mcp-proxy 5.11.2 → 5.12.1

package/src/startHTTPServer.ts

@@ -81,7 +81,9 @@ const getWWWAuthenticateHeader = (
 
   // Add resource_metadata if configured
   if (oauth.protectedResource?.resource) {
-    params.push(`resource_metadata="${oauth.protectedResource.resource}/.well-known/oauth-protected-resource"`);
+    params.push(
+      `resource_metadata="${oauth.protectedResource.resource}/.well-known/oauth-protected-resource"`,
+    );
   }
 
   // Add error from options or config (options takes precedence)
@@ -91,7 +93,8 @@ const getWWWAuthenticateHeader = (
   }
 
   // Add error_description from options or config (options takes precedence)
-  const error_description = options?.error_description || oauth.error_description;
+  const error_description =
+    options?.error_description || oauth.error_description;
   if (error_description) {
     // Escape quotes in error description
     const escaped = error_description.replace(/"/g, '\\"');
@@ -118,6 +121,30 @@ const getWWWAuthenticateHeader = (
   return `Bearer ${params.join(", ")}`;
 };
 
+// Helper function to detect scope challenge errors
+const isScopeChallengeError = (
+  error: unknown,
+): error is {
+  data: {
+    error: string;
+    errorDescription?: string;
+    requiredScopes: string[];
+  };
+  name: string;
+} => {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "name" in error &&
+    error.name === "InsufficientScopeError" &&
+    "data" in error &&
+    typeof error.data === "object" &&
+    error.data !== null &&
+    "error" in error.data &&
+    error.data.error === "insufficient_scope"
+  );
+};
+
 // Helper function to handle Response errors and send appropriate HTTP response
 const handleResponseError = async (
   error: unknown,
@@ -125,11 +152,12 @@ const handleResponseError = async (
 ): Promise<boolean> => {
   // Check if it's a Response-like object (duck typing)
   // The instanceof check may fail due to different Response implementations across module boundaries
-  const isResponseLike = error &&
-    typeof error === 'object' &&
-    'status' in error &&
-    'headers' in error &&
-    'statusText' in error;
+  const isResponseLike =
+    error &&
+    typeof error === "object" &&
+    "status" in error &&
+    "headers" in error &&
+    "statusText" in error;
 
   if (isResponseLike || error instanceof Response) {
     const responseError = error as Response;
@@ -188,7 +216,8 @@ const applyCorsHeaders = (
 
   // Default CORS configuration for backward compatibility
   const defaultCorsOptions: CorsOptions = {
-    allowedHeaders: "Content-Type, Authorization, Accept, Mcp-Session-Id, Last-Event-Id",
+    allowedHeaders:
+      "Content-Type, Authorization, Accept, Mcp-Session-Id, Last-Event-Id",
     credentials: true,
     exposedHeaders: ["Mcp-Session-Id"],
     methods: ["GET", "POST", "OPTIONS"],
@@ -224,7 +253,9 @@ const applyCorsHeaders = (
           ? origin.origin
           : "false";
       } else if (typeof finalCorsOptions.origin === "function") {
-        allowedOrigin = finalCorsOptions.origin(origin.origin) ? origin.origin : "false";
+        allowedOrigin = finalCorsOptions.origin(origin.origin)
+          ? origin.origin
+          : "false";
       }
     }
 
@@ -234,30 +265,43 @@ const applyCorsHeaders = (
 
     // Handle credentials
     if (finalCorsOptions.credentials !== undefined) {
-      res.setHeader("Access-Control-Allow-Credentials", finalCorsOptions.credentials.toString());
+      res.setHeader(
+        "Access-Control-Allow-Credentials",
+        finalCorsOptions.credentials.toString(),
+      );
     }
 
     // Handle methods
     if (finalCorsOptions.methods) {
-      res.setHeader("Access-Control-Allow-Methods", finalCorsOptions.methods.join(", "));
+      res.setHeader(
+        "Access-Control-Allow-Methods",
+        finalCorsOptions.methods.join(", "),
+      );
     }
 
     // Handle allowed headers
     if (finalCorsOptions.allowedHeaders) {
-      const allowedHeaders = typeof finalCorsOptions.allowedHeaders === "string"
-        ? finalCorsOptions.allowedHeaders
-        : finalCorsOptions.allowedHeaders.join(", ");
+      const allowedHeaders =
+        typeof finalCorsOptions.allowedHeaders === "string"
+          ? finalCorsOptions.allowedHeaders
+          : finalCorsOptions.allowedHeaders.join(", ");
       res.setHeader("Access-Control-Allow-Headers", allowedHeaders);
     }
 
