portkey-admin-mcp 0.9.0 → 0.10.0

package/README.md

@@ -15,6 +15,8 @@
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
   <br>
   <a href="https://github.com/CodesWhat/portkey-admin-mcp/actions/workflows/ci.yml"><img src="https://github.com/CodesWhat/portkey-admin-mcp/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://securityscorecards.dev/viewer/?uri=github.com/CodesWhat/portkey-admin-mcp"><img src="https://img.shields.io/ossf-scorecard/github.com/CodesWhat/portkey-admin-mcp?label=openssf+scorecard&style=flat" alt="OpenSSF Scorecard"></a>
+  <a href="https://www.bestpractices.dev/projects/14031"><img src="https://www.bestpractices.dev/projects/14031/badge" alt="OpenSSF Best Practices"></a>
   <a href="https://github.com/punkpeye/awesome-mcp-servers"><img src="https://awesome.re/mentioned-badge.svg" alt="Mentioned in Awesome MCP Servers"></a>
   <a href="https://lobehub.com/mcp/codeswhat-portkey-admin-mcp"><img src="https://lobehub.com/badge/mcp/codeswhat-portkey-admin-mcp" alt="LobeHub MCP"></a>
 </p>
@@ -34,8 +36,13 @@
 - [🧰 What You Can Do](#what-you-can-do)
 - [🔑 API Key Scopes](#api-key-scopes)
 - [🌐 HTTP Server (Experimental)](#http-server)
+- [🏗️ Architecture](./docs/ARCHITECTURE.md)
 - [🔄 Prisma AIRS interoperability](./docs/PRISMA_AIRS_INTEROPERABILITY.md)
+- [🔏 Verify a release](./docs/VERIFY_RELEASE.md)
 - [🛠️ Development](#development)
+- [🤝 Contributing](./CONTRIBUTING.md)
+- [🏛️ Governance](./GOVERNANCE.md)
+- [🛡️ Security assurance](./SECURITY-ASSURANCE.md)
 - [🧾 Full tool list — ENDPOINTS.md](./ENDPOINTS.md)
 
 <hr>
@@ -219,6 +226,7 @@ For local-only HTTP use, leave `MCP_HOST` at its default `127.0.0.1`. Set `MCP_H
 | `MCP_MAX_SESSIONS` | `100` | Maximum concurrent stateful sessions or active stateless request handlers |
 | `MCP_EVENT_STORE` | `off` | `off`, `memory`, or `redis`; stateless `GET /mcp` replay requires `memory` or `redis` |
 | `MCP_EVENT_TTL_SECONDS` | `300` | Replay retention in seconds |
+| `MCP_EVENT_STORE_COMMAND_TIMEOUT_MS` | `5000` | Redis command timeout for the event store, in milliseconds; `0` disables the timeout (restores unbounded pre-v6 behavior) |
 | `MCP_REDIS_URL` | — | Redis URL for shared event store; production requires `rediss://` and ACL-scoped credentials |
 | `MCP_EVENT_ENCRYPTION_KEY` | — | Required 32-byte base64 AES key for Redis replay payloads; generate with `openssl rand -base64 32` |
 | `MCP_REDIS_KEY_PREFIX` | `mcp:event-store` | Dedicated Redis namespace for replay data |
@@ -283,13 +291,24 @@ docker run \
 npm run dev           # stdio with hot reload
 npm run dev:http      # HTTP with hot reload
 npm test              # unit + contract tests
+npm run test:coverage # unit + contract tests with the enforced 80% line floor
 npm run test:e2e      # MCP protocol tests
 npm run test:http     # HTTP endpoint smoke test
-npm run ci            # full pipeline (lint + typecheck + test + build + e2e + verify)
+npm run ci            # full pipeline (lint + typecheck + coverage + build + e2e + verify)
 ```
 
+The required CI and release gates measure every TypeScript source file and fail
+below 80% line coverage. The current full report is 99.36% lines, 92.61%
+branches, and 99.01% functions.
+
 `npm run dev:http` now requires `MCP_AUTH_MODE=bearer` or `MCP_AUTH_MODE=clerk` by default. For deliberate local-only unauthenticated testing, set `MCP_ALLOW_UNAUTHENTICATED_HTTP=true`.
 
+Contributions use pull requests and the checks documented in
+[`CONTRIBUTING.md`](CONTRIBUTING.md). Project decisions and maintainer roles are
+documented in [`GOVERNANCE.md`](GOVERNANCE.md). Report vulnerabilities through
+[`SECURITY.md`](SECURITY.md), and see [`SECURITY-ASSURANCE.md`](SECURITY-ASSURANCE.md)
+for the public threat model and assurance case.
