openrouteservice-mcp 1.0.1 → 1.0.2

package/README.md

@@ -15,18 +15,18 @@ Query OpenRouteService (free key; set OPENROUTESERVICE_API_KEY): geocode, revers
 <!-- paywall -->
 ## Premium tools
 
-These tools need a license key:
+These tools need a licence key:
 
 * `osrm_route_steps`
 * `valhalla_mode_compare`
 
-Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-openrouteservice-mcp and set it in your MCP client config:
+The tool bodies run on our gateway, not inside this package, so the key is what buys access. Buy one at https://buy.polar.sh/polar_cl_mrO7rS5LZxpqM7oAFFEA10i9121J240U40IIj4JRZO4 and set it in your MCP client config:
 
 ```json
-"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+"env": { "MCP_LICENSE_KEY": "polar_..." }
 ```
 
-The key is checked against MCP Marketplace, cached for 24 hours, and keeps
-working offline once one check has succeeded. Every other tool on this server
+The gateway checks the key against Polar and gives every key 1,000 free premium
+calls a month before per-call billing starts. Every other tool on this server
 stays free.
 <!-- /paywall -->

package/dist/api.d.ts

@@ -12,19 +12,3 @@ export declare function nominatimLookup(args: {
     lon?: number;
     limit?: number;
 }): Promise<string>;
-/** A road route from OSRM, with the turn-by-turn an OpenStreetMap router can give. */
-export declare function osrmRouteSteps(args: {
-    from_lat?: number;
-    from_lon?: number;
-    to_lat?: number;
-    to_lon?: number;
-    alternatives?: boolean;
-}): Promise<string>;
-/** The same trip by several modes, from Valhalla, which models them with different cost functions. */
-export declare function valhallaModeCompare(args: {
-    from_lat?: number;
-    from_lon?: number;
-    to_lat?: number;
-    to_lon?: number;
-    modes?: string;
-}): Promise<string>;

