rhombus-node-mcp 0.1.13 → 0.1.15

package/README.md

@@ -49,7 +49,7 @@ Your insights will directly influence our development roadmap and help us create
         "--rm",
         "-e",
         "RHOMBUS_API_KEY=YOUR_API_KEY_HERE",
-        "johnrhombusdocker/mcp-server-rhombus"
+        "rhombussystems/mcp-server-rhombus"
       ],
       "env": {
         "RHOMBUS_API_KEY": "YOUR_API_KEY_HERE"
@@ -106,7 +106,7 @@ docker build -t mcp-server-rhombus .
 ### 2. Update Your Claude Config for Local Use ⚡
 Now, you'll need to adjust your `claude_desktop_config.json` to point to your newly built local Docker image.
 
-> ***Note:*** When running locally, the Docker image name changes to `mcp-server-rhombus` from `johnrhombusdocker/mcp-server-rhombus`. Make sure to update this in your configuration!
+> ***Note:*** When running locally, the Docker image name changes to `mcp-server-rhombus` from `rhombussystems/mcp-server-rhombus`. Make sure to update this in your configuration!
 
 ```json
 {

package/dist/createServer.js

@@ -0,0 +1,44 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { logger } from "./logger.js";
+import getResources from "./resources/getResources.js";
+import getTools from "./tools/getTools.js";
+let initiated = false;
+let resources;
+let tools;
+export async function serverInit() {
+    resources = await getResources();
+    logger.info(`📚 Found ${resources.length} resources`);
+    for (const resource of resources) {
+        logger.debug(`📕 - ${resource.name}`);
+    }
+    tools = await getTools();
+    logger.info(`🛠️ Found ${tools.length} tools`);
+    for (const tool of tools) {
+        logger.debug(`🔧 - ${tool.name}`);
+    }
+    initiated = true;
+}
+export default async function createServer() {
+    if (!initiated) {
+        await serverInit();
+    }
+    logger.info(`🖥️ Creating Server`);
+    const server = new McpServer({
+        name: "rhombus-node-mcp",
+        version: "1.0.0",
+        capabilities: {
+            resources: {},
+            tools: {},
+        },
+    });
+    for (const resource of resources) {
+        resource.create(server);
+    }
+    logger.info(`🛠️ Registered ${resources.length} resources`);
+    for (const tool of tools) {
+        tool.create(server);
+    }
+    logger.info(`🛠️ Registered ${tools.length} tools`);
+    logger.info(`✅ Server created`);
+    return server;
+}

package/dist/index.js

@@ -1,43 +1,38 @@
 #!/usr/bin/env node
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import "dotenv/config";
-import getTools from "./tools/getTools.js";
+import { serverInit } from "./createServer.js";
 import { logger } from "./logger.js";
-import getResources from "./resources/getResources.js";
+import stdioTransport from "./transports/stdio.js";
+import streamableHttpTransport from "./transports/streamable-http.js";
 const RHOMBUS_API_KEY = process.env.RHOMBUS_API_KEY;
-if (!RHOMBUS_API_KEY) {
-    logger.info("Missing RHOMBUS_API_KEY");
-}
-const serverUrl = process.env.RHOMBUS_API_SERVER || "api2.rhombussystems.com";
-logger.info(`Using API_KEY: ${RHOMBUS_API_KEY}`);
-logger.info(`To hit API server: ${serverUrl}`);
-logger.info("🌐 Using server url", serverUrl);
-export const server = new McpServer({
-    name: "rhombus",
-    version: "1.0.0",
-    capabilities: {
-        resources: {},
-        tools: {},
-    },
-});
+const TRANSPORT_TYPE = process.env.TRANSPORT_TYPE || "stdio";
 async function main() {
