openapi-dynamic-mcp 0.1.3 → 0.2.1

package/README.md

@@ -1,38 +1,64 @@
-# openapi-dynamic-mcp
-
-TypeScript MCP stdio server that loads one or more OpenAPI 3.x specs from YAML config and exposes generic tools for API discovery and request execution.
-
-## What It Does
-
-- Runs as a single MCP stdio server for multiple APIs.
-- Supports OpenAPI `3.x` local spec files.
-- Exposes generic MCP tools:
-  - `list_apis`
-  - `list_api_endpoints`
-  - `get_api_endpoint`
-  - `get_api_schema`
-  - `make_endpoint_request`
-- Supports auth:
-  - `apiKey`
-  - OAuth2 client credentials (`oauth2`)
-  - combined OpenAPI security requirements (AND inside object, OR across array)
-- Supports per-API environment overrides for:
-  - base URL
-  - extra headers
-
-## Requirements
+<div align="center">
+  <h1>openapi-dynamic-mcp</h1>
+  
+  <p>
+    <strong>A TypeScript MCP stdio server that seamlessly loads multiple OpenAPI 2.x and 3.x specifications and exposes powerful, generic tools for AI agents.</strong>
+  </p>
+
+  <p>
+    <a href="https://www.npmjs.com/package/openapi-dynamic-mcp"><img src="https://img.shields.io/npm/v/openapi-dynamic-mcp?color=blue&style=flat-square" alt="NPM Version" /></a>
+    <a href="https://github.com/mayorandrew/openapi-dynamic-mcp/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/openapi-dynamic-mcp?style=flat-square" alt="License" /></a>
+    <img src="https://img.shields.io/node/v/openapi-dynamic-mcp?style=flat-square" alt="Node.js Version" />
+  </p>
+</div>
+
+## 📖 Table of Contents
+
+- [What It Does](#-what-it-does)
+- [Requirements](#-requirements)
+- [Quick Start](#-quick-start)
+- [Client Configuration](#-client-configuration)
+  - [Claude Desktop / Claude Code](#claude-desktop--claude-code)
+  - [Cursor](#cursor)
+- [Configuration](#-configuration)
+  - [Environment Variables](#-environment-variables)
+- [Advanced Features](#-advanced-features)
+  - [File Uploads and Binary Data](#file-uploads-and-binary-data)
+- [Available MCP Tools](#-available-mcp-tools)
+- [Development](#-development)
+- [License](#-license)
+
+## ✨ What It Does
+
+`openapi-dynamic-mcp` runs as a single Model Context Protocol (MCP) server over `stdio` for multiple APIs. It acts as a bridge between your LLMs and your API, taking care of parsing, request execution, authentication, and error handling.
+
+- 🔄 **Multi-API Support**: Run a single server for any number of APIs simultaneously.
+- 📄 **Specification Compatibility**: Seamlessly supports both OpenAPI `3.x` and Swagger `2.0` specifications.
+- 🔌 **Dynamic Resolution**: Supports local spec files via `specPath` or remote URL specs via `specUrl`.
+- 🔐 **Robust Authentication**: Handles API Keys, HTTP `bearer`/`basic`, and OAuth2 client credentials out-of-the-box. Supports complex OpenAPI security requirements (AND/OR logic).
+- 🌍 **Environment Overrides**: Easily override base URLs, tokens, and extra headers per API.
+- 🔁 **Resilience**: Configurable exponential retries on `429 Too Many Requests` responses.
+- ✅ **Tested**: Continuously tested against real-world APIs.
+
+## 🚀 Requirements
 
 - Node.js `20+`
 
-## Quick Start
+## 🏃 Quick Start
+
+Run the server directly using `npx`:
 
 ```bash
-npx openapi-dynamic-mcp --config ./examples/config.yaml
+npx -y openapi-dynamic-mcp@latest --config ./config.yaml
 ```
 
-## Client Configuration
+## 🔌 Client Configuration
+
+To use this with your favorite MCP-compatible client, add it to their respective config files.
 
