mcp-proxy 6.5.3 → 6.5.5

package/dist/index.d.mts

@@ -42,15 +42,31 @@ declare class AuthenticationMiddleware {
 }
 //#endregion
 //#region src/InMemoryEventStore.d.ts
+interface InMemoryEventStoreOptions {
+  /**
+   * Maximum number of events retained across all streams before the oldest
+   * are evicted (FIFO). Bounds memory use; older reconnect attempts beyond
+   * this window fall back to a fresh (non-resumed) stream instead of a replay.
+   *
+   * @default 1000
+   */
+  maxEvents?: number;
+}
 /**
  * Simple in-memory implementation of the EventStore interface for resumability
  * This is primarily intended for examples and testing, not for production use
  * where a persistent storage solution would be more appropriate.
  */
 declare class InMemoryEventStore implements EventStore {
+  /**
+   * The number of events currently retained (for observability/testing).
+   */
+  get size(): number;
   private events;
   private lastTimestamp;
   private lastTimestampCounter;
+  private readonly maxEvents;
+  constructor(options?: InMemoryEventStoreOptions);
   /**
    * Replays events that occurred after a specific event ID
    * Implements EventStore.replayEventsAfter
@@ -90,6 +106,13 @@ declare const proxyServer: ({
 }) => Promise<void>;
 //#endregion
 //#region src/startHTTPServer.d.ts
+/**
+ * `false` disables the resumability event store entirely (no replay-on-
+ * reconnect, no retained state). Omitted/`undefined` creates a fresh,
+ * bounded `InMemoryEventStore` per session - see `eventStoreMaxEvents`.
+ * Pass an `EventStore` instance to use a shared or custom-backed store.
+ */
+type EventStoreOption = EventStore | false;
 interface CorsOptions {
   allowedHeaders?: string | string[];
   credentials?: boolean;
@@ -112,6 +135,7 @@ declare const startHTTPServer: <T extends ServerLike>({
   createServer,
   enableJsonResponse,
   eventStore,
+  eventStoreMaxEvents,
   host,
   keepAliveTimeout,
   oauth,
@@ -131,7 +155,22 @@ declare const startHTTPServer: <T extends ServerLike>({
   cors?: boolean | CorsOptions;
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
-  eventStore?: EventStore;
+  /**
+   * Event store for the streamable HTTP transport's resumability support.
+   * Pass `false` to disable resumability entirely (recommended for
+   * request/response-only deployments that don't need replay-on-reconnect).
+   * Omit to get a fresh, bounded `InMemoryEventStore` per session - see
+   * `eventStoreMaxEvents`. Pass an `EventStore` instance to bring your own
+   * (e.g. a persistent, cross-process store); it will be shared across all
+   * sessions handled by this server.
+   */
+  eventStore?: EventStoreOption;
+  /**
+   * Caps how many events the auto-created per-session `InMemoryEventStore`
+   * retains (oldest evicted first) before it's overridden by an explicit
+   * `eventStore`. Bounds memory for long-lived sessions. Default: 1000.
+   */
+  eventStoreMaxEvents?: number;
   host?: string;
   keepAliveTimeout?: number;
   oauth?: AuthConfig["oauth"];
@@ -185,5 +224,5 @@ type TransportEvent = {
 };
 declare const tapTransport: (transport: Transport, eventHandler: (event: TransportEvent) => void) => Transport;
 //#endregion
-export { type AuthConfig, AuthenticationMiddleware, type CorsOptions, InMemoryEventStore, ServerType, proxyServer, startHTTPServer, startStdioServer, tapTransport };
+export { type AuthConfig, AuthenticationMiddleware, type CorsOptions, type EventStoreOption, InMemoryEventStore, type InMemoryEventStoreOptions, ServerType, proxyServer, startHTTPServer, startStdioServer, tapTransport };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as NEVER, S as _coercedNumber, T as AuthenticationMiddleware, _ as looseObject, a as startHTTPServer, b as string, c as LATEST_PROTOCOL_VERSION, d as isJSONRPCResultResponse, f as ZodNumber, g as literal, h as boolean, i as Client, l as isInitializedNotification, m as array, n as serializeMessage, o as proxyServer, p as any, r as Server, s as JSONRPCMessageSchema, t as ReadBuffer, u as isJSONRPCRequest, v as number$1, w as InMemoryEventStore, x as url, y as object } from "./stdio-DNR9B0BZ.mjs";
+import { C as NEVER, S as _coercedNumber, T as AuthenticationMiddleware, _ as looseObject, a as startHTTPServer, b as string, c as LATEST_PROTOCOL_VERSION, d as isJSONRPCResultResponse, f as ZodNumber, g as literal, h as boolean, i as Client, l as isInitializedNotification, m as array, n as serializeMessage, o as proxyServer, p as any, r as Server, s as JSONRPCMessageSchema, t as ReadBuffer, u as isJSONRPCRequest, v as number$1, w as InMemoryEventStore, x as url, y as object } from "./stdio-Be0Fx2iV.mjs";
 import process from "node:process";
 
