mcp-use 2.0.0-beta.5 → 2.0.0-beta.6

package/dist/index.js

@@ -18,8 +18,9 @@ import {
   originValidationMiddleware,
   pathnameOf,
   requireBearerAuth,
-  routeFetch
-} from "./chunk-SFI2T6TE.js";
+  routeFetch,
+  toFrameworkHandler
+} from "./chunk-PMPGMSYA.js";
 import {
   getOAuthProviderOptions,
   resolveConfiguredOAuthResource,
@@ -229,6 +230,176 @@ function toAuthenticatedRequestContext(ctx) {
   };
 }
 
+// src/middleware/cors.ts
+var DEFAULT_METHODS = ["GET", "HEAD", "POST", "OPTIONS"];
+var DEFAULT_ALLOWED_HEADERS = [
+  "Content-Type",
+  "Authorization",
+  "mcp-protocol-version",
+  "mcp-method",
+  "mcp-name"
+];
+function resolveAllowedOrigin(origin, requestOrigin) {
+  if (origin === void 0) {
+    return requestOrigin;
+  }
+  if (typeof origin === "function") {
+    return origin(requestOrigin);
+  }
+  if (origin === "*") {
+    return "*";
+  }
+  if (Array.isArray(origin)) {
+    if (requestOrigin !== null && origin.includes(requestOrigin)) {
+      return requestOrigin;
+    }
+    return null;
+  }
+  return origin;
+}
+function corsHeaders(options, request) {
+  if (request.headers.has("Access-Control-Allow-Origin")) {
+    return void 0;
+  }
+  const requestOrigin = request.headers.get("Origin");
+  const allowedOrigin = resolveAllowedOrigin(options.origin, requestOrigin);
+  if (allowedOrigin === null) {
+    return void 0;
+  }
+  const headers = {
+    "Access-Control-Allow-Origin": allowedOrigin,
+    "Access-Control-Allow-Methods": options.methods.join(", "),
+    "Access-Control-Allow-Headers": options.allowedHeaders.join(", ")
+  };
+  if (options.credentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  if (allowedOrigin !== "*") {
+    headers.Vary = "Origin";
+  }
+  return headers;
+}
+function mergeCorsHeaders(response, headers) {
+  if (response.headers.has("Access-Control-Allow-Origin")) {
+    return response;
+  }
+  const merged = new Headers(response.headers);
+  const corsHeaders2 = new Headers(headers);
+  corsHeaders2.forEach((value, key) => {
+    merged.set(key, value);
+  });
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: merged
+  });
+}
+function corsFetchMiddleware(options) {
+  const enabled = options.enabled !== false;
+  if (!enabled) {
+    return async (_request, next) => next();
+  }
+  const resolved = {
+    ...options.origin !== void 0 && { origin: options.origin },
+    methods: options.methods ?? DEFAULT_METHODS,
+    allowedHeaders: options.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS,
+    credentials: options.credentials ?? false
+  };
+  return async (request, next) => {
+    const headers = corsHeaders(resolved, request);
+    if (headers === void 0) {
+      return next();
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers });
+    }
+    const response = await next();
+    return mergeCorsHeaders(response, headers);
+  };
+}
+function isGlobalCorsEnabled(cors) {
+  return cors !== void 0 && cors.enabled !== false;
+}
+
+// src/middleware/mcp-middleware.ts
+function matchesPattern(pattern, method) {
+  if (pattern === "*") return true;
+  if (pattern.endsWith("/*")) {
+    const prefix = pattern.slice(0, -1);
+    return method.startsWith(prefix);
+  }
+  return pattern === method;
+}
+function composeMiddleware(entries, method, innerFn) {
+  const matching = entries.filter((e) => matchesPattern(e.pattern, method));
+  if (matching.length === 0) {
+    return (_ctx) => innerFn();
+  }
+  return (ctx) => {
+    let index = -1;
+    const dispatch = (i) => {
+      if (i <= index) {
+        return Promise.reject(new Error("next() called multiple times"));
+      }
+      index = i;
+      if (i === matching.length) {
+        return innerFn();
+      }
+      const entry = matching[i];
+      return entry.handler(ctx, () => dispatch(i + 1));
+    };
+    return dispatch(0);
+  };
+}
+function freezeMiddlewareContext(ctx) {
+  return Object.freeze({
+    method: ctx.method,
+    params: Object.freeze({ ...ctx.params }),
+    ...ctx.auth !== void 0 && { auth: ctx.auth },
+    state: ctx.state
+  });
+}
+async function runMcpOperation(middlewares, events, method, ctx, innerFn) {
+  dispatchMcpEvents(events, method, "before", ctx);
+  const chained = composeMiddleware(middlewares, method, innerFn);
+  const result = await chained(ctx);
+  dispatchMcpEvents(events, method, "complete", ctx, result);
+  return result;
+}