package/dist/api.js

@@ -147,115 +147,3 @@ export async function nominatimLookup(args) {
         "This is a different geocoder from the one this server's other tools use, and they will disagree: Nominatim ranks by OpenStreetMap importance, while a commercial geocoder ranks by its own address database. A pin that moves between them is usually a boundary or a duplicated feature, not a bug in either.",
     ].filter(Boolean).join("\n");
 }
-/** A road route from OSRM, with the turn-by-turn an OpenStreetMap router can give. */
-export async function osrmRouteSteps(args) {
-    const nums = [args.from_lat, args.from_lon, args.to_lat, args.to_lon].map((v) => Number(v));
-    if (nums.some((n) => !Number.isFinite(n))) {
-        throw new OrsError("All four of from_lat, from_lon, to_lat and to_lon are required, for example 48.8584, 2.2945 to 48.8606, 2.3376.");
-    }
-    const [fromLat, fromLon, toLat, toLon] = nums;
-    if (Math.abs(fromLat) > 90 || Math.abs(toLat) > 90)
-        throw new OrsError("from_lat and to_lat must be between -90 and 90.");
-    if (Math.abs(fromLon) > 180 || Math.abs(toLon) > 180)
-        throw new OrsError("from_lon and to_lon must be between -180 and 180.");
-    // This OSRM build rejects any geometries parameter, including "none"; overview=false
-    // already suppresses the route geometry, and per-step geometry is not printed.
-    const params = new URLSearchParams({ overview: "false", steps: "true" });
-    if (args.alternatives !== false)
-        params.set("alternatives", "3");
-    const d = await orsFetch(`${ORS_OSRM}/route/v1/driving/${fromLon},${fromLat};${toLon},${toLat}?${params}`);
-    if (d.code !== "Ok" || !d.routes?.length)
-        throw new OrsError(`OSRM could not route between those points (status ${d.code ?? "unknown"}). Check that both points are on the road network.`);
-    const routes = d.routes;
-    return [
-        `OSRM road route, ${routes.length} option(s) found (OpenStreetMap road data)`,
-        `The demo OSRM instance is shared and not meant for production traffic, so treat the route as an indication rather than a navigation instruction.`,
-        "",
-        ...routes.map((r, ri) => {
-            const steps = r.legs?.flatMap((l) => l.steps ?? []) ?? [];
-            const named = steps.filter((s) => s.name && s.distance > 20);
-            return [
-                `Option ${ri + 1}: ${orsMetres(r.distance)}, ${orsDuration(r.duration)} estimated${ri === 0 ? " (the one OSRM prefers)" : ""}`,
-                `  via ${named.length} named road segment(s): ${[...new Set(named.map((s) => s.name))].slice(0, 8).join(", ") || "none recorded"}`,
-                `  turn-by-turn:`,
-                ...steps.slice(0, 10).map((s) => {
-                    const m = s.maneuver ?? {};
-                    const what = [m.modifier, m.type].filter(Boolean).join(" ");
-                    return `    ${String(Math.round(s.distance)).padStart(6)} m  ${s.name || "(unnamed road)"} — ${what}${m.instruction ? `: ${m.instruction}` : ""}`;
-                }),
-                steps.length > 10 ? `    ... ${steps.length - 10} further step(s) not shown` : "",
-            ].filter(Boolean).join("\n");
-        }),
-        "",
-        "The duration is a free-flow estimate with no traffic, no turn penalties beyond the model's own, and no time-of-day variation, so it is optimistic compared to what a navigation app will show you.",
-    ].join("\n");
-}
-/** The same trip by several modes, from Valhalla, which models them with different cost functions. */
-export async function valhallaModeCompare(args) {
-    const nums = [args.from_lat, args.from_lon, args.to_lat, args.to_lon].map((v) => Number(v));
-    if (nums.some((n) => !Number.isFinite(n))) {
-        throw new OrsError("All four of from_lat, from_lon, to_lat and to_lon are required.");
-    }
-    const [fromLat, fromLon, toLat, toLon] = nums;
-    const known = ["auto", "bicycle", "pedestrian", "multimodal", "truck", "taxi"];
-    const wanted = String(args?.modes ?? "auto,bicycle,pedestrian")
-        .split(",")
-        .map((m) => m.trim().toLowerCase())
-        .filter(Boolean)
-        .filter((m) => known.includes(m))
-        .slice(0, 4);
-    if (!wanted.length) {
-        throw new OrsError(`No usable mode in "${args.modes}". Valhalla costings here: ${known.join(", ")}.`);
-    }
-    const results = [];
-    for (const mode of wanted) {
-        try {
-            const d = await orsFetch(`${ORS_VALHALLA}/route?json=`, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({
-                    locations: [{ lat: fromLat, lon: fromLon }, { lat: toLat, lon: toLon }],
-                    costing: mode,
-                    directions_options: { units: "kilometers" },
-                    ...(mode === "multimodal" ? { costings: [{ costing: "pedestrian" }, { costing: "bicycle" }] } : {}),
-                }),
-            });
-            if (d.error) {
-                results.push({ mode, ok: false, note: `${d.error_code ?? "error"}: ${d.error}` });
-                continue;
-            }
-            const s = d.trip?.summary ?? {};
-            const maneuvers = d.trip?.legs?.flatMap((l) => l.maneuvers ?? []) ?? [];
-            results.push({
-                mode,
-                ok: true,
-                note: [
-                    orsMetres((s.length ?? 0) * 1000),
-                    orsDuration(s.time ?? 0),
-                    `cost ${s.cost ?? "not reported"}`,
-                    s.has_toll ? "tolls" : "no tolls",
-                    s.has_ferry ? "includes a ferry" : "",
-                    s.has_highway ? "uses a motorway" : "",
-                    s.has_time_restrictions ? "has a time restriction" : "",
-                    s.energy_use?.value !== undefined ? `energy ${s.energy_use.value} ${s.energy_use.unit ?? ""}` : "",
-                    `${maneuvers.length} maneuver(s)`,
-                ].filter(Boolean).join(", "),
-            });
-            if (maneuvers.length) {
-                results[results.length - 1].note += `\n      first turns: ${maneuvers.slice(0, 3).map((m) => `${m.instruction ?? "?"}${m.street_names?.length ? ` (${m.street_names[0]})` : ""}`).join(" | ")}`;
-            }
-        }
-        catch (e) {
-            results.push({ mode, ok: false, note: errorMessage(e) });
-        }
-    }
-    return [
-        `Same trip by ${wanted.length} costing model(s), from Valhalla's public instance`,
-        `${fromLat}, ${fromLon} to ${toLat}, ${toLon}`,
-        "",
-        ...results.map((r) => `  ${r.ok ? "ok  " : "fail"} ${r.mode.padEnd(11)} ${r.note}`),
-        "",
-        "The costing models disagree on purpose: a bicycle and a pedestrian route on the same two points are different journeys, and the fast car route is often the one you cannot walk. Compare them before assuming one mode is the right one.",
-        "Valhalla's public instance is a shared demo, so a routing failure here is not evidence the trip is unroutable.",
-    ].join("\n");
-}

