mcp-proxy 5.5.6 → 5.6.1

package/README.md

@@ -37,6 +37,7 @@ options:
 - `--port`: Specify the port to listen on (default: 8080)
 - `--debug`: Enable debug logging
 - `--shell`: Spawn the server via the user's shell
+- `--apiKey`: API key for authenticating requests (uses X-API-Key header)
 
 ### Passing arguments to the wrapped command
 
@@ -83,6 +84,64 @@ npx mcp-proxy --port 8080 --stateless --server stream tsx server.js
 - **Request isolation**: When you need complete independence between requests
 - **Simple deployments**: When you don't need to maintain connection state
 
+### API Key Authentication
+
+MCP Proxy supports optional API key authentication to secure your endpoints. When enabled, clients must provide a valid API key in the `X-API-Key` header to access the proxy.
+
+#### Enabling Authentication
+
+Authentication is disabled by default for backward compatibility. To enable it, provide an API key via:
+
+**Command-line:**
+```bash
+npx mcp-proxy --port 8080 --apiKey "your-secret-key" tsx server.js
+```
+
+**Environment variable:**
+```bash
+export MCP_PROXY_API_KEY="your-secret-key"
+npx mcp-proxy --port 8080 tsx server.js
+```
+
+#### Client Configuration
+
+Clients must include the API key in the `X-API-Key` header:
+
+```typescript
+// For streamable HTTP transport
+const transport = new StreamableHTTPClientTransport(
+  new URL('http://localhost:8080/mcp'),
+  {
+    headers: {
+      'X-API-Key': 'your-secret-key'
+    }
+  }
+);
+
+// For SSE transport
+const transport = new SSEClientTransport(
+  new URL('http://localhost:8080/sse'),
+  {
+    headers: {
+      'X-API-Key': 'your-secret-key'
+    }
+  }
+);
+```
+
+#### Exempt Endpoints
+
+The following endpoints do not require authentication:
+- `/ping` - Health check endpoint
+- `OPTIONS` requests - CORS preflight requests
+
+#### Security Notes
+
+- **Use HTTPS in production**: API keys should only be transmitted over secure connections
+- **Keep keys secure**: Never commit API keys to version control
+- **Generate strong keys**: Use cryptographically secure random strings for API keys
+- **Rotate keys regularly**: Change API keys periodically for better security
+
 ### Node.js SDK
 
 The Node.js SDK provides several utilities that are used to create a proxy.
@@ -137,6 +196,7 @@ Options:
 - `sseEndpoint`: SSE endpoint path (default: "/sse", set to null to disable)
 - `streamEndpoint`: Streamable HTTP endpoint path (default: "/mcp", set to null to disable)
 - `stateless`: Enable stateless mode for HTTP streamable transport (default: false)
+- `apiKey`: API key for authenticating requests (optional)
 - `onConnect`: Callback when a server connects (optional)
 - `onClose`: Callback when a server disconnects (optional)
 - `onUnhandledRequest`: Callback for unhandled HTTP requests (optional)

package/dist/bin/mcp-proxy.d.ts

@@ -1,2 +1 @@
-#!/usr/bin/env node
-export {};
+export { };

package/dist/bin/mcp-proxy.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Client, InMemoryEventStore, ReadBuffer, Server, __commonJS, __toESM, proxyServer, serializeMessage, startHTTPServer } from "../stdio-CQWnvum1.js";
+import { Client, InMemoryEventStore, ReadBuffer, Server, __commonJS, __toESM, proxyServer, serializeMessage, startHTTPServer } from "../stdio-D0Lv8ytu.js";
 import { createRequire } from "node:module";
 import { basename, dirname, extname, join, normalize, relative, resolve } from "path";
