shabaaspay-mcp-server 1.0.1

package/dist/server/http-server.js

@@ -0,0 +1,524 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpMcpServer = void 0;
+const http_1 = __importDefault(require("http"));
+const url_1 = require("url");
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const zod_to_json_schema_1 = require("zod-to-json-schema");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const client_js_1 = require("../api/client.js");
+const index_js_2 = require("../tools/index.js");
+const rate_limiter_js_1 = require("../security/rate-limiter.js");
+const auth_js_1 = require("../security/auth.js");
+const policy_js_1 = require("../security/policy.js");
+class HttpMcpServer {
+    server;
+    tools;
+    rateLimiter;
+    config;
+    mcpServer;
+    mcpTransport;
+    constructor(config) {
+        this.config = config;
+        // Initialize API client
+        const apiClient = new client_js_1.ShabaasApiClient(config);
+        // Create tools
+        this.tools = (0, index_js_2.createAllTools)(apiClient, config);
+        // Create MCP server (Streamable HTTP transport for VS Code / MCP HTTP clients)
+        this.mcpServer = new index_js_1.Server({
+            name: 'shabaaspay-mcp',
+            version: '1.0.0',
+        }, {
+            capabilities: {
+                tools: {},
+            },
+        });
+        this.setupMcpHandlers();
+        this.mcpTransport = new streamableHttp_js_1.StreamableHTTPServerTransport();
+        // Initialize rate limiter
+        this.rateLimiter = new rate_limiter_js_1.RateLimiter(config.rateLimitPerMinute, config.rateLimitPerHour);
+        // Create HTTP server
+        this.server = http_1.default.createServer(this.handleRequest.bind(this));
+    }
+    async handleRequest(req, res) {
+        const startTime = Date.now();
+        const requestId = `req_${startTime}`;
+        try {
+            // Parse request
+            const parsedUrl = new url_1.URL(req.url || '', `http://${req.headers.host}`);
+            const path = parsedUrl.pathname;
+            // CORS preflight for any route (including /mcp)
+            if ((req.method || '').toUpperCase() === 'OPTIONS') {
+                this.sendResponse(res, this.corsResponse());
+                return;
+            }
+            // Dedicated MCP HTTP transport endpoint
+            if (path === '/mcp') {
+                await this.handleMcpTransport(req, res, startTime);
+                return;
+            }
+            const body = await this.parseBody(req);
+            const request = {
+                method: req.method || 'GET',
+                path,
+                headers: req.headers,
+                body,
+                requestId,
+            };
+            console.log(`[HTTP] ${request.method} ${request.path}`);
+            // Health check does not require auth
+            if (request.method === 'GET' && request.path === '/health') {
+                this.sendResponse(res, this.healthResponse());
+                return;
+            }
+            // Handle CORS preflight
+            if (request.method === 'OPTIONS') {
+                this.sendResponse(res, this.corsResponse());
+                return;
+            }
+            // Authenticate
+            const authResult = this.authenticate(request);
+            if (!authResult.success) {
+                this.sendResponse(res, authResult.response);
+                this.logStructured({
+                    requestId,
+                    clientId: undefined,
+                    toolName: request.toolName,
+                    statusCode: authResult.response?.statusCode || 401,
+                    latencyMs: Date.now() - startTime,
+                    rejection: 'auth_failed',
+                });
+                return;
+            }
+            request.clientId = authResult.clientId;
+            // Rate limiting
+            const clientId = this.getClientIdentifier(request);
+            const minuteLimit = this.rateLimiter.checkLimit(clientId, 'minute');
+            const hourLimit = this.rateLimiter.checkLimit(clientId, 'hour');
+            if (!minuteLimit.allowed) {
+                this.sendResponse(res, this.rateLimitResponse(minuteLimit));
+                return;
+            }
+            if (!hourLimit.allowed) {
+                this.sendResponse(res, this.rateLimitResponse(hourLimit));
+                return;
+            }
+            // Route request
+            const response = await this.routeRequest(request);
+            // Add rate limit headers
+            response.headers['X-RateLimit-Limit-Minute'] = minuteLimit.limit.toString();
+            response.headers['X-RateLimit-Remaining-Minute'] = minuteLimit.remaining.toString();
+            response.headers['X-RateLimit-Reset-Minute'] = minuteLimit.reset.toString();
+            response.headers['X-RateLimit-Limit-Hour'] = hourLimit.limit.toString();
+            response.headers['X-RateLimit-Remaining-Hour'] = hourLimit.remaining.toString();
+            response.headers['X-RateLimit-Reset-Hour'] = hourLimit.reset.toString();
+            // Add processing time
+            response.headers['X-Processing-Time'] = `${Date.now() - startTime}ms`;
+            this.sendResponse(res, response, requestId);
+            this.logStructured({
+                requestId,
+                clientId: request.clientId,
+                toolName: request.toolName,
+                statusCode: response.statusCode,
+                latencyMs: Date.now() - startTime,
+            });
+        }
+        catch (error) {
+            console.error('[HTTP] Error:', error);
+            this.sendResponse(res, this.errorResponse('Internal error'), requestId);
+            this.logStructured({
+                requestId,
+                clientId: undefined,
+                toolName: undefined,
+                statusCode: 500,
+                latencyMs: Date.now() - startTime,
+                rejection: 'internal_error',
+            });
+        }
+    }
+    healthResponse() {