+function dispatchMcpEvents(events, method, phase, ctx, result) {
+  const frozen = freezeMiddlewareContext(ctx);
+  for (const entry of events) {
+    if (entry.phase !== phase || !matchesPattern(entry.pattern, method)) {
+      continue;
+    }
+    try {
+      if (phase === "before") {
+        entry.handler(frozen);
+      } else {
+        entry.handler(frozen, result);
+      }
+    } catch (error) {
+      console.error(
+        `[mcp-use] MCP event listener for "${entry.pattern}" (${phase}) threw:`,
+        error
+      );
+    }
+  }
+}
+function parseMcpPattern(raw) {
+  const pattern = raw.startsWith("mcp:") ? raw.slice(4) : raw;
+  if (pattern.endsWith(":complete")) {
+    return {
+      pattern: pattern.slice(0, -":complete".length),
+      phase: "complete"
+    };
+  }
+  return { pattern, phase: "before" };
+}
+function normalizeMcpMiddlewarePattern(raw) {
+  return raw.startsWith("mcp:") ? raw.slice(4) : raw;
+}
+
 // src/inspector-shell.ts
 var INSPECTOR_TAG = "beta";
 var DEFAULT_INSPECTOR_ASSETS_URL = `https://cdn.jsdelivr.net/npm/@mcp-use/inspector@${INSPECTOR_TAG}/dist/cdn/inspector.js`;
@@ -866,13 +1037,16 @@ function createViewAssetsHandler(basePath, views, options) {
     if (entry === void 0 || entry.kind !== "external") {
       return new Response("Not Found", { status: 404 });
     }
-    const [{ join }, { resolvePublicFilePath, servePublicFile }] = await Promise.all([import("path"), import("./public-route-7IK5D7V7.js")]);
+    const [{ join }, { resolvePublicFilePath, servePublicFile }] = await Promise.all([import("path"), import("./public-route-26FUVRO5.js")]);
     const viewRoot = join(projectRoot, VIEW_ASSETS_BUILD_ROOT, viewName);
     const diskPath = await resolvePublicFilePath(viewRoot, subpath);
     if (diskPath === null) {
       return new Response("Not Found", { status: 404 });
     }
-    return await servePublicFile(diskPath);
+    return await servePublicFile(
+      diskPath,
+      options?.deferCors === true ? { deferCors: true } : {}
+    );
   };
 }
 function createViewPublicHandler(basePath, views, options) {
@@ -894,30 +1068,43 @@ function createViewPublicHandler(basePath, views, options) {
     if (subpath.length === 0) {
       return new Response("Not Found", { status: 404 });
     }
-    const [{ join }, { resolvePublicFilePath, servePublicFile }] = await Promise.all([import("path"), import("./public-route-7IK5D7V7.js")]);
+    const [{ join }, { resolvePublicFilePath, servePublicFile }] = await Promise.all([import("path"), import("./public-route-26FUVRO5.js")]);
     const publicRoot = join(projectRoot, subdir);
     const diskPath = await resolvePublicFilePath(publicRoot, subpath);
     if (diskPath === null) {
       return new Response("Not Found", { status: 404 });
     }
-    return await servePublicFile(diskPath);
+    return await servePublicFile(
+      diskPath,
+      options?.deferCors === true ? { deferCors: true } : {}
+    );
   };
 }
 
 // src/views/wire.ts
-function buildToolUiMeta(viewName, visibility) {
-  if (viewName === void 0 && visibility === void 0) {
+function buildToolUiMeta(viewName, visibility, existingMetadata) {
+  if (viewName === void 0 && visibility === void 0 && existingMetadata === void 0) {
     return void 0;
   }
-  const ui = {};
-  const meta = { [UI_META_KEY]: ui };
+  const meta = { ...existingMetadata };
+  const existingUi = existingMetadata?.[UI_META_KEY];
+  const existingUiIsObject = typeof existingUi === "object" && existingUi !== null && !Array.isArray(existingUi);
+  const ui = existingUiIsObject ? { ...existingUi } : {};
   if (viewName !== void 0) {
     const resourceUri = viewResourceUri(viewName);
     ui["resourceUri"] = resourceUri;
     meta[UI_RESOURCE_URI_META_KEY] = resourceUri;
+  } else {
+    delete ui["resourceUri"];
+    delete meta[UI_RESOURCE_URI_META_KEY];
   }
   if (visibility !== void 0) {
     ui["visibility"] = [visibility];
+  } else {
+    delete ui["visibility"];
+  }
+  if (viewName !== void 0 || visibility !== void 0 || existingUiIsObject) {
+    meta[UI_META_KEY] = ui;
   }
   return meta;
 }
@@ -990,6 +1177,8 @@ var MCPServer = class _MCPServer {
   #oauthResourceConfigurationAbsent = false;
   /** Whether the mounted app validates Host headers (fixed at first mount). */
   #hostValidated = false;
+  #mcpMiddlewares = [];
+  #mcpEventListeners = [];
   /**
    * Create an MCP server from a parsed, bundled OpenAPI document.