-    const resources = await getResources();
-    logger.info(`🛠️ Registering ${resources.length} resources`);
-    for (const resource of resources) {
-        resource.create(server);
-        logger.debug(`🔧 Registered resource ${resource.name}`);
+    if (!RHOMBUS_API_KEY) {
+        logger.info("Missing RHOMBUS_API_KEY");
+    }
+    const serverUrl = process.env.RHOMBUS_API_SERVER || "api2.rhombussystems.com";
+    logger.info(`Using API_KEY: ${RHOMBUS_API_KEY}`);
+    logger.info(`To hit API server: ${serverUrl}`);
+    logger.info("🌐 Using server url", serverUrl);
+    await serverInit();
+    const server = new McpServer({
+        name: "rhombus",
+        version: "1.0.0",
+        capabilities: {
+            resources: {},
+            tools: {},
+        },
+    });
+    if (TRANSPORT_TYPE === "stdio") {
+        await stdioTransport();
+    }
+    else if (TRANSPORT_TYPE === "streamable-http") {
+        await streamableHttpTransport();
     }
-    const tools = await getTools();
-    logger.info(`🛠️ Registering ${tools.length} tools`);
-    for (const tool of tools) {
-        tool.create(server);
-        logger.debug(`🔧 Registered tool ${tool.name}`);
+    else {
+        throw new Error(`Invalid transport type: ${TRANSPORT_TYPE}`);
     }
-    const transport = new StdioServerTransport();
-    logger.info(`🚙 Starting stdio transport`);
-    await server.connect(transport);
-    logger.info(`🚙🌬️ Connected.`);
 }
 main().catch(error => {
     console.error("Fatal error in main():", error);

package/dist/logger.js

@@ -5,7 +5,7 @@ log4js.configure({
         mcp: {
             type: "file",
             filename: path.resolve(process.env.LOG_FOLDER ?? process.cwd(), "rhombus-node-mcp.log"),
-            maxLogSize: "1K",
+            maxLogSize: "1M",
             layout: {
                 type: "basic",
             },

package/dist/network.js

@@ -34,15 +34,19 @@ export const appendQueryParams = (url, params) => {
     const queryString = existingSearchParams.toString();
     return queryString ? `${baseUrl}?${queryString}` : baseUrl;
 };
-export async function postApi(route, body, modifiers = undefined) {
+export async function postApi(route, body, modifiers) {
+    // merge headers
     let requestHeaders = {
-        ...(modifiers?.headers ?? AUTH_HEADERS),
         ...STATIC_HEADERS,
+        ...AUTH_HEADERS,
+        ...(modifiers?.headers ?? {}),
     };
     let url = BASE_URL + route;
+    // attach query params if provided
     if (modifiers?.query) {
         url = appendQueryParams(url, modifiers.query);
     }
+    // stringify body if it's not already a string
     if (typeof body === "object") {
         body = JSON.stringify(body);
     }

package/dist/tools/clips-tool.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { postApi } from "../network.js";
-import { createToolArgs } from "../util.js";
 const ClipsArgs = z.object({
     deviceUuidFilters: z
         .array(z.string())
@@ -50,11 +49,11 @@ The tool returns a JSON object with the following structure and important fields
     * **status (string):** The current processing status of the clip, with possible values such as INITIATING, UPLOADING, RENDERING, FAILED, COMPLETE, OFFLINE, or UNKNOWN.
     * **userUuid (string | null):** The UUID of the user associated with the clip, if applicable.
     * **sourceAlertUuid (string | null):** The UUID of the alert that triggered the creation of this clip, if any.