 import { format, inspect } from "util";
@@ -507,7 +507,6 @@ var UI = class {
 				remainingWidth -= col.width;
 				return col.width;
 			}
-			return void 0;
 		});
 		const unsetWidth = unset ? Math.floor(remainingWidth / unset) : 0;
 		return widths.map((w, i) => {
@@ -560,8 +559,7 @@ function cliui(opts, _mixin) {
 //#endregion
 //#region node_modules/.pnpm/ansi-regex@6.1.0/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
-	const ST = "(?:\\u0007|\\u001B\\u005C|\\u009C)";
-	const pattern = [`[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?${ST})`, "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
+	const pattern = [`[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?(?:\\u0007|\\u001B\\u005C|\\u009C))`, "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
 	return new RegExp(pattern, onlyFirst ? void 0 : "g");
 }
 
@@ -825,8 +823,7 @@ const wrapWord = (rows, word, columns) => {
 		}
 		if (ESCAPES.has(character)) {
 			isInsideEscape = true;
-			const ansiEscapeLinkCandidate = characters.slice(index + 1, index + 1 + ANSI_ESCAPE_LINK.length).join("");
-			isInsideLinkEscape = ansiEscapeLinkCandidate === ANSI_ESCAPE_LINK;
+			isInsideLinkEscape = characters.slice(index + 1, index + 1 + ANSI_ESCAPE_LINK.length).join("") === ANSI_ESCAPE_LINK;
 		}
 		if (isInsideEscape) {
 			if (isInsideLinkEscape) {
@@ -878,8 +875,7 @@ const exec = (string, columns, options = {}) => {
 		if (options.hard && lengths[index] > columns) {
 			const remainingColumns = columns - rowLength;
 			const breaksStartingThisLine = 1 + Math.floor((lengths[index] - remainingColumns - 1) / columns);
-			const breaksStartingNextLine = Math.floor((lengths[index] - 1) / columns);
-			if (breaksStartingNextLine < breaksStartingThisLine) rows.push("");
+			if (Math.floor((lengths[index] - 1) / columns) < breaksStartingThisLine) rows.push("");
 			wrapWord(rows, word, columns);
 			continue;
 		}
@@ -939,8 +935,8 @@ function ui(opts) {
 //#region node_modules/.pnpm/escalade@3.2.0/node_modules/escalade/sync/index.mjs
 function sync_default(start, callback) {
 	let dir = resolve(".", start);
-	let tmp, stats = statSync(dir);
-	if (!stats.isDirectory()) dir = dirname(dir);
+	let tmp;
+	if (!statSync(dir).isDirectory()) dir = dirname(dir);
 	while (true) {
 		tmp = callback(dir, readdirSync(dir));
 		if (tmp) return resolve(dir, tmp);
@@ -957,8 +953,7 @@ function sync_default(start, callback) {
 * SPDX-License-Identifier: ISC
 */
 function camelCase(str) {
-	const isCamelCase = str !== str.toLowerCase() && str !== str.toUpperCase();
-	if (!isCamelCase) str = str.toLowerCase();
+	if (!(str !== str.toLowerCase() && str !== str.toUpperCase())) str = str.toLowerCase();
 	if (str.indexOf("-") === -1 && str.indexOf("_") === -1) return str;
 	else {
 		let camelcase = "";
@@ -1116,12 +1111,11 @@ var YargsParser = class {
 		[].concat(opts.array || []).filter(Boolean).forEach(function(opt) {
 			const key = typeof opt === "object" ? opt.key : opt;
 			const assignment = Object.keys(opt).map(function(key$1) {
-				const arrayFlagKeys = {
+				return {
 					boolean: "bools",
 					string: "strings",
 					number: "numbers"
-				};
-				return arrayFlagKeys[key$1];
+				}[key$1];
 			}).filter(Boolean).pop();
 			if (assignment) flags[assignment][key] = true;
 			flags.arrays[key] = true;
@@ -1381,20 +1375,17 @@ var YargsParser = class {
