mcp-proxy 6.5.2 → 6.5.4

package/dist/index.d.mts

@@ -113,6 +113,7 @@ declare const startHTTPServer: <T extends ServerLike>({
   enableJsonResponse,
   eventStore,
   host,
+  keepAliveTimeout,
   oauth,
   onClose,
   onConnect,
@@ -132,6 +133,7 @@ declare const startHTTPServer: <T extends ServerLike>({
   enableJsonResponse?: boolean;
   eventStore?: EventStore;
   host?: string;
+  keepAliveTimeout?: number;
   oauth?: AuthConfig["oauth"];
   onClose?: (server: T) => Promise<void>;
   onConnect?: (server: T) => Promise<void>;

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as NEVER, S as _coercedNumber, T as AuthenticationMiddleware, _ as looseObject, a as startHTTPServer, b as string, c as LATEST_PROTOCOL_VERSION, d as isJSONRPCResultResponse, f as ZodNumber, g as literal, h as boolean, i as Client, l as isInitializedNotification, m as array, n as serializeMessage, o as proxyServer, p as any, r as Server, s as JSONRPCMessageSchema, t as ReadBuffer, u as isJSONRPCRequest, v as number$1, w as InMemoryEventStore, x as url, y as object } from "./stdio-DLwYts_5.mjs";
+import { C as NEVER, S as _coercedNumber, T as AuthenticationMiddleware, _ as looseObject, a as startHTTPServer, b as string, c as LATEST_PROTOCOL_VERSION, d as isJSONRPCResultResponse, f as ZodNumber, g as literal, h as boolean, i as Client, l as isInitializedNotification, m as array, n as serializeMessage, o as proxyServer, p as any, r as Server, s as JSONRPCMessageSchema, t as ReadBuffer, u as isJSONRPCRequest, v as number$1, w as InMemoryEventStore, x as url, y as object } from "./stdio-BQunCFor.mjs";
 import process from "node:process";
 