-### Claude Code
+### Claude Desktop / Claude Code
+
+Add the following to your `claude_desktop_config.json` or equivalent:
 
 ```json
 {
@@ -58,6 +84,8 @@ npx openapi-dynamic-mcp --config ./examples/config.yaml
 
 ### Cursor
 
+Add to your MCP servers in Cursor settings:
+
 ```json
 {
   "mcpServers": {
@@ -70,26 +98,28 @@ npx openapi-dynamic-mcp --config ./examples/config.yaml
         "/absolute/path/to/config.yaml"
       ],
       "env": {
-        "PET_API_BASE_URL": "http://localhost:3000",
-        "PET_API_APIKEY_API_KEY": "secret",
-        "PET_API_OAUTH2_CLIENT_ID": "client_id",
-        "PET_API_OAUTH2_CLIENT_SECRET": "client_secret"
+        "PET_API_BASE_URL": "http://localhost:3000"
       }
     }
   }
 }
 ```
 
-## Configuration
+## ⚙️ Configuration
+
+Create a YAML configuration file to define your APIs.
 
 ```yaml
 # Config file version
 version: 1
+
 apis:
   # Unique ID for this API
   - name: pet-api
-    # Path to local OpenAPI spec
+    # Path to local OpenAPI spec (use specUrl for remote definitions)
     specPath: ./pet-api.yaml
+    # Alternative: remote OpenAPI spec URL
+    # specUrl: https://api.example.com/openapi.yaml
     # Base URL override
     baseUrl: https://api.example.com/v1
     # Request timeout in milliseconds
@@ -124,24 +154,24 @@ apis:
 ### Validation Rules
 
 - `apis[].name` must be unique (case-insensitive after normalization).
-- `apis[].specPath` must point to a readable local file.
-- OpenAPI version must be `3.x`.
+- Exactly one of `apis[].specPath` (local file) or `apis[].specUrl` (remote URL) must be provided.
+- Supported specifications: OpenAPI `3.x` and Swagger `2.0`.
 - Base URL resolution order: env -> config -> `openapi.servers[0].url`.
 
-## Environment Variables
+## 🔐 Environment Variables
 
 Environment variables allow specifying sensitive or environment-specific configuration for APIs. Variables are defined for each API separately.
 
 ### Name Normalization
 
-API and auth scheme names are normalized as:
+API and auth scheme names are normalized automatically:
 
-- uppercase
-- non-alphanumeric -> `_`
-- repeated `_` collapsed
-- leading/trailing `_` removed
+- Uppercase
+- Non-alphanumeric -> `_`
+- Repeated `_` collapsed
+- Leading/trailing `_` removed
 
-Examples:
+_Examples:_
 
 - `pet-api` -> `PET_API`
 - `OAuth2` -> `OAUTH2`
@@ -151,97 +181,112 @@ Examples:
 - `<API>_BASE_URL` - Overrides the API's base URL.
 - `<API>_HEADERS` (JSON object string) - Adds custom headers to all requests.
 
-### API Key Variables
-
-For each API key security scheme defined in the OpenAPI spec, the following environment variables can be set:
-
-- `<API>_<SCHEME>_API_KEY` - The API key value for the specified security scheme.
+### Authentication Variables
 
-### OAuth2 Client Credentials Variables
+**API Key** (`<API>_<SCHEME>_API_KEY`)
 
-For each OAuth2 client credentials security scheme defined in the OpenAPI spec, the following environment variables can be set:
+- The API key value for the specified security scheme.
 
-- `<API>_<SCHEME>_CLIENT_ID` - The client ID for OAuth2.
-- `<API>_<SCHEME>_CLIENT_SECRET` - The client secret for OAuth2.
-- `<API>_<SCHEME>_TOKEN_URL` - The token endpoint URL for OAuth2.
-- `<API>_<SCHEME>_SCOPES` (space-delimited) - The scopes required for the OAuth2 token.
-- `<API>_<SCHEME>_TOKEN_AUTH_METHOD` (`client_secret_basic` or `client_secret_post`) - The authentication method for the token endpoint.
+**HTTP Authentication**
 
-### Precedence
+- `<API>_<SCHEME>_TOKEN` - Bearer token value.
+- `<API>_<SCHEME>_USERNAME` - Basic auth username.
+- `<API>_<SCHEME>_PASSWORD` - Basic auth password.
 
