mcp-compress-router 1.5.5 → 1.6.0

package/build/cli/router-runner.js

@@ -112,11 +112,29 @@ export async function runRouter(configPath, verbose) {
     logger.info('Loading configuration', { path: resolved });
     const servers = await loadConfig(resolved);
     logger.info('Configuration loaded', { serverCount: servers.length });
-    await persistAuthRequirements(resolved, servers, logger);
+    // Refresh the cached OAuth auth requirements CONCURRENTLY with the
+    // downstream connects. Both phases are network-bound, so running them
+    // sequentially would stack their worst-case latencies; in parallel the
+    // startup time is bounded by the slower of the two — and each default
+    // timeout (see timeout.ts) stays well below the 30 s startup budget
+    // most MCP hosts allow, so even a hung server cannot blow it.
+    // `Promise.allSettled` avoids unhandled rejections when both phases
+    // fail; the connect failure is surfaced first because it is the one
+    // the host needs to act on.
     logger.info('Connecting to downstream servers', {
         servers: servers.map((s) => s.name),
     });
-    const { connections, discovered } = await connectAllServers(servers, resolved, logger);
+    const [authRefresh, connectResult] = await Promise.allSettled([
+        persistAuthRequirements(resolved, servers, logger),
+        connectAllServers(servers, resolved, logger),
+    ]);
+    if (connectResult.status === 'rejected') {
+        throw connectResult.reason;
+    }
+    if (authRefresh.status === 'rejected') {
+        throw authRefresh.reason;
+    }
+    const { connections, discovered } = connectResult.value;
     logger.info('Tools discovered', {
         servers: discovered.map((d) => ({
             name: d.name,

package/build/services/dedicated-fetch.js

@@ -0,0 +1,49 @@
+import { Agent, fetch as undiciFetch } from 'undici';
+/**
+ * Max concurrent connections per origin for the dedicated agent behind a
+ * Streamable HTTP transport. MUST be greater than one: the MCP streamable
+ * HTTP spec keeps a long-lived GET SSE stream open while POSTing
+ * messages, and a single-connection pool would deadlock — the SSE holds
+ * the only socket and every message POST queues behind it forever.
+ * Four connections cover the SSE stream plus concurrent message POSTs and
+ * the occasional session DELETE without sharing a pool with other
+ * servers.
+ */
+const DEDICATED_FETCH_CONNECTIONS = 4;
+/**
+ * Idle timeout (ms) for sockets owned by a dedicated agent. Kept short so
+ * sockets from a closed transport drain within a second instead of
+ * holding the process alive at undici's default 4 s keep-alive.
+ */
+const DEDICATED_FETCH_KEEP_ALIVE_MS = 1_000;
+/**
+ * Builds a fetch implementation backed by a dedicated undici `Agent`.
+ *
+ * Every `StreamableHTTPClientTransport` gets its own agent, so all of a
+ * downstream server's traffic — the SSE stream and the message POSTs —
+ * runs on connections drawn from a private pool for that transport
+ * instead of the shared default fetch pool. This isolates one server's
+ * connections from the OAuth metadata probes and from every other
+ * server: a probe or another server can never reuse a socket that
+ * belongs to this transport (and a connection-sensitive downstream or
+ * proxy never sees unrelated requests on the same TCP connection).
+ *
+ * The agent is intentionally left open-ended: it keeps per-origin
+ * keep-alive sockets that drain after {@link DEDICATED_FETCH_KEEP_ALIVE_MS}
+ * (the router force-exits on shutdown, so no explicit close is needed).
+ *
+ * @returns A fetch-compatible function for the caller's transport.
+ */
+export function createDedicatedFetch() {
+    const agent = new Agent({
+        connections: DEDICATED_FETCH_CONNECTIONS,
+        keepAliveTimeout: DEDICATED_FETCH_KEEP_ALIVE_MS,
+    });
+    return (url, init) => undiciFetch(url, {
+        // undici v8's `RequestInit`/`Response` and the global fetch types come
+        // from different type generations (TS 7 ArrayBuffer variance), so the
+        // bridge casts below are required; the runtime objects are identical.
+        ...init,
+        dispatcher: agent,
+    });
+}

package/build/services/discovery.js

@@ -2,6 +2,7 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { getDownstreamTimeoutMs } from '../utils/index.js';
+import { createDedicatedFetch } from './dedicated-fetch.js';
 /** JSON-RPC error code for "Method not found". */
 const METHOD_NOT_FOUND = -32601;
 /**
@@ -131,5 +132,8 @@ export function createTransport(server, getAuthProvider) {
     return new StreamableHTTPClientTransport(new URL(server.url), {
         requestInit: Object.keys(requestInit).length > 0 ? requestInit : undefined,
         authProvider,
+        // Route all of this server's traffic through its own undici agent so
+        // it uses a private connection pool instead of the shared default one.
+        fetch: createDedicatedFetch(),
     });
 }