    *
@@ -1172,7 +1361,72 @@ var MCPServer = class _MCPServer {
    */
   getHandler(options = {}) {
     const { fetch } = this.#ensureMounted("handler", void 0, options.bus);
-    return fetch;
+    return toFrameworkHandler(fetch);
+  }
+  /**
+   * Node `(req, res) => void` handler for composing with an existing
+   * `http.Server`. Uses the same internal `toNodeHandler` bridge as
+   * {@link MCPServer.listen}; MCPServer users do not need to import
+   * `mcp-use/node`.
+   *
+   * @example
+   * ```ts
+   * import { createServer } from "node:http";
+   * const httpServer = createServer(await server.getNodeHandler());
+   * httpServer.listen(3000);
+   * ```
+   */
+  async getNodeHandler() {
+    const { fetch } = this.#ensureMounted("handler");
+    const { toNodeHandler } = await import("./node-bridge.js");
+    return toNodeHandler({ fetch });
+  }
+  /**
+   * Register MCP operation middleware that intercepts JSON-RPC dispatch.
+   *
+   * Patterns use an `mcp:` prefix (for example `mcp:tools/call`, `mcp:*`).
+   * Middleware runs in registration order; call `next()` to continue the chain.
+   *
+   * @example
+   * ```ts
+   * server.use("mcp:tools/call", async (ctx, next) => {
+   *   console.log(`Calling tool: ${ctx.params.name}`);
+   *   return next();
+   * });
+   * ```
+   */
+  use(pattern, handler) {
+    this.#assertNotStarted("middleware", pattern);
+    this.#mcpMiddlewares.push({
+      pattern: normalizeMcpMiddlewarePattern(pattern),
+      handler
+    });
+    return this;
+  }
+  /**
+   * Register a read-only MCP observer. Unlike {@link MCPServer.use}, listeners
+   * cannot block, override, or mutate params. Throwing is logged and does not
+   * fail the request.
+   *
+   * Append `:complete` to run after the handler (for example
+   * `mcp:tools/call:complete`).
+   *
+   * @example
+   * ```ts
+   * server.on("mcp:tools/call", (ctx) => {
+   *   metrics.increment("tools.call", { tool: ctx.params.name });
+   * });
+   * ```
+   */
+  on(pattern, handler) {
+    this.#assertNotStarted("event listener", pattern);
+    const { pattern: stripped, phase } = parseMcpPattern(pattern);
+    this.#mcpEventListeners.push({
+      pattern: stripped,
+      phase,
+      handler
+    });
+    return this;
   }
   /**
    * Publish a tools-list change to v2 clients with active subscriptions.