-- Base URL: env > config > OpenAPI servers.
-- OAuth token URL: scheme env > config override > OpenAPI flow `tokenUrl`.
-- OAuth scopes: scheme env > config scopes > OpenAPI flow scopes.
-- Headers: config headers + env headers + tool-request headers (later wins), then auth is applied.
+**OAuth2 Client Credentials**
 
-## MCP Tools
+- `<API>_<SCHEME>_CLIENT_ID` - Client ID.
+- `<API>_<SCHEME>_CLIENT_SECRET` - Client secret.
+- `<API>_<SCHEME>_TOKEN_URL` - Token endpoint URL.
+- `<API>_<SCHEME>_SCOPES` (space-delimited) - Scopes required for the OAuth2 token.
+- `<API>_<SCHEME>_TOKEN_AUTH_METHOD` (`client_secret_basic` or `client_secret_post`) - Auth method for the token endpoint.
 
-### `list_apis`
+_Precedence Rules:_
 
-Returns all available APIs.
+- **Base URL:** env > config > OpenAPI servers.
+- **OAuth token URL:** scheme env > config override > OpenAPI flow `tokenUrl`.
+- **OAuth scopes:** scheme env > config scopes > OpenAPI flow scopes.
+- **Headers:** config headers + env headers + tool-request headers (later wins), then auth is applied.
 
-Input: Nothing
+## 🛠️ Advanced Features
 
-### `list_api_endpoints`
+### File Uploads and Binary Data
 
-Paginate or search through endpoints in a given APIs.
+When your AI needs to send a file to an endpoint (either raw `application/octet-stream`, or inside a `multipart/form-data` payload), MCP passes messages as JSON. The LLM formats the corresponding file using the `files` parameter mapping, and `make_endpoint_request` processes it natively (converting to Blobs and FormData).
 
-Input fields:
+#### MCP File Descriptor format
 
-- required: `apiName`
-- optional: `method`, `tag`, `pathContains`, `search`, `limit`, `cursor`
+Each key in the `files` object maps to a form field name. You must provide exactly one of `base64`, `text`, or `filePath`:
 
-### `get_api_endpoint`
-
-Returns endpoint metadata including parameters, request body content types, responses, and security requirements.
-
-Input fields: `apiName`, `endpointId`
+```jsonc
+{
+  "name": "avatar.png", // (Optional) Explicit file name
+  "contentType": "image/png", // (Optional) Explicit mime type
 
-### `get_api_schema`
+  // Choose EXACTLY ONE content source:
+  "base64": "iVBORw0KGgo...", // Base64 encoded bytes
+  "text": "File contents", // Raw text content
+  "filePath": "/path/to/img", // Local absolute file path to read
+}
+```
 
-Returns the detailed specification of a given schema object.
+#### Example: Multipart Form-Data
 
-Input fields: `apiName`, optional `pointer` (JSON Pointer)
+```json
+{
+  "apiName": "pet-api",
+  "endpointId": "uploadProfile",
+  "contentType": "multipart/form-data",
+  "body": {
+    "description": "A photo of Fido"
+  },
+  "files": {
+    "profileImage": {
+      "name": "fido.jpg",
+      "contentType": "image/jpeg",
+      "filePath": "/Users/local/images/fido.jpg"
+    }
+  }
+}
+```
 
-### `make_endpoint_request`
+#### Example: Raw Octet Stream
 
-Executes an API endpoint request.
+```json
+{
+  "apiName": "pet-api",
+  "endpointId": "uploadRaw",
+  "contentType": "application/octet-stream",
+  "files": {
+    "body": {
+      "filePath": "/Users/local/data.bin"
+    }
+  }
+}
+```
 