-`, createToolArgs({
+`, {
         ...ClipsArgs.shape,
-    }), async ({ requestModifiers, ...args }) => {
+    }, async ({ ...args }, extra) => {
         let ret;
-        ret = await getSavedClips(args, requestModifiers);
+        ret = await getSavedClips(args, extra._meta?.requestModifiers);
         return {
             content: [{ type: "text", text: JSON.stringify(ret) }],
         };

package/dist/tools/create-tool.js

@@ -1,10 +1,9 @@
 import { z } from "zod";
-import { createToolArgs } from "../util.js";
-import { CreateVideoWallOptions } from "../types.js";
-import { postApi } from "../network.js";
 import { logger } from "../logger.js";
+import { postApi } from "../network.js";
+import { CreateVideoWallOptions } from "../types.js";
 import { addConfirmationParams, requireConfirmation } from "../utils/confirmation.js";
-async function createVideoWall(options, headers) {
+async function createVideoWall(options, requestModifiers) {
     const body = {
         videoWall: {
             displayName: options?.displayName,
@@ -19,12 +18,12 @@ async function createVideoWall(options, headers) {
             },
         },
     };
-    const response = await postApi("/camera/createVideoWall", body, headers);
+    const response = await postApi("/camera/createVideoWall", body, requestModifiers);
     return response;
 }
-async function handleCreateVideoWallRequest(videoWallCreateOptions, headers) {
+async function handleCreateVideoWallRequest(videoWallCreateOptions, requestModifiers) {
     let text = "Unable to create video wall!";
-    logger.error("🔨 Creating video wall");
+    logger.info("🔨 Creating video wall");
     if (!videoWallCreateOptions?.displayName) {
         text = JSON.stringify({
             needUserInput: true,
@@ -38,8 +37,8 @@ async function handleCreateVideoWallRequest(videoWallCreateOptions, headers) {
         });
     }
     else {
-        logger.error("Creating video wall with options: ", JSON.stringify(videoWallCreateOptions));
-        text = JSON.stringify(await createVideoWall(videoWallCreateOptions, headers));
+        logger.info("Creating video wall with options: ", JSON.stringify(videoWallCreateOptions));
+        text = JSON.stringify(await createVideoWall(videoWallCreateOptions, requestModifiers));
     }
     return Promise.resolve({
         content: [
@@ -51,17 +50,17 @@ async function handleCreateVideoWallRequest(videoWallCreateOptions, headers) {
     });
 }
 export function createTool(server) {
-    server.tool("create-tool", "Tool for creating many entity types such as video walls.", addConfirmationParams(createToolArgs({
+    server.tool("create-tool", "Tool for creating many entity types such as video walls.", addConfirmationParams({
         entityType: z
             .enum(["video-wall"])
             .describe("The entity type to create.  Example: video wall."),
         videoWallCreateOptions: CreateVideoWallOptions,
-    })), async ({ entityType, videoWallCreateOptions, requestModifiers, confirmationId }) => {
+    }), async ({ entityType, videoWallCreateOptions, confirmationId }, extra) => {
         const confirmation = requireConfirmation(confirmationId);
         if (confirmation === true) {
             switch (entityType) {
                 case "video-wall":
-                    return await handleCreateVideoWallRequest(videoWallCreateOptions, requestModifiers);
+                    return await handleCreateVideoWallRequest(videoWallCreateOptions, extra._meta?.requestModifiers);
                 default:
             }
             return {

package/dist/tools/devices/camera-tool/camera-tool.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { getLogger } from "../../../logger.js";
 import { appendQueryParams, AUTH_HEADERS, postApi, STATIC_HEADERS } from "../../../network.js";
-import { createToolArgs, createToolTextContent, removeNullFields, } from "../../../util.js";
+import { createToolTextContent, removeNullFields } from "../../../util.js";
 import { addConfirmationParams, isConfirmed, requireConfirmation, } from "../../../utils/confirmation.js";
 import { ExternalUpdateableFacetedUserConfigSchema, } from "./types.js";
 const logger = getLogger("camera-tool");
@@ -130,14 +130,14 @@ Please make sure you only update the necessary fields, since any unnecessary cha
 It may be a good idea to call "image" on this tool again after updating settings to make sure the new settings were effective in fulfilling
 the user's request.
 Use Cases: Adjust streaming parameters for Camera E.
-`, addConfirmationParams(createToolArgs({
+`, addConfirmationParams({
         requestType: z.enum(["image", "get-settings", "update-settings"]),
         timestampMs: z.optional(z.number()).describe(`
           the timestamp in milliseconds. You can default to the current time if the user didn't specify a time, or you can call time-tool to parse the user's time description
           `),
         cameraUuid: z.optional(z.string()).describe("the camera uuid requested"),
         configUpdate: ExternalUpdateableFacetedUserConfigSchema.optional().describe('the config update that would be applied to the camera if the requestType is "update-settings"'),
-    })), async ({ cameraUuid, timestampMs, requestType, configUpdate, requestModifiers, confirmationId, }) => {
+    }), async ({ cameraUuid, timestampMs, requestType, configUpdate, confirmationId }, extra) => {
         if (!cameraUuid) {
             return {
                 content: [
@@ -167,7 +167,7 @@ Use Cases: Adjust streaming parameters for Camera E.