package/dist/gateway.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Thin client for the premium gateway.
+ *
+ * The premium tools do not run in this package any more. Their bodies live on
+ * the gateway, which checks a Polar licence key before it does any work, so
+ * deleting anything here buys nothing: the answer only exists behind the gate.
+ *
+ * Set `MCP_LICENSE_KEY` to a Polar licence key. `MCP_GATEWAY_URL` overrides the
+ * endpoint, which is only useful for testing.
+ */
+/** Raised when a premium call cannot be completed. `message` is safe to show. */
+export declare class GatewayError extends Error {
+    readonly refused: boolean;
+    constructor(message: string, refused: boolean);
+}
+export declare function premiumTool(tool: string, args: Record<string, unknown>): Promise<string>;

package/dist/gateway.js

@@ -0,0 +1,85 @@
+/**
+ * Thin client for the premium gateway.
+ *
+ * The premium tools do not run in this package any more. Their bodies live on
+ * the gateway, which checks a Polar licence key before it does any work, so
+ * deleting anything here buys nothing: the answer only exists behind the gate.
+ *
+ * Set `MCP_LICENSE_KEY` to a Polar licence key. `MCP_GATEWAY_URL` overrides the
+ * endpoint, which is only useful for testing.
+ */
+const DEFAULT_GATEWAY_URL = 'https://mcp-gateway.contactae2000.workers.dev/mcp';
+const DEFAULT_TIMEOUT_MS = 25000;
+const USER_AGENT = 'mrfentmen-mcp/1.0';
+/** Raised when a premium call cannot be completed. `message` is safe to show. */
+export class GatewayError extends Error {
+    refused;
+    constructor(message, refused) {
+        super(message);
+        this.refused = refused;
+        this.name = 'GatewayError';
+    }
+}
+export async function premiumTool(tool, args) {
+    const key = (process.env.MCP_LICENSE_KEY ?? '').trim();
+    if (!key) {
+        throw new GatewayError(`"${tool}" is a premium tool and no licence key is set. Set MCP_LICENSE_KEY in your MCP client config.`, true);
+    }
+    const url = (process.env.MCP_GATEWAY_URL ?? DEFAULT_GATEWAY_URL).trim();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'application/json',
+                'user-agent': USER_AGENT,
+                authorization: `Bearer ${key}`,
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'tools/call',
+                params: { name: tool, arguments: args },
+            }),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        throw new GatewayError(`"${tool}" could not reach the licence gateway. Check your connection and try again.`, false);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        throw new GatewayError(`"${tool}" could not reach the licence gateway (HTTP ${response.status}).`, false);
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        throw new GatewayError(`"${tool}" got an unreadable answer from the licence gateway.`, false);
+    }
+    if (body.error) {
+        throw new GatewayError(`"${tool}" was refused by the licence gateway: ${body.error.message ?? 'unknown error'}`, false);
+    }
+    const result = body.result ?? {};
+    const text = (result.content ?? [])
+        .map((part) => part.text ?? '')
+        .join('\n')
+        .trim();
+    if (result.isError) {
+        // The gateway marks a licence refusal structurally, so a missing or rejected
+        // key is told apart from a tool that failed after the gate let it through.
+        if (result.structuredContent?.licenceRefusal) {
+            throw new GatewayError(text || `"${tool}" needs a valid licence key.`, true);
+        }
+        throw new GatewayError(text || `"${tool}" failed on the licence gateway.`, false);
+    }
+    if (!text)
+        throw new GatewayError(`"${tool}" returned no data.`, false);
+    return text;
+}