 				keyProperties = keyProperties.concat(a);
 				if (!(flags.aliases[key] || []).includes(keyProperties.join("."))) setKey(argv$1, keyProperties, value);
 			});
-			if (checkAllAliases(key, flags.normalize) && !checkAllAliases(key, flags.arrays)) {
-				const keys = [key].concat(flags.aliases[key] || []);
-				keys.forEach(function(key$1) {
-					Object.defineProperty(argvReturn, key$1, {
-						enumerable: true,
-						get() {
-							return val;
-						},
-						set(value$1) {
-							val = typeof value$1 === "string" ? mixin.normalize(value$1) : value$1;
-						}
-					});
+			if (checkAllAliases(key, flags.normalize) && !checkAllAliases(key, flags.arrays)) [key].concat(flags.aliases[key] || []).forEach(function(key$1) {
+				Object.defineProperty(argvReturn, key$1, {
+					enumerable: true,
+					get() {
+						return val;
+					},
+					set(value$1) {
+						val = typeof value$1 === "string" ? mixin.normalize(value$1) : value$1;
+					}
 				});
-			}
+			});
 		}
 		function addNewAlias(key, alias) {
 			if (!(flags.aliases[key] && flags.aliases[key].length)) {
@@ -1421,8 +1412,7 @@ var YargsParser = class {
 		function maybeCoerceNumber(key, value) {
 			if (!configuration["parse-positional-numbers"] && key === "_") return value;
 			if (!checkAllAliases(key, flags.strings) && !checkAllAliases(key, flags.bools) && !Array.isArray(value)) {
-				const shouldCoerceNumber = looksLikeNumber(value) && configuration["parse-numbers"] && Number.isSafeInteger(Math.floor(parseFloat(`${value}`)));
-				if (shouldCoerceNumber || !isUndefined(value) && checkAllAliases(key, flags.numbers)) value = Number(value);
+				if (looksLikeNumber(value) && configuration["parse-numbers"] && Number.isSafeInteger(Math.floor(parseFloat(`${value}`))) || !isUndefined(value) && checkAllAliases(key, flags.numbers)) value = Number(value);
 			}
 			return value;
 		}
@@ -1594,14 +1584,12 @@ var YargsParser = class {
 		}
 		function hasAnyFlag(key) {
 			const flagsKeys = Object.keys(flags);
-			const toCheck = [].concat(flagsKeys.map((k) => flags[k]));
-			return toCheck.some(function(flag) {
+			return [].concat(flagsKeys.map((k) => flags[k])).some(function(flag) {
 				return Array.isArray(flag) ? flag.includes(key) : flag[key];
 			});
 		}
 		function hasFlagsMatching(arg, ...patterns) {
-			const toCheck = [].concat(...patterns);
-			return toCheck.some(function(pattern) {
+			return [].concat(...patterns).some(function(pattern) {
 				const match = arg.match(pattern);
 				return match && hasAnyFlag(match[1]);
 			});
@@ -1628,25 +1616,19 @@ var YargsParser = class {
 			arg = arg.replace(/^-{3,}/, "--");
 			if (arg.match(negative)) return false;
 			if (hasAllShortFlags(arg)) return false;
-			const flagWithEquals = /^-+([^=]+?)=[\s\S]*$/;
-			const normalFlag = /^-+([^=]+?)$/;
-			const flagEndingInHyphen = /^-+([^=]+?)-$/;
-			const flagEndingInDigits = /^-+([^=]+?\d+)$/;
-			const flagEndingInNonWordCharacters = /^-+([^=]+?)\W+.*$/;
-			return !hasFlagsMatching(arg, flagWithEquals, negatedBoolean, normalFlag, flagEndingInHyphen, flagEndingInDigits, flagEndingInNonWordCharacters);
+			return !hasFlagsMatching(arg, /^-+([^=]+?)=[\s\S]*$/, negatedBoolean, /^-+([^=]+?)$/, /^-+([^=]+?)-$/, /^-+([^=]+?\d+)$/, /^-+([^=]+?)\W+.*$/);
 		}
 		function defaultValue(key) {
 			if (!checkAllAliases(key, flags.bools) && !checkAllAliases(key, flags.counts) && `${key}` in defaults) return defaults[key];