                         ],
                     };
                 }
-                response = await getImageForCameraAtTime(cameraUuid, timestampMs, requestModifiers);
+                response = await getImageForCameraAtTime(cameraUuid, timestampMs, extra._meta?.requestModifiers);
                 if (!response.success || !response.imageData) {
                     return {
                         content: [{ type: "text", text: JSON.stringify(response) }],
@@ -183,7 +183,7 @@ Use Cases: Adjust streaming parameters for Camera E.
                     ],
                 };
             case "get-settings":
-                response = await getCameraSettings(cameraUuid, requestModifiers);
+                response = await getCameraSettings(cameraUuid, extra._meta?.requestModifiers);
                 return {
                     content: [{ type: "text", text: JSON.stringify(response) }],
                 };
@@ -195,7 +195,7 @@ Use Cases: Adjust streaming parameters for Camera E.
                 if (!configUpdate) {
                     return createToolTextContent("Missing configUpdate");
                 }
-                response = await updateCameraSettings(cameraUuid, configUpdate, requestModifiers);
+                response = await updateCameraSettings(cameraUuid, configUpdate, extra._meta?.requestModifiers);
                 return {
                     content: [{ type: "text", text: JSON.stringify(response) }],
                 };

package/dist/tools/devices/get-entity-tool.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { postApi } from "../../network.js";
-import { createToolArgs, createToolTextContent } from "../../util.js";
 import DeviceType from "../../types/deviceType.js";
+import { createToolTextContent } from "../../util.js";
 async function getCameraList(requestModifiers) {
     return {
         cameras: (await postApi("/camera/getMinimalCameraStateList", "{}", requestModifiers)).cameraStates.filter((camera) => !!camera.locationUuid),
@@ -69,11 +69,12 @@ export function createTool(server) {
     Retrieves entities (or devices) of certain types.
     Can request multiple entity types at once.
     The return structure is a JSON string that continues the states of the requested entities.
-    This data is exact. Whatever entities exist will be returned here.`, createToolArgs({
+    This data is exact. Whatever entities exist will be returned here.`, {
         entityTypes: z
             .array(z.nativeEnum(DeviceType).describe("The entity type to retreive"))
             .describe("What type of entities to retrieve."),
-    }), async ({ entityTypes, requestModifiers }) => {
+    }, async ({ entityTypes }, extra) => {
+        const requestModifiers = extra._meta?.requestModifiers;
         const promises = [];
         if (entityTypes.includes(DeviceType.CAMERA)) {
             promises.push(getCameraList(requestModifiers));

package/dist/tools/events-tool.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
-import { createToolArgs } from "../util.js";
+import { FIVE_SECONDS_MS, THREE_HOURS_MS } from "../constants.js";
 import { postApi } from "../network.js";
-import { THREE_HOURS_MS, FIVE_SECONDS_MS } from "../constants.js";
 async function getFaceEvents(_locationUuid, requestModifiers) {
     const nowMs = Date.now();
     const rangeStartMs = nowMs - THREE_HOURS_MS;
@@ -47,13 +46,13 @@ async function getAccessControlEvents(doorUuid, requestModifiers) {
     return response;
 }
 export function createTool(server) {
-    server.tool("events-tool", "event data for certain types of information like faces, license plates, and access-control events", createToolArgs({
+    server.tool("events-tool", "event data for certain types of information like faces, license plates, and access-control events", {
         eventType: z.enum(["faces", "people", "access-control"]),
         locationUuid: z.optional(z.string()),
         accessControlledDoorUuid: z.optional(z.string()),
-    }), async ({ eventType, locationUuid, accessControlledDoorUuid, requestModifiers }) => {
+    }, async ({ eventType, locationUuid, accessControlledDoorUuid }, extra) => {
         if (eventType === "faces" || eventType === "people") {
-            const response = await getFaceEvents(locationUuid, requestModifiers);
+            const response = await getFaceEvents(locationUuid, extra._meta?.requestModifiers);
             return {
                 content: [
                     {