+
 ---
 
 <div align="center">

package/build/index.js

@@ -3,6 +3,59 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/lib/logger.ts
+var LOG_LEVELS = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+function getConfiguredLogLevel() {
+  const envLevel = process.env.LOG_LEVEL?.toLowerCase();
+  if (envLevel && envLevel in LOG_LEVELS) {
+    return envLevel;
+  }
+  return "info";
+}
+var configuredLogLevel = getConfiguredLogLevel();
+function shouldLog(level) {
+  return LOG_LEVELS[level] >= LOG_LEVELS[configuredLogLevel];
+}
+function formatEntry(level, message, extra) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    message,
+    ...extra
+  };
+}
+function writeLog(entry) {
+  process.stderr.write(`${JSON.stringify(entry)}
+`);
+}
+var Logger = {
+  debug(message, extra) {
+    if (shouldLog("debug")) {
+      writeLog(formatEntry("debug", message, extra));
+    }
+  },
+  info(message, extra) {
+    if (shouldLog("info")) {
+      writeLog(formatEntry("info", message, extra));
+    }
+  },
+  warn(message, extra) {
+    if (shouldLog("warn")) {
+      writeLog(formatEntry("warn", message, extra));
+    }
+  },
+  error(message, extra) {
+    if (shouldLog("error")) {
+      writeLog(formatEntry("error", message, extra));
+    }
+  }
+};
+
 // src/lib/mcp-server.ts
 import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -64,62 +117,10 @@ async function parseErrorResponse(response) {
   }
 }
 
-// src/lib/logger.ts
-var LOG_LEVELS = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3
-};
-function getConfiguredLogLevel() {
-  const envLevel = process.env.LOG_LEVEL?.toLowerCase();
-  if (envLevel && envLevel in LOG_LEVELS) {
-    return envLevel;
-  }
-  return "info";
-}
-var configuredLogLevel = getConfiguredLogLevel();
-function shouldLog(level) {
-  return LOG_LEVELS[level] >= LOG_LEVELS[configuredLogLevel];
-}
-function formatEntry(level, message, extra) {
-  return {
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    level,
-    message,
-    ...extra
-  };
-}
-function writeLog(entry) {
-  process.stderr.write(`${JSON.stringify(entry)}
-`);
-}
-var Logger = {
-  debug(message, extra) {
-    if (shouldLog("debug")) {
-      writeLog(formatEntry("debug", message, extra));
-    }
-  },
-  info(message, extra) {
-    if (shouldLog("info")) {
-      writeLog(formatEntry("info", message, extra));
-    }
-  },
-  warn(message, extra) {
-    if (shouldLog("warn")) {
-      writeLog(formatEntry("warn", message, extra));
-    }
-  },
-  error(message, extra) {
-    if (shouldLog("error")) {
-      writeLog(formatEntry("error", message, extra));
-    }
-  }
-};
-
 // src/services/base.service.ts
 var DEFAULT_BASE_URL = "https://api.portkey.ai/v1";
 var DEFAULT_PUBLIC_BASE_URL = "https://api.portkey.ai";
+var MISSING_API_KEY_PLACEHOLDER = "__PORTKEY_API_KEY_NOT_CONFIGURED__";
 var PRIVATE_BASE_URL_OVERRIDE_HINT = "Set PORTKEY_ALLOW_PRIVATE_BASE_URL=true to allow self-hosted gateways on loopback or private networks.";
 var INSECURE_HTTP_OVERRIDE_HINT = "Set PORTKEY_ALLOW_INSECURE_HTTP=true only for a trusted self-hosted gateway when TLS is unavailable.";
 function isPrivateOrLocalHost(hostname) {
@@ -233,6 +234,11 @@ var BaseService = class {
     return body ? JSON.stringify(body) : void 0;
   }
   async executeRequest(method, path, options = {}) {
+    if ((options.authenticate ?? true) && this.apiKey === MISSING_API_KEY_PLACEHOLDER) {
+      throw new Error(
+        "PORTKEY_API_KEY is not configured. Set the PORTKEY_API_KEY environment variable to a valid Portkey Admin API key."
