mcp-proxy 5.7.0 → 5.8.1

package/src/startHTTPServer.ts

@@ -93,6 +93,7 @@ const cleanupServer = async <T extends ServerLike>(
 
 const handleStreamRequest = async <T extends ServerLike>({
   activeTransports,
+  authenticate,
   createServer,
   enableJsonResponse,
   endpoint,
@@ -107,6 +108,7 @@ const handleStreamRequest = async <T extends ServerLike>({
     string,
     { server: T; transport: StreamableHTTPServerTransport }
   >;
+  authenticate?: (request: http.IncomingMessage) => Promise<unknown>;
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
   endpoint: string;
@@ -132,6 +134,51 @@ const handleStreamRequest = async <T extends ServerLike>({
 
       const body = await getBody(req);
 
+      // Per-request authentication in stateless mode
+      if (stateless && authenticate) {
+        try {
+          const authResult = await authenticate(req);
+
+          // Check for both falsy AND { authenticated: false } pattern
+          if (!authResult || (typeof authResult === 'object' && 'authenticated' in authResult && !authResult.authenticated)) {
+            // Extract error message if available
+            const errorMessage =
+              authResult && typeof authResult === 'object' && 'error' in authResult && typeof authResult.error === 'string'
+                ? authResult.error
+                : "Unauthorized: Authentication failed";
+
+            res.setHeader("Content-Type", "application/json");
+            res.writeHead(401).end(
+              JSON.stringify({
+                error: {
+                  code: -32000,
+                  message: errorMessage
+                },
+                id: (body as { id?: unknown })?.id ?? null,
+                jsonrpc: "2.0"
+              })
+            );
+            return true;
+          }
+        } catch (error) {
+          // Extract error details from thrown errors
+          const errorMessage = error instanceof Error ? error.message : "Unauthorized: Authentication error";
+          console.error("Authentication error:", error);
+          res.setHeader("Content-Type", "application/json");
+          res.writeHead(401).end(
+            JSON.stringify({
+              error: {
+                code: -32000,
+                message: errorMessage
+              },
+              id: (body as { id?: unknown })?.id ?? null,
+              jsonrpc: "2.0"
+            })
+          );
+          return true;
+        }
+      }
+
       if (sessionId) {
         const activeTransport = activeTransports[sessionId];
         if (!activeTransport) {
@@ -186,6 +233,26 @@ const handleStreamRequest = async <T extends ServerLike>({
         try {
           server = await createServer(req);
         } catch (error) {
+          // Detect authentication errors and return HTTP 401
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          const isAuthError = errorMessage.includes('Authentication') ||
+                             errorMessage.includes('Invalid JWT') ||
+                             errorMessage.includes('Token') ||
+                             errorMessage.includes('Unauthorized');
+
+          if (isAuthError) {
+            res.setHeader("Content-Type", "application/json");
+            res.writeHead(401).end(JSON.stringify({
+              error: {
+                code: -32000,
+                message: errorMessage
+              },
+              id: (body as { id?: unknown })?.id ?? null,
+              jsonrpc: "2.0"
+            }));
+            return true;
+          }
+
           if (handleResponseError(error, res)) {
             return true;
           }
@@ -218,6 +285,26 @@ const handleStreamRequest = async <T extends ServerLike>({
         try {
           server = await createServer(req);
         } catch (error) {
+          // Detect authentication errors and return HTTP 401
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          const isAuthError = errorMessage.includes('Authentication') ||
+                             errorMessage.includes('Invalid JWT') ||
+                             errorMessage.includes('Token') ||
+                             errorMessage.includes('Unauthorized');
+
+          if (isAuthError) {
+            res.setHeader("Content-Type", "application/json");
+            res.writeHead(401).end(JSON.stringify({
+              error: {
+                code: -32000,
+                message: errorMessage
+              },
+              id: (body as { id?: unknown })?.id ?? null,
+              jsonrpc: "2.0"
+            }));
+            return true;
+          }
+
           if (handleResponseError(error, res)) {
             return true;
           }
@@ -457,6 +544,7 @@ const handleSSERequest = async <T extends ServerLike>({
 
 export const startHTTPServer = async <T extends ServerLike>({
   apiKey,
+  authenticate,
   createServer,
   enableJsonResponse,
   eventStore,
@@ -470,6 +558,7 @@ export const startHTTPServer = async <T extends ServerLike>({
   streamEndpoint = "/mcp",
 }: {
   apiKey?: string;
+  authenticate?: (request: http.IncomingMessage) => Promise<unknown>;
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
   eventStore?: EventStore;
@@ -508,8 +597,8 @@ export const startHTTPServer = async <T extends ServerLike>({
         res.setHeader("Access-Control-Allow-Origin", origin.origin);
         res.setHeader("Access-Control-Allow-Credentials", "true");
         res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "*");
-        res.setHeader("Access-Control-Expose-Headers", "mcp-session-id");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Accept, Mcp-Session-Id, Last-Event-Id");
+        res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
       } catch (error) {
         console.error("[mcp-proxy] error parsing origin", error);
       }
@@ -553,6 +642,7 @@ export const startHTTPServer = async <T extends ServerLike>({
       streamEndpoint &&
       (await handleStreamRequest({
         activeTransports: activeStreamTransports,
+        authenticate,
         createServer,
         enableJsonResponse,
         endpoint: streamEndpoint,