mcp-grocy 2.7.1 → 2.7.2

package/build/server/http-server.js

@@ -0,0 +1,398 @@
+import express from 'express';
+import { randomUUID, timingSafeEqual } from 'crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { VERSION, PACKAGE_NAME as SERVER_NAME } from '../version.js';
+import cors from 'cors';
+import http from 'http';
+import { logger } from '../utils/logger.js';
+/** Default idle window before an abandoned streamable session is reaped. */
+const DEFAULT_SESSION_IDLE_TIMEOUT_MS = 5 * 60_000;
+/** Default interval between idle-session sweeps. */
+const DEFAULT_SESSION_SWEEP_INTERVAL_MS = 60_000;
+/** Constant-time string comparison to prevent timing attacks on token validation. */
+function safeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+function createMcpAccessGate(accessToken) {
+    return (req, res, next) => {
+        if (!accessToken) {
+            next();
+            return;
+        }
+        if (req.method === 'OPTIONS') {
+            next();
+            return;
+        }
+        const bearer = req.headers.authorization;
+        const headerToken = req.headers['x-mcp-access-token'];
+        const headerTokenStr = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        const q = req.query.access_token;
+        const queryToken = typeof q === 'string' ? q : undefined;
+        const ok = (typeof bearer === 'string' && safeEqual(bearer, `Bearer ${accessToken}`)) ||
+            (typeof headerTokenStr === 'string' && safeEqual(headerTokenStr, accessToken)) ||
+            (req.method === 'GET' &&
+                typeof queryToken === 'string' &&
+                safeEqual(queryToken, accessToken));
+        if (ok) {
+            next();
+            return;
+        }
+        res.status(401).json({
+            jsonrpc: '2.0',
+            error: {
+                code: -32000,
+                message: 'Unauthorized: configure MCP_HTTP_ACCESS_TOKEN and send Authorization: Bearer, X-MCP-Access-Token, or access_token query (GET only)',
+            },
+            id: (req.body && typeof req.body === 'object' && 'id' in req.body
+                ? req.body.id
+                : null) ?? null,
+        });
+    };
+}
+// HTTP Transport for MCP (Context7 style)
+export function startHttpServer(mcpServer, port = 8080, security, sessionOptions = {}) {
+    return new Promise((resolve, reject) => {
+        const app = express();
+        const mcpAccessGate = createMcpAccessGate(security.accessToken);
+        if (security.accessToken) {
+            logger.config('HTTP MCP access token is enabled (Bearer, X-MCP-Access-Token, or access_token on GET)');
+        }
+        // Enable JSON body parsing with increased limit
+        app.use(express.json({
+            limit: '10mb',
+        }));
+        app.use(cors({
+            origin: security.corsOrigin,
+            methods: ['GET', 'POST', 'OPTIONS', 'DELETE'],
+            allowedHeaders: [
+                'Origin',
+                'X-Requested-With',
+                'Content-Type',
+                'Accept',
+                'Mcp-Session-Id',
+                'Mcp-Protocol-Version',
+                'Authorization',
+                'X-MCP-Access-Token',
+            ],
+            exposedHeaders: ['Mcp-Session-Id', 'Content-Type'],
+            optionsSuccessStatus: 200,
+        }));
+        // Health check endpoint — always accessible for monitoring/load balancers,
+        // but only exposes service details when no access token is configured or request is authenticated.
+        app.get('/', (req, res) => {
+            const minimal = { status: 'ok' };
+            if (security.accessToken) {
+                const bearer = req.headers.authorization;
+                const headerToken = req.headers['x-mcp-access-token'];
+                const headerTokenStr = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+                const authenticated = (typeof bearer === 'string' && safeEqual(bearer, `Bearer ${security.accessToken}`)) ||
+                    (typeof headerTokenStr === 'string' && safeEqual(headerTokenStr, security.accessToken));
+                if (!authenticated) {
+                    res.json(minimal);
+                    return;
+                }
+            }
+            res.json({
+                ...minimal,
+                service: SERVER_NAME,
+                version: VERSION,
+                message: 'MCP server is running',
+                endpoints: {
+                    streamable: '/mcp',
+                    sse: '/mcp/sse',
+                    sseMessages: '/mcp/messages',
+                },
+            });
+        });
+        // Session management for transports
+        const streamableTransports = {};
+        const streamableServers = {};
+        const streamableLastActivity = {};
+        const sseTransports = {};
+        const sseServerInstances = {};
+        const idleTimeoutMs = sessionOptions.idleTimeoutMs ?? DEFAULT_SESSION_IDLE_TIMEOUT_MS;
+        const sweepIntervalMs = sessionOptions.sweepIntervalMs ?? DEFAULT_SESSION_SWEEP_INTERVAL_MS;
+        // Close and forget a streamable session, freeing both its transport and the
+        // per-session McpServer (52 tools + 3 resources). Idempotent and re-entry
+        // safe: the map entries are removed first, so the transport's own `onclose`
+        // (which calls back here) short-circuits on the next entry.