@@ -1385,6 +1639,11 @@ var MCPServer = class _MCPServer {
         jsonBodyMiddleware(),
         requestLogger(this.#config.logging)
       ];
+      const corsConfig = this.#config.cors;
+      if (corsConfig !== void 0) {
+        middlewares.unshift(corsFetchMiddleware(corsConfig));
+      }
+      const deferViewCors = isGlobalCorsEnabled(corsConfig);
       if (hosts !== void 0) {
         middlewares.unshift(hostValidationMiddleware(hosts));
         middlewares.push(originValidationMiddleware(origins ?? hosts));
@@ -1445,7 +1704,8 @@ var MCPServer = class _MCPServer {
       const routes = [];
       const viewHandler = createViewPublicHandler(basePath, this.#views, {
         dev: this.#viewsDevMode,
-        projectRoot: this.#viewsProjectRoot
+        projectRoot: this.#viewsProjectRoot,
+        deferCors: deferViewCors
       });
       if (viewHandler !== void 0) {
         routes.push({
@@ -1459,7 +1719,7 @@ var MCPServer = class _MCPServer {
         const viewAssetsHandler = createViewAssetsHandler(
           basePath,
           this.#views,
-          { projectRoot: this.#viewsProjectRoot }
+          { projectRoot: this.#viewsProjectRoot, deferCors: deferViewCors }
         );
         if (viewAssetsHandler !== void 0) {
           routes.push({
@@ -1600,11 +1860,78 @@ var MCPServer = class _MCPServer {
         basePath
       );
     }
+    this.#wrapListHandlers(server);
     return server;
   }
+  #createMiddlewareContext(method, params, ctx) {
+    return {
+      method,
+      params,
+      ...ctx.http?.authInfo !== void 0 && { auth: ctx.http.authInfo },
+      state: /* @__PURE__ */ new Map()
+    };
+  }
+  #runMcpHook(method, ctx, innerFn) {
+    return runMcpOperation(
+      this.#mcpMiddlewares,
+      this.#mcpEventListeners,
+      method,
+      ctx,
+      innerFn
+    );
+  }
+  /**
+   * Wrap native SDK list handlers with the MCP middleware chain.
+   *
+   * ponytail: uses SDK-private `_requestHandlers`; pin compile-time test.
+   *
+   * @internal
+   */
+  #wrapListHandlers(server) {
+    const handlers = server.server._requestHandlers;
+    if (handlers === void 0) {
+      return;
+    }
+    const wrapListMethod = (method, resultKey) => {
+      const original = handlers.get(method);
+      if (original === void 0) {
+        return;
+      }
+      if (original.__mcpListWrapped) {
+        return;
+      }
+      const wrapped = async (request, extra) => {
+        const authInfo = extra?.http?.authInfo;
+        const mwCtx = {
+          method,
+          params: {},
+          ...authInfo !== void 0 && { auth: authInfo },
+          state: /* @__PURE__ */ new Map()
+        };
+        const innerFn = async () => {
+          const result = await original(request, extra);
+          return result[resultKey] ?? result;
+        };
+        const filtered = await this.#runMcpHook(method, mwCtx, innerFn);
+        if (Array.isArray(filtered)) {
+          return { [resultKey]: filtered };
+        }
+        return filtered;
+      };
+      wrapped.__mcpListWrapped = true;
+      handlers.set(method, wrapped);
+    };
+    wrapListMethod("tools/list", "tools");
+    wrapListMethod("resources/list", "resources");
+    wrapListMethod("prompts/list", "prompts");
+  }
   #registerTool(server, { definition, callback }) {
     const view = definition.view;
-    const toolUiMeta = buildToolUiMeta(view?.name, definition.visibility);
+    const toolMeta = buildToolUiMeta(
+      view?.name,
+      definition.visibility,
+      definition._meta
+    );
     const config = {
       ...definition.title !== void 0 && { title: definition.title },
       ...definition.description !== void 0 && {
@@ -1616,29 +1943,22 @@ var MCPServer = class _MCPServer {
       ...definition.outputSchema !== void 0 && {
         outputSchema: definition.outputSchema
       },
-      ...toolUiMeta !== void 0 && { _meta: toolUiMeta }
+      ...toolMeta !== void 0 && { _meta: toolMeta }
     };
     const wireResultMeta = view !== void 0 ? buildToolResultUiMeta(view.name) : void 0;
     const inputSchema = resolveToolInputSchema(definition);
-    if (inputSchema !== void 0) {
-      server.registerTool(
-        definition.name,
-        { ...config, inputSchema },
-        async (args, ctx) => {
-          const params = args;
-          const result = await callback(params, this.#toRequestContext(ctx));
-          if (isInputRequiredResult(result) || wireResultMeta === void 0 || result.isError === true) {
-            return result;
-          }
-          return {
-            ...result,
-            _meta: { ...result._meta, ...wireResultMeta }
-          };
-        }
+    const invokeTool = async (args, ctx) => {
+      const mwCtx = this.#createMiddlewareContext(
+        "tools/call",