 //#region node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/compat.js

package/dist/{stdio-DLwYts_5.mjs → stdio-BQunCFor.mjs}

@@ -15856,6 +15856,7 @@ var StreamableHTTPServerTransport = class {
 
 //#endregion
 //#region src/startHTTPServer.ts
+const DEFAULT_KEEP_ALIVE_TIMEOUT = 3e5;
 const getBody = (request) => {
 	return new Promise((resolve$2) => {
 		const bodyParts = [];
@@ -15883,6 +15884,16 @@ const createJsonRpcErrorResponse = (code, message) => {
 		jsonrpc: "2.0"
 	});
 };
+const getRequestId = (body) => {
+	if (typeof body !== "object" || body === null || Array.isArray(body) || !("id" in body)) return null;
+	return body.id;
+};
+const isJsonRpcMessage = (message) => {
+	return JSONRPCMessageSchema.safeParse(message).success;
+};
+const isJsonRpcBody = (body) => {
+	return Array.isArray(body) ? body.every(isJsonRpcMessage) : isJsonRpcMessage(body);
+};
 const getWWWAuthenticateHeader = (oauth, options) => {
 	if (!oauth) return;
 	const params = [];
@@ -15902,6 +15913,23 @@ const getWWWAuthenticateHeader = (oauth, options) => {
 	if (params.length === 0) return;
 	return `Bearer ${params.join(", ")}`;
 };
+const sendSessionUnauthorizedResponse = ({ body, oauth, res }) => {
+	const message = "Unauthorized: No valid session ID provided";
+	res.setHeader("Content-Type", "application/json");
+	const wwwAuthHeader = getWWWAuthenticateHeader(oauth, {
+		error: "invalid_token",
+		error_description: message
+	});
+	if (wwwAuthHeader) res.setHeader("WWW-Authenticate", wwwAuthHeader);
+	res.writeHead(401).end(JSON.stringify({
+		error: {
+			code: -32e3,
+			message
+		},
+		id: getRequestId(body),
+		jsonrpc: "2.0"
+	}));
+};
 const isScopeChallengeError = (error$1) => {
 	return typeof error$1 === "object" && error$1 !== null && "name" in error$1 && error$1.name === "InsufficientScopeError" && "data" in error$1 && typeof error$1.data === "object" && error$1.data !== null && "error" in error$1.data && error$1.data.error === "insufficient_scope";
 };
@@ -16022,6 +16050,14 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 			if (sessionId) {
 				const activeTransport = activeTransports[sessionId];
 				if (!activeTransport) {
+					if (authenticate && isJsonRpcBody(body)) {
+						sendSessionUnauthorizedResponse({
+							body,
+							oauth,
+							res
+						});
+						return true;
+					}
 					res.setHeader("Content-Type", "application/json");
 					res.writeHead(404).end(createJsonRpcErrorResponse(-32001, "Session not found"));
 					return true;
@@ -16117,6 +16153,14 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 				await transport.handleRequest(req, res, body);
 				return true;
 			} else {
+				if (authenticate && isJsonRpcBody(body)) {
+					sendSessionUnauthorizedResponse({
+						body,
+						oauth,
+						res
+					});
+					return true;
+				}
 				res.setHeader("Content-Type", "application/json");
 				res.writeHead(400).end(createJsonRpcErrorResponse(-32e3, "Bad Request: No valid session ID provided"));
 				return true;
@@ -16144,10 +16188,24 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 				res.writeHead(405, { Allow: "POST" }).end("Method Not Allowed");
 				return true;
 			}
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("No sessionId");
 			return true;
 		}
 		if (!activeTransport) {
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("No active transport");
 			return true;
 		}
@@ -16161,12 +16219,26 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 		console.log("[mcp-proxy] received delete request");
 		const sessionId = req.headers["mcp-session-id"];
 		if (!sessionId) {
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("Invalid or missing sessionId");
 			return true;
 		}
 		console.log("[mcp-proxy] received delete request for session", sessionId);
 		const activeTransport = activeTransports[sessionId];
 		if (!activeTransport) {
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("No active transport");
 			return true;
 		}
@@ -16236,7 +16308,7 @@ const handleSSERequest = async ({ activeTransports, createServer, endpoint, onCl
 	}
 	return false;
 };
-const startHTTPServer = async ({ apiKey, authenticate, cors, createServer, enableJsonResponse, eventStore, host = "::", oauth, onClose, onConnect, onUnhandledRequest, port, sseEndpoint = "/sse", sslCa, sslCert, sslKey, stateless, streamEndpoint = "/mcp" }) => {
+const startHTTPServer = async ({ apiKey, authenticate, cors, createServer, enableJsonResponse, eventStore, host = "::", keepAliveTimeout = DEFAULT_KEEP_ALIVE_TIMEOUT, oauth, onClose, onConnect, onUnhandledRequest, port, sseEndpoint = "/sse", sslCa, sslCert, sslKey, stateless, streamEndpoint = "/mcp" }) => {
 	const activeSSETransports = {};
 	const activeStreamTransports = {};
 	const authMiddleware = new AuthenticationMiddleware({
@@ -16321,6 +16393,8 @@ const startHTTPServer = async ({ apiKey, authenticate, cors, createServer, enabl
 		}
 		httpServer = https.createServer(options, requestListener);
 	} else httpServer = http.createServer(requestListener);
+	httpServer.keepAliveTimeout = keepAliveTimeout;
+	httpServer.headersTimeout = Math.max(httpServer.headersTimeout, keepAliveTimeout + 1e3);
 	await new Promise((resolve$2) => {
 		httpServer.listen(port, host, () => {
 			resolve$2(void 0);
@@ -24821,4 +24895,4 @@ function serializeMessage(message) {
 
 //#endregion
 export { NEVER as C, __toESM as D, __commonJSMin as E, _coercedNumber as S, AuthenticationMiddleware as T, looseObject as _, startHTTPServer as a, string as b, LATEST_PROTOCOL_VERSION as c, isJSONRPCResultResponse as d, ZodNumber as f, literal as g, boolean as h, Client as i, isInitializedNotification as l, array as m, serializeMessage as n, proxyServer as o, any as p, Server as r, JSONRPCMessageSchema as s, ReadBuffer as t, isJSONRPCRequest as u, number as v, InMemoryEventStore as w, url as x, object as y };
-//# sourceMappingURL=stdio-DLwYts_5.mjs.map
+//# sourceMappingURL=stdio-BQunCFor.mjs.map