+        return {
+            statusCode: 200,
+            headers: this.corsHeaders(),
+            body: {
+                status: 'healthy',
+                version: '1.0.0',
+                environment: this.config.environment,
+                timestamp: new Date().toISOString(),
+            },
+        };
+    }
+    async handleMcpTransport(req, res, startTime) {
+        console.log(`[HTTP][MCP] ${req.method} ${req.url}`);
+        // Always set CORS headers for MCP responses
+        const baseCors = this.corsHeaders();
+        Object.entries(baseCors).forEach(([k, v]) => res.setHeader(k, v));
+        // Auth
+        const authResult = this.authenticateHeaders(req.headers);
+        if (!authResult.success) {
+            this.sendResponse(res, authResult.response);
+            return;
+        }
+        // Rate limiting
+        const clientId = this.getClientIdentifierFromHeaders(req.headers);
+        const minuteLimit = this.rateLimiter.checkLimit(clientId, 'minute');
+        const hourLimit = this.rateLimiter.checkLimit(clientId, 'hour');
+        if (!minuteLimit.allowed) {
+            this.sendResponse(res, this.rateLimitResponse(minuteLimit));
+            return;
+        }
+        if (!hourLimit.allowed) {
+            this.sendResponse(res, this.rateLimitResponse(hourLimit));
+            return;
+        }
+        // Pass through to MCP transport
+        res.setHeader('X-RateLimit-Limit-Minute', minuteLimit.limit.toString());
+        res.setHeader('X-RateLimit-Remaining-Minute', minuteLimit.remaining.toString());
+        res.setHeader('X-RateLimit-Reset-Minute', minuteLimit.reset.toString());
+        res.setHeader('X-RateLimit-Limit-Hour', hourLimit.limit.toString());
+        res.setHeader('X-RateLimit-Remaining-Hour', hourLimit.remaining.toString());
+        res.setHeader('X-RateLimit-Reset-Hour', hourLimit.reset.toString());
+        res.setHeader('X-Processing-Time', `${Date.now() - startTime}ms`);
+        await this.mcpTransport.handleRequest(req, res);
+    }
+    async parseBody(req) {
+        return new Promise((resolve, reject) => {
+            let body = '';
+            req.on('data', chunk => (body += chunk.toString()));
+            req.on('end', () => {
+                try {
+                    resolve(body ? JSON.parse(body) : undefined);
+                }
+                catch (error) {
+                    reject(new Error('Invalid JSON body'));
+                }
+            });
+            req.on('error', reject);
+        });
+    }
+    authenticate(request) {
+        const token = (0, auth_js_1.extractBearerToken)(request.headers.authorization);
+        if (!token) {
+            return {
+                success: false,
+                response: {
+                    statusCode: 401,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Authentication required',
+                        message: 'Authorization header with UUID is required',
+                    },
+                },
+            };
+        }
+        // Optional HTTP guard
+        if (this.config.mcpHttpApiKey && token !== this.config.mcpHttpApiKey) {
+            return {
+                success: false,
+                response: {
+                    statusCode: 403,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Invalid API key',
+                        message: 'The provided API key is not valid',
+                    },
+                },
+            };
+        }
+        const policyResult = (0, policy_js_1.lookupClientPolicy)(token, this.config.environment);
+        if (!policyResult.policy) {
+            return {
+                success: false,
+                response: {
+                    statusCode: 403,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Forbidden',
+                        message: 'Access denied',
+                    },
+                },
+            };
+        }
+        return { success: true, clientId: policyResult.policy.client_id };
+    }
+    authenticateHeaders(headers) {
+        const token = (0, auth_js_1.extractBearerToken)(headers.authorization);
+        if (!token) {
+            return {
+                success: false,
+                response: {
+                    statusCode: 401,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Authentication required',
+                        message: 'Authorization header with UUID is required',
+                    },
+                },
+            };
+        }
+        if (this.config.mcpHttpApiKey && token !== this.config.mcpHttpApiKey) {
+            return {
+                success: false,
+                response: {
+                    statusCode: 403,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Invalid API key',
+                        message: 'The provided API key is not valid',
+                    },
+                },
+            };
+        }
+        const policyResult = (0, policy_js_1.lookupClientPolicy)(token, this.config.environment);
+        if (!policyResult.policy) {
+            return {
+                success: false,
+                response: {
+                    statusCode: 403,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Forbidden',
+                        message: 'Access denied',
+                    },
+                },
+            };
+        }
+        return { success: true, clientId: policyResult.policy.client_id };
+    }
+    getClientIdentifier(request) {
+        return this.getClientIdentifierFromHeaders(request.headers);
+    }
+    getClientIdentifierFromHeaders(headers) {
+        // Use IP address for rate limiting
+        return headers['x-forwarded-for']?.toString() ||
+            headers['x-real-ip']?.toString() ||
+            'unknown';
+    }
+    async routeRequest(request) {
+        const { method, path, body } = request;
+        // Health check
+        if (path === '/health' && method === 'GET') {
+            return {
+                statusCode: 200,
+                headers: this.corsHeaders(),
