mcp-local-tunnel 1.0.0

package/dist/oidc-client.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcClient = void 0;
+const node_crypto_1 = require("node:crypto");
+const jose_1 = require("jose");
+const parseCacheTtl = (headers, defaultMs) => {
+    const cacheControl = headers.get('cache-control');
+    if (cacheControl) {
+        const match = /max-age=(\d+)/.exec(cacheControl);
+        if (match) {
+            return Number(match[1]) * 1000;
+        }
+    }
+    return defaultMs;
+};
+const DEFAULT_DISCOVERY_TTL_MS = 3_600_000; // 1 hour
+class OidcClient {
+    config;
+    discovery;
+    discoveryExpiresAt = 0;
+    jwks;
+    constructor(config) {
+        this.config = config;
+    }
+    async getDiscovery() {
+        if (this.discovery && Date.now() < this.discoveryExpiresAt) {
+            return this.discovery;
+        }
+        const url = `${this.config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+        const res = await fetch(url);
+        if (!res.ok) {
+            throw new Error(`OIDC discovery failed: ${res.status} ${res.statusText}`);
+        }
+        this.discovery = await res.json();
+        this.discoveryExpiresAt = Date.now() + parseCacheTtl(res.headers, DEFAULT_DISCOVERY_TTL_MS);
+        return this.discovery;
+    }
+    async buildAuthorizeUrl(params) {
+        const disc = await this.getDiscovery();
+        const clientId = this.config.clientId ?? 'mcp-local-tunnel';
+        const url = new URL(disc.authorization_endpoint);
+        url.searchParams.set('client_id', clientId);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('redirect_uri', params.redirectUri);
+        url.searchParams.set('state', params.state);
+        url.searchParams.set('scope', (this.config.scopes ?? ['openid']).join(' '));
+        url.searchParams.set('code_challenge', params.codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+        return url.toString();
+    }
+    generateCodeVerifierAndChallenge() {
+        const codeVerifier = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const codeChallenge = (0, node_crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url');
+        return { codeVerifier, codeChallenge };
+    }
+    async exchangeCode(code, redirectUri, codeVerifier) {
+        const disc = await this.getDiscovery();
+        const clientId = this.config.clientId ?? 'mcp-local-tunnel';
+        const params = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            client_id: clientId,
+            code_verifier: codeVerifier,
+        });
+        if (this.config.clientSecret) {
+            params.set('client_secret', this.config.clientSecret);
+        }
+        const res = await fetch(disc.token_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params.toString(),
+        });
+        if (!res.ok) {
+            const body = await res.text();
+            throw new Error(`Upstream token exchange failed: ${res.status} ${body}`);
+        }
+        const tokens = await res.json();
+        if (tokens.id_token) {
+            this.jwks ||= (0, jose_1.createRemoteJWKSet)(new URL(disc.jwks_uri));
+            const { payload } = await (0, jose_1.jwtVerify)(tokens.id_token, this.jwks, {
+                issuer: disc.issuer,
+                audience: clientId,
+            });
+            const claim = this.config.userClaim ?? 'sub';
+            const userId = payload[claim];
+            if (typeof userId !== 'string') {
+                throw new Error(`Upstream ID token missing claim "${claim}"`);
+            }
+            return { claims: payload, userId };
+        }
+        throw new Error('Upstream did not return an id_token');
+    }
+}
+exports.OidcClient = OidcClient;

package/dist/pages.d.ts

@@ -0,0 +1,2 @@
+export declare const renderSuccessPage: (message: string) => string;
+export declare const renderErrorPage: (message: string) => string;