+      );
+    }
     const requestId = crypto.randomUUID();
     const url = this.buildUrl(path, options.params, options.baseUrl);
     const startTime = Date.now();
@@ -1795,7 +1801,6 @@ var WorkspacesService = class extends BaseService {
 
 // src/services/index.ts
 import { createHmac, randomBytes } from "node:crypto";
-var MISSING_API_KEY_PLACEHOLDER = "__PORTKEY_API_KEY_NOT_CONFIGURED__";
 var SERVICE_CACHE_HMAC_KEY = randomBytes(32);
 function resolvePortkeyApiKey(apiKey) {
   const resolvedApiKey = apiKey ?? process.env.PORTKEY_API_KEY;
@@ -6108,14 +6113,18 @@ function registerPromptsTools(server, service) {
       });
       if (dry_run) {
         const current = await service.prompts.getPrompt(prompt_id);
+        const changes = Object.keys(updateData).filter(
+          (k) => updateData[k] !== void 0
+        );
+        if (messages !== void 0 && !changes.includes("string")) {
+          changes.push("string");
+        }
         return jsonResult({
           dry_run: true,
           action: "update",
           message: `Would update prompt "${current.name}"`,
           current_version: current.current_version?.version_number ?? null,
-          changes: Object.keys(updateData).filter(
-            (k) => updateData[k] !== void 0
-          )
+          changes
         });
       }
       const result = await service.prompts.updatePrompt(prompt_id, {
@@ -8240,6 +8249,11 @@ function createMcpServer(options = {}) {
 // src/index.ts
 async function main() {
   try {
+    if (!process.env.PORTKEY_API_KEY) {
+      Logger.warn(
+        "PORTKEY_API_KEY is not set; tool calls will fail until it is configured."
+      );
+    }
     const { server } = createMcpServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/build/server.js

@@ -137,6 +137,7 @@ var Logger = {
 // src/services/base.service.ts
 var DEFAULT_BASE_URL = "https://api.portkey.ai/v1";
 var DEFAULT_PUBLIC_BASE_URL = "https://api.portkey.ai";
+var MISSING_API_KEY_PLACEHOLDER = "__PORTKEY_API_KEY_NOT_CONFIGURED__";
 var PRIVATE_BASE_URL_OVERRIDE_HINT = "Set PORTKEY_ALLOW_PRIVATE_BASE_URL=true to allow self-hosted gateways on loopback or private networks.";
 var INSECURE_HTTP_OVERRIDE_HINT = "Set PORTKEY_ALLOW_INSECURE_HTTP=true only for a trusted self-hosted gateway when TLS is unavailable.";
 function isPrivateOrLocalHost(hostname) {
@@ -250,6 +251,11 @@ var BaseService = class {
     return body ? JSON.stringify(body) : void 0;
   }
   async executeRequest(method, path, options = {}) {
+    if ((options.authenticate ?? true) && this.apiKey === MISSING_API_KEY_PLACEHOLDER) {
+      throw new Error(
+        "PORTKEY_API_KEY is not configured. Set the PORTKEY_API_KEY environment variable to a valid Portkey Admin API key."
+      );
+    }
     const requestId = crypto.randomUUID();
     const url = this.buildUrl(path, options.params, options.baseUrl);
     const startTime = Date.now();
@@ -1812,7 +1818,6 @@ var WorkspacesService = class extends BaseService {
 
 // src/services/index.ts
 import { createHmac, randomBytes } from "node:crypto";
-var MISSING_API_KEY_PLACEHOLDER = "__PORTKEY_API_KEY_NOT_CONFIGURED__";
 var SERVICE_CACHE_HMAC_KEY = randomBytes(32);
 function resolvePortkeyApiKey(apiKey) {
   const resolvedApiKey = apiKey ?? process.env.PORTKEY_API_KEY;
@@ -6125,14 +6130,18 @@ function registerPromptsTools(server, service) {
       });
       if (dry_run) {
         const current = await service.prompts.getPrompt(prompt_id);
+        const changes = Object.keys(updateData).filter(
+          (k) => updateData[k] !== void 0
+        );
+        if (messages !== void 0 && !changes.includes("string")) {
+          changes.push("string");
+        }
         return jsonResult({
           dry_run: true,
           action: "update",
           message: `Would update prompt "${current.name}"`,
           current_version: current.current_version?.version_number ?? null,
-          changes: Object.keys(updateData).filter(
-            (k) => updateData[k] !== void 0
-          )
+          changes
         });
       }
       const result = await service.prompts.updatePrompt(prompt_id, {
@@ -8086,6 +8095,21 @@ function registerAllTools(server, service, options = {}) {
 // src/lib/auth.ts
 import crypto2 from "node:crypto";
 import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// src/lib/request-path.ts
+function canonicalizeRequestPath(path) {
+  const normalized = path.toLowerCase();
+  return normalized.length > 1 && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
+function isMcpRequestPath(path) {
+  return canonicalizeRequestPath(path) === "/mcp";
+}
+function isHealthOrReadyPath(path) {
+  const canonical = canonicalizeRequestPath(path);
+  return canonical === "/health" || canonical === "/ready";
+}
+
+// src/lib/auth.ts
 function getPrincipalOwnerKey(principal) {
   return crypto2.createHash("sha256").update(principal.id, "utf8").digest("hex");