 //#region node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/compat.js

package/dist/{stdio-DNR9B0BZ.mjs → stdio-Be0Fx2iV.mjs}

@@ -113,15 +113,28 @@ var AuthenticationMiddleware = class {
 
 //#endregion
 //#region src/InMemoryEventStore.ts
+const DEFAULT_MAX_EVENTS = 1e3;
 /**
 * Simple in-memory implementation of the EventStore interface for resumability
 * This is primarily intended for examples and testing, not for production use
 * where a persistent storage solution would be more appropriate.
 */
 var InMemoryEventStore = class {
+	/**
+	* The number of events currently retained (for observability/testing).
+	*/
+	get size() {
+		return this.events.size;
+	}
 	events = /* @__PURE__ */ new Map();
 	lastTimestamp = 0;
 	lastTimestampCounter = 0;
+	maxEvents;
+	constructor(options = {}) {
+		const maxEvents = options.maxEvents ?? DEFAULT_MAX_EVENTS;
+		if (!(maxEvents >= 1)) throw new Error("maxEvents must be at least 1");
+		this.maxEvents = maxEvents;
+	}
 	/**
 	* Replays events that occurred after a specific event ID
 	* Implements EventStore.replayEventsAfter
@@ -152,6 +165,11 @@ var InMemoryEventStore = class {
 			message,
 			streamId
 		});
+		while (this.events.size > this.maxEvents) {
+			const oldestEventId = this.events.keys().next().value;
+			if (oldestEventId === void 0) break;
+			this.events.delete(oldestEventId);
+		}
 		return eventId;
 	}
 	/**
@@ -15857,6 +15875,10 @@ var StreamableHTTPServerTransport = class {
 //#endregion
 //#region src/startHTTPServer.ts
 const DEFAULT_KEEP_ALIVE_TIMEOUT = 3e5;
+const resolveEventStore = (eventStore, maxEvents) => {
+	if (eventStore === false) return;
+	return eventStore ?? new InMemoryEventStore({ maxEvents });
+};
 const getBody = (request) => {
 	return new Promise((resolve$2) => {
 		const bodyParts = [];
@@ -15884,6 +15906,16 @@ const createJsonRpcErrorResponse = (code, message) => {
 		jsonrpc: "2.0"
 	});
 };
+const getRequestId = (body) => {
+	if (typeof body !== "object" || body === null || Array.isArray(body) || !("id" in body)) return null;
+	return body.id;
+};
+const isJsonRpcMessage = (message) => {
+	return JSONRPCMessageSchema.safeParse(message).success;
+};
+const isJsonRpcBody = (body) => {
+	return Array.isArray(body) ? body.every(isJsonRpcMessage) : isJsonRpcMessage(body);
+};
 const getWWWAuthenticateHeader = (oauth, options) => {
 	if (!oauth) return;
 	const params = [];
@@ -15903,6 +15935,23 @@ const getWWWAuthenticateHeader = (oauth, options) => {
 	if (params.length === 0) return;
 	return `Bearer ${params.join(", ")}`;
 };
+const sendSessionUnauthorizedResponse = ({ body, oauth, res }) => {
+	const message = "Unauthorized: No valid session ID provided";
+	res.setHeader("Content-Type", "application/json");
+	const wwwAuthHeader = getWWWAuthenticateHeader(oauth, {
+		error: "invalid_token",
+		error_description: message
+	});
+	if (wwwAuthHeader) res.setHeader("WWW-Authenticate", wwwAuthHeader);
+	res.writeHead(401).end(JSON.stringify({
+		error: {
+			code: -32e3,
+			message
+		},
+		id: getRequestId(body),
+		jsonrpc: "2.0"
+	}));
+};
 const isScopeChallengeError = (error$1) => {
 	return typeof error$1 === "object" && error$1 !== null && "name" in error$1 && error$1.name === "InsufficientScopeError" && "data" in error$1 && typeof error$1.data === "object" && error$1.data !== null && "error" in error$1.data && error$1.data.error === "insufficient_scope";
 };
@@ -15971,7 +16020,7 @@ const applyCorsHeaders = (req, res, corsOptions) => {
 		console.error("[mcp-proxy] error parsing origin", error$1);
 	}
 };
-const handleStreamRequest = async ({ activeTransports, authenticate, authMiddleware, createServer, enableJsonResponse, endpoint, eventStore, oauth, onClose, onConnect, req, res, stateless }) => {
+const handleStreamRequest = async ({ activeTransports, authenticate, authMiddleware, createServer, enableJsonResponse, endpoint, eventStore, eventStoreMaxEvents, oauth, onClose, onConnect, req, res, stateless }) => {
 	if (req.method === "POST" && new URL(req.url, "http://localhost").pathname === endpoint) {
 		let body;
 		try {
@@ -16023,6 +16072,14 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 			if (sessionId) {
 				const activeTransport = activeTransports[sessionId];
 				if (!activeTransport) {
+					if (authenticate && isJsonRpcBody(body)) {
+						sendSessionUnauthorizedResponse({
+							body,
+							oauth,
+							res
+						});
+						return true;
+					}