 			else return defaultForType(guessType$1(key));
 		}
 		function defaultForType(type) {
-			const def = {
+			return {
 				[DefaultValuesForTypeKey.BOOLEAN]: true,
 				[DefaultValuesForTypeKey.STRING]: "",
 				[DefaultValuesForTypeKey.NUMBER]: void 0,
 				[DefaultValuesForTypeKey.ARRAY]: []
-			};
-			return def[type];
+			}[type];
 		}
 		function guessType$1(key) {
 			let type = DefaultValuesForTypeKey.BOOLEAN;
@@ -1690,16 +1672,13 @@ function combineAliases(aliases) {
 	});
 	while (change) {
 		change = false;
-		for (let i = 0; i < aliasArrays.length; i++) for (let ii = i + 1; ii < aliasArrays.length; ii++) {
-			const intersect = aliasArrays[i].filter(function(v) {
-				return aliasArrays[ii].indexOf(v) !== -1;
-			});
-			if (intersect.length) {
-				aliasArrays[i] = aliasArrays[i].concat(aliasArrays[ii]);
-				aliasArrays.splice(ii, 1);
-				change = true;
-				break;
-			}
+		for (let i = 0; i < aliasArrays.length; i++) for (let ii = i + 1; ii < aliasArrays.length; ii++) if (aliasArrays[i].filter(function(v) {
+			return aliasArrays[ii].indexOf(v) !== -1;
+		}).length) {
+			aliasArrays[i] = aliasArrays[i].concat(aliasArrays[ii]);
+			aliasArrays.splice(ii, 1);
+			change = true;
+			break;
 		}
 	}
 	aliasArrays.forEach(function(aliasArray) {
@@ -1735,8 +1714,7 @@ var _a, _b, _c;
 const minNodeVersion = process && process.env && process.env.YARGS_MIN_NODE_VERSION ? Number(process.env.YARGS_MIN_NODE_VERSION) : 20;
 const nodeVersion = (_b = (_a = process === null || process === void 0 ? void 0 : process.versions) === null || _a === void 0 ? void 0 : _a.node) !== null && _b !== void 0 ? _b : (_c = process === null || process === void 0 ? void 0 : process.version) === null || _c === void 0 ? void 0 : _c.slice(1);
 if (nodeVersion) {
-	const major = Number(nodeVersion.match(/^([^.]+)/)[1]);
-	if (major < minNodeVersion) throw Error(`yargs parser supports a minimum Node.js version of ${minNodeVersion}. Read our version support policy: https://github.com/yargs/yargs-parser#supported-nodejs-versions`);
+	if (Number(nodeVersion.match(/^([^.]+)/)[1]) < minNodeVersion) throw Error(`yargs parser supports a minimum Node.js version of ${minNodeVersion}. Read our version support policy: https://github.com/yargs/yargs-parser#supported-nodejs-versions`);
 }
 const env = process ? process.env : {};
 const require$1 = createRequire ? createRequire(import.meta.url) : void 0;
@@ -1755,8 +1733,7 @@ const parser = new YargsParser({
 	}
 });
 const yargsParser = function Parser(args, opts) {
-	const result = parser.parse(args.slice(), opts);
-	return result.argv;
+	return parser.parse(args.slice(), opts).argv;
 };
 yargsParser.detailed = function(args, opts) {
 	return parser.parse(args.slice(), opts);
@@ -1842,10 +1819,7 @@ var Y18N = class {
 		if (typeof args[args.length - 1] === "function") cb = args.pop();
 		if (!this.cache[this.locale]) this._readLocaleFile();
 		let str = quantity === 1 ? singular : plural;
-		if (this.cache[this.locale][singular]) {
-			const entry = this.cache[this.locale][singular];
-			str = entry[quantity === 1 ? "one" : "other"];
-		}
+		if (this.cache[this.locale][singular]) str = this.cache[this.locale][singular][quantity === 1 ? "one" : "other"];
 		if (!this.cache[this.locale][singular] && this.updateFiles) {
 			this.cache[this.locale][singular] = {
 				one: singular,