 }
@@ -8306,7 +8330,7 @@ async function verifyClerkToken(token, config) {
   return authorizeClerkClaims(payload, config);
 }
 async function mcpAuthMiddleware(req, res, next) {
-  if (!req.path.startsWith("/mcp")) {
+  if (!isMcpRequestPath(req.path)) {
     next();
     return;
   }
@@ -8435,6 +8459,15 @@ function getServerConfig() {
       `Invalid MCP_EVENT_TTL_SECONDS value: ${eventStoreTtlStr}. Must be a positive integer`
     );
   }
+  const eventStoreCommandTimeoutStr = (process.env.MCP_EVENT_STORE_COMMAND_TIMEOUT_MS || "5000").trim();
+  const eventStoreCommandTimeoutMs = parseStrictInteger(
+    eventStoreCommandTimeoutStr
+  );
+  if (Number.isNaN(eventStoreCommandTimeoutMs) || eventStoreCommandTimeoutMs < 0) {
+    throw new Error(
+      `Invalid MCP_EVENT_STORE_COMMAND_TIMEOUT_MS value: ${eventStoreCommandTimeoutStr}. Must be a non-negative integer (0 disables the timeout)`
+    );
+  }
   const redisUrl = process.env.MCP_REDIS_URL?.trim() || process.env.REDIS_URL?.trim();
   if (eventStoreMode === "redis" && !redisUrl) {
     throw new Error(
@@ -8494,7 +8527,8 @@ function getServerConfig() {
       ttlSeconds: eventStoreTtlSeconds,
       redisUrl,
       redisKeyPrefix,
-      encryptionKey: eventEncryptionKey
+      encryptionKey: eventEncryptionKey,
+      commandTimeoutMs: eventStoreCommandTimeoutMs
     },
     protocol,
     port,
@@ -8726,13 +8760,15 @@ var RedisEventStore = class _RedisEventStore {
   keyPrefix;
   ownerKey;
   encryptionKey;
+  commandTimeoutMs;
   connection;
-  constructor(redisUrl, keyPrefix, ttlSeconds, ownerKey, encryptionKey, connection = {}) {
+  constructor(redisUrl, keyPrefix, ttlSeconds, ownerKey, encryptionKey, commandTimeoutMs, connection = {}) {
     this.redisUrl = redisUrl;
     this.ttlSeconds = ttlSeconds;
     this.keyPrefix = keyPrefix;
     this.ownerKey = ownerKey;
     this.encryptionKey = encryptionKey;
+    this.commandTimeoutMs = commandTimeoutMs;
     this.connection = connection;
   }
   get client() {
@@ -8748,6 +8784,7 @@ var RedisEventStore = class _RedisEventStore {
       this.ttlSeconds,
       ownerKey,
       this.encryptionKey,
+      this.commandTimeoutMs,
       this.connection
     );
   }
@@ -8769,11 +8806,19 @@ var RedisEventStore = class _RedisEventStore {
       this.connection.client = createClient({
         url: this.redisUrl,
         // node-redis v6 defaults to RESP3, a 5-second command timeout, and a
-        // 30-second keepalive delay. Keep the event store's v5 behavior stable
-        // while taking the v6 fixes and supported runtime baseline.
+        // 30-second keepalive delay. storeEvent/replayEventsAfter sit on the
+        // MCP request-critical path (SSE sends, GET replay), so an unbounded
+        // command wait here would hang requests indefinitely if Redis accepts
+        // TCP but stalls on replies. Keep RESP2 for v5-compatible replies, but
+        // use a bounded, configurable command timeout (default 5s, matching
+        // node-redis's own default) instead of disabling it. Set
+        // MCP_EVENT_STORE_COMMAND_TIMEOUT_MS=0 to restore the old unbounded
+        // (v5-compatible) behavior.
         RESP: 2,
         socket: { keepAliveInitialDelay: 5e3 },
-        commandOptions: { timeout: void 0 }
+        commandOptions: {
+          timeout: this.commandTimeoutMs === 0 ? void 0 : this.commandTimeoutMs
+        }
       });
       this.connection.client.on("error", (error) => {
         Logger.error("Redis event store error", {
@@ -8953,7 +8998,8 @@ function createManagedEventStore(config) {
     config.eventStore.redisKeyPrefix,
     config.eventStore.ttlSeconds,
     "internal",
-    encryptionKey
+    encryptionKey,
+    config.eventStore.commandTimeoutMs
   );
   return {
     mode: "redis",
@@ -9229,7 +9275,7 @@ function isAllowedHost(host) {
   });
 }
 function originValidationMiddleware(req, res, next) {
-  if (req.path === "/health" || req.path === "/ready") {
+  if (isHealthOrReadyPath(req.path)) {
     next();
     return;
   }
@@ -9246,7 +9292,7 @@ function originValidationMiddleware(req, res, next) {
   next();
 }
 function hostValidationMiddleware(req, res, next) {
-  if (req.path === "/health" || req.path === "/ready") {
+  if (isHealthOrReadyPath(req.path)) {
     next();
     return;
   }
@@ -9378,23 +9424,26 @@ function resolveRateLimitRedisUrl(store) {
   }
   return redisUrl;
 }
-var rateLimitEnabled = process.env.RATE_LIMIT_ENABLED?.trim().toLowerCase() !== "false";
-var rateLimitStore = resolveRateLimitStore();
-if (rateLimitEnabled && rateLimitStore === "memory" && process.env.NODE_ENV?.trim().toLowerCase() === "production" && !isExplicitlyEnabled2(process.env.RATE_LIMIT_SINGLE_PROCESS)) {
-  throw new Error(
-    "Production in-memory rate limiting requires RATE_LIMIT_SINGLE_PROCESS=true. Use RATE_LIMIT_STORE=redis for multi-instance deployments."
