rewind-mcp-server 0.1.0

package/dist/worker.js

@@ -0,0 +1,173 @@
+/**
+ * Cloudflare Worker entry point for remote MCP access (Claude iOS, claude.ai).
+ * Deployed at mcp.rewind.rest.
+ *
+ * Uses @cloudflare/workers-oauth-provider for OAuth 2.1 with GitHub as the
+ * upstream identity provider. The OAuth layer is only for the remote transport;
+ * local stdio transport (Claude Desktop, Claude Code) uses REWIND_API_KEY directly.
+ */
+import { OAuthProvider } from '@cloudflare/workers-oauth-provider';
+import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+import { RewindClient } from './client.js';
+import { createServer } from './server.js';
+import { renderConsentPage } from './consent.js';
+import { getGitHubAuthorizeUrl, exchangeGitHubCode } from './github-auth.js';
+// Per-isolate rate limiting
+const rateLimitWindows = new Map();
+const RATE_LIMIT_RPM = 120;
+const RATE_LIMIT_WINDOW_MS = 60_000;
+function checkRateLimit(key) {
+    const now = Date.now();
+    const entry = rateLimitWindows.get(key);
+    if (!entry || now >= entry.resetAt) {
+        rateLimitWindows.set(key, {
+            count: 1,
+            resetAt: now + RATE_LIMIT_WINDOW_MS,
+        });
+        return { allowed: true, remaining: RATE_LIMIT_RPM - 1 };
+    }
+    entry.count++;
+    if (entry.count > RATE_LIMIT_RPM) {
+        return { allowed: false, remaining: 0 };
+    }
+    return { allowed: true, remaining: RATE_LIMIT_RPM - entry.count };
+}
+/**
+ * MCP API handler -- receives authenticated requests after OAuth.
+ * ctx.props contains the GrantProps set during authorization.
+ */
+const mcpHandler = {
+    async fetch(request, env, _ctx) {
+        // Rate limit by IP
+        const ip = request.headers.get('cf-connecting-ip') ?? 'unknown';
+        const rateResult = checkRateLimit(ip);
+        if (!rateResult.allowed) {
+            return Response.json({ error: 'Too Many Requests' }, { status: 429, headers: { 'Retry-After': '60' } });
+        }
+        // Get user props from OAuth context
+        const props = request.props;
+        if (!props?.rewindApiKey) {
+            return Response.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+        const apiUrl = env.REWIND_API_URL || 'https://api.rewind.rest';
+        const client = new RewindClient(apiUrl, props.rewindApiKey);
+        const server = createServer(client);
+        const transport = new WebStandardStreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+        });
+        await server.connect(transport);
+        return transport.handleRequest(request);
+    },
+};
+/**
+ * Default handler -- serves the authorize page and GitHub callback.
+ * All non-API, non-OAuth-infrastructure requests go here.
