tools/list call so a server that
+    // accepts the connection but never replies surfaces a clear error
+    // instead of hanging the command indefinitely (the SDK's own default
+    // is 60s; we use a shorter, configurable budget).
+    const requestOptions = { timeout: getDownstreamTimeoutMs() };
     try {
-        await client.connect(transport);
-        const listResult = await listToolsOrEmpty(client);
+        await client.connect(transport, requestOptions);
+        const listResult = await listToolsOrEmpty(client, requestOptions);
         logger.info(`Connected to "${server.name}" — ${listResult.tools.length} tools discovered`, {
             server: server.name,
             toolCount: listResult.tools.length,

package/build/services/oauth-discovery.js

@@ -1,3 +1,60 @@
+import { createTimeoutFetch, getAuthDiscoveryTimeoutMs } from '../utils/index.js';
+/**
+ * Returns true when the thrown error means an endpoint responded with a
+ * body that is not JSON (e.g. an HTML page, an SPA catch-all route, or a
+ * proxy error page). The SDK parses well-known metadata with
+ * `response.json()`, which throws `SyntaxError` on invalid JSON.
+ *
+ * Such a response is a server's way of saying "no OAuth metadata here",
+ * not a probe failure: the endpoint answered, it just is not an OAuth
+ * metadata endpoint. These misses must not surface as errors — a plain
+ * web page at the well-known path means the server publishes no OAuth
+ * metadata (auth requirement `'none'`), not that probing is broken.
+ *
+ * @param err - The thrown value from an SDK discovery helper.
+ * @returns True when the error is a JSON parse failure.
+ */
+function isNonJsonResponse(err) {
+    return err instanceof SyntaxError;
+}
+/**
+ * Converts a raw `authorization_servers` string into a URL. Returns
+ * `undefined` for malformed entries so a broken PRM advertisement is
+ * skipped like any other failed candidate instead of aborting discovery.
+ *
+ * @param value - The advertised authorization server URL string.
+ * @returns The parsed URL, or `undefined` when malformed.
+ */
+function toUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Races every candidate probe in parallel and resolves with the first
+ * candidate that finds metadata. Candidates that miss (or error) are
+ * treated as rejections, so a hung endpoint on one candidate can never
+ * delay a hit found by another candidate.
+ *
+ * @param urls - The candidate URLs to probe.
+ * @param probe - The per-candidate probe callback (never throws).
+ * @returns The first hit, or `undefined` when every candidate missed.
+ */
+async function raceCandidates(urls, probe) {
+    if (urls.length === 0) {
+        return undefined;
+    }
+    return Promise.any(urls.map(async (url) => {
+        const metadata = await probe(url);
+        if (!metadata) {
+            throw new Error(`No OAuth metadata at ${url.href}`);
+        }
+        return { url, metadata };
+    })).catch(() => undefined);
+}
 /**
  * Discovers OAuth metadata for a downstream MCP server following the
  * MCP 2025-06-18 authorization spec two-step flow:
@@ -11,35 +68,50 @@
  * AS), discovery falls back to the server URL and, if that URL has a path,
  * its origin root.
  *
- * All per-candidate discovery errors are swallowed and treated as "not
- * found" so a single flaky endpoint never aborts the whole flow — discovery
- * falls through to the next candidate. When no metadata is found anywhere
- * AND at least one candidate threw, the last error is re-thrown so callers
- * can distinguish a clean "no OAuth published" (all 404s) from an actual
- * server/network failure (e.g. the auth probe reports `'unknown'`, the
- * login command throws a guided error).
+ * The candidates of each group are probed **in parallel** and the first
+ * hit wins, so a hung well-known endpoint on one candidate never delays
+ * discovery of another. PRM-advertised AS URLs are preferred over the
+ * legacy fallback candidates (the fallback group is only probed when no
+ * advertised AS yields metadata).
+ *
+ * A candidate that responds with a non-JSON body (e.g. HTML) is treated as
+ * "not an OAuth endpoint" — a clean miss, not a probe failure. All other
+ * per-candidate errors (5xx, network, timeout) are swallowed and treated as
+ * "not found" so a single flaky endpoint never aborts the whole flow.
+ * When no metadata is found anywhere AND at least one candidate threw a
+ * genuine error, the last such error is re-thrown so callers can
+ * distinguish a clean "no OAuth published" (all 404s / non-JSON) from an
+ * actual server/network failure (e.g. the auth probe reports `'unknown'`,
+ * the login command throws a guided error).
  *
  * @param serverUrl - The downstream MCP server URL to discover auth for.
  * @returns The discovered resource and/or server metadata plus the AS URL