package/dist/pages.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderErrorPage = exports.renderSuccessPage = void 0;
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- CJS module, can't use import.meta
+const pkg = require('../package.json');
+const { version } = pkg;
+const repoUrl = pkg.repository?.url?.replace(/\.git$/, '').replace(/^git\+/, '') ?? 'https://github.com/domdomegg/mcp-local-tunnel';
+const VARS_LIGHT = `--bg: #fafafa; --fg: #111; --muted: #888; --subtle: #666;
+      --btn-bg: #111; --btn-fg: #fafafa; --btn-hover: #333;
+      --error: #b91c1c;
+      --footer: #aaa; --footer-hover: #888;`;
+const VARS_DARK = `--bg: #161616; --fg: #e5e5e5; --muted: #777; --subtle: #999;
+      --btn-bg: #e5e5e5; --btn-fg: #161616; --btn-hover: #ccc;
+      --error: #f87171;
+      --footer: #555; --footer-hover: #777;`;
+const BASE = `* { margin: 0; padding: 0; box-sizing: border-box; }
+  body { font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', 'Consolas', monospace; padding: 48px 24px; max-width: 520px; margin: 0 auto; background: var(--bg); color: var(--fg); }
+  h1 { font-size: 14px; text-transform: uppercase; letter-spacing: 2px; font-weight: 700; color: var(--muted); }`;
+const FOOTER = `footer { margin-top: 32px; font-size: 10px; color: var(--footer); }
+  footer a { color: var(--footer); text-decoration: none; }
+  footer a:hover { color: var(--footer-hover); border-bottom: 1px solid var(--footer-hover); }`;
+const CENTER_CSS = `h1 { margin-bottom: 0; }
+  .center { text-align: center; margin-top: 80px; }
+  .msg { font-size: 13px; line-height: 1.6; margin-top: 12px; color: var(--subtle); }`;
+const footerHtml = `<footer><a href="${escapeHtml(repoUrl)}">mcp-local-tunnel</a> v${escapeHtml(version)}</footer>`;
+const pageHead = (title, extraCss) => `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="generator" content="mcp-local-tunnel">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+  @media (prefers-color-scheme: light) { :root { ${VARS_LIGHT} } }
+  @media (prefers-color-scheme: dark) { :root { ${VARS_DARK} } }
+  ${BASE}
+  ${extraCss}
+  ${FOOTER}
+</style>
+</head>`;
+const renderSuccessPage = (message) => `${pageHead('Authenticated', CENTER_CSS)}
+<body>
+<div class="center">
+<h1>MCP Local Tunnel</h1>
+<p class="msg">${escapeHtml(message)}</p>
+${footerHtml}
+</div>
+</body>
+</html>`;
+exports.renderSuccessPage = renderSuccessPage;
+const renderErrorPage = (message) => `${pageHead('Authentication failed', `${CENTER_CSS}
+  .msg-err { color: var(--error); }`)}
+<body>
+<div class="center">
+<h1>MCP Local Tunnel</h1>
+<p class="msg msg-err">${escapeHtml(message)}</p>
+${footerHtml}
+</div>
+</body>
+</html>`;
+exports.renderErrorPage = renderErrorPage;
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}

package/dist/relay-mcp-server.d.ts

@@ -0,0 +1,3 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { ConnectionManager } from './connection-manager.js';
+export declare const createRelayMcpServer: (connectionManager: ConnectionManager, userId: string) => Server;

