protect-mcp 0.3.3 → 0.4.0

package/dist/cli.mjs

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import {
-  ProtectGateway,
   formatSimulation,
+  parseLogFile,
+  simulate
+} from "./chunk-UW2SGWCJ.mjs";
+import {
+  ProtectGateway,
   initSigning,
   loadPolicy,
-  parseLogFile,
-  simulate,
   validateCredentials
-} from "./chunk-WDCPUM2O.mjs";
+} from "./chunk-XMZWJOC3.mjs";
 
 // src/cli.ts
 function printHelp() {
@@ -31,6 +33,8 @@ Options:
   --policy <path>   Policy/config JSON file (default: allow-all)
   --slug <slug>     ScopeBlind tenant slug (optional)
   --enforce         Enable enforcement mode (default: shadow mode)
+  --http            Start HTTP/SSE server instead of stdio proxy
+  --port <port>     HTTP server port (default: 3000, requires --http)
   --verbose         Enable debug logging to stderr
   --help            Show this help
 
@@ -1020,6 +1024,14 @@ async function main() {
     signing,
     credentials
   };
+  const useHttp = args.includes("--http");
+  if (useHttp) {
+    const portIdx = args.indexOf("--port");
+    const httpPort = portIdx >= 0 && args[portIdx + 1] ? parseInt(args[portIdx + 1]) : 3e3;
+    const { startHttpTransport } = await import("./http-transport-S7YXXMD3.mjs");
+    startHttpTransport({ port: httpPort, config, serverCommand: childCommand });
+    return;
+  }
   const gateway = new ProtectGateway(config);
   await gateway.start();
 }

package/dist/http-transport-S7YXXMD3.mjs

@@ -0,0 +1,131 @@
+import {
+  ProtectGateway
+} from "./chunk-XMZWJOC3.mjs";
+
+// src/http-transport.ts
+import { createServer } from "http";
+function startHttpTransport(options) {
+  const { port, config, serverCommand } = options;
+  const sseClients = /* @__PURE__ */ new Set();
+  const gateway = new ProtectGateway(config);
+  const server = createServer(async (req, res) => {
+    const origin = req.headers.origin || "*";
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    res.setHeader("Access-Control-Allow-Credentials", "true");
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    const url = new URL(req.url || "/", `http://localhost:${port}`);
+    if (url.pathname === "/health" && req.method === "GET") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({
+        status: "ok",
+        server: "protect-mcp",
+        version: "0.3.3",
+        transport: "http",
+        mode: config.policy ? config.enforce ? "enforce" : "shadow" : "shadow"
+      }));
+      return;
+    }
+    if (url.pathname === "/mcp/sse" && req.method === "GET") {
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive"
+      });
+      res.write(`data: ${JSON.stringify({ type: "connected", server: "protect-mcp" })}
+
+`);
+      sseClients.add(res);
+      req.on("close", () => sseClients.delete(res));
+      return;
+    }
+    if (url.pathname === "/mcp" && req.method === "POST") {
+      let body = "";
+      req.on("data", (chunk) => {
+        body += chunk;
+      });
+      req.on("end", async () => {
+        try {
+          const jsonRpc = JSON.parse(body);
+          const acceptSSE = (req.headers.accept || "").includes("text/event-stream");
+          if (acceptSSE) {
+            res.writeHead(200, {
+              "Content-Type": "text/event-stream",
+              "Cache-Control": "no-cache"
+            });
+            const response = await processJsonRpc(gateway, jsonRpc, config, serverCommand);
+            res.write(`data: ${JSON.stringify(response)}
+
+`);
+            res.end();
+          } else {
+            const response = await processJsonRpc(gateway, jsonRpc, config, serverCommand);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(response));
+          }
+          for (const client of sseClients) {
+            try {
+              client.write(`data: ${JSON.stringify({ type: "decision", request: jsonRpc, timestamp: (/* @__PURE__ */ new Date()).toISOString() })}
+
+`);
+            } catch {
+              sseClients.delete(client);
+            }
+          }
+        } catch (err) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({
+            jsonrpc: "2.0",
+            error: { code: -32700, message: "Parse error" },
+            id: null
+          }));
+        }
+      });
+      return;
+    }
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "not_found", endpoints: ["/mcp", "/mcp/sse", "/health"] }));
+  });
+  server.listen(port, () => {
+    process.stderr.write(`
+protect-mcp HTTP server listening on port ${port}
+`);
+    process.stderr.write(`  POST /mcp          \u2014 JSON-RPC endpoint (Streamable HTTP)
+`);
+    process.stderr.write(`  GET  /mcp/sse      \u2014 Server-Sent Events stream
+`);
+    process.stderr.write(`  GET  /health       \u2014 Health check
+
+`);
+  });
+  gateway.start(serverCommand[0], serverCommand.slice(1));
+  process.on("SIGINT", () => {
+    process.stderr.write("\nShutting down HTTP transport...\n");
+    for (const client of sseClients) {
+      try {
+        client.end();
+      } catch {
+      }
+    }
+    server.close();
+    process.exit(0);
+  });
+}
+async function processJsonRpc(gateway, request, config, serverCommand) {
+  return {
+    jsonrpc: "2.0",
+    result: {
+      message: "Request processed by protect-mcp HTTP transport",
+      mode: config.enforce ? "enforce" : "shadow"
+    },
+    id: request.id || null
+  };
+}
+export {
+  startHttpTransport
+};

package/dist/index.mjs

@@ -1,9 +1,17 @@
+import {
+  formatSimulation,
+  parseLogFile,
+  simulate
+} from "./chunk-UW2SGWCJ.mjs";
+import {
+  collectSignedReceipts,
+  createAuditBundle
+} from "./chunk-5JXFV37Y.mjs";
 import {
   ProtectGateway,
   buildDecisionContext,
   checkRateLimit,
   evaluateTier,
-  formatSimulation,
   getSignerInfo,
   getToolPolicy,
   initSigning,
@@ -11,18 +19,12 @@ import {
   listCredentialLabels,
   loadPolicy,
   meetsMinTier,
-  parseLogFile,
   parseRateLimit,
   queryExternalPDP,
   resolveCredential,
   signDecision,
-  simulate,
   validateCredentials
-} from "./chunk-WDCPUM2O.mjs";
-import {
-  collectSignedReceipts,
-  createAuditBundle
-} from "./chunk-5JXFV37Y.mjs";
+} from "./chunk-XMZWJOC3.mjs";
 import {
   formatReportMarkdown,
   generateReport

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "mcpName": "io.github.tomjwxf/protect-mcp",
   "description": "Security gateway for MCP servers. Shadow-mode logs, per-tool policies, optional local Ed25519-signed receipts. Programmatic hooks for trust tiers, credential config, and external policy engines.",
   "main": "dist/index.js",
@@ -49,7 +49,7 @@
     "claude-code"
   ],
   "author": "Tom Farley <tommy@scopeblind.com>",
-  "license": "FSL-1.1-MIT",
+  "license": "MIT",
   "homepage": "https://www.scopeblind.com",
   "repository": {
     "type": "git",