+        const closeStreamableSession = (sessionId) => {
+            const transport = streamableTransports[sessionId];
+            if (!transport) {
+                return;
+            }
+            delete streamableTransports[sessionId];
+            delete streamableLastActivity[sessionId];
+            const serverInstance = streamableServers[sessionId];
+            delete streamableServers[sessionId];
+            try {
+                void transport.close?.();
+            }
+            catch {
+                /* already closed */
+            }
+            try {
+                void serverInstance?.close?.();
+            }
+            catch {
+                /* already closed */
+            }
+        };
+        // Simplified request logging
+        app.use((req, _res, next) => {
+            logger.server(`${req.method} ${req.path}`);
+            next();
+        });
+        // Helper function to get server instance (shared or new)
+        const getServerInstance = () => {
+            if (typeof mcpServer === 'function') {
+                return mcpServer(); // Create new instance
+            }
+            else {
+                return mcpServer; // Use shared instance
+            }
+        };
+        // Streamable HTTP endpoint (Context7 modern)
+        app.all('/mcp', mcpAccessGate, async (req, res) => {
+            try {
+                const clientSessionId = req.headers['mcp-session-id'] ||
+                    req.query.sessionId ||
+                    req.query['mcp-session-id'];
+                let transport = undefined;
+                // Accept header check (can be done early)
+                const accept = req.headers.accept || '';
+                // Home Assistant might not send perfect accept headers, so we log a warning instead of blocking
+                if (!accept.includes('application/json') && !accept.includes('text/event-stream')) {
+                    logger.warn('Client should accept application/json or text/event-stream', 'server');
+                }
+                const isInitializeRequest = req.method === 'POST' && req.body?.method === 'initialize';
+                if (clientSessionId && !isInitializeRequest) {
+                    // Existing session: look up transport
+                    transport = streamableTransports[clientSessionId];
+                    if (!transport) {
+                        logger.warn(`Session ${clientSessionId} not found, returning 400`, 'server');
+                        res.status(400).json({
+                            jsonrpc: '2.0',
+                            error: {
+                                code: -32001,
+                                message: `Invalid or expired session ID: ${clientSessionId}. Please re-initialize.`,
+                            },
+                            id: req.body?.id || null,
+                        });
+                        return;
+                    }
+                    // Mark activity so the idle reaper keeps live sessions alive.
+                    streamableLastActivity[clientSessionId] = Date.now();
+                }
+                else if (isInitializeRequest) {
+                    // POST initialize: create new transport and session
+                    if (clientSessionId) {
+                        logger.info(`Initialize request included prior session ID ${clientSessionId} (non-graceful reconnect), starting fresh session`, 'server');
+                        // Clean up the stale transport + server to prevent memory leaks
+                        closeStreamableSession(clientSessionId);
+                    }
+                    const newGeneratedSessionId = randomUUID();
+                    const newTransportInstance = new StreamableHTTPServerTransport({
+                        sessionIdGenerator: () => newGeneratedSessionId,
+                        enableJsonResponse: true,
+                    });
+                    transport = newTransportInstance;
+                    streamableTransports[newGeneratedSessionId] = transport;
+                    streamableLastActivity[newGeneratedSessionId] = Date.now();
+                    const serverInstance = getServerInstance();
+                    streamableServers[newGeneratedSessionId] = serverInstance;
+                    await serverInstance.connect(transport);
+                    // McpServer.connect() installs its own transport.onclose; wrap it so we
+                    // also evict the session from our maps and close the server whenever the
+                    // transport goes away (explicit DELETE, client disconnect, or idle reap).