package/dist/relay-mcp-server.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRelayMcpServer = void 0;
+/* eslint-disable @typescript-eslint/no-deprecated -- Using low-level Server to proxy JSON Schema without Zod conversion */
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const createRelayMcpServer = (connectionManager, userId) => {
+    const server = new index_js_1.Server({ name: 'mcp-local-tunnel', version: '1.0.0' }, { capabilities: { tools: {} } });
+    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
+        const tools = [];
+        // Meta tools (always available)
+        const conns = connectionManager.getConnectionsForUser(userId);
+        const connected = conns.length > 0;
+        const statusDesc = connected
+            ? `Show tunnel status. Currently connected: ${conns.map((c) => c.name).join(', ')}`
+            : 'Show tunnel status. No agent is currently connected.';
+        tools.push({
+            name: 'status',
+            description: statusDesc,
+            inputSchema: { type: 'object', properties: {} },
+            annotations: {
+                title: 'Tunnel Status',
+                readOnlyHint: true,
+                openWorldHint: false,
+            },
+        });
+        tools.push({
+            name: 'restart',
+            description: 'Restart all local MCP server processes on connected agents. Useful if a server is stuck or you\'ve changed its configuration.',
+            inputSchema: { type: 'object', properties: {} },
+            annotations: {
+                title: 'Restart Servers',
+                readOnlyHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        });
+        // Tunnelled tools from connected agents
+        const agentTools = connectionManager.getToolsForUser(userId);
+        for (const tool of agentTools) {
+            tools.push({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: tool.inputSchema,
+                ...(tool.annotations ? { annotations: tool.annotations } : {}),
+            });
+        }
+        return { tools };
+    });
+    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+        const { name, arguments: args } = request.params;
+        if (name === 'status') {
+            const conns = connectionManager.getConnectionsForUser(userId);
+            if (conns.length === 0) {
+                return {
+                    content: [{ type: 'text', text: 'No agent is currently connected. Start one with: npx mcp-local-tunnel' }],
+                };
+            }
+            const devices = conns.map((c) => ({
+                name: c.name,
+                connectedSince: new Date(c.connectedAt).toISOString(),
+                tools: c.tools.map((t) => t.name),
+            }));
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ connected: true, devices }, null, 2) }],
+            };
+        }
+        if (name === 'restart') {
+            const conns = connectionManager.getConnectionsForUser(userId);
+            if (conns.length === 0) {
+                return {
+                    content: [{ type: 'text', text: 'No agent is currently connected — nothing to restart.' }],
+                    isError: true,
+                };
+            }
+            connectionManager.sendRestart(userId);
+            return {
+                content: [{ type: 'text', text: `Restart signal sent to ${conns.length} agent(s). Tools will update shortly.` }],
+            };
+        }
+        // Route to agent: find which device owns this tool
+        const agentTools = connectionManager.getToolsForUser(userId);
+        const tool = agentTools.find((t) => t.name === name);
+        if (!tool) {
+            return {
+                content: [{ type: 'text', text: `Unknown tool: ${name}` }],
+                isError: true,
+            };
+        }
+        // Determine the original tool name (strip device prefix if multi-device)
+        const conns = connectionManager.getConnectionsForUser(userId);
+        const multiDevice = conns.length > 1;
+        const originalName = multiDevice && name.startsWith(`${tool.deviceName}__`)
+            ? name.slice(tool.deviceName.length + 2)
+            : name;
+        try {
+            const result = await connectionManager.sendRequest(userId, tool.deviceName, originalName, args ?? {});
+            return result;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                content: [{ type: 'text', text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    });
+    return server;
+};
+exports.createRelayMcpServer = createRelayMcpServer;

package/dist/relay-server.d.ts

@@ -0,0 +1,10 @@
+import express from 'express';
+import type { Server as HttpServer } from 'node:http';
+import type { TunnelOAuthProvider } from './oauth-provider.js';
+import type { OidcClient } from './oidc-client.js';
+import type { ConnectionManager } from './connection-manager.js';
+import type { RelayConfig } from './types.js';
+export declare const createRelayApp: (config: RelayConfig, provider: TunnelOAuthProvider, oidcClient: OidcClient, connectionManager: ConnectionManager) => {
+    app: express.Express;
+    attachWebSocket: (server: HttpServer) => void;
+};