-Input fields:
+## 🧰 Available MCP Tools
 
-- `apiName`
-- `endpointId`
-- `pathParams`
-- `query`
-- `headers`
-- `cookies`
-- `body`
-- `contentType`
-- `accept`
-- `timeoutMs`
-- `retry429` object
-  - `maxRetries`
-  - `baseDelayMs`
-  - `maxDelayMs`
-  - `jitterRatio` (0..1)
-  - `respectRetryAfter`
+These tools are exposed to your MCP client:
 
-Output includes:
+| Tool                    | Description                                                     | Inputs                                                                                                                              |
+| ----------------------- | --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| `list_apis`             | Returns all available configured APIs                           | _None_                                                                                                                              |
+| `list_api_endpoints`    | Paginate or search endpoints in an API                          | `apiName` (req), `method`, `tag`, `pathContains`, `search`, `limit`, `cursor`                                                       |
+| `get_api_endpoint`      | Endpoint metadata (parameters, body types, responses, security) | `apiName`, `endpointId`                                                                                                             |
+| `get_api_schema`        | Detailed API schema object specification                        | `apiName`, `pointer` (JSON Pointer, optional)                                                                                       |
+| `make_endpoint_request` | Executes the actual API endpoint request                        | `apiName`, `endpointId`, `pathParams`, `query`, `headers`, `cookies`, `body`, `contentType`, `accept`, `timeoutMs`, `maxRetries429` |
 
-- `request` metadata with redacted sensitive headers
-- `response` status, headers, and body
-- `timingMs`
-- `authUsed`
+## 💻 Development
 
-## Development
+Install dependencies and run tests:
 
 ```bash
+npm install
 npm test
 npm run build
 ```
 
-## Notes
+## 📄 License
 
-- Supports local OpenAPI files only.
-- 429 retries are supported and disabled by default (`maxRetries: 0`).
-- JSON responses are parsed first; non-JSON is returned as text or base64 binary.
+This project is licensed under the MIT License.

package/dist/auth/env.d.ts

@@ -3,7 +3,12 @@ export interface OAuthClientCredentialsFromEnv {
     clientSecret?: string;
     tokenUrl?: string;
     scopes?: string[];
-    tokenAuthMethod?: "client_secret_basic" | "client_secret_post";
+    tokenAuthMethod?: 'client_secret_basic' | 'client_secret_post';
+}
+export interface HttpAuthCredentialsFromEnv {
+    token?: string;
+    username?: string;
+    password?: string;
 }
 export declare function normalizeEnvSegment(value: string): string;
 export declare function apiPrefix(apiName: string): string;
@@ -12,3 +17,4 @@ export declare function readApiBaseUrl(apiName: string, env?: NodeJS.ProcessEnv)
 export declare function readApiExtraHeaders(apiName: string, env?: NodeJS.ProcessEnv): Record<string, string>;
 export declare function readApiKeyValue(apiName: string, schemeName: string, env?: NodeJS.ProcessEnv): string | undefined;
 export declare function readOAuthClientCredentials(apiName: string, schemeName: string, env?: NodeJS.ProcessEnv): OAuthClientCredentialsFromEnv;
+export declare function readHttpAuthCredentials(apiName: string, schemeName: string, env?: NodeJS.ProcessEnv): HttpAuthCredentialsFromEnv;