-  );
-}
-var RATE_LIMIT_CONFIG = {
-  enabled: rateLimitEnabled,
-  store: rateLimitStore,
-  maxTokens: parsePositiveIntegerEnv("RATE_LIMIT_MAX", 60),
-  windowMs: parsePositiveIntegerEnv("RATE_LIMIT_WINDOW_MS", 6e4),
-  refillRate: parsePositiveIntegerEnv("RATE_LIMIT_REFILL", 60),
-  maxBuckets: parsePositiveIntegerEnv("RATE_LIMIT_MAX_BUCKETS", 1e4),
-  redisUrl: resolveRateLimitRedisUrl(rateLimitStore),
-  redisKeyPrefix: process.env.RATE_LIMIT_REDIS_KEY_PREFIX?.trim() || "mcp:rate-limit"
-};
+function resolveRateLimitConfig() {
+  const enabled = process.env.RATE_LIMIT_ENABLED?.trim().toLowerCase() !== "false";
+  const store = resolveRateLimitStore();
+  if (enabled && store === "memory" && process.env.NODE_ENV?.trim().toLowerCase() === "production" && !isExplicitlyEnabled2(process.env.RATE_LIMIT_SINGLE_PROCESS)) {
+    throw new Error(
+      "Production in-memory rate limiting requires RATE_LIMIT_SINGLE_PROCESS=true. Use RATE_LIMIT_STORE=redis for multi-instance deployments."
+    );
+  }
+  return {
+    enabled,
+    store,
+    maxTokens: parsePositiveIntegerEnv("RATE_LIMIT_MAX", 60),
+    windowMs: parsePositiveIntegerEnv("RATE_LIMIT_WINDOW_MS", 6e4),
+    refillRate: parsePositiveIntegerEnv("RATE_LIMIT_REFILL", 60),
+    maxBuckets: parsePositiveIntegerEnv("RATE_LIMIT_MAX_BUCKETS", 1e4),
+    redisUrl: resolveRateLimitRedisUrl(store),
+    redisKeyPrefix: process.env.RATE_LIMIT_REDIS_KEY_PREFIX?.trim() || "mcp:rate-limit"
+  };
+}
+var RATE_LIMIT_CONFIG = resolveRateLimitConfig();
 function getRateLimitConfig() {
   return RATE_LIMIT_CONFIG;
 }
@@ -9527,11 +9576,11 @@ function applyRateLimit(scope, req, res, next) {
     next();
     return;
   }
-  if (req.path === "/health" || req.path === "/ready") {
+  if (isHealthOrReadyPath(req.path)) {
     next();
     return;
   }
-  if (scope === "authentication" && req.path !== "/mcp") {
+  if (scope === "authentication" && !isMcpRequestPath(req.path)) {
     next();
     return;
   }
@@ -10385,14 +10434,16 @@ function createMcpPostHandler(deps) {
     try {
       await transport.handleRequest(req, res, req.body);
     } catch (error) {
-      if (hasReservedSessionSlot) {
-        sessionStore.releaseReservation();
-      }
       respondJsonRpcInternalError(
         res,
         sessionId ? "POST /mcp stateful session" : "POST /mcp stateful initialize",
         error
       );
+    } finally {
+      if (hasReservedSessionSlot) {
+        sessionStore.releaseReservation();
+        hasReservedSessionSlot = false;
+      }
     }
   };
 }
@@ -10428,143 +10479,150 @@ function createMcpGetHandler(deps) {
         );
         return;
       }
-      const replayEventStore = managedEventStore.eventStoreForOwner(ownerKey);
-      if (!replayEventStore || !managedEventStore.acquireReplayLease) {
-        res.setHeader("Allow", "POST");
-        respondJsonRpcClientError(
-          res,
-          405,
-          "Stateless GET /mcp replay requires MCP_EVENT_STORE=memory or redis",
-          -32e3
-        );
-        return;
-      }
-      const lastEventId = req.headers["last-event-id"];
-      if (typeof lastEventId !== "string" || lastEventId.length === 0) {
-        res.setHeader("Allow", "POST");
-        respondJsonRpcClientError(
-          res,
-          405,
-          "Stateless GET /mcp only supports replay with Last-Event-ID",
-          -32e3
-        );
-        return;
-      }
-      if (!req.headers.accept?.includes("text/event-stream")) {
-        respondJsonRpcClientError(
-          res,
-          406,
-          "Not Acceptable: Client must accept text/event-stream",
-          -32e3
-        );
-        return;
-      }
-      const protocolError = validateRequiredProtocolVersion(
-        getMcpProtocolVersion(req)
-      );
-      if (protocolError) {
-        respondJsonRpcClientError(res, 400, protocolError, -32e3);
-        return;
-      }
+      let releaseReplaySlot;
+      const replaySlot = new Promise((resolve) => {
+        releaseReplaySlot = resolve;
+      });
+      activeReplayOperations.add(replaySlot);
       try {
-        const lease = await managedEventStore.acquireReplayLease(
-          lastEventId,
-          ownerKey
+        const replayEventStore = managedEventStore.eventStoreForOwner(ownerKey);
+        if (!replayEventStore || !managedEventStore.acquireReplayLease) {
+          res.setHeader("Allow", "POST");
+          respondJsonRpcClientError(
+            res,
+            405,
+            "Stateless GET /mcp replay requires MCP_EVENT_STORE=memory or redis",
+            -32e3
+          );
+          return;
+        }