+                    const sdkOnClose = transport.onclose;
+                    transport.onclose = () => {
+                        try {
+                            sdkOnClose?.();
+                        }
+                        finally {
+                            closeStreamableSession(newGeneratedSessionId);
+                        }
+                    };
+                }
+                else {
+                    // Non-initialize request without a session ID (e.g. GET SSE before session established)
+                    // Return 405 so clients that probe for SSE support handle it gracefully
+                    res
+                        .status(405)
+                        .set('Allow', 'POST')
+                        .json({
+                        jsonrpc: '2.0',
+                        error: {
+                            code: -32000,
+                            message: 'Method not allowed: session not established. Send a POST initialize request first.',
+                        },
+                        id: req.body?.id || null,
+                    });
+                    return;
+                }
+                if (!transport) {
+                    logger.error('Transport is undefined before handling request. This should not happen.', 'server');
+                    res.status(500).json({
+                        jsonrpc: '2.0',
+                        error: { code: -32000, message: 'Internal server error: Transport not available' },
+                        id: req.body?.id || null,
+                    });
+                    return;
+                }
+                if (transport.sessionId) {
+                    res.setHeader('Mcp-Session-Id', transport.sessionId);
+                }
+                await transport.handleRequest(req, res, req.body);
+            }
+            catch (error) {
+                logger.error('Failed to handle streamable HTTP request', 'server', { error });
+                // Send error response if headers not sent yet
+                if (!res.headersSent) {
+                    res.status(500).json({
+                        jsonrpc: '2.0',
+                        error: {
+                            code: -32000,
+                            message: `Internal server error: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                        id: req.body?.id ?? null,
+                    });
+                }
+            }
+        });
+        // SSE endpoint
+        app.get('/mcp/sse', mcpAccessGate, async (_req, res) => {
+            try {
+                // Set SSE headers before creating transport
+                res.setHeader('Content-Type', 'text/event-stream');
+                res.setHeader('Cache-Control', 'no-cache');
+                res.setHeader('Connection', 'keep-alive');
+                const transport = new SSEServerTransport('/mcp/messages', res);
+                const sessionId = transport.sessionId;
+                logger.info(`Created SSE session: ${sessionId}`, 'DEBUG');
+                sseTransports[sessionId] = transport;
+                // Handle connection cleanup
+                const cleanup = () => {
+                    delete sseTransports[sessionId];
+                    const isolated = sseServerInstances[sessionId];
+                    delete sseServerInstances[sessionId];
+                    try {
+                        void isolated?.close?.();
+                    }
+                    catch {
+                        /* already closed */
+                    }
+                };
+                res.on('close', cleanup);
+                res.on('error', (err) => {
+                    logger.error(`SSE connection error for session ${sessionId}`, 'server', { error: err });
+                    cleanup();
+                });
+                // Create isolated server instance for this SSE connection to prevent response cross-talk
+                const isolatedServer = getServerInstance();
+                sseServerInstances[sessionId] = isolatedServer;
+                // Connect transport to isolated MCP server (non-blocking)
+                isolatedServer.connect(transport).catch((error) => {
+                    logger.error(`Failed to connect SSE transport for session ${sessionId}`, 'server', {
+                        error,
+                    });
+                    cleanup();
+                    if (!res.headersSent) {
+                        res.status(500).end();
+                    }
+                });
+                // Send initial comment to keep connection alive
+                res.write(': connected\n\n');
+            }
+            catch (error) {
+                logger.error('Failed to handle SSE connection', 'server', { error });
+                if (!res.headersSent) {
+                    res.status(500).send('Internal Server Error');
+                }
+                else {
+                    res.end();
+                }
+            }
+        });
+        // Message endpoint for SSE
+        app.post('/mcp/messages', mcpAccessGate, async (req, res) => {
+            const sessionId = req.query.sessionId;
+            if (!sessionId) {
+                logger.error('Missing sessionId parameter in SSE message', 'server');
+                res.status(400).json({
+                    error: 'Missing sessionId parameter',
+                    status: 400,
+                });
+                return;
+            }
+            const transport = sseTransports[sessionId];
+            if (transport) {
+                logger.info(`Found active transport for session ${sessionId}`, 'DEBUG');
+                try {
+                    await transport.handlePostMessage(req, res, req.body);
+                }
+                catch (error) {
+                    logger.error(`Failed to handle SSE message for session ${sessionId}`, 'server', {
+                        error,
+                    });
+                    res.status(500).json({
+                        error: `Internal server error: ${error instanceof Error ? error.message : String(error)}`,
+                        status: 500,
+                    });
+                }
+            }
+            else {
+                res.status(404).json({
+                    error: `No active SSE connection found for session ID: ${sessionId}`,
+                    status: 404,
+                });
+            }
+        });
+        // Catch-all for undefined routes — return JSON instead of Express default HTML
+        app.use((_req, res) => {
+            res.status(404).json({
+                jsonrpc: '2.0',
+                error: { code: -32000, message: 'Not found' },
+                id: null,
+            });
+        });
+        // Create HTTP server with explicit error handling
+        const server = http.createServer(app);
+        // Idle-session reaper: abandoned streamable sessions (clients that reconnect
+        // without sending DELETE) are closed once they exceed the idle window, so
+        // their transports + McpServers can be garbage collected instead of growing
+        // without bound.