@@ -78,7 +77,7 @@ export function createTool(server) {
                 };
             }
             else {
-                const events = await getAccessControlEvents(accessControlledDoorUuid, requestModifiers);
+                const events = await getAccessControlEvents(accessControlledDoorUuid, extra._meta?.requestModifiers);
                 return {
                     content: [
                         {

package/dist/tools/faces-tool.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { postApi } from "../network.js";
-import { createToolArgs } from "../util.js";
 var RequestType;
 (function (RequestType) {
     RequestType["GET_FACE_EVENTS"] = "get-face-events";
@@ -112,7 +111,7 @@ If the requestType is "get-registered-faces":
 
 `, 
     // FacesToolArgs directly passed here
-    createToolArgs({
+    {
         requestType: z.nativeEnum(RequestType),
         args: z.union([
             z.object({
@@ -123,15 +122,15 @@ If the requestType is "get-registered-faces":
                 args: GetRegisteredFacesArgsSchema,
             }),
         ]),
-    }), async ({ requestModifiers, requestType, args }) => {
+    }, async ({ requestType, args }, extra) => {
         let ret;
         if (requestType === "get-face-events") {
             // Pass the args directly, as requested
-            ret = await getFaceEvents(args, requestModifiers);
+            ret = await getFaceEvents(args, extra._meta?.requestModifiers);
         }
         else if (requestType === "get-registered-faces") {
             // Pass the args (will effectively be an empty object for this call)
-            ret = await getRegisteredFaces(args, requestModifiers);
+            ret = await getRegisteredFaces(args, extra._meta?.requestModifiers);
         }
         return {
             content: [{ type: "text", text: JSON.stringify(ret) }],

package/dist/tools/get-org-information.js

@@ -1,11 +1,10 @@
-import { createToolArgs } from "../util.js";
 import { postApi } from "../network.js";
 async function getOrg(requestModifiers) {
     return await postApi("/org/getOrgV2", {}, requestModifiers);
 }
 export function createTool(server) {
-    server.tool("get-org-information", "Get general information about the organization including org name, camera configuration defaults, contact information, and org settings.", createToolArgs({}), async ({ requestModifiers }) => {
-        const org = await getOrg(requestModifiers);
+    server.tool("get-org-information", "Get general information about the organization including org name, camera configuration defaults, contact information, and org settings.", {}, async (_, extra) => {
+        const org = await getOrg(extra._meta?.requestModifiers);
         return {
             content: [
                 {

package/dist/tools/location-tool.js

@@ -1,12 +1,11 @@
 import { z } from "zod";
-import { createToolArgs } from "../util.js";
 import { postApi } from "../network.js";
 async function getLocations(requestModifiers) {
     return await postApi("/location/getLocationsV2", {}, requestModifiers);
 }
 export function createTool(server) {
     server.tool("location-tool", `This tool performs operations on locations.
-- 'get': Retrieves all locations.`, createToolArgs({
+- 'get': Retrieves all locations.`, {
         action: z.enum(["get", "update"]),
         locationUpdate: z
             .object({
@@ -14,11 +13,11 @@ export function createTool(server) {
             name: z.string(),
         })
             .optional(),
-    }), async ({ action, requestModifiers }) => {
+    }, async ({ action }, extra) => {
         let ret;
         switch (action) {
             case "get":
-                ret = await getLocations(requestModifiers);
+                ret = await getLocations(extra._meta?.requestModifiers);
                 break;
             case "update":
                 ret = { error: true, status: "not implemented" };

package/dist/tools/policy-alerts-tool.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { postApi } from "../network.js";
-import { createToolArgs } from "../util.js";
 const PolicyAlertsArgs = z.object({
     afterTimestampMs: z
         .number()
@@ -45,11 +44,11 @@ policy alerts within the Rhombus system.
 This tool allows you to filter existing alerts by a specific time range (before or after a timestamp in milliseconds),
 by a list of device UUIDs, or by a list of location UUIDs.
 You can also specify the maximum number of results to return.