 					res.setHeader("Content-Type", "application/json");
 					res.writeHead(404).end(createJsonRpcErrorResponse(-32001, "Session not found"));
 					return true;
@@ -16033,7 +16090,7 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 			} else if (!sessionId && isInitializeRequest(body)) {
 				transport = new StreamableHTTPServerTransport({
 					enableJsonResponse,
-					eventStore: eventStore || new InMemoryEventStore(),
+					eventStore: resolveEventStore(eventStore, eventStoreMaxEvents),
 					onsessioninitialized: (_sessionId) => {
 						if (!stateless && _sessionId) activeTransports[_sessionId] = {
 							server,
@@ -16084,7 +16141,7 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 			} else if (stateless && !sessionId && !isInitializeRequest(body)) {
 				transport = new StreamableHTTPServerTransport({
 					enableJsonResponse,
-					eventStore: eventStore || new InMemoryEventStore(),
+					eventStore: resolveEventStore(eventStore, eventStoreMaxEvents),
 					onsessioninitialized: () => {},
 					sessionIdGenerator: void 0
 				});
@@ -16118,6 +16175,14 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 				await transport.handleRequest(req, res, body);
 				return true;
 			} else {
+				if (authenticate && isJsonRpcBody(body)) {
+					sendSessionUnauthorizedResponse({
+						body,
+						oauth,
+						res
+					});
+					return true;
+				}
 				res.setHeader("Content-Type", "application/json");
 				res.writeHead(400).end(createJsonRpcErrorResponse(-32e3, "Bad Request: No valid session ID provided"));
 				return true;
@@ -16145,10 +16210,24 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 				res.writeHead(405, { Allow: "POST" }).end("Method Not Allowed");
 				return true;
 			}
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("No sessionId");
 			return true;
 		}
 		if (!activeTransport) {
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("No active transport");
 			return true;
 		}
@@ -16162,12 +16241,26 @@ const handleStreamRequest = async ({ activeTransports, authenticate, authMiddlew
 		console.log("[mcp-proxy] received delete request");
 		const sessionId = req.headers["mcp-session-id"];
 		if (!sessionId) {
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("Invalid or missing sessionId");
 			return true;
 		}
 		console.log("[mcp-proxy] received delete request for session", sessionId);
 		const activeTransport = activeTransports[sessionId];
 		if (!activeTransport) {
+			if (authenticate) {
+				sendSessionUnauthorizedResponse({
+					oauth,
+					res
+				});
+				return true;
+			}
 			res.writeHead(400).end("No active transport");
 			return true;
 		}
@@ -16237,7 +16330,7 @@ const handleSSERequest = async ({ activeTransports, createServer, endpoint, onCl
 	}
 	return false;
 };
-const startHTTPServer = async ({ apiKey, authenticate, cors, createServer, enableJsonResponse, eventStore, host = "::", keepAliveTimeout = DEFAULT_KEEP_ALIVE_TIMEOUT, oauth, onClose, onConnect, onUnhandledRequest, port, sseEndpoint = "/sse", sslCa, sslCert, sslKey, stateless, streamEndpoint = "/mcp" }) => {
+const startHTTPServer = async ({ apiKey, authenticate, cors, createServer, enableJsonResponse, eventStore, eventStoreMaxEvents, host = "::", keepAliveTimeout = DEFAULT_KEEP_ALIVE_TIMEOUT, oauth, onClose, onConnect, onUnhandledRequest, port, sseEndpoint = "/sse", sslCa, sslCert, sslKey, stateless, streamEndpoint = "/mcp" }) => {
 	const activeSSETransports = {};
 	const activeStreamTransports = {};
 	const authMiddleware = new AuthenticationMiddleware({
@@ -16293,6 +16386,7 @@ const startHTTPServer = async ({ apiKey, authenticate, cors, createServer, enabl
 			enableJsonResponse,
 			endpoint: streamEndpoint,
 			eventStore,
+			eventStoreMaxEvents,
 			oauth,
 			onClose,
 			onConnect,
@@ -24824,4 +24918,4 @@ function serializeMessage(message) {
 
 //#endregion
 export { NEVER as C, __toESM as D, __commonJSMin as E, _coercedNumber as S, AuthenticationMiddleware as T, looseObject as _, startHTTPServer as a, string as b, LATEST_PROTOCOL_VERSION as c, isJSONRPCResultResponse as d, ZodNumber as f, literal as g, boolean as h, Client as i, isInitializedNotification as l, array as m, serializeMessage as n, proxyServer as o, any as p, Server as r, JSONRPCMessageSchema as s, ReadBuffer as t, isJSONRPCRequest as u, number as v, InMemoryEventStore as w, url as x, object as y };
-//# sourceMappingURL=stdio-DNR9B0BZ.mjs.map
+//# sourceMappingURL=stdio-Be0Fx2iV.mjs.map