+        const lastEventId = req.headers["last-event-id"];
+        if (typeof lastEventId !== "string" || lastEventId.length === 0) {
+          res.setHeader("Allow", "POST");
+          respondJsonRpcClientError(
+            res,
+            405,
+            "Stateless GET /mcp only supports replay with Last-Event-ID",
+            -32e3
+          );
+          return;
+        }
+        if (!req.headers.accept?.includes("text/event-stream")) {
+          respondJsonRpcClientError(
+            res,
+            406,
+            "Not Acceptable: Client must accept text/event-stream",
+            -32e3
+          );
+          return;
+        }
+        const protocolError = validateRequiredProtocolVersion(
+          getMcpProtocolVersion(req)
         );
-        if (lease.status !== "acquired") {
-          if (lease.status === "missing") {
+        if (protocolError) {
+          respondJsonRpcClientError(res, 400, protocolError, -32e3);
+          return;
+        }
+        try {
+          const lease = await managedEventStore.acquireReplayLease(
+            lastEventId,
+            ownerKey
+          );
+          if (lease.status !== "acquired") {
+            if (lease.status === "missing") {
+              respondJsonRpcClientError(
+                res,
+                400,
+                "Invalid event ID format",
+                -32e3
+              );
+              return;
+            }
             respondJsonRpcClientError(
               res,
-              400,
-              "Invalid event ID format",
+              409,
+              "Conflict: Stream already has an active replay connection",
               -32e3
             );
             return;
           }
-          respondJsonRpcClientError(
-            res,
-            409,
-            "Conflict: Stream already has an active replay connection",
-            -32e3
-          );
-          return;
-        }
-        const replayOperation = (async () => {
-          try {
-            res.status(200);
-            res.setHeader("Content-Type", "text/event-stream");
-            res.setHeader("Cache-Control", "no-cache, no-transform");
-            res.flushHeaders();
-            let cursor = lastEventId;
-            let finalResponseSeen = false;
-            const deadline = Date.now() + 25e3;
-            while (getIsReady() && !res.destroyed && !finalResponseSeen) {
-              await replayEventStore.replayEventsAfter(cursor, {
-                send: async (eventId, message) => {
-                  cursor = eventId;
-                  finalResponseSeen = "id" in message && ("result" in message || "error" in message);
-                  if (!res.write(
-                    `event: message
+          const replayOperation = (async () => {
+            try {
+              res.status(200);
+              res.setHeader("Content-Type", "text/event-stream");
+              res.setHeader("Cache-Control", "no-cache, no-transform");
+              res.flushHeaders();
+              let cursor = lastEventId;
+              let finalResponseSeen = false;
+              const deadline = Date.now() + 25e3;
+              while (getIsReady() && !res.destroyed && !finalResponseSeen) {
+                await replayEventStore.replayEventsAfter(cursor, {
+                  send: async (eventId, message) => {
+                    cursor = eventId;
+                    finalResponseSeen = "id" in message && ("result" in message || "error" in message);
+                    if (!res.write(
+                      `event: message
 id: ${eventId}
 data: ${JSON.stringify(message)}
 
 `
-                  )) {
-                    await waitForResponseWritable(res);
+                    )) {
+                      await waitForResponseWritable(res);
+                    }
                   }
+                });
+                if (finalResponseSeen || res.destroyed) {
+                  break;
                 }
-              });
-              if (finalResponseSeen || res.destroyed) {
-                break;
-              }
-              if (Date.now() >= deadline) {
-                res.write(`id: ${cursor}
+                if (Date.now() >= deadline) {
+                  res.write(`id: ${cursor}
 data: 
 
 `);
-                break;
-              }
-              await new Promise((resolvePoll) => setTimeout(resolvePoll, 100));
-            }
-            if (!res.writableEnded && !res.destroyed) {
-              await new Promise((resolveResponse) => {
-                const done = () => resolveResponse();
-                res.once("finish", done);