+ */
+const defaultHandler = {
+    async fetch(request, env, _ctx) {
+        const url = new URL(request.url);
+        // Health check
+        if (url.pathname === '/' || url.pathname === '/health') {
+            return Response.json({ status: 'ok', service: 'rewind-mcp-server' });
+        }
+        // Authorization page -- user sees consent screen, clicks "Sign in with GitHub"
+        if (url.pathname === '/authorize') {
+            // Parse the MCP OAuth authorization request from query params
+            const clientName = url.searchParams.get('client_name') ?? 'Claude';
+            const scopes = (url.searchParams.get('scope') ?? 'read').split(' ');
+            const state = url.searchParams.get('state') ?? '';
+            // Store the original OAuth params in a short-lived KV key so we can
+            // retrieve them after GitHub redirects back
+            const oauthState = crypto.randomUUID();
+            await env.OAUTH_KV.put(`github_state:${oauthState}`, JSON.stringify({
+                originalUrl: request.url,
+                state,
+            }), { expirationTtl: 600 } // 10 minutes
+            );
+            const callbackUrl = `${url.origin}/callback`;
+            const gitHubUrl = getGitHubAuthorizeUrl(env.GITHUB_CLIENT_ID, callbackUrl, oauthState);
+            const html = renderConsentPage({
+                clientName,
+                scopes,
+                gitHubAuthorizeUrl: gitHubUrl,
+            });
+            return new Response(html, {
+                headers: { 'Content-Type': 'text/html' },
+            });
+        }
+        // GitHub OAuth callback -- user has authenticated with GitHub
+        if (url.pathname === '/callback') {
+            const code = url.searchParams.get('code');
+            const githubState = url.searchParams.get('state');
+            if (!code || !githubState) {
+                return Response.json({ error: 'Missing code or state from GitHub' }, { status: 400 });
+            }
+            // Retrieve the original OAuth params
+            const storedState = await env.OAUTH_KV.get(`github_state:${githubState}`);
+            if (!storedState) {
+                return Response.json({ error: 'Invalid or expired state. Please try connecting again.' }, { status: 400 });
+            }
+            // eslint-disable-next-line drizzle/enforce-delete-with-where -- KV.delete(), not Drizzle
+            await env.OAUTH_KV.delete(`github_state:${githubState}`);
+            const { originalUrl } = JSON.parse(storedState);
+            // Exchange GitHub code for user info
+            let gitHubUser;
+            try {
+                gitHubUser = await exchangeGitHubCode(code, env.GITHUB_CLIENT_ID, env.GITHUB_CLIENT_SECRET);
+            }
+            catch (error) {
+                return Response.json({
+                    error: `GitHub authentication failed: ${error instanceof Error ? error.message : String(error)}`,
+                }, { status: 400 });
+            }
+            // Check if this GitHub user is in the allowlist
+            const allowlist = JSON.parse(env.USER_ALLOWLIST || '{}');
+            const rewindUserId = allowlist[String(gitHubUser.id)];
+            if (rewindUserId === undefined) {
+                return Response.json({
+                    error: `GitHub user @${gitHubUser.login} is not authorized. Contact the Rewind admin to request access.`,
+                }, { status: 403 });
+            }
+            // Complete the OAuth authorization using the workers-oauth-provider helpers.
+            // We need to redirect back to the original authorize URL with the approval.
+            // The OAuthProvider handles the actual code generation and redirect.
+            // We pass the user info as props that will be available in the API handler.
+            // Redirect to the original authorize URL with an approval indicator
+            // The OAuthProvider's authorize flow will pick this up
+            const approveUrl = new URL(originalUrl);
+            approveUrl.searchParams.set('github_user_id', String(gitHubUser.id));
+            approveUrl.searchParams.set('github_login', gitHubUser.login);
+            approveUrl.searchParams.set('rewind_user_id', String(rewindUserId));
+            approveUrl.searchParams.set('approved', 'true');
+            return Response.redirect(approveUrl.toString(), 302);
+        }
+        return Response.json({ error: 'Not found', docs: 'https://docs.rewind.rest' }, { status: 404 });
+    },
+};
+// OAuth Provider configuration
+const provider = new OAuthProvider({
+    apiRoute: '/mcp',
+    apiHandler: mcpHandler,
+    defaultHandler: defaultHandler,
+    authorizeEndpoint: '/authorize',
+    tokenEndpoint: '/token',
+    clientRegistrationEndpoint: '/register',
+    accessTokenTTL: 3600, // 1 hour
+    refreshTokenTTL: 7_776_000, // 90 days