package/build/services/oauth-discovery.js

@@ -1,4 +1,60 @@
 import { createTimeoutFetch, getAuthDiscoveryTimeoutMs } from '../utils/index.js';
+/**
+ * Returns true when the thrown error means an endpoint responded with a
+ * body that is not JSON (e.g. an HTML page, an SPA catch-all route, or a
+ * proxy error page). The SDK parses well-known metadata with
+ * `response.json()`, which throws `SyntaxError` on invalid JSON.
+ *
+ * Such a response is a server's way of saying "no OAuth metadata here",
+ * not a probe failure: the endpoint answered, it just is not an OAuth
+ * metadata endpoint. These misses must not surface as errors — a plain
+ * web page at the well-known path means the server publishes no OAuth
+ * metadata (auth requirement `'none'`), not that probing is broken.
+ *
+ * @param err - The thrown value from an SDK discovery helper.
+ * @returns True when the error is a JSON parse failure.
+ */
+function isNonJsonResponse(err) {
+    return err instanceof SyntaxError;
+}
+/**
+ * Converts a raw `authorization_servers` string into a URL. Returns
+ * `undefined` for malformed entries so a broken PRM advertisement is
+ * skipped like any other failed candidate instead of aborting discovery.
+ *
+ * @param value - The advertised authorization server URL string.
+ * @returns The parsed URL, or `undefined` when malformed.
+ */
+function toUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Races every candidate probe in parallel and resolves with the first
+ * candidate that finds metadata. Candidates that miss (or error) are
+ * treated as rejections, so a hung endpoint on one candidate can never
+ * delay a hit found by another candidate.
+ *
+ * @param urls - The candidate URLs to probe.
+ * @param probe - The per-candidate probe callback (never throws).
+ * @returns The first hit, or `undefined` when every candidate missed.
+ */
+async function raceCandidates(urls, probe) {
+    if (urls.length === 0) {
+        return undefined;
+    }
+    return Promise.any(urls.map(async (url) => {
+        const metadata = await probe(url);
+        if (!metadata) {
+            throw new Error(`No OAuth metadata at ${url.href}`);
+        }
+        return { url, metadata };
+    })).catch(() => undefined);
+}
 /**
  * Discovers OAuth metadata for a downstream MCP server following the
  * MCP 2025-06-18 authorization spec two-step flow:
@@ -12,21 +68,29 @@ import { createTimeoutFetch, getAuthDiscoveryTimeoutMs } from '../utils/index.js
  * AS), discovery falls back to the server URL and, if that URL has a path,
  * its origin root.
  *
- * All per-candidate discovery errors are swallowed and treated as "not
- * found" so a single flaky endpoint never aborts the whole flow — discovery
- * falls through to the next candidate. When no metadata is found anywhere
- * AND at least one candidate threw, the last error is re-thrown so callers
- * can distinguish a clean "no OAuth published" (all 404s) from an actual
- * server/network failure (e.g. the auth probe reports `'unknown'`, the
- * login command throws a guided error).
+ * The candidates of each group are probed **in parallel** and the first
+ * hit wins, so a hung well-known endpoint on one candidate never delays
+ * discovery of another. PRM-advertised AS URLs are preferred over the
+ * legacy fallback candidates (the fallback group is only probed when no
+ * advertised AS yields metadata).
+ *
+ * A candidate that responds with a non-JSON body (e.g. HTML) is treated as
+ * "not an OAuth endpoint" — a clean miss, not a probe failure. All other
+ * per-candidate errors (5xx, network, timeout) are swallowed and treated as
+ * "not found" so a single flaky endpoint never aborts the whole flow.
+ * When no metadata is found anywhere AND at least one candidate threw a
+ * genuine error, the last such error is re-thrown so callers can
+ * distinguish a clean "no OAuth published" (all 404s / non-JSON) from an
+ * actual server/network failure (e.g. the auth probe reports `'unknown'`,
+ * the login command throws a guided error).
  *
  * @param serverUrl - The downstream MCP server URL to discover auth for.
  * @returns The discovered resource and/or server metadata plus the AS URL
  *   that yielded the metadata. `serverMetadata` is `undefined` when no OAuth
  *   endpoints could be discovered.
  * @throws The last discovery error when no metadata was found and at least
- *   one candidate endpoint errored. Clean "not found" (all 404s) does not
- *   throw.
+ *   one candidate endpoint errored. Clean "not found" (all 404s or
+ *   non-JSON responses) does not throw.
  */
 export async function discoverAuth(serverUrl) {
     const { discoverOAuthProtectedResourceMetadata, discoverAuthorizationServerMetadata } = await import('@modelcontextprotocol/sdk/client/auth.js');
@@ -34,17 +98,20 @@ export async function discoverAuth(serverUrl) {
     // that hangs its well-known endpoint would trap discovery forever. Pass
     // a fetch that aborts after a short, configurable budget.
     const fetchFn = createTimeoutFetch(getAuthDiscoveryTimeoutMs());
-    // Tracks the last error seen across all candidates so the caller can be
-    // notified when discovery failed entirely (vs. cleanly finding nothing).
+    // Tracks the last genuine error seen across all candidates so the caller
+    // can be notified when discovery failed entirely (vs. cleanly finding
+    // nothing). Non-JSON responses are excluded — they are clean misses.
     let lastError;
     // Tolerant AS discovery: any error (404-as-throw, 5xx, network) is
-    // recorded and treated as "not found" so the next candidate is tried.
+    // recorded and treated as "not found" so the other candidates are tried.
     const safeDiscoverAs = async (url) => {
         try {
             return await discoverAuthorizationServerMetadata(url, { fetchFn });
         }
         catch (err) {
-            lastError = err;
+            if (!isNonJsonResponse(err)) {
+                lastError = err;
+            }
             return undefined;
         }
     };
@@ -59,32 +126,36 @@ export async function discoverAuth(serverUrl) {
     catch {
         // No PRM published; fall through to direct AS discovery below.
     }
-    // Step 2: AS metadata at each advertised authorization server.
-    if (resourceMetadata?.authorization_servers?.length) {
-        for (const asUrlString of resourceMetadata.authorization_servers) {
-            const asUrl = new URL(asUrlString);
-            const metadata = await safeDiscoverAs(asUrl);
-            if (metadata) {
-                return { resourceMetadata, serverMetadata: metadata, authorizationServerUrl: asUrl };
-            }
-        }
-    }
-    // Legacy fallback: direct AS discovery at the server URL, then its origin
-    // root (for servers that host AS metadata at the root with the MCP endpoint
-    // on a subpath and no PRM).
-    const candidates = [serverUrl];
+    // Step 2: probe the candidates in parallel, first hit wins. Advertised
+    // AS URLs take precedence; the legacy fallback group (the server URL
+    // and, for subpath URLs, its origin root) is only probed when no
+    // advertised AS yields metadata.
+    const advertisedUrls = (resourceMetadata?.authorization_servers ?? [])
+        .map((value) => toUrl(value))
+        .filter((url) => url !== undefined);
+    const fallbackUrls = [serverUrl];
     if (serverUrl.pathname !== '/') {
-        candidates.push(new URL(serverUrl.origin));
+        fallbackUrls.push(new URL(serverUrl.origin));
     }
-    for (const candidate of candidates) {
-        const metadata = await safeDiscoverAs(candidate);
-        if (metadata) {
-            return { resourceMetadata, serverMetadata: metadata, authorizationServerUrl: candidate };
-        }
+    const advertisedHit = await raceCandidates(advertisedUrls, safeDiscoverAs);
+    if (advertisedHit) {
+        return {
+            resourceMetadata,
+            serverMetadata: advertisedHit.metadata,
+            authorizationServerUrl: advertisedHit.url,
+        };
+    }
+    const fallbackHit = await raceCandidates(fallbackUrls, safeDiscoverAs);
+    if (fallbackHit) {
+        return {
+            resourceMetadata,
+            serverMetadata: fallbackHit.metadata,
+            authorizationServerUrl: fallbackHit.url,
+        };
     }
     // No metadata found anywhere. If any candidate actually errored (vs. a
-    // clean 404), surface that so callers can report a probe failure rather
-    // than a misleading "no OAuth supported".
+    // clean 404 or a non-JSON response), surface that so callers can report
+    // a probe failure rather than a misleading "no OAuth supported".
     if (lastError !== undefined) {
         throw lastError;
     }