-The output is provided in JSON format.`, createToolArgs({
+The output is provided in JSON format.`, {
         ...PolicyAlertsArgs.shape,
-    }), async ({ requestModifiers, ...args }) => {
+    }, async ({ ...args }, extra) => {
         let ret;
-        ret = await getPolicyAlerts(args, requestModifiers);
+        ret = await getPolicyAlerts(args, extra._meta?.requestModifiers);
         return {
             content: [{ type: "text", text: JSON.stringify(ret) }],
         };

package/dist/tools/reboot-cameras.js

@@ -1,5 +1,4 @@
 import { z } from "zod";
-import { createToolArgs } from "../util.js";
 import { postApi } from "../network.js";
 import { addConfirmationParams, isConfirmed, requireConfirmation } from "../utils/confirmation.js";
 async function rebootCameras(cameraUuids, requestModifiers) {
@@ -31,16 +30,16 @@ async function rebootCameras(cameraUuids, requestModifiers) {
     }
 }
 export function createTool(server) {
-    server.tool("reboot-cameras", "this tool is for rebooting one or more cameras causing them to reconnect to the server, this is a helpful option when a camera is experiencing connectivity issues or is in need of troubleshooting. THIS TOOL PERFORMS AN ACTION.", addConfirmationParams(createToolArgs({
+    server.tool("reboot-cameras", "this tool is for rebooting one or more cameras causing them to reconnect to the server, this is a helpful option when a camera is experiencing connectivity issues or is in need of troubleshooting. THIS TOOL PERFORMS AN ACTION.", addConfirmationParams({
         cameraUuids: z
             .array(z.string())
             .describe("An array of camera UUID strings which are unique identifiers for cameras"),
-    })), async ({ cameraUuids, requestModifiers, confirmationId }) => {
+    }), async ({ cameraUuids, confirmationId }, extra) => {
         const confirmation = requireConfirmation(confirmationId);
         if (!isConfirmed(confirmation)) {
             return confirmation;
         }
-        const cameraRebootData = await rebootCameras(cameraUuids, requestModifiers);
+        const cameraRebootData = await rebootCameras(cameraUuids, extra._meta?.requestModifiers);
         if (!cameraRebootData) {
             return {
                 content: [

package/dist/tools/time-tool.js

@@ -1,6 +1,7 @@
-import { z } from "zod";
 import { parse } from "chrono-node";
 import { DateTime } from "luxon";
+import { z } from "zod";
+import { logger } from "../logger.js";
 function nullToUndefined(value) {
     return value === null ? undefined : value;
 }
@@ -13,7 +14,8 @@ export function createTool(server) {
             .string()
             .optional()
             .describe("Optional IANA timezone string (e.g., 'America/Los_Angeles', 'UTC'). Will default to system timezone if not provided."),
-    }, async ({ time_description, timezone }) => {
+    }, async ({ time_description, timezone }, extra) => {
+        logger.info("EXTRA", extra);
         // console.error(`🕛 handling tool call for time ${time_description} using timezone ${timezone}`);
         const now = DateTime.now()
             .setZone(timezone || undefined)

package/dist/transports/stdio.js

@@ -0,0 +1,10 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import createServer from "../createServer.js";
+import { logger } from "../logger.js";
+export default async function stdioTransport() {
+    const server = await createServer();
+    const transport = new StdioServerTransport();
+    logger.info(`🚙 Starting stdio transport`);
+    await server.connect(transport);
+    logger.info(`🚙🌬️ Connected.`);
+}

package/dist/transports/streamable-http.js

@@ -0,0 +1,98 @@
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import express from "express";
+import jwt from "jsonwebtoken";
+import createServer from "../createServer.js";
+import { logger } from "../logger.js";
+import { RequestModifiers } from "../util.js";
+const JWT_SECRET = process.env.SECRET;
+export default function streamableHttpTransport() {
+    if (!JWT_SECRET) {
+        throw new Error("SECRET is not set");
+    }
+    const app = express();
+    app.use(express.json());
+    app.post("/mcp", async (req, res) => {
+        logger.info(`Received MCP request`, req.body);
+        // check JWT
+        const token = req.headers.authorization?.split(" ")[1];
+        let authRequestModifiers;
+        if (token) {
+            try {
+                const decoded = RequestModifiers.parse(jwt.verify(token, JWT_SECRET));
+                // if successful (did not throw)
+                authRequestModifiers = decoded;
+                // inject auth into request body's meta object
