mcp-expose 1.1.0 → 1.1.2

package/dist/{server-BRw1E2xy.d.ts → server-BPDTsT2o.d.ts}

@@ -1,4 +1,4 @@
-import { O as OAuthOptions, A as AuthInfo } from './oauth-8RmQamGP.js';
+import { A as AuthInfo, O as OAuthOptions } from './oauth-8RmQamGP.js';
 
 /**
  * Shared types for mcp-expose. Everything in `core` is runtime-agnostic
@@ -99,7 +99,55 @@ interface RouteToolOptions {
     headers?: Record<string, string>;
     /** OAuth scopes needed to call this tool (when the `oauth` option is enabled). */
     scopes?: string[];
+    /**
+     * Shape what the agent sees from the route's response: trim or rename fields,
+     * add hints, or enrich it with data from other routes (`ctx.callRoute`).
+     * Overrides the server-level `transformResponse`.
+     */
+    transformResponse?: ResponseTransform;
+}
+/** A route's HTTP response as seen by `transformResponse`. */
+interface RouteToolResponse extends RouteResponse {
+    /** The parsed body when the response is JSON, otherwise `undefined`. */
+    json?: unknown;
+    /** `true` for 2xx/3xx responses. */
+    ok: boolean;
+}
+interface ResponseTransformContext {
+    /** Name of the tool being called. */
+    tool: string;
+    /** The arguments the agent passed (after validation). */
+    args: Record<string, unknown>;
+    /** The internal request that produced the response. */
+    request: RouteRequest;
+    /** The MCP call context: headers, client IP and, with OAuth, the verified token (`auth`). */
+    toolContext: ToolContext;
+    /** The result mcp-expose would return without the hook. */
+    defaultResult(): ToolResult;
+    /**
+     * Call another route of the same app, with the same forwarded credentials
+     * (auth header, cookies) and through the same middleware, guards and validation.
+     */
+    callRoute(request: {
+        method?: string;
+        /** Path of the route, e.g. `/customers/:id`. Placeholders are filled from `params`. */
+        path: string;
+        /** Values for `:param` / `{param}` placeholders; URL-encoded, and `.` / `..` are rejected. */
+        params?: Record<string, unknown>;
+        query?: Record<string, string | string[]>;
+        body?: unknown;
+        headers?: Record<string, string>;
+    }): Promise<RouteToolResponse>;
 }
+/**
+ * Turns a route's response into the tool result. Return:
+ *  - a string or any JSON value: sent to the agent (as `structuredContent` for objects).
+ *    It is an error result when the route answered with an HTTP error status;
+ *  - a full `ToolResult`: used as is (set `isError` yourself);
+ *  - `undefined`: keep the default result.
+ * Throwing turns the call into an error result with the message.
+ */
+type ResponseTransform = (response: RouteToolResponse, ctx: ResponseTransformContext) => unknown;
 /** HTTP route that backs a tool. `path` may use `:param` or `{param}` placeholders. */
 interface RouteSpec {
     method: string;
@@ -148,6 +196,11 @@ interface McpServerOptions {
     forwardHeaders?: string[];
     /** Max characters of an API response returned to the model. @default 100_000 */
     maxResponseChars?: number;
+    /**
+     * Default `transformResponse` for every route tool of this server that does not
+     * set its own (e.g. to strip internal fields everywhere).
+     */
+    transformResponse?: ResponseTransform;
     /**
      * Protect the MCP endpoint with OAuth 2.1, as the MCP authorization spec
      * describes. MCP clients (Claude, Cursor, VS Code, ...) then discover your
@@ -218,4 +271,4 @@ declare class McpServer {
     handleHttp(req: McpHttpRequest, ctx: ToolContext): Promise<McpHttpResponse>;
 }
 
-export { type Dispatcher as D, type JsonSchema as J, LATEST_PROTOCOL_VERSION as L, type McpServerOptions as M, type RouteToolOptions as R, type SchemaLike as S, type ToolContext as T, type McpToolDefinition as a, McpServer as b, type RouteSpec as c, type ToolAnnotations as d, type ToolResult as e, type JsonRpcResponse as f, type McpHttpRequest as g, type McpHttpResponse as h, type RouteRequest as i, type RouteResponse as j, SUPPORTED_PROTOCOL_VERSIONS as k, type TextContent as l };
+export { type Dispatcher as D, type JsonSchema as J, LATEST_PROTOCOL_VERSION as L, type McpServerOptions as M, type RouteToolOptions as R, type SchemaLike as S, type ToolContext as T, type McpToolDefinition as a, McpServer as b, type RouteSpec as c, type ToolResult as d, type ToolAnnotations as e, type JsonRpcResponse as f, type McpHttpRequest as g, type McpHttpResponse as h, type ResponseTransform as i, type ResponseTransformContext as j, type RouteRequest as k, type RouteResponse as l, type RouteToolResponse as m, SUPPORTED_PROTOCOL_VERSIONS as n, type TextContent as o };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-expose",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Turn the HTTP routes of your existing Node.js app (NestJS, Express, Fastify, Koa, Hono, AdonisJS) into MCP tools for AI agents, reusing your auth, validation and rate limits.",
   "keywords": [
     "mcp",
@@ -220,6 +220,7 @@
     "class-validator": "^0.15.1",
     "eslint": "^10.11.0",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.7.0",
     "fastify": "^5.12.5",
     "globals": "^17.12.0",
     "hono": "^4.13.9",