  *   that yielded the metadata. `serverMetadata` is `undefined` when no OAuth
  *   endpoints could be discovered.
  * @throws The last discovery error when no metadata was found and at least
- *   one candidate endpoint errored. Clean "not found" (all 404s) does not
- *   throw.
+ *   one candidate endpoint errored. Clean "not found" (all 404s or
+ *   non-JSON responses) does not throw.
  */
 export async function discoverAuth(serverUrl) {
     const { discoverOAuthProtectedResourceMetadata, discoverAuthorizationServerMetadata } = await import('@modelcontextprotocol/sdk/client/auth.js');
-    // Tracks the last error seen across all candidates so the caller can be
-    // notified when discovery failed entirely (vs. cleanly finding nothing).
+    // The SDK discovery helpers use a raw fetch with no timeout; a server
+    // that hangs its well-known endpoint would trap discovery forever. Pass
+    // a fetch that aborts after a short, configurable budget.
+    const fetchFn = createTimeoutFetch(getAuthDiscoveryTimeoutMs());
+    // Tracks the last genuine error seen across all candidates so the caller
+    // can be notified when discovery failed entirely (vs. cleanly finding
+    // nothing). Non-JSON responses are excluded — they are clean misses.
     let lastError;
     // Tolerant AS discovery: any error (404-as-throw, 5xx, network) is
-    // recorded and treated as "not found" so the next candidate is tried.
+    // recorded and treated as "not found" so the other candidates are tried.
     const safeDiscoverAs = async (url) => {
         try {
-            return await discoverAuthorizationServerMetadata(url);
+            return await discoverAuthorizationServerMetadata(url, { fetchFn });
         }
         catch (err) {
-            lastError = err;
+            if (!isNonJsonResponse(err)) {
+                lastError = err;
+            }
             return undefined;
         }
     };
@@ -49,37 +121,41 @@ export async function discoverAuth(serverUrl) {
     // legacy-server path, not a probe failure.
     let resourceMetadata;
     try {
-        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl);
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, fetchFn);
     }
     catch {
         // No PRM published; fall through to direct AS discovery below.
     }
-    // Step 2: AS metadata at each advertised authorization server.
-    if (resourceMetadata?.authorization_servers?.length) {
-        for (const asUrlString of resourceMetadata.authorization_servers) {
-            const asUrl = new URL(asUrlString);
-            const metadata = await safeDiscoverAs(asUrl);
-            if (metadata) {
-                return { resourceMetadata, serverMetadata: metadata, authorizationServerUrl: asUrl };
-            }
-        }
-    }
-    // Legacy fallback: direct AS discovery at the server URL, then its origin
-    // root (for servers that host AS metadata at the root with the MCP endpoint
-    // on a subpath and no PRM).
-    const candidates = [serverUrl];
+    // Step 2: probe the candidates in parallel, first hit wins. Advertised
+    // AS URLs take precedence; the legacy fallback group (the server URL
+    // and, for subpath URLs, its origin root) is only probed when no
+    // advertised AS yields metadata.
+    const advertisedUrls = (resourceMetadata?.authorization_servers ?? [])
+        .map((value) => toUrl(value))
+        .filter((url) => url !== undefined);
+    const fallbackUrls = [serverUrl];
     if (serverUrl.pathname !== '/') {
-        candidates.push(new URL(serverUrl.origin));
+        fallbackUrls.push(new URL(serverUrl.origin));
     }
-    for (const candidate of candidates) {
-        const metadata = await safeDiscoverAs(candidate);
-        if (metadata) {
-            return { resourceMetadata, serverMetadata: metadata, authorizationServerUrl: candidate };
-        }
+    const advertisedHit = await raceCandidates(advertisedUrls, safeDiscoverAs);
+    if (advertisedHit) {
+        return {
+            resourceMetadata,
+            serverMetadata: advertisedHit.metadata,
+            authorizationServerUrl: advertisedHit.url,
+        };
+    }
+    const fallbackHit = await raceCandidates(fallbackUrls, safeDiscoverAs);
+    if (fallbackHit) {
+        return {
+            resourceMetadata,
+            serverMetadata: fallbackHit.metadata,
+            authorizationServerUrl: fallbackHit.url,
+        };
     }
     // No metadata found anywhere. If any candidate actually errored (vs. a
-    // clean 404), surface that so callers can report a probe failure rather
-    // than a misleading "no OAuth supported".
+    // clean 404 or a non-JSON response), surface that so callers can report
+    // a probe failure rather than a misleading "no OAuth supported".
     if (lastError !== undefined) {
         throw lastError;
     }