     // Handle exposed headers
     if (finalCorsOptions.exposedHeaders) {
-      res.setHeader("Access-Control-Expose-Headers", finalCorsOptions.exposedHeaders.join(", "));
+      res.setHeader(
+        "Access-Control-Expose-Headers",
+        finalCorsOptions.exposedHeaders.join(", "),
+      );
     }
 
     // Handle max age
     if (finalCorsOptions.maxAge !== undefined) {
-      res.setHeader("Access-Control-Max-Age", finalCorsOptions.maxAge.toString());
+      res.setHeader(
+        "Access-Control-Max-Age",
+        finalCorsOptions.maxAge.toString(),
+      );
     }
   } catch (error) {
     console.error("[mcp-proxy] error parsing origin", error);
@@ -267,6 +311,7 @@ const applyCorsHeaders = (
 const handleStreamRequest = async <T extends ServerLike>({
   activeTransports,
   authenticate,
+  authMiddleware,
   createServer,
   enableJsonResponse,
   endpoint,
@@ -283,6 +328,7 @@ const handleStreamRequest = async <T extends ServerLike>({
     { server: T; transport: StreamableHTTPServerTransport }
   >;
   authenticate?: (request: http.IncomingMessage) => Promise<unknown>;
+  authMiddleware: AuthenticationMiddleware;
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
   endpoint: string;
@@ -298,6 +344,7 @@ const handleStreamRequest = async <T extends ServerLike>({
     req.method === "POST" &&
     new URL(req.url!, "http://localhost").pathname === endpoint
   ) {
+    let body: unknown;
     try {
       const sessionId = Array.isArray(req.headers["mcp-session-id"])
         ? req.headers["mcp-session-id"][0]
@@ -307,7 +354,7 @@ const handleStreamRequest = async <T extends ServerLike>({
 
       let server: T;
 
-      const body = await getBody(req);
+      body = await getBody(req);
 
       // Per-request authentication in stateless mode
       if (stateless && authenticate) {
@@ -315,10 +362,18 @@ const handleStreamRequest = async <T extends ServerLike>({
           const authResult = await authenticate(req);
 
           // Check for both falsy AND { authenticated: false } pattern
-          if (!authResult || (typeof authResult === 'object' && 'authenticated' in authResult && !authResult.authenticated)) {
+          if (
+            !authResult ||
+            (typeof authResult === "object" &&
+              "authenticated" in authResult &&
+              !authResult.authenticated)
+          ) {
             // Extract error message if available
             const errorMessage =
-              authResult && typeof authResult === 'object' && 'error' in authResult && typeof authResult.error === 'string'
+              authResult &&
+              typeof authResult === "object" &&
+              "error" in authResult &&
+              typeof authResult.error === "string"
                 ? authResult.error
                 : "Unauthorized: Authentication failed";
 
@@ -337,11 +392,11 @@ const handleStreamRequest = async <T extends ServerLike>({
               JSON.stringify({
                 error: {
                   code: -32000,
-                  message: errorMessage
+                  message: errorMessage,
                 },
                 id: (body as { id?: unknown })?.id ?? null,
-                jsonrpc: "2.0"
-              })
+                jsonrpc: "2.0",
+              }),
             );
             return true;
           }
@@ -352,7 +407,10 @@ const handleStreamRequest = async <T extends ServerLike>({
           }
 
           // Extract error details from thrown errors
-          const errorMessage = error instanceof Error ? error.message : "Unauthorized: Authentication error";
+          const errorMessage =
+            error instanceof Error
+              ? error.message
+              : "Unauthorized: Authentication error";
           console.error("Authentication error:", error);
           res.setHeader("Content-Type", "application/json");
 
@@ -369,11 +427,11 @@ const handleStreamRequest = async <T extends ServerLike>({
             JSON.stringify({
               error: {
                 code: -32000,
-                message: errorMessage
+                message: errorMessage,
               },
               id: (body as { id?: unknown })?.id ?? null,
-              jsonrpc: "2.0"
-            })
+              jsonrpc: "2.0",
+            }),
           );
           return true;
         }
@@ -439,11 +497,13 @@ const handleStreamRequest = async <T extends ServerLike>({
           }
 
           // Detect authentication errors and return HTTP 401
-          const errorMessage = error instanceof Error ? error.message : String(error);
-          const isAuthError = errorMessage.includes('Authentication') ||
-                             errorMessage.includes('Invalid JWT') ||
-                             errorMessage.includes('Token') ||
-                             errorMessage.includes('Unauthorized');
+          const errorMessage =
+            error instanceof Error ? error.message : String(error);
+          const isAuthError =
+            errorMessage.includes("Authentication") ||
+            errorMessage.includes("Invalid JWT") ||
+            errorMessage.includes("Token") ||
+            errorMessage.includes("Unauthorized");
 
           if (isAuthError) {
             res.setHeader("Content-Type", "application/json");
@@ -457,14 +517,16 @@ const handleStreamRequest = async <T extends ServerLike>({
               res.setHeader("WWW-Authenticate", wwwAuthHeader);
             }
 