+                // to be made available to MCP tools
+                if (req.body.params) {
+                    req.body.params._meta = {
+                        ...(req.body.params._meta ?? {}),
+                        requestModifiers: authRequestModifiers,
+                    };
+                }
+                logger.info(`🔒 MCP request authenticated with x-auth-session: ${authRequestModifiers?.headers?.["x-auth-session"]} and x-auth-chat: ${authRequestModifiers?.headers?.["x-auth-chat"]}`);
+            }
+            catch (err) {
+                logger.error(`Error verifying JWT: ${token}, err: ${err}`);
+                res.status(401).json({
+                    jsonrpc: "2.0",
+                    error: { code: -32000, message: "Unauthorized" },
+                    id: null,
+                });
+                return;
+            }
+        }
+        const server = await createServer();
+        try {
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+            });
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+            res.on("close", () => {
+                logger.log("Request closed");
+                transport.close();
+                server.close();
+            });
+        }
+        catch (error) {
+            logger.error("Error handling MCP request:", error);
+            if (!res.headersSent) {
+                res.status(500).json({
+                    jsonrpc: "2.0",
+                    error: {
+                        code: -32603,
+                        message: "Internal server error",
+                    },
+                    id: null,
+                });
+            }
+        }
+    });
+    app.get("/mcp", async (req, res) => {
+        logger.warn("Received Not Allowed GET MCP request");
+        res.writeHead(405).end(JSON.stringify({
+            jsonrpc: "2.0",
+            error: {
+                code: -32000,
+                message: "Method not allowed.",
+            },
+            id: null,
+        }));
+    });
+    app.delete("/mcp", async (req, res) => {
+        logger.warn("Received Not Allowed DELETE MCP request");
+        res.writeHead(405).end(JSON.stringify({
+            jsonrpc: "2.0",
+            error: {
+                code: -32000,
+                message: "Method not allowed.",
+            },
+            id: null,
+        }));
+    });
+    // Start the server
+    const PORT = process.env.PORT || 3000;
+    app.listen(PORT, () => {
+        logger.info(`rhombus-node-mcp listening on port ${PORT}`);
+    });
+}

package/dist/util.js

@@ -10,14 +10,10 @@ export function generateRandomString(length) {
     }
     return result;
 }
-const STATIC_ARGS = {
-    requestModifiers: z
-        .optional(z.object({
-        headers: z.nullable(z.record(z.string(), z.string())),
-        query: z.nullable(z.record(z.string(), z.string())),
-    }))
-        .describe("Optional headers accepted by tools.  LLM should never ever use this. 😅"),
-};
+export const RequestModifiers = z.object({
+    headers: z.optional(z.record(z.string(), z.string())),
+    query: z.optional(z.record(z.string(), z.string())),
+}).optional();
 /**
  * Get all file paths in a directory in a directory
  *
@@ -46,12 +42,6 @@ export function getFilePathsInDirectory(dirPath) {
     }
     return filePaths;
 }
-export function createToolArgs(args) {
-    return {
-        ...args,
-        ...STATIC_ARGS,
-    };
-}
 /**
  * Returns an object in the form expected by `server.tool`
  */

package/dist/utils/confirmation.js

@@ -4,12 +4,6 @@
 import { z } from "zod";
 import { createToolTextContent, generateRandomString } from "../util.js";
 import { logger } from "../logger.js";
-// export function createToolArgs<TArgs extends object>(args: TArgs): TArgs & typeof STATIC_ARGS {
-//     return {
-//       ...args,
-//       ...STATIC_ARGS,
-//     };
-//   }
 export const CONFIRMATION_ARGS = {
     confirmationId: z.string().nullable().optional(),
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rhombus-node-mcp",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "MCP server for Rhombus API",
   "keywords": [
     "ai",
@@ -35,11 +35,16 @@
     "@modelcontextprotocol/sdk": "^1.9.0",
     "chrono-node": "^2.8.0",
     "dotenv": "^16.5.0",
+    "express": "^5.1.0",
+    "express-jwt": "^8.5.1",
+    "jsonwebtoken": "^9.0.2",
     "log4js": "^6.9.1",
     "luxon": "^3.6.1",
     "zod": "^3.24.2"
   },
   "devDependencies": {
+    "@types/express": "^5.0.3",
+    "@types/jwt-express": "^1.1.6",
     "@types/luxon": "^3.6.2",
     "@types/node": "^22.14.0",
     "prettier": "3.5.3",