-                res.once("close", done);
-                res.end();
-              });
-            }
-          } finally {
-            try {
-              await lease.release();
-            } catch (error) {
-              Logger.error("Failed to release stateless replay lease", {
-                metadata: {
-                  error: error instanceof Error ? error.message : String(error)
+                  break;
                 }
-              });
+                await new Promise(
+                  (resolvePoll) => setTimeout(resolvePoll, 100)
+                );
+              }
+              if (!res.writableEnded && !res.destroyed) {
+                await new Promise((resolveResponse) => {
+                  const done = () => resolveResponse();
+                  res.once("finish", done);
+                  res.once("close", done);
+                  res.end();
+                });
+              }
+            } finally {
+              try {
+                await lease.release();
+              } catch (error) {
+                Logger.error("Failed to release stateless replay lease", {
+                  metadata: {
+                    error: error instanceof Error ? error.message : String(error)
+                  }
+                });
+              }
             }
-          }
-        })();
-        activeReplayOperations.add(replayOperation);
-        try {
+          })();
           await replayOperation;
-        } finally {
-          activeReplayOperations.delete(replayOperation);
-        }
-      } catch (error) {
-        if (res.headersSent) {
-          Logger.error("GET /mcp stateless replay failed", {
-            metadata: {
-              error: error instanceof Error ? error.message : String(error)
+        } catch (error) {
+          if (res.headersSent) {
+            Logger.error("GET /mcp stateless replay failed", {
+              metadata: {
+                error: error instanceof Error ? error.message : String(error)
+              }
+            });
+            if (!res.writableEnded) {
+              res.end();
             }
-          });
-          if (!res.writableEnded) {
-            res.end();
+          } else {
+            respondJsonRpcInternalError(res, "GET /mcp stateless", error);
           }
-        } else {
-          respondJsonRpcInternalError(res, "GET /mcp stateless", error);
         }
+      } finally {
+        activeReplayOperations.delete(replaySlot);
+        releaseReplaySlot();
       }
       return;
     }
@@ -10601,6 +10659,45 @@ data:
         return;
       }
       sessionStore.touch(sessionId);
+      const lastEventId = req.headers["last-event-id"];
+      if (typeof lastEventId === "string" && lastEventId.length > 0 && managedEventStore.acquireReplayLease) {
+        const lease = await managedEventStore.acquireReplayLease(
+          lastEventId,
+          ownerKey
+        );
+        if (lease.status !== "acquired") {
+          if (lease.status === "missing") {
+            respondJsonRpcClientError(
+              res,
+              400,
+              "Invalid event ID format",
+              -32e3
+            );
+            return;
+          }
+          respondJsonRpcClientError(
+            res,
+            409,
+            "Conflict: Stream already has an active replay connection",
+            -32e3
+          );
+          return;
+        }
+        try {
+          await transport.handleRequest(req, res);
+        } finally {
+          try {
+            await lease.release();
+          } catch (error) {
+            Logger.error("Failed to release stateful replay lease", {
+              metadata: {
+                error: error instanceof Error ? error.message : String(error)
+              }
+            });
+          }
+        }
+        return;
+      }
       await transport.handleRequest(req, res);
     } else {
       res.status(404).json({
@@ -10674,9 +10771,9 @@ function createHttpAppRuntime() {
   const readyCheckMode = getReadyCheckMode();
   const requestBodyLimit = process.env.MCP_MAX_REQUEST_SIZE?.trim() || "1mb";
   const allowedOrigins = getAllowedOrigins();
-  const corsOriginConfig = allowedOrigins.includes(
-    "*"
-  ) ? true : allowedOrigins;
+  const corsOriginConfig = (origin, callback) => {
+    callback(null, validateOrigin(origin));
+  };
   if (allowedOrigins.includes("*") && authConfig.mode === "none") {
     Logger.warn(
       "CORS wildcard (ALLOWED_ORIGINS=*) combined with MCP_AUTH_MODE=none: all origins are accepted with no authentication. Do not expose this server publicly."