+        const reaper = setInterval(() => {
+            const now = Date.now();
+            for (const sessionId of Object.keys(streamableTransports)) {
+                const last = streamableLastActivity[sessionId] ?? 0;
+                if (now - last > idleTimeoutMs) {
+                    logger.info(`Reaping idle MCP session ${sessionId} (idle ${now - last}ms)`, 'server');
+                    closeStreamableSession(sessionId);
+                }
+            }
+        }, sweepIntervalMs);
+        // Don't let the sweep timer keep the process (or test runner) alive.
+        reaper.unref?.();
+        server.on('close', () => clearInterval(reaper));
+        // Expose the live session count for observability and tests.
+        server.getMcpSessionCount = () => Object.keys(streamableTransports).length + Object.keys(sseTransports).length;
+        server.on('error', (error) => {
+            logger.error(`HTTP server error: ${error.message}`, 'server');
+            reject(error);
+        });
+        // Start the server
+        server.listen(port, () => {
+            logger.server(`HTTP server listening on port ${port}`);
+            logger.server(`Available endpoints:`);
+            logger.server(`  - Health check: http://localhost:${port}/`);
+            logger.server(`  - Streamable HTTP: http://localhost:${port}/mcp`);
+            logger.server(`  - SSE: http://localhost:${port}/mcp/sse`);
+            logger.server(`  - SSE Messages: http://localhost:${port}/mcp/messages`);
+            resolve(server);
+        });
+    });
+}

package/build/server/mcp-server.js

@@ -0,0 +1,230 @@
+/**
+ * Grocy MCP server — McpServer API (registerTool / registerResource).
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import { CallToolRequestSchema, ErrorCode, McpError, } from '@modelcontextprotocol/sdk/types.js';
+import { VERSION, PACKAGE_NAME, SERVER_NAME as RESOURCE_URI_SCHEME } from '../version.js';
+import { createToolRegistry } from '../tools/index.js';
+import { config } from '../config/index.js';
+import { startHttpServer } from './http-server.js';
+import { ResourceHandler, STATIC_MCP_RESOURCE_ENTRIES } from './resources.js';
+import { toolDefinitionInputZod } from './tool-input-zod.js';
+import { logger } from '../utils/logger.js';
+import { ErrorHandler } from '../utils/errors.js';
+/** Protocol capabilities; merge keeps `tools.asyncSupported` when SDK adds `listChanged`. */
+const GROCY_SERVER_CAPABILITIES = {
+    tools: {
+        asyncSupported: true,
+    },
+    resources: {},
+    prompts: {},
+};
+const SERVER_INFO = {
+    name: PACKAGE_NAME,
+    version: VERSION,
+    websiteUrl: 'https://github.com/miguelangel-nubla/mcp-grocy',
+    description: 'MCP server for Grocy. Documentation: https://github.com/miguelangel-nubla/mcp-grocy/blob/main/README.md',
+};
+export class GrocyMcpServer {
+    static sigintHandlerRegistered = false;
+    static activeServers = new Set();
+    mcp;
+    enabledTools = new Set();
+    toolSubConfigs = new Map();
+    toolAckTokens = new Map();
+    resourceHandler;
+    toolRegistry;
+    constructor(mcp, toolRegistry, resourceHandler) {
+        this.mcp = mcp;
+        this.toolRegistry = toolRegistry;