package/dist/auth/env.js

@@ -1,10 +1,10 @@
-import { OpenApiMcpError } from "../errors.js";
+import { OpenApiMcpError } from '../errors.js';
 export function normalizeEnvSegment(value) {
     return value
         .toUpperCase()
-        .replace(/[^A-Z0-9]+/g, "_")
-        .replace(/_+/g, "_")
-        .replace(/^_+|_+$/g, "");
+        .replace(/[^A-Z0-9]+/g, '_')
+        .replace(/_+/g, '_')
+        .replace(/^_+|_+$/g, '');
 }
 export function apiPrefix(apiName) {
     return normalizeEnvSegment(apiName);
@@ -25,15 +25,17 @@ export function readApiExtraHeaders(apiName, env = process.env) {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new OpenApiMcpError("CONFIG_ERROR", `Invalid JSON in ${apiPrefix(apiName)}_HEADERS`, { value: raw });
+        throw new OpenApiMcpError('CONFIG_ERROR', `Invalid JSON in ${apiPrefix(apiName)}_HEADERS`, {
+            value: raw,
+        });
     }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new OpenApiMcpError("CONFIG_ERROR", `${apiPrefix(apiName)}_HEADERS must be a JSON object`);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new OpenApiMcpError('CONFIG_ERROR', `${apiPrefix(apiName)}_HEADERS must be a JSON object`);
     }
     const out = {};
     for (const [key, value] of Object.entries(parsed)) {
-        if (typeof value !== "string") {
-            throw new OpenApiMcpError("CONFIG_ERROR", `${apiPrefix(apiName)}_HEADERS values must be strings`, { key });
+        if (typeof value !== 'string') {
+            throw new OpenApiMcpError('CONFIG_ERROR', `${apiPrefix(apiName)}_HEADERS values must be strings`, { key });
         }
         out[key] = value;
     }
@@ -47,18 +49,29 @@ export function readOAuthClientCredentials(apiName, schemeName, env = process.en
     const scopesRaw = env[`${prefix}_SCOPES`];
     const tokenAuthMethodRaw = env[`${prefix}_TOKEN_AUTH_METHOD`];
     let tokenAuthMethod;
-    if (tokenAuthMethodRaw === "client_secret_basic" || tokenAuthMethodRaw === "client_secret_post") {
+    if (tokenAuthMethodRaw === 'client_secret_basic' ||
+        tokenAuthMethodRaw === 'client_secret_post') {
         tokenAuthMethod = tokenAuthMethodRaw;
     }
     else if (tokenAuthMethodRaw) {
-        throw new OpenApiMcpError("CONFIG_ERROR", `Invalid ${prefix}_TOKEN_AUTH_METHOD value`, { value: tokenAuthMethodRaw });
+        throw new OpenApiMcpError('CONFIG_ERROR', `Invalid ${prefix}_TOKEN_AUTH_METHOD value`, {
+            value: tokenAuthMethodRaw,
+        });
     }
     return {
         clientId: env[`${prefix}_CLIENT_ID`],
         clientSecret: env[`${prefix}_CLIENT_SECRET`],
         tokenUrl: env[`${prefix}_TOKEN_URL`],
         scopes: scopesRaw ? scopesRaw.split(/\s+/).filter(Boolean) : undefined,
-        tokenAuthMethod
+        tokenAuthMethod,
+    };
+}
+export function readHttpAuthCredentials(apiName, schemeName, env = process.env) {
+    const prefix = schemePrefix(apiName, schemeName);
+    return {
+        token: env[`${prefix}_TOKEN`],
+        username: env[`${prefix}_USERNAME`],
+        password: env[`${prefix}_PASSWORD`],
     };
 }
 //# sourceMappingURL=env.js.map