package/dist/relay-server.js

@@ -0,0 +1,146 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRelayApp = void 0;
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const router_js_1 = require("@modelcontextprotocol/sdk/server/auth/router.js");
+const bearerAuth_js_1 = require("@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js");
+const express_1 = __importDefault(require("express"));
+const ws_1 = require("ws");
+const relay_mcp_server_js_1 = require("./relay-mcp-server.js");
+const pages_js_1 = require("./pages.js");
+const getString = (value) => typeof value === 'string' ? value : undefined;
+const createRelayApp = (config, provider, oidcClient, connectionManager) => {
+    const app = (0, express_1.default)();
+    const getBaseUrl = () => config.issuerUrl ?? `http://localhost:${config.port ?? 3000}`;
+    const issuerUrl = new URL(getBaseUrl());
+    const mcpUrl = new URL('/mcp', issuerUrl);
+    // Custom /authorize handler — accepts any client_id and redirect_uri
+    app.all('/authorize', (req, res) => {
+        const params = req.method === 'POST' ? req.body : req.query;
+        const clientId = getString(params.client_id);
+        const redirectUri = getString(params.redirect_uri);
+        const codeChallenge = getString(params.code_challenge);
+        const codeChallengeMethod = getString(params.code_challenge_method);
+        const scope = getString(params.scope);
+        const state = getString(params.state);
+        if (!clientId || !redirectUri || !codeChallenge) {
+            res.status(400).json({ error: 'invalid_request', error_description: 'Missing client_id, redirect_uri, or code_challenge' });
+            return;
+        }
+        if (codeChallengeMethod && codeChallengeMethod !== 'S256') {
+            res.status(400).json({ error: 'invalid_request', error_description: 'code_challenge_method must be S256' });
+            return;
+        }
+        const client = { client_id: clientId, redirect_uris: [redirectUri] };
+        const authParams = {
+            scopes: scope ? scope.split(' ') : [],
+            redirectUri,
+            codeChallenge,
+        };
+        if (state) {
+            authParams.state = state;
+        }
+        void provider.authorize(client, authParams, res).catch((err) => {
+            console.error('Authorize error:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'server_error' });
+            }
+        });
+    });
+    // OAuth routes (discovery, token, register, revoke)
+    const noRateLimit = { rateLimit: false };
+    app.use((0, router_js_1.mcpAuthRouter)({
+        provider,
+        issuerUrl,
+        baseUrl: issuerUrl,
+        resourceServerUrl: mcpUrl,
+        tokenOptions: noRateLimit,
+        authorizationOptions: noRateLimit,
+        clientRegistrationOptions: noRateLimit,
+        revocationOptions: noRateLimit,
+    }));
+    // OIDC callback
+    app.get('/callback', async (req, res) => {
+        try {
+            const code = getString(req.query.code);
+            const sealedState = getString(req.query.state);
+            if (!code || !sealedState) {
+                res.status(400).type('html').send((0, pages_js_1.renderErrorPage)('Missing code or state parameter.'));
+                return;
+            }
+            const pending = provider.unsealState(sealedState);
+            if (!pending) {
+                res.status(400).type('html').send((0, pages_js_1.renderErrorPage)('Invalid or expired authorization session.'));
+                return;
+            }
+            const callbackUrl = `${getBaseUrl()}/callback`;
+            const { userId } = await oidcClient.exchangeCode(code, callbackUrl, pending.upstreamCodeVerifier);
+            const { redirectUrl } = provider.completeAuthorization(pending, userId);
+            res.redirect(redirectUrl);
+        }
+        catch (err) {
+            console.error('Callback error:', err);
+            res.status(500).type('html').send((0, pages_js_1.renderErrorPage)('Authentication failed.'));
+        }
+    });
+    // Protected MCP endpoint
+    const bearerAuth = (0, bearerAuth_js_1.requireBearerAuth)({
+        verifier: provider,
+        resourceMetadataUrl: (0, router_js_1.getOAuthProtectedResourceMetadataUrl)(mcpUrl),
+    });
+    app.all('/mcp', bearerAuth, async (req, res) => {
+        const userId = getString(req.auth?.extra?.userId);
+        if (!userId) {
+            res.status(401).json({ error: 'Missing user identity' });
+            return;
+        }
+        const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
+            enableJsonResponse: true,
+        });
+        const server = (0, relay_mcp_server_js_1.createRelayMcpServer)(connectionManager, userId);
+        await server.connect(transport);
+        await transport.handleRequest(req, res);
+    });
+    // WebSocket upgrade handler for agent connections
+    const attachWebSocket = (httpServer) => {
+        const wss = new ws_1.WebSocketServer({ noServer: true });
+        httpServer.on('upgrade', async (req, socket, head) => {
+            if (req.url?.startsWith('/ws')) {
+                // Extract bearer token from query param or header
+                const url = new URL(req.url, `http://${req.headers.host}`);
+                const token = url.searchParams.get('token')
+                    ?? req.headers.authorization?.replace(/^Bearer /i, '');
+                const name = url.searchParams.get('name') ?? 'default';
+                if (!token) {
+                    socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                    socket.destroy();
+                    return;
+                }
+                try {
+                    const authInfo = await provider.verifyAccessToken(token);
+                    const userId = getString(authInfo.extra?.userId);
+                    if (!userId) {
+                        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                        socket.destroy();
+                        return;
+                    }
+                    wss.handleUpgrade(req, socket, head, (ws) => {
+                        connectionManager.addConnection(ws, userId, name);
+                    });
+                }
+                catch {
+                    socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                    socket.destroy();
+                }
+            }
+            else {
+                socket.destroy();
+            }
+        });
+    };
+    return { app, attachWebSocket };
+};
+exports.createRelayApp = createRelayApp;