+        this.resourceHandler = resourceHandler;
+        this.parseToolConfiguration();
+        this.registerToolsAndResources(this.mcp);
+        this.setupErrorHandling(this.mcp);
+    }
+    static async create() {
+        const toolRegistry = await createToolRegistry();
+        const resourceHandler = new ResourceHandler();
+        const mcp = new McpServer(SERVER_INFO, {
+            capabilities: GROCY_SERVER_CAPABILITIES,
+        });
+        GrocyMcpServer.activeServers.add(mcp);
+        return new GrocyMcpServer(mcp, toolRegistry, resourceHandler);
+    }
+    parseToolConfiguration() {
+        const { enabledTools, toolSubConfigs, toolAckTokens } = config.parseToolConfiguration();
+        this.toolSubConfigs = toolSubConfigs;
+        this.toolAckTokens = toolAckTokens;
+        const validToolNames = new Set(this.toolRegistry.getToolNames());
+        if (enabledTools.size > 0) {
+            const invalidTools = Array.from(enabledTools).filter((tool) => !validToolNames.has(tool));
+            if (invalidTools.length > 0) {
+                const validNames = Array.from(validToolNames).sort().join(', ');
+                logger.error(`Invalid tools: ${invalidTools.join(', ')}. Valid: ${validNames}`, 'CONFIG');
+                process.exit(1);
+            }
+            this.enabledTools = enabledTools;
+            logger.config(`Enabled tools: ${Array.from(enabledTools).join(', ')}`);
+        }
+        else {
+            logger.warn('No tools enabled', 'CONFIG');
+        }
+    }
+    registerToolsAndResources(mcp) {
+        for (const def of this.toolRegistry.getDefinitions()) {
+            const inputSchema = toolDefinitionInputZod(def);
+            const registered = mcp.registerTool(def.name, {
+                ...(def.title?.trim() ? { title: def.title.trim() } : {}),
+                description: def.description,
+                inputSchema,
+                outputSchema: z.object({ data: z.unknown() }),
+                ...(def.annotations ? { annotations: def.annotations } : {}),
+                ...(def.meta && Object.keys(def.meta).length > 0 ? { _meta: def.meta } : {}),
+            }, async (args) => this.invokeTool(def.name, args));
+            if (!this.enabledTools.has(def.name)) {
+                registered.disable();
+            }
+        }
+        for (const entry of STATIC_MCP_RESOURCE_ENTRIES) {
+            const uri = `${RESOURCE_URI_SCHEME}://${entry.slug}`;
+            mcp.registerResource(entry.name, uri, { description: entry.description, mimeType: entry.mimeType }, async (resourceUrl) => this.resourceHandler.readResource(resourceUrl.toString()));
+        }
+        logger.config(`Registered ${this.toolRegistry.getDefinitions().length} tool(s) (${this.enabledTools.size} enabled) and ${STATIC_MCP_RESOURCE_ENTRIES.length} resource(s) via McpServer`);
+        this.installStrictToolsCallHandling(mcp);
+    }
+    /**
+     * MCP SDK maps most tool errors to CallToolResult with isError, but compliance harnesses expect
+     * JSON-RPC errors for unknown/disabled tool names.
+     *
+     * WARNING: accesses SDK internals (_requestHandlers, _registeredTools).
+     * Tested against @modelcontextprotocol/sdk ^1.28.0 — verify after upgrades.