-            res.writeHead(401).end(JSON.stringify({
-              error: {
-                code: -32000,
-                message: errorMessage
-              },
-              id: (body as { id?: unknown })?.id ?? null,
-              jsonrpc: "2.0"
-            }));
+            res.writeHead(401).end(
+              JSON.stringify({
+                error: {
+                  code: -32000,
+                  message: errorMessage,
+                },
+                id: (body as { id?: unknown })?.id ?? null,
+                jsonrpc: "2.0",
+              }),
+            );
             return true;
           }
 
@@ -502,11 +564,13 @@ const handleStreamRequest = async <T extends ServerLike>({
           }
 
           // Detect authentication errors and return HTTP 401
-          const errorMessage = error instanceof Error ? error.message : String(error);
-          const isAuthError = errorMessage.includes('Authentication') ||
-                             errorMessage.includes('Invalid JWT') ||
-                             errorMessage.includes('Token') ||
-                             errorMessage.includes('Unauthorized');
+          const errorMessage =
+            error instanceof Error ? error.message : String(error);
+          const isAuthError =
+            errorMessage.includes("Authentication") ||
+            errorMessage.includes("Invalid JWT") ||
+            errorMessage.includes("Token") ||
+            errorMessage.includes("Unauthorized");
 
           if (isAuthError) {
             res.setHeader("Content-Type", "application/json");
@@ -520,14 +584,16 @@ const handleStreamRequest = async <T extends ServerLike>({
               res.setHeader("WWW-Authenticate", wwwAuthHeader);
             }
 
-            res.writeHead(401).end(JSON.stringify({
-              error: {
-                code: -32000,
-                message: errorMessage
-              },
-              id: (body as { id?: unknown })?.id ?? null,
-              jsonrpc: "2.0"
-            }));
+            res.writeHead(401).end(
+              JSON.stringify({
+                error: {
+                  code: -32000,
+                  message: errorMessage,
+                },
+                id: (body as { id?: unknown })?.id ?? null,
+                jsonrpc: "2.0",
+              }),
+            );
             return true;
           }
 
@@ -566,6 +632,19 @@ const handleStreamRequest = async <T extends ServerLike>({
 
       return true;
     } catch (error) {
+      // Check for scope challenge errors
+      if (isScopeChallengeError(error)) {
+        const response = authMiddleware.getScopeChallengeResponse(
+          error.data.requiredScopes,
+          error.data.errorDescription,
+          (body as { id?: unknown })?.id,
+        );
+
+        res.writeHead(response.statusCode, response.headers);
+        res.end(response.body);
+        return true;
+      }
+
       console.error("[mcp-proxy] error handling request", error);
 
       res.setHeader("Content-Type", "application/json");
@@ -858,6 +937,7 @@ export const startHTTPServer = async <T extends ServerLike>({
       (await handleStreamRequest({
         activeTransports: activeStreamTransports,
         authenticate,
+        authMiddleware,
         createServer,
         enableJsonResponse,
         endpoint: streamEndpoint,

package/src/startStdioServer.test.ts

@@ -19,9 +19,8 @@ describe("startStdioServer.test.ts", () => {
   let proc: ChildProcess;
 
   beforeEach(async () => {
-    const serverPath = require.resolve(
-      "@modelcontextprotocol/sdk/examples/server/sseAndStreamableHttpCompatibleServer.js",
-    );
+    const serverPath =
+      require.resolve("@modelcontextprotocol/sdk/examples/server/sseAndStreamableHttpCompatibleServer.js");
     proc = fork(serverPath, [], {
       stdio: "pipe",
     });
@@ -83,9 +82,11 @@ describe("startStdioServer.test.ts", () => {
         {
           description:
             "Starts sending periodic notifications for testing resumability",
+          execution: {
+            taskSupport: "forbidden",
+          },
           inputSchema: {
             $schema: "http://json-schema.org/draft-07/schema#",
-            additionalProperties: false,
             properties: {
               count: {
                 default: 50,
@@ -177,9 +178,11 @@ describe("startStdioServer.test.ts", () => {
         {
           description:
             "Starts sending periodic notifications for testing resumability",
+          execution: {
+            taskSupport: "forbidden",
+          },
           inputSchema: {
             $schema: "http://json-schema.org/draft-07/schema#",
-            additionalProperties: false,
             properties: {
               count: {
                 default: 50,