package/dist/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { errorMessage, geocode, reverse, directions, nominatimLookup, osrmRouteSteps, valhallaModeCompare } from "./api.js";
-import { premiumRequired } from "./license.js";
+import { errorMessage, geocode, reverse, directions, nominatimLookup } from "./api.js";
+import { premiumTool } from "./gateway.js";
 const text = (t) => ({ content: [{ type: "text", text: t }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -91,12 +91,10 @@ export function createServer() {
         annotations: READ_ONLY,
     }, async (args) => {
         // ---- paywall: osrm_route_steps ----
-        const paywallMessage = await premiumRequired("osrm_route_steps");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // The body runs on the gateway, behind the licence gate.
         // ---- paywall: end ----
         try {
-            return text(await osrmRouteSteps(args));
+            return text(await premiumTool("mcp_openrouteservice_osrm_route_steps", args));
         }
         catch (e) {
             return textError(errorMessage(e));
@@ -115,12 +113,10 @@ export function createServer() {
         annotations: READ_ONLY,
     }, async (args) => {
         // ---- paywall: valhalla_mode_compare ----
-        const paywallMessage = await premiumRequired("valhalla_mode_compare");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // The body runs on the gateway, behind the licence gate.
         // ---- paywall: end ----
         try {
-            return text(await valhallaModeCompare(args));
+            return text(await premiumTool("mcp_openrouteservice_valhalla_mode_compare", args));
         }
         catch (e) {
             return textError(errorMessage(e));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrouteservice-mcp",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Query OpenRouteService (free key; set OPENROUTESERVICE_API_KEY): geocode, reverse geocode, driving directions.",
   "type": "module",
   "mcpName": "io.github.mrfentmen/openrouteservice-mcp",

package/dist/license.js

@@ -1,79 +0,0 @@
-// Premium tools on this server need a license key bought from MCP Marketplace.
-// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
-// that is not listed in PREMIUM keeps working without a key.
-const SLUG = "openrouteservice-mcp";
-// Tools that need a key. Everything else is free.
-const PREMIUM = new Set([
-    "osrm_route_steps",
-    "valhalla_mode_compare",
-]);
-const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
-// The license check calls the marketplace's verify endpoint directly instead of
-// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
-// check it makes is rejected by Supabase before it reaches the function. The
-// publishable key below is public by design - it ships in mcp-marketplace.io's
-// own JavaScript and only ever reaches their licence check.
-const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
-const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
-const OK_CACHE_MS = 60 * 60 * 1000;
-const BAD_CACHE_MS = 60 * 1000;
-const seen = new Map();
-const REASONS = {
-    missing_key: "no key is set",
-    invalid_format: "that key is not a valid MCP Marketplace key",
-    not_found: "that key was not found",
-    revoked: "that key has been revoked",
-    rotated: "that key was rotated, use your new one",
-    expired: "that key has expired, renew it",
-    rate_limited: "there were too many checks just now, try again shortly",
-    network_error: "the license server could not be reached",
-};
-function blocked(tool, reason) {
-    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
-    return `"${tool}" needs a license key, but ${why}. ` +
-        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
-}
-async function verify(key) {
-    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
-        method: "POST",
-        headers: {
-            apikey: PUBLISHABLE_KEY,
-            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ key, slug: SLUG }),
-        // an unusable key answers 400 with a JSON body, so read the body either way
-        signal: AbortSignal.timeout(15000),
-    });
-    const data = (await res.json());
-    if (typeof data?.valid !== "boolean")
-        return { valid: false, reason: "unexpected_response" };
-    return data;
-}
-/**
- * Returns null when the caller may run the tool, or a short message telling
- * them how to get a key.
- *
- * A good key is remembered for an hour, so a busy session does not hit the
- * license server on every call and keeps working through a brief outage.
- */
-export async function premiumRequired(tool) {
-    if (!PREMIUM.has(tool))
-        return null;
-    const key = process.env.MCP_LICENSE_KEY;
-    if (!key)
-        return blocked(tool, "missing_key");
-    const hit = seen.get(key);
-    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
-        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
-    }
-    let result;
-    try {
-        result = await verify(key);
-    }
-    catch {
-        result = { valid: false, reason: "network_error" };
-    }
-    seen.set(key, { ...result, at: Date.now() });
-    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
-}