+     */
+    installStrictToolsCallHandling(mcp) {
+        const server = mcp.server;
+        const previous = server._requestHandlers?.get('tools/call');
+        if (!previous) {
+            logger.warn('Could not install strict tools/call handling — SDK internals may have changed', 'MCP');
+            return;
+        }
+        const toolsMap = mcp
+            ._registeredTools;
+        if (!toolsMap) {
+            logger.warn('Could not install strict tools/call handling — _registeredTools not found', 'MCP');
+            return;
+        }
+        mcp.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+            const name = request.params.name;
+            const registered = toolsMap[name];
+            if (!registered) {
+                throw new McpError(ErrorCode.MethodNotFound, `Tool '${name}' not found`);
+            }
+            if (!registered.enabled) {
+                throw new McpError(ErrorCode.InvalidParams, `Tool '${name}' is disabled`);
+            }
+            return previous(request, extra);
+        });
+    }
+    async invokeTool(toolName, args) {
+        const handler = this.toolRegistry.getHandler(toolName);
+        if (!handler) {
+            throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${toolName}`);
+        }
+        try {
+            const subConfigs = this.toolSubConfigs.get(toolName);
+            const result = await handler(args, subConfigs);
+            if (!result.isError) {
+                if (config.server.serialize_structured_to_content &&
+                    result.structuredContent?.data !== undefined &&
+                    result.structuredContent?.data !== null) {
+                    const dataJson = JSON.stringify(result.structuredContent.data, null, 2);
+                    const firstBlock = result.content[0];
+                    if (firstBlock && firstBlock.type === 'text') {
+                        const currentText = firstBlock.text;
+                        if (!currentText.includes(dataJson)) {
+                            firstBlock.text =
+                                currentText && currentText !== 'Operation completed successfully'
+                                    ? `${currentText}\n${dataJson}`
+                                    : dataJson;
+                        }
+                    }
+                }
+                const ackToken = this.toolAckTokens.get(toolName);
+                if (ackToken) {
+                    result.content.unshift({
+                        type: 'text',
+                        text: `Acknowledgment token: ${ackToken}`,
+                    });
+                }
+            }
+            return result;
+        }
+        catch (error) {
+            ErrorHandler.logError(error, `tool: ${toolName}`);
+            throw ErrorHandler.toMcpError(error, `${toolName} failed`);
+        }
+    }
+    setupErrorHandling(mcp) {
+        mcp.server.onerror = (error) => {
+            logger.error('MCP protocol error', 'MCP', { error });
+        };
+        if (GrocyMcpServer.sigintHandlerRegistered) {
+            return;
+        }
+        GrocyMcpServer.sigintHandlerRegistered = true;
+        process.on('SIGINT', async () => {
+            logger.info('Shutting down server...', 'SERVER');
+            await Promise.all(Array.from(GrocyMcpServer.activeServers).map((s) => s.close().catch(() => { })));
+            process.exit(0);
+        });
+    }
+    createMcpServer() {
+        const mcp = new McpServer(SERVER_INFO, {
+            capabilities: GROCY_SERVER_CAPABILITIES,
+        });
+        GrocyMcpServer.activeServers.add(mcp);
+        this.registerToolsAndResources(mcp);
+        this.setupErrorHandling(mcp);
+        return mcp;
+    }
+    async start() {
+        const httpTransportOnly = process.env.MCP_HTTP_TRANSPORT_ONLY === 'true' || process.env.MCP_HTTP_TRANSPORT_ONLY === '1';
+        if (httpTransportOnly && !config.server.enable_http_server) {
+            logger.error('MCP_HTTP_TRANSPORT_ONLY is set but HTTP server is disabled; enable server.enable_http_server or ENABLE_HTTP_SERVER', 'SERVER');
+            process.exit(1);
+        }
+        if (!httpTransportOnly) {
+            const transport = new StdioServerTransport();
+            await this.mcp.connect(transport);
+            logger.info('MCP server running on stdio', 'SERVER');
+        }
+        else {
+            logger.info('MCP_HTTP_TRANSPORT_ONLY: stdio transport skipped', 'SERVER');
+        }
+        if (config.server.enable_http_server) {
+            try {
+                logger.config(`Starting HTTP server on port ${config.server.http_server_port}`);
+                const serverFactory = () => this.createMcpServer();
+                await startHttpServer(serverFactory, config.server.http_server_port, {
+                    corsOrigin: config.server.http_cors_origin,
+                    ...(config.server.http_access_token !== undefined && {
+                        accessToken: config.server.http_access_token,
+                    }),
+                }, {
+                    idleTimeoutMs: config.server.session_idle_timeout_ms,
+                    sweepIntervalMs: config.server.session_sweep_interval_ms,
+                });
+            }
+            catch (error) {
+                logger.error('Failed to start HTTP server', 'SERVER', { error });
+                logger.error('HTTP server is explicitly enabled but cannot start - exiting', 'SERVER');
+                process.exit(1);
+            }
+        }
+    }
+    get serverInstance() {
+        return this.mcp;
+    }
+}
+export default GrocyMcpServer;