package/build/utils/timeout.js

@@ -7,17 +7,26 @@ import process from 'node:process';
  * some Streamable HTTP servers behind CDNs) surfaces a clear error instead
  * of blocking the `tools` command or router startup indefinitely.
  *
+ * The value is deliberately kept well below the 30 s startup budget most
+ * MCP hosts allow: downstream connects run in parallel, so a single
+ * timed-out server costs exactly this budget, and the OAuth metadata
+ * probes run concurrently with the connects (see `runRouter`), keeping
+ * worst-case startup around 10 s even when a server hangs.
+ *
  * @internal Exported for tests only; not part of the public module API.
  */
-export const DEFAULT_DOWNSTREAM_TIMEOUT_MS = 30_000;
+export const DEFAULT_DOWNSTREAM_TIMEOUT_MS = 10_000;
 /**
  * Default timeout (ms) for OAuth metadata discovery probes (RFC 9728 /
  * RFC 8414 well-known endpoint fetches). These are best-effort probes;
  * a server that hangs its well-known endpoint must not stall startup.
+ * At startup the probes run concurrently with the downstream connects
+ * and the per-server candidates are probed in parallel, so this budget
+ * is a per-request cap rather than a serialized startup cost.
  *
  * @internal Exported for tests only; not part of the public module API.
  */
-export const DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS = 10_000;
+export const DEFAULT_AUTH_DISCOVERY_TIMEOUT_MS = 5_000;
 /**
  * Reads a positive-integer environment variable, returning `undefined`
  * when unset or invalid (non-integer or non-positive). Invalid values

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-compress-router",
-  "version": "1.5.5",
+  "version": "1.6.0",
   "description": "Compress all connected MCP servers into a single router MCP to save tokens",
   "license": "MIT",
   "type": "module",
@@ -68,6 +68,7 @@
     "dotenv": "17.4.2",
     "jsonc-parser": "3.3.1",
     "picomatch": "4.0.5",
+    "undici": "8.10.0",
     "zod": "4.4.3"
   }
 }