@@ -2042,8 +2016,7 @@ var YError = class YError extends Error {
 //#endregion
 //#region node_modules/.pnpm/yargs@18.0.0/node_modules/yargs/build/lib/parse-command.js
 function parseCommand(cmd) {
-	const extraSpacesStrippedCommand = cmd.replace(/\s{2,}/g, " ");
-	const splitCommand = extraSpacesStrippedCommand.split(/\s+(?![^[]*]|[^<]*>)/);
+	const splitCommand = cmd.replace(/\s{2,}/g, " ").split(/\s+(?![^[]*]|[^<]*>)/);
 	const bregex = /\.*[\][<>]/g;
 	const firstCommand = splitCommand.shift();
 	if (!firstCommand) throw new Error(`No command found in: ${cmd}`);
@@ -2105,16 +2078,14 @@ function argsert(arg1, arg2, arg3) {
 		parsed.demanded.forEach((demanded) => {
 			const arg = args.shift();
 			const observedType = guessType(arg);
-			const matchingTypes = demanded.cmd.filter((type) => type === observedType || type === "*");
-			if (matchingTypes.length === 0) argumentTypeError(observedType, demanded.cmd, position);
+			if (demanded.cmd.filter((type) => type === observedType || type === "*").length === 0) argumentTypeError(observedType, demanded.cmd, position);
 			position += 1;
 		});
 		parsed.optional.forEach((optional) => {
 			if (args.length === 0) return;
 			const arg = args.shift();
 			const observedType = guessType(arg);
-			const matchingTypes = optional.cmd.filter((type) => type === observedType || type === "*");
-			if (matchingTypes.length === 0) argumentTypeError(observedType, optional.cmd, position);
+			if (optional.cmd.filter((type) => type === observedType || type === "*").length === 0) argumentTypeError(observedType, optional.cmd, position);
 			position += 1;
 		});
 	} catch (err) {
@@ -2264,8 +2235,7 @@ var CommandInstance = class {
 				const joined = this.shim.path.join(fullDirPath, file);
 				const module$1 = req(joined);
 				const extendableModule = Object.create(null, Object.getOwnPropertyDescriptors({ ...module$1 }));
-				const visited = visit(extendableModule, joined, file);
-				if (visited) {
+				if (visit(extendableModule, joined, file)) {
 					if (this.requireCache.has(joined)) continue;
 					else this.requireCache.add(joined);
 					if (!extendableModule.command) extendableModule.command = this.shim.path.basename(joined, this.shim.path.extname(joined));
@@ -2526,7 +2496,6 @@ var CommandInstance = class {
 		else if (!isCommandBuilderDefinition(builder)) Object.keys(builder).forEach((key) => {
 			yargs.option(key, builder[key]);
 		});
-		return void 0;
 	}
 	extractDesc({ describe, description, desc }) {
 		for (const test of [
@@ -2835,8 +2804,7 @@ function usage(yargs, shim$2) {
 				switches
 			};
 		});
-		const shortSwitchesUsed = displayedGroups.filter(({ groupName }) => groupName !== self.getPositionalGroupName()).some(({ normalizedKeys, switches }) => !normalizedKeys.every((key) => isLongSwitch(switches[key])));
-		if (shortSwitchesUsed) displayedGroups.filter(({ groupName }) => groupName !== self.getPositionalGroupName()).forEach(({ normalizedKeys, switches }) => {
+		if (displayedGroups.filter(({ groupName }) => groupName !== self.getPositionalGroupName()).some(({ normalizedKeys, switches }) => !normalizedKeys.every((key) => isLongSwitch(switches[key])))) displayedGroups.filter(({ groupName }) => groupName !== self.getPositionalGroupName()).forEach(({ normalizedKeys, switches }) => {
 			normalizedKeys.forEach((key) => {
 				if (isLongSwitch(switches[key])) switches[key] = addIndentation(switches[key], 4);