+        { name: definition.name, arguments: args },
+        ctx
       );
-    } else {
-      server.registerTool(definition.name, config, async (ctx) => {
-        const result = await callback({}, this.#toRequestContext(ctx));
+      const innerFn = async () => {
+        const effectiveArgs = mwCtx.params.arguments ?? {};
+        const result = await callback(
+          effectiveArgs,
+          this.#toRequestContext(ctx)
+        );
         if (isInputRequiredResult(result) || wireResultMeta === void 0 || result.isError === true) {
           return result;
         }
@@ -1646,7 +1966,21 @@ var MCPServer = class _MCPServer {
           ...result,
           _meta: { ...result._meta, ...wireResultMeta }
         };
-      });
+      };
+      return await this.#runMcpHook("tools/call", mwCtx, innerFn);
+    };
+    if (inputSchema !== void 0) {
+      server.registerTool(
+        definition.name,
+        { ...config, inputSchema },
+        async (args, ctx) => invokeTool(args, ctx)
+      );
+    } else {
+      server.registerTool(
+        definition.name,
+        config,
+        async (ctx) => invokeTool({}, ctx)
+      );
     }
   }
   #registerViewResource(server, viewName, entry, metaOptions, basePath) {
@@ -1701,9 +2035,27 @@ var MCPServer = class _MCPServer {
         },
         ...definition.mimeType !== void 0 && {
           mimeType: definition.mimeType
+        },
+        ...definition.annotations !== void 0 && {
+          annotations: definition.annotations
+        },
+        ...definition._meta !== void 0 && {
+          _meta: { ...definition._meta }
         }
       },
-      async (uri, ctx) => callback(uri, this.#toRequestContext(ctx))
+      async (uri, ctx) => {
+        const mwCtx = this.#createMiddlewareContext(
+          "resources/read",
+          { uri: uri.href },
+          ctx
+        );
+        const innerFn = async () => callback(uri, this.#toRequestContext(ctx));
+        return await this.#runMcpHook(
+          "resources/read",
+          mwCtx,
+          innerFn
+        );
+      }
     );
   }
   #registerResourceTemplate(server, { definition, callback }) {
@@ -1720,13 +2072,31 @@ var MCPServer = class _MCPServer {
         },
         ...definition.mimeType !== void 0 && {
           mimeType: definition.mimeType
+        },
+        ...definition.annotations !== void 0 && {
+          annotations: definition.annotations
+        },
+        ...definition._meta !== void 0 && {
+          _meta: { ...definition._meta }
         }
       },
-      async (uri, variables, ctx) => callback(
-        uri,
-        variables,
-        this.#toRequestContext(ctx)
-      )
+      async (uri, variables, ctx) => {
+        const mwCtx = this.#createMiddlewareContext(
+          "resources/read",
+          { uri: uri.href },
+          ctx
+        );
+        const innerFn = async () => callback(
+          uri,
+          variables,
+          this.#toRequestContext(ctx)
+        );
+        return await this.#runMcpHook(
+          "resources/read",
+          mwCtx,
+          innerFn
+        );
+      }
     );
   }
   #viewResourceFacts(viewConfig) {
@@ -1754,17 +2124,26 @@ var MCPServer = class _MCPServer {
         description: definition.description
       }
     };
+    const invokePrompt = async (args, ctx) => {
+      const mwCtx = this.#createMiddlewareContext(
+        "prompts/get",
+        { name: definition.name, arguments: args },
+        ctx
+      );
+      const innerFn = async () => {
+        const effectiveArgs = mwCtx.params.arguments ?? {};
+        return callback(effectiveArgs, this.#toRequestContext(ctx));
+      };
+      return await this.#runMcpHook("prompts/get", mwCtx, innerFn);
+    };
     if (definition.schema !== void 0) {
       server.registerPrompt(
         definition.name,
         { ...config, argsSchema: definition.schema },
-        async (args, ctx) => {
-          const params = args;
-          return callback(params, this.#toRequestContext(ctx));
-        }
+        async (args, ctx) => invokePrompt(args, ctx)
       );
     } else {
-      const handler = async (ctx) => callback({}, this.#toRequestContext(ctx));
+      const handler = async (ctx) => invokePrompt({}, ctx);
       server.registerPrompt(
         definition.name,
         config,
@@ -1811,6 +2190,7 @@ export {
   acceptedContent,
   completable,
   composeFetch,
+  composeMiddleware,
   createMcpMount,
   createRequestStateCodec,
   getRequestBag,
@@ -1821,10 +2201,12 @@ export {
   jsonBodyMiddleware,
   matchesPath,
   matchesPathPrefix,
+  matchesPattern,
   originValidationMiddleware,
   pathnameOf,
   registerViews,
   requestLogger,
-  routeFetch
+  routeFetch,
+  toFrameworkHandler
 };
 //# sourceMappingURL=index.js.map