@@ -10715,7 +10812,6 @@ function createHttpAppRuntime() {
       } : false
     })
   );
-  app.use(express.json({ limit: requestBodyLimit }));
   if (authConfig.mode === "none") {
     app.use(hostValidationMiddleware);
   }
@@ -10728,13 +10824,14 @@ function createHttpAppRuntime() {
       standardHeaders: false,
       legacyHeaders: false,
       validate: false,
-      skip: (req) => !rateLimitConfig.enabled || req.path !== "/mcp",
+      skip: (req) => !rateLimitConfig.enabled || !isMcpRequestPath(req.path),
       message: { error: "Too Many Requests" }
     })
   );
   app.use(rateLimitMiddleware);
   app.use(mcpAuthMiddleware);
   app.use(principalRateLimitMiddleware);
+  app.use(express.json({ limit: requestBodyLimit }));
   app.use(
     (err, _req, res, next) => {
       const errorType = err && typeof err === "object" && "type" in err ? err.type : void 0;

package/package.json

@@ -11,7 +11,9 @@
 		"lint": "biome lint .",
 		"format": "biome format --write .",
 		"check": "biome check --write .",
-		"test": "tsx --test tests/config.test.ts tests/security.test.ts tests/contract.test.ts tests/contract-extended.test.ts tests/unit.test.ts tests/http-server.test.ts tests/tools-observability.test.ts tests/tools-catalog.test.ts tests/tools-platform.test.ts tests/tools-keys.test.ts tests/tools-users.test.ts tests/tools-analytics.test.ts tests/current-api.test.ts tests/release-readiness.test.ts tests/auth-clerk.test.ts",
+		"test": "tsx --test tests/config.test.ts tests/security-worker-layout.test.ts tests/security-edge-runtime.test.ts tests/contract.test.ts tests/contract-extended.test.ts tests/unit.test.ts tests/services.test.ts tests/base-services.test.ts tests/http-server.test.ts tests/http-edge-runtime.test.ts tests/http-edge-runtime-final.test.ts tests/tools-observability.test.ts tests/tools-catalog.test.ts tests/tools-prompts-configs.test.ts tests/tools-remaining.test.ts tests/tools-edge-workflows.test.ts tests/tools-platform.test.ts tests/tools-keys.test.ts tests/tools-users.test.ts tests/tools-analytics.test.ts tests/current-api.test.ts tests/release-readiness.test.ts tests/auth-clerk.test.ts tests/lib-event-store.test.ts tests/lib-session-mcp.test.ts",
+		"test:coverage": "tsx --test --experimental-test-coverage --test-coverage-include='src/**/*.ts' --test-coverage-lines=80 $TEST_COVERAGE_REPORTERS tests/config.test.ts tests/security-worker-layout.test.ts tests/security-edge-runtime.test.ts tests/contract.test.ts tests/contract-extended.test.ts tests/unit.test.ts tests/services.test.ts tests/base-services.test.ts tests/http-server.test.ts tests/http-edge-runtime.test.ts tests/http-edge-runtime-final.test.ts tests/tools-observability.test.ts tests/tools-catalog.test.ts tests/tools-prompts-configs.test.ts tests/tools-remaining.test.ts tests/tools-edge-workflows.test.ts tests/tools-platform.test.ts tests/tools-keys.test.ts tests/tools-users.test.ts tests/tools-analytics.test.ts tests/current-api.test.ts tests/release-readiness.test.ts tests/auth-clerk.test.ts tests/lib-event-store.test.ts tests/lib-session-mcp.test.ts",
+		"test:coverage:qlty": "mkdir -p coverage && TEST_COVERAGE_REPORTERS=\"--test-reporter=lcov --test-reporter-destination=$PWD/coverage/lcov.info --test-reporter=spec --test-reporter-destination=stdout\" npm run test:coverage",
 		"dev": "tsx --watch src/index.ts",
 		"dev:http": "tsx --watch src/server.ts",
 		"smoke": "tsx tests/smoke.ts",
@@ -23,7 +25,7 @@
 		"verify:tool-quality": "node scripts/check-tool-definition-quality.mjs",
 		"verify:readme-tools": "node scripts/verify-readme-tools.mjs",
 		"knip": "knip",
-		"ci": "npm run lint && npm run knip && npm run typecheck && npm run typecheck:tests && npm run test && npm run build && npm run verify:tool-quality && npm run test:e2e && npm run verify:readme-tools",
+		"ci": "npm run lint && npm run knip && npm run typecheck && npm run typecheck:tests && npm run test:coverage && npm run build && npm run verify:tool-quality && npm run test:e2e && npm run verify:readme-tools",
 		"start:http": "node build/server.js",
 		"generate:lobehub-tools": "npm run build && node scripts/generate-lobehub-tools.mjs && biome format --write lhm.plugin.json",
 		"update:lobehub": "npm run generate:lobehub-tools && npx -y @lobehub/market-cli plugin update --dir \"$PWD\"",
@@ -53,7 +55,7 @@
 	},
 	"name": "portkey-admin-mcp",
 	"mcpName": "io.github.CodesWhat/portkey-admin-mcp",
-	"version": "0.9.0",
+	"version": "0.10.0",
 	"main": "build/index.js",
 	"keywords": [
 		"mcp",