package/build/services/server-connection.js

@@ -3,6 +3,7 @@ import { createTransport, listToolsOrEmpty } from './discovery.js';
 import { OAuthCredentialManager } from './oauth.js';
 import { saveToolCache, loadToolCache } from './tool-cache.js';
 import { isAuthError } from './index.js';
+import { getDownstreamTimeoutMs } from '../utils/index.js';
 /**
  * 30-second cooldown after a failed reconnect attempt. Subsequent
  * `invokeWithRecovery` calls within this window return the cached
@@ -218,8 +219,12 @@ export class ServerConnection {
             ? (_s) => this.authProvider
             : undefined;
         const transport = createTransport(this.server, getAuthProvider);
-        await this.client.connect(transport);
-        const listResult = await listToolsOrEmpty(this.client);
+        // Cap the initialize handshake and tools/list call so a hung
+        // downstream server fails fast instead of stalling startup (or
+        // self-recovery) for the SDK's 60s default.
+        const requestOptions = { timeout: getDownstreamTimeoutMs() };
+        await this.client.connect(transport, requestOptions);
+        const listResult = await listToolsOrEmpty(this.client, requestOptions);
         return listResult.tools.map((t) => ({
             name: t.name,
             description: t.description,

package/build/utils/index.js

@@ -6,3 +6,4 @@ export { expandEnvField } from './expand-env.js';
 export { Logger } from './logger.js';
 export { parseJsonc } from './parse-jsonc.js';
 export { VALID_COMPRESSION_LEVELS, isCompressionLevel } from './compression-level.js';
+export { getDownstreamTimeoutMs, getAuthDiscoveryTimeoutMs, createTimeoutFetch, } from './timeout.js';

package/build/utils/timeout.js

@@ -0,0 +1,84 @@
+import process from 'node:process';
+/**
+ * Default timeout (ms) for a downstream server's `initialize` request and
+ * `tools/list` call during discovery. The MCP SDK's own default is 60s;
+ * we cap these fast handshake operations sooner so a server that accepts
+ * the TCP/TLS connection but never replies (a real-world hang observed on
+ * some Streamable HTTP servers behind CDNs) surfaces a clear error instead
+ * of blocking the `tools` command or router startup indefinitely.
+ *
+ * The value is deliberately kept well below the 30 s startup budget most
+ * MCP hosts allow: downstream connects run in parallel, so a single
+ * timed-out server costs exactly this budget, and the OAuth metadata
+ * probes run concurrently with the connects (see `runRouter`), keeping
+ * worst-case startup around 10 s even when a server hangs.
+ *
+ * @internal Exported for tests only; not part of the public module API.
+ */
+export const DEFAULT_DOWNSTREAM_TIMEOUT_MS = 10_000;
+/**
+ * Default timeout (ms) for OAuth metadata discovery probes (RFC 9728 /
+ * RFC 8414 well-known endpoint fetches). These are best-effort probes;
+ * a server that hangs its well-known endpoint must not stall startup.
+ * At startup the probes run concurrently with the downstream connects
+ * and the per-server candidates are probed in parallel, so this budget
+ * is a per-request cap rather than a serialized startup cost.
+ *
+ * @internal Exported for tests only; not part of the public module API.
+ */
+export const DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS = 5_000;
+/**
+ * Reads a positive-integer environment variable, returning `undefined`
+ * when unset or invalid (non-integer or non-positive). Invalid values
+ * silently fall back to the default rather than aborting startup.
+ */
+function readPositiveIntEnv(name) {
+    const raw = process.env[name];
+    if (raw === undefined) {
+        return undefined;
+    }
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value <= 0) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Resolves the downstream connect/listTools timeout in milliseconds.
+ * Override with `MCP_COMPRESS_ROUTER_DOWNSTREAM_TIMEOUT_MS` (a positive
+ * integer); invalid values fall back to
+ * {@link DEFAULT_DOWNSTREAM_TIMEOUT_MS}.
+ */
+export function getDownstreamTimeoutMs() {
+    return (readPositiveIntEnv('MCP_COMPRESS_ROUTER_DOWNSTREAM_TIMEOUT_MS') ?? DEFAULT_DOWNSTREAM_TIMEOUT_MS);
+}
+/**
+ * Resolves the OAuth discovery probe timeout in milliseconds. Override
+ * with `MCP_COMPRESS_ROUTER_AUTH_DISCOVERY_TIMEOUT_MS` (a positive
+ * integer); invalid values fall back to
+ * {@link DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS}.
+ */
+export function getAuthDiscoveryTimeoutMs() {
+    return (readPositiveIntEnv('MCP_COMPRESS_ROUTER_AUTH_DISCOVERY_TIMEOUT_MS') ??
+        DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS);
+}
+/**
+ * Wraps the global `fetch` so each request aborts after `timeoutMs`.
+ * The caller's own `init.signal` (if any) is honored alongside the
+ * timeout signal via `AbortSignal.any`.
+ *
+ * Used to add a request-level timeout to SDK helpers (OAuth metadata
+ * discovery) that accept a custom `fetchFn` but expose no timeout option
+ * of their own — without it, a server that hangs the well-known endpoint
+ * traps discovery forever.
+ *
+ * @param timeoutMs - Per-request timeout in milliseconds.
+ * @returns A fetch-compatible function that aborts on timeout.
+ */
+export function createTimeoutFetch(timeoutMs) {
+    return (input, init) => {
+        const timeoutSignal = AbortSignal.timeout(timeoutMs);
+        const signal = init?.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
+        return fetch(input, { ...init, signal });
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-compress-router",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "Compress all connected MCP servers into a single router MCP to save tokens",
   "license": "MIT",
   "type": "module",