 			});
@@ -2974,14 +2942,12 @@ function usage(yargs, shim$2) {
 	self.showHelp = (level) => {
 		const logger = yargs.getInternalMethods().getLoggerInstance();
 		if (!level) level = "error";
-		const emit = typeof level === "function" ? level : logger[level];
-		emit(self.help());
+		(typeof level === "function" ? level : logger[level])(self.help());
 	};
 	self.functionDescription = (fn) => {
-		const description = fn.name ? shim$2.Parser.decamelize(fn.name, "-") : __("generated-value");
 		return [
 			"(",
-			description,
+			fn.name ? shim$2.Parser.decamelize(fn.name, "-") : __("generated-value"),
 			")"
 		].join("");
 	};
@@ -3023,8 +2989,7 @@ function usage(yargs, shim$2) {
 	self.showVersion = (level) => {
 		const logger = yargs.getInternalMethods().getLoggerInstance();
 		if (!level) level = "error";
-		const emit = typeof level === "function" ? level : logger[level];
-		emit(version);
+		(typeof level === "function" ? level : logger[level])(version);
 	};
 	self.reset = function reset(localLookup) {
 		failMessage = null;
@@ -3195,8 +3160,7 @@ var Completion = class {
 			const positionalKeys = this.yargs.getGroups()[this.usage.getPositionalGroupName()] || [];
 			Object.keys(options.key).forEach((key) => {
 				const negable = !!options.configuration["boolean-negation"] && options.boolean.includes(key);
-				const isPositionalKey = positionalKeys.includes(key);
-				if (!isPositionalKey && !options.hiddenOptions.includes(key) && !this.argsContainKey(args, key, negable)) this.completeOptionKey(key, completions, current, negable && !!options.default[key]);
+				if (!positionalKeys.includes(key) && !options.hiddenOptions.includes(key) && !this.argsContainKey(args, key, negable)) this.completeOptionKey(key, completions, current, negable && !!options.default[key]);
 			});
 		}
 	}
@@ -3347,8 +3311,7 @@ function validation(yargs, usage$1, shim$2) {
 	const self = {};
 	self.nonOptionCount = function nonOptionCount(argv$1) {
 		const demandedCommands = yargs.getDemandedCommands();
-		const positionalCount = argv$1._.length + (argv$1["--"] ? argv$1["--"].length : 0);
-		const _s = positionalCount - yargs.getInternalMethods().getContext().commands.length;
+		const _s = argv$1._.length + (argv$1["--"] ? argv$1["--"].length : 0) - yargs.getInternalMethods().getContext().commands.length;
 		if (demandedCommands._ && (_s < demandedCommands._.min || _s > demandedCommands._.max)) {
 			if (_s < demandedCommands._.min) if (demandedCommands._.minMsg !== void 0) usage$1.fail(demandedCommands._.minMsg ? demandedCommands._.minMsg.replace(/\$0/g, _s.toString()).replace(/\$1/, demandedCommands._.min.toString()) : null);
 			else usage$1.fail(__n("Not enough non-option arguments: got %s, need at least %s", "Not enough non-option arguments: got %s, need at least %s", _s, _s.toString(), demandedCommands._.min.toString()));
@@ -3387,8 +3350,7 @@ function validation(yargs, usage$1, shim$2) {
 			if (!commandKeys.includes("" + key)) unknown.push("" + key);
 		});
 		if (checkPositionals) {
-			const demandedCommands = yargs.getDemandedCommands();
-			const maxNonOptDemanded = ((_a$1 = demandedCommands._) === null || _a$1 === void 0 ? void 0 : _a$1.max) || 0;
+			const maxNonOptDemanded = ((_a$1 = yargs.getDemandedCommands()._) === null || _a$1 === void 0 ? void 0 : _a$1.max) || 0;