package/dist/auth/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/auth/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAU/C,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,UAAkB;IAC9D,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClF,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,mBAAmB,SAAS,CAAC,OAAO,CAAC,UAAU,EAC/C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,GAAG,SAAS,CAAC,OAAO,CAAC,gCAAgC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,GAAG,SAAS,CAAC,OAAO,CAAC,iCAAiC,EACtD,EAAE,GAAG,EAAE,CACR,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;IAC1C,MAAM,kBAAkB,GAAG,GAAG,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC;IAC9D,IAAI,eAAyE,CAAC;IAC9E,IAAI,kBAAkB,KAAK,qBAAqB,IAAI,kBAAkB,KAAK,oBAAoB,EAAE,CAAC;QAChG,eAAe,GAAG,kBAAkB,CAAC;IACvC,CAAC;SAAM,IAAI,kBAAkB,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,WAAW,MAAM,0BAA0B,EAC3C,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAC9B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC;QACpC,YAAY,EAAE,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC;QAC5C,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC;QACpC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,eAAe;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/auth/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAgB/C,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,UAAkB;IAC9D,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,mBAAmB,SAAS,CAAC,OAAO,CAAC,UAAU,EAC/C;YACE,KAAK,EAAE,GAAG;SACX,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,GAAG,SAAS,CAAC,OAAO,CAAC,gCAAgC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,GAAG,SAAS,CAAC,OAAO,CAAC,iCAAiC,EACtD,EAAE,GAAG,EAAE,CACR,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;IAC1C,MAAM,kBAAkB,GAAG,GAAG,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC;IAC9D,IAAI,eAAyE,CAAC;IAC9E,IACE,kBAAkB,KAAK,qBAAqB;QAC5C,kBAAkB,KAAK,oBAAoB,EAC3C,CAAC;QACD,eAAe,GAAG,kBAAkB,CAAC;IACvC,CAAC;SAAM,IAAI,kBAAkB,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,WAAW,MAAM,0BAA0B,EAC3C;YACE,KAAK,EAAE,kBAAkB;SAC1B,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC;QACpC,YAAY,EAAE,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC;QAC5C,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC;QACpC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,QAAQ,CAAC;QAC7B,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC;KACpC,CAAC;AACJ,CAAC"}

package/dist/auth/oauthClient.d.ts

@@ -4,7 +4,7 @@ export interface OAuthTokenRequest {
     clientId: string;
     clientSecret: string;
     scopes: string[];
-    tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post";
+    tokenEndpointAuthMethod: 'client_secret_basic' | 'client_secret_post';
 }
 export declare class OAuthClient {
     private readonly cache;

package/dist/auth/oauthClient.js

@@ -1,5 +1,5 @@
-import * as oauth from "oauth4webapi";
-import { OpenApiMcpError } from "../errors.js";
+import * as oauth from 'oauth4webapi';
+import { OpenApiMcpError } from '../errors.js';
 const TOKEN_EXPIRY_SAFETY_MS = 60_000;
 export class OAuthClient {
     cache = new Map();
@@ -10,44 +10,44 @@ export class OAuthClient {
         }
         const as = {
             issuer: new URL(request.tokenUrl).origin,
-            token_endpoint: request.tokenUrl
+            token_endpoint: request.tokenUrl,
         };
         const client = {
-            client_id: request.clientId
+            client_id: request.clientId,
         };
-        const clientAuth = request.tokenEndpointAuthMethod === "client_secret_post"
+        const clientAuth = request.tokenEndpointAuthMethod === 'client_secret_post'
             ? oauth.ClientSecretPost(request.clientSecret)
             : oauth.ClientSecretBasic(request.clientSecret);
         const parameters = new URLSearchParams();
         if (request.scopes.length > 0) {
-            parameters.set("scope", request.scopes.join(" "));
+            parameters.set('scope', request.scopes.join(' '));
         }
         try {
             const tokenResponse = await oauth.clientCredentialsGrantRequest(as, client, clientAuth, parameters);
             const tokenResult = await oauth.processClientCredentialsResponse(as, client, tokenResponse);
             this.cache.set(request.cacheKey, {
                 accessToken: tokenResult.access_token,
-                expiresAtMs: Date.now() + Math.max(tokenResult.expires_in ?? 3600, 1) * 1000
+                expiresAtMs: Date.now() + Math.max(tokenResult.expires_in ?? 3600, 1) * 1000,
             });
             return tokenResult.access_token;
         }
         catch (error) {
             if (error instanceof oauth.ResponseBodyError) {
-                throw new OpenApiMcpError("AUTH_ERROR", "OAuth2 token request failed", {
+                throw new OpenApiMcpError('AUTH_ERROR', 'OAuth2 token request failed', {
                     tokenUrl: request.tokenUrl,
-                    oauthError: error.cause
+                    oauthError: error.cause,
                 });
             }
             if (error instanceof oauth.OperationProcessingError) {
-                throw new OpenApiMcpError("AUTH_ERROR", "OAuth2 operation failed", {
+                throw new OpenApiMcpError('AUTH_ERROR', 'OAuth2 operation failed', {
                     tokenUrl: request.tokenUrl,
                     code: error.code,
-                    cause: error.message
+                    cause: error.message,
                 });
             }
-            throw new OpenApiMcpError("AUTH_ERROR", "OAuth2 token request failed", {
+            throw new OpenApiMcpError('AUTH_ERROR', 'OAuth2 token request failed', {
                 tokenUrl: request.tokenUrl,
-                cause: error instanceof Error ? error.message : String(error)
+                cause: error instanceof Error ? error.message : String(error),
             });
         }
     }