+    scopesSupported: [
+        'read',
+        'read:listening',
+        'read:running',
+        'read:watching',
+        'read:collecting',
+        'read:reading',
+        'read:feed',
+    ],
+    allowPlainPKCE: false, // S256 only per MCP spec
+    resourceMetadata: {
+        resource_name: 'Rewind Personal Data API',
+    },
+});
+export default provider;
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AACzH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAmB7E,4BAA4B;AAC5B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA8C,CAAC;AAC/E,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YACxB,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,oBAAoB;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,KAAK,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAyB;IACvC,KAAK,CAAC,KAAK,CACT,OAAgB,EAChB,GAAQ,EACR,IAAsB;QAEtB,mBAAmB;QACnB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QAChE,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,KAAK,GAAI,OAA4C,CAAC,KAAK,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,IAAI,yBAAyB,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,cAAc,GAAyB;IAC3C,KAAK,CAAC,KAAK,CACT,OAAgB,EAChB,GAAQ,EACR,IAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,eAAe;QACf,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,+EAA+E;QAC/E,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,8DAA8D;YAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC;YACnE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAElD,oEAAoE;YACpE,4CAA4C;YAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CACpB,gBAAgB,UAAU,EAAE,EAC5B,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW,EAAE,OAAO,CAAC,GAAG;gBACxB,KAAK;aACN,CAAC,EACF,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa;aACrC,CAAC;YAEF,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC;YAC7C,MAAM,SAAS,GAAG,qBAAqB,CACrC,GAAG,CAAC,gBAAgB,EACpB,WAAW,EACX,UAAU,CACX,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC;gBAC7B,UAAU;gBACV,MAAM;gBACN,kBAAkB,EAAE,SAAS;aAC9B,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAElD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAC9C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,qCAAqC;YACrC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,wDAAwD,EAAE,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YACD,yFAAyF;YACzF,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAC;YAEzD,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAG7C,CAAC;YAEF,qCAAqC;YACrC,IAAI,UAAU,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,kBAAkB,CACnC,IAAI,EACJ,GAAG,CAAC,gBAAgB,EACpB,GAAG,CAAC,oBAAoB,CACzB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,KAAK,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACjG,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,gDAAgD;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAGtD,CAAC;YACF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAEtD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,KAAK,EAAE,gBAAgB,UAAU,CAAC,KAAK,iEAAiE;iBACzG,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,6EAA6E;YAC7E,4EAA4E;YAC5E,qEAAqE;YACrE,4EAA4E;YAC5E,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACrE,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YAC9D,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACpE,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAEhD,OAAO,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,0BAA0B,EAAE,EACxD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,+BAA+B;AAC/B,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAM;IACtC,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,UACmC;IAC/C,cAAc,EAAE,cAAc;IAC9B,iBAAiB,EAAE,YAAY;IAC/B,aAAa,EAAE,QAAQ;IACvB,0BAA0B,EAAE,WAAW;IACvC,cAAc,EAAE,IAAI,EAAE,SAAS;IAC/B,eAAe,EAAE,SAAS,EAAE,UAAU;IACtC,eAAe,EAAE;QACf,MAAM;QACN,gBAAgB;QAChB,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,cAAc;QACd,WAAW;KACZ;IACD,cAAc,EAAE,KAAK,EAAE,yBAAyB;IAChD,gBAAgB,EAAE;QAChB,aAAa,EAAE,0BAA0B;KAC1C;CACF,CAAC,CAAC;AAEH,eAAe,QAAQ,CAAC"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "rewind-mcp-server",
+  "version": "0.1.0",
+  "description": "MCP server for the Rewind personal data API",
+  "type": "module",
+  "bin": {
+    "rewind-mcp-server": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "rewind",
+    "personal-data",
+    "lastfm",
+    "strava",
+    "plex",
+    "discogs",
+    "instapaper",
+    "claude",
+    "anthropic"
+  ],
+  "author": "Patrick Dugan",
+  "license": "MIT",
+  "homepage": "https://rewind.rest",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pdugan20/rewind.git",
+    "directory": "mcp-server"
+  },
+  "bugs": {
+    "url": "https://github.com/pdugan20/rewind/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@cloudflare/workers-oauth-provider": "^0.4.0",
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20260403.1",
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.3"
+  }
+}