 			const expected = currentContext.commands.length + maxNonOptDemanded;
 			if (expected < argv$1._.length) argv$1._.slice(expected).forEach((key) => {
 				key = String(key);
@@ -4520,8 +4482,7 @@ var YargsInstance = class {
 		this.locale(locale.replace(/[.:].*/, ""));
 	}
 	[kGuessVersion]() {
-		const obj = this[kPkgUp]();
-		return obj.version || "unknown";
+		return this[kPkgUp]().version || "unknown";
 	}
 	[kParsePositionalNumbers](argv$1) {
 		const args = argv$1["--"] ? argv$1["--"] : argv$1._;
@@ -4537,7 +4498,7 @@ var YargsInstance = class {
 			if (__classPrivateFieldGet(this, _YargsInstance_shim, "f").path.extname(startDir)) startDir = __classPrivateFieldGet(this, _YargsInstance_shim, "f").path.dirname(startDir);
 			const pkgJsonPath = __classPrivateFieldGet(this, _YargsInstance_shim, "f").findUp(startDir, (dir, names) => {
 				if (names.includes("package.json")) return "package.json";
-				else return void 0;
+				else return;
 			});
 			assertNotStrictEqual(pkgJsonPath, void 0, __classPrivateFieldGet(this, _YargsInstance_shim, "f"));
 			obj = JSON.parse(__classPrivateFieldGet(this, _YargsInstance_shim, "f").readFileSync(pkgJsonPath, "utf8"));
@@ -4670,8 +4631,7 @@ var YargsInstance = class {
 		if (calledFromCommand) return argv$1;
 		if (isPromise(argv$1)) return argv$1;
 		if (!populateDoubleDash) argv$1 = this[kCopyDoubleDash](argv$1);
-		const parsePositionalNumbers = this[kGetParserConfiguration]()["parse-positional-numbers"] || this[kGetParserConfiguration]()["parse-positional-numbers"] === void 0;
-		if (parsePositionalNumbers) argv$1 = this[kParsePositionalNumbers](argv$1);
+		if (this[kGetParserConfiguration]()["parse-positional-numbers"] || this[kGetParserConfiguration]()["parse-positional-numbers"] === void 0) argv$1 = this[kParsePositionalNumbers](argv$1);
 		if (runGlobalMiddleware) argv$1 = applyMiddleware(argv$1, this, __classPrivateFieldGet(this, _YargsInstance_globalMiddleware, "f").getMiddleware(), false);
 		return argv$1;
 	}
@@ -4766,8 +4726,7 @@ var YargsInstance = class {
 			this[kGuessLocale]();
 			if (shortCircuit) return this[kPostProcess](argv$1, populateDoubleDash, !!calledFromCommand, false);
 			if (__classPrivateFieldGet(this, _YargsInstance_helpOpt, "f")) {
-				const helpCmds = [__classPrivateFieldGet(this, _YargsInstance_helpOpt, "f")].concat(aliases[__classPrivateFieldGet(this, _YargsInstance_helpOpt, "f")] || []).filter((k) => k.length > 1);
-				if (helpCmds.includes("" + argv$1._[argv$1._.length - 1])) {
+				if ([__classPrivateFieldGet(this, _YargsInstance_helpOpt, "f")].concat(aliases[__classPrivateFieldGet(this, _YargsInstance_helpOpt, "f")] || []).filter((k) => k.length > 1).includes("" + argv$1._[argv$1._.length - 1])) {
 					argv$1._.pop();
 					helpOptSet = true;
 				}
@@ -5057,6 +5016,10 @@ const argv = await yargs_default(hideBin(process.argv)).scriptName("mcp-proxy").
 	describe: "The arguments to pass to the command",
 	type: "string"
 }).env("MCP_PROXY").parserConfiguration({ "populate--": true }).options({
+	apiKey: {
+		describe: "API key for authenticating requests (uses X-API-Key header)",
+		type: "string"
+	},
 	debug: {
 		default: false,
 		describe: "Enable debug logging",
@@ -5142,6 +5105,7 @@ const proxy = async () => {
 		return server$1;
 	};
 	const server = await startHTTPServer({
+		apiKey: argv.apiKey,
 		createServer,
 		eventStore: new InMemoryEventStore(),
 		host: argv.host,