package/dist/relay.d.ts

@@ -0,0 +1,2 @@
+import type { RelayConfig } from './types.js';
+export declare const startRelay: (config: RelayConfig) => void;

package/dist/relay.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startRelay = void 0;
+const oidc_client_js_1 = require("./oidc-client.js");
+const oauth_provider_js_1 = require("./oauth-provider.js");
+const connection_manager_js_1 = require("./connection-manager.js");
+const relay_server_js_1 = require("./relay-server.js");
+const startRelay = (config) => {
+    const oidcClient = new oidc_client_js_1.OidcClient(config.auth);
+    const provider = new oauth_provider_js_1.TunnelOAuthProvider(oidcClient, config);
+    const connectionManager = new connection_manager_js_1.ConnectionManager();
+    const { app, attachWebSocket } = (0, relay_server_js_1.createRelayApp)(config, provider, oidcClient, connectionManager);
+    const port = config.port ?? 3000;
+    const host = config.host ?? '0.0.0.0';
+    const server = app.listen(port, host, () => {
+        console.log(`mcp-local-tunnel relay listening on ${host}:${port}`);
+        console.log(`Auth: ${config.auth.issuer}`);
+    });
+    attachWebSocket(server);
+    const shutdown = () => {
+        console.log('\nShutting down...');
+        server.close();
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+};
+exports.startRelay = startRelay;

