mcp-proxy 5.5.6 → 5.6.0

package/dist/index.d.ts

@@ -60,6 +60,7 @@ type ServerLike = {
   connect: Server["connect"];
 };
 declare const startHTTPServer: <T extends ServerLike>({
+  apiKey,
   createServer,
   enableJsonResponse,
   eventStore,
@@ -72,6 +73,7 @@ declare const startHTTPServer: <T extends ServerLike>({
   stateless,
   streamEndpoint
 }: {
+  apiKey?: string;
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
   eventStore?: EventStore;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Client, InMemoryEventStore, JSONRPCMessageSchema, LATEST_PROTOCOL_VERSION, ReadBuffer, Server, anyType, arrayType, booleanType, isInitializedNotification, isJSONRPCRequest, isJSONRPCResponse, numberType, objectType, proxyServer, serializeMessage, startHTTPServer, stringType } from "./stdio-CQWnvum1.js";
+import { Client, InMemoryEventStore, JSONRPCMessageSchema, LATEST_PROTOCOL_VERSION, ReadBuffer, Server, anyType, arrayType, booleanType, isInitializedNotification, isJSONRPCRequest, isJSONRPCResponse, numberType, objectType, proxyServer, serializeMessage, startHTTPServer, stringType } from "./stdio-Cm2W-uxV.js";
 import process from "node:process";
 
 //#region node_modules/.pnpm/eventsource-parser@3.0.3/node_modules/eventsource-parser/dist/index.js

package/dist/{stdio-CQWnvum1.js → stdio-Cm2W-uxV.js}

@@ -14948,6 +14948,33 @@ var StreamableHTTPServerTransport = class {
 	}
 };
 
+//#endregion
+//#region src/authentication.ts
+var AuthenticationMiddleware = class {
+	constructor(config = {}) {
+		this.config = config;
+	}
+	getUnauthorizedResponse() {
+		return {
+			body: JSON.stringify({
+				error: {
+					code: 401,
+					message: "Unauthorized: Invalid or missing API key"
+				},
+				id: null,
+				jsonrpc: "2.0"
+			}),
+			headers: { "Content-Type": "application/json" }
+		};
+	}
+	validateRequest(req) {
+		if (!this.config.apiKey) return true;
+		const apiKey = req.headers["x-api-key"];
+		if (!apiKey || typeof apiKey !== "string") return false;
+		return apiKey === this.config.apiKey;
+	}
+};
+
 //#endregion
 //#region src/startHTTPServer.ts
 const getBody = (request) => {
@@ -15173,9 +15200,10 @@ const handleSSERequest = async ({ activeTransports, createServer, endpoint, onCl
 	}
 	return false;
 };
-const startHTTPServer = async ({ createServer, enableJsonResponse, eventStore, host = "::", onClose, onConnect, onUnhandledRequest, port, sseEndpoint = "/sse", stateless, streamEndpoint = "/mcp" }) => {
+const startHTTPServer = async ({ apiKey, createServer, enableJsonResponse, eventStore, host = "::", onClose, onConnect, onUnhandledRequest, port, sseEndpoint = "/sse", stateless, streamEndpoint = "/mcp" }) => {
 	const activeSSETransports = {};
 	const activeStreamTransports = {};
+	const authMiddleware = new AuthenticationMiddleware({ apiKey });
 	/**
 	* @author https://dev.classmethod.jp/articles/mcp-sse/
 	*/
@@ -15199,6 +15227,12 @@ const startHTTPServer = async ({ createServer, enableJsonResponse, eventStore, h
 			res.writeHead(200).end("pong");
 			return;
 		}
+		if (!authMiddleware.validateRequest(req)) {
+			const authResponse = authMiddleware.getUnauthorizedResponse();
+			res.writeHead(401, authResponse.headers);
+			res.end(authResponse.body);
+			return;
+		}
 		if (sseEndpoint && await handleSSERequest({
 			activeTransports: activeSSETransports,
 			createServer,
@@ -21421,4 +21455,4 @@ function serializeMessage(message) {
 
 //#endregion
 export { Client, InMemoryEventStore, JSONRPCMessageSchema, LATEST_PROTOCOL_VERSION, ReadBuffer, Server, __commonJS, __toESM, anyType, arrayType, booleanType, isInitializedNotification, isJSONRPCRequest, isJSONRPCResponse, numberType, objectType, proxyServer, serializeMessage, startHTTPServer, stringType };
-//# sourceMappingURL=stdio-CQWnvum1.js.map
+//# sourceMappingURL=stdio-Cm2W-uxV.js.map