package/dist/auth/oauthClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthClient.js","sourceRoot":"","sources":["../../src/auth/oauthClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAgB/C,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,MAAM,OAAO,WAAW;IACL,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE5D,KAAK,CAAC,yBAAyB,CAAC,OAA0B;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,MAAM,EAAE,GAA8B;YACpC,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM;YACxC,cAAc,EAAE,OAAO,CAAC,QAAQ;SACjC,CAAC;QACF,MAAM,MAAM,GAAiB;YAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC;QACF,MAAM,UAAU,GACd,OAAO,CAAC,uBAAuB,KAAK,oBAAoB;YACtD,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,6BAA6B,CAC7D,EAAE,EACF,MAAM,EACN,UAAU,EACV,UAAU,CACX,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC5F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAC/B,WAAW,EAAE,WAAW,CAAC,YAAY;gBACrC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI;aAC7E,CAAC,CAAC;YAEH,OAAO,WAAW,CAAC,YAAY,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC7C,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,6BAA6B,EAAE;oBACrE,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,KAAK,CAAC,KAAK;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,YAAY,KAAK,CAAC,wBAAwB,EAAE,CAAC;gBACpD,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,yBAAyB,EAAE;oBACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,6BAA6B,EAAE;gBACrE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"oauthClient.js","sourceRoot":"","sources":["../../src/auth/oauthClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAgB/C,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,MAAM,OAAO,WAAW;IACL,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE5D,KAAK,CAAC,yBAAyB,CAAC,OAA0B;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,MAAM,EAAE,GAA8B;YACpC,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM;YACxC,cAAc,EAAE,OAAO,CAAC,QAAQ;SACjC,CAAC;QACF,MAAM,MAAM,GAAiB;YAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC;QACF,MAAM,UAAU,GACd,OAAO,CAAC,uBAAuB,KAAK,oBAAoB;YACtD,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,6BAA6B,CAC7D,EAAE,EACF,MAAM,EACN,UAAU,EACV,UAAU,CACX,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,gCAAgC,CAC9D,EAAE,EACF,MAAM,EACN,aAAa,CACd,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAC/B,WAAW,EAAE,WAAW,CAAC,YAAY;gBACrC,WAAW,EACT,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI;aAClE,CAAC,CAAC;YAEH,OAAO,WAAW,CAAC,YAAY,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC7C,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,6BAA6B,EAAE;oBACrE,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,KAAK,CAAC,KAAK;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,YAAY,KAAK,CAAC,wBAAwB,EAAE,CAAC;gBACpD,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,yBAAyB,EAAE;oBACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,6BAA6B,EAAE;gBACrE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/auth/resolveAuth.d.ts

@@ -1,10 +1,10 @@
-import { OAuthClient } from "./oauthClient.js";
-import type { EndpointDefinition, LoadedApi, ResolvedAuthResult } from "../types.js";
+import { OAuthClient } from './oauthClient.js';
+import type { EndpointDefinition, LoadedApi, ResolvedAuthResult } from '../types.js';
 interface ResolveAuthInput {
     api: LoadedApi;
     endpoint: EndpointDefinition;
     oauthClient: OAuthClient;
     env?: NodeJS.ProcessEnv;
 }
-export declare function resolveAuth({ api, endpoint, oauthClient, env }: ResolveAuthInput): Promise<ResolvedAuthResult>;
+export declare function resolveAuth({ api, endpoint, oauthClient, env, }: ResolveAuthInput): Promise<ResolvedAuthResult>;
 export {};