package/dist/types.d.ts

@@ -0,0 +1,92 @@
+import { z } from 'zod';
+export declare const AuthConfigSchema: z.ZodObject<{
+    issuer: z.ZodURL;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    userClaim: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const ServerEntrySchema: z.ZodObject<{
+    command: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    url: z.ZodOptional<z.ZodURL>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export declare const RelayConfigSchema: z.ZodObject<{
+    mode: z.ZodLiteral<"relay">;
+    auth: z.ZodObject<{
+        issuer: z.ZodURL;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        userClaim: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    port: z.ZodOptional<z.ZodNumber>;
+    host: z.ZodOptional<z.ZodString>;
+    issuerUrl: z.ZodOptional<z.ZodURL>;
+    secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const AgentConfigSchema: z.ZodObject<{
+    mode: z.ZodLiteral<"agent">;
+    relay: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    servers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        command: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        url: z.ZodOptional<z.ZodURL>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const ConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"relay">;
+    auth: z.ZodObject<{
+        issuer: z.ZodURL;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        userClaim: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    port: z.ZodOptional<z.ZodNumber>;
+    host: z.ZodOptional<z.ZodString>;
+    issuerUrl: z.ZodOptional<z.ZodURL>;
+    secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    mode: z.ZodLiteral<"agent">;
+    relay: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    servers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        command: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        url: z.ZodOptional<z.ZodURL>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>], "mode">;
+export type AuthConfig = z.infer<typeof AuthConfigSchema>;
+export type ServerEntry = z.infer<typeof ServerEntrySchema>;
+export type RelayConfig = z.infer<typeof RelayConfigSchema>;
+export type AgentConfig = z.infer<typeof AgentConfigSchema>;
+export type Config = z.infer<typeof ConfigSchema>;
+/** Message sent over the WebSocket between relay and agent. */
+export type WsMessage = {
+    type: 'tools';
+    tools: ToolDef[];
+} | {
+    type: 'request';
+    id: string;
+    method: string;
+    params: unknown;
+} | {
+    type: 'response';
+    id: string;
+    result: unknown;
+} | {
+    type: 'error';
+    id: string;
+    message: string;
+} | {
+    type: 'restart';
+};
+export type ToolDef = {
+    name: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+    annotations?: Record<string, unknown>;
+};
+export {};

package/dist/types.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigSchema = exports.AgentConfigSchema = exports.RelayConfigSchema = exports.AuthConfigSchema = void 0;
+const zod_1 = require("zod");
+exports.AuthConfigSchema = zod_1.z.object({
+    issuer: zod_1.z.url(),
+    clientId: zod_1.z.string().min(1).optional(),
+    clientSecret: zod_1.z.string().optional(),
+    scopes: zod_1.z.array(zod_1.z.string()).optional(),
+    userClaim: zod_1.z.string().optional(),
+});
+const ServerEntrySchema = zod_1.z.object({
+    command: zod_1.z.array(zod_1.z.string()).optional(),
+    url: zod_1.z.url().optional(),
+    env: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional(),
+});
+exports.RelayConfigSchema = zod_1.z.object({
+    mode: zod_1.z.literal('relay'),
+    auth: exports.AuthConfigSchema,
+    port: zod_1.z.number().int().positive().optional(),
+    host: zod_1.z.string().optional(),
+    issuerUrl: zod_1.z.url().optional(),
+    secret: zod_1.z.string().optional(),
+});
+exports.AgentConfigSchema = zod_1.z.object({
+    mode: zod_1.z.literal('agent'),
+    relay: zod_1.z.string().min(1),
+    name: zod_1.z.string().optional(),
+    servers: zod_1.z.record(zod_1.z.string(), ServerEntrySchema),
+});
+exports.ConfigSchema = zod_1.z.discriminatedUnion('mode', [exports.RelayConfigSchema, exports.AgentConfigSchema]);

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "mcp-local-tunnel",
+  "version": "1.0.0",
+  "description": "Expose local MCP servers to remote clients without opening ports.",
+  "license": "MIT",
+  "author": "Adam Jones (domdomegg)",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/domdomegg/mcp-local-tunnel.git"
+  },
+  "bin": "dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest --watch",
+    "lint": "eslint",
+    "clean": "rm -rf dist",
+    "build": "tsc --project tsconfig.build.json",
+    "start": "npm run build && node dist/index.js",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "devDependencies": {
+    "@tsconfig/node-lts": "^22.0.2",
+    "@types/express": "^5.0.6",
+    "@types/ws": "^8.18.1",
+    "eslint": "^9.32.0",
+    "eslint-config-domdomegg": "^2.0.9",
+    "tsconfig-domdomegg": "^1.0.0",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "express": "^5.2.1",
+    "jose": "^6.1.3",
+    "ws": "^8.18.0",
+    "zod": "^4.3.6"
+  }
+}