+                body: {
+                    status: 'healthy',
+                    version: '1.0.0',
+                    environment: this.config.environment,
+                    timestamp: new Date().toISOString(),
+                },
+            };
+        }
+        // List tools
+        if (path === '/tools' && method === 'GET') {
+            const toolsList = Object.values(this.tools).map(tool => ({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: tool.inputSchema,
+            }));
+            return {
+                statusCode: 200,
+                headers: this.corsHeaders(),
+                body: {
+                    tools: toolsList,
+                },
+            };
+        }
+        // Execute tool
+        if (path === '/tools/execute' && method === 'POST') {
+            if (!body || !body.tool || !body.arguments) {
+                throw new Error('Request must include "tool" and "arguments" fields');
+            }
+            const { tool: toolName, arguments: args } = body;
+            request.toolName = toolName;
+            const tool = this.tools[toolName];
+            if (!tool) {
+                return {
+                    statusCode: 404,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Tool not found',
+                        message: `Tool "${toolName}" does not exist`,
+                    },
+                };
+            }
+            // Tool allowlist check based on policy
+            const token = (0, auth_js_1.extractBearerToken)(request.headers.authorization);
+            if (!token) {
+                return {
+                    statusCode: 401,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Authentication required',
+                        message: 'Authorization header with UUID is required',
+                    },
+                };
+            }
+            const policyResult = (0, policy_js_1.lookupClientPolicy)(token, this.config.environment);
+            if (!policyResult.policy || !(0, policy_js_1.isToolAllowed)(policyResult.policy, toolName)) {
+                return {
+                    statusCode: 403,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Forbidden',
+                        message: 'Tool is not permitted',
+                    },
+                };
+            }
+            try {
+                const result = await tool.execute(args);
+                return {
+                    statusCode: 200,
+                    headers: this.corsHeaders(),
+                    body: {
+                        success: true,
+                        result,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    statusCode: 400,
+                    headers: this.corsHeaders(),
+                    body: {
+                        error: 'Tool execution failed',
+                        message: error.message,
+                    },
+                };
+            }
+        }
+        // 404 - Not found
+        return {
+            statusCode: 404,
+            headers: this.corsHeaders(),
+            body: {
+                error: 'Not found',
+                message: `Endpoint ${method} ${path} does not exist`,
+            },
+        };
+    }
+    corsHeaders() {
+        const origins = this.config.allowedOrigins;
+        const allowOrigin = origins.includes('*') ? '*' : origins[0];
+        return {
+            'Content-Type': 'application/json',
+            'Access-Control-Allow-Origin': allowOrigin,
+            'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+            'Access-Control-Allow-Headers': 'Content-Type, Authorization, MCP-Protocol-Version, MCP-Sequence-Id, MCP-Client-Id, X-Requested-With',
+            'Access-Control-Max-Age': '86400',
+        };
+    }
+    corsResponse() {
+        return {
+            statusCode: 204,
+            headers: this.corsHeaders(),
+            body: null,
+        };
+    }
+    rateLimitResponse(limitInfo) {
+        return {
+            statusCode: 429,
+            headers: {
+                ...this.corsHeaders(),
+                'Retry-After': Math.ceil((limitInfo.reset - Date.now()) / 1000).toString(),
+                'X-RateLimit-Limit': limitInfo.limit.toString(),
+                'X-RateLimit-Remaining': limitInfo.remaining.toString(),
+                'X-RateLimit-Reset': limitInfo.reset.toString(),
+            },
+            body: {
+                error: 'Rate limit exceeded',
+                message: 'Too many requests. Please try again later.',
+                retry_after: Math.ceil((limitInfo.reset - Date.now()) / 1000),
+            },
+        };
+    }
+    errorResponse(message) {
+        return {
+            statusCode: 500,
+            headers: this.corsHeaders(),
+            body: {
+                error: 'Internal server error',
+                message,
+            },
+        };
+    }
+    sendResponse(res, response, requestId) {
+        if (requestId) {
+            res.setHeader('X-Request-Id', requestId);
+        }
+        res.writeHead(response.statusCode, response.headers);
+        res.end(response.body ? JSON.stringify(response.body, null, 2) : '');
+    }
+    logStructured(entry) {
+        console.error(JSON.stringify(entry));
+    }
+    setupMcpHandlers() {
+        // List available tools
+        this.mcpServer.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
+            const toolsList = Object.values(this.tools).map(tool => ({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: (0, zod_to_json_schema_1.zodToJsonSchema)(tool.inputSchema),
+            }));
+            console.log(`[HTTP][MCP] Listing ${toolsList.length} tools`);
+            return {
+                tools: toolsList,
+            };
+        });
+        // Execute tool calls
+        this.mcpServer.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+            const { name, arguments: args } = request.params;
+            console.log(`[HTTP][MCP] Executing tool: ${name}`);
+            console.log(`[HTTP][MCP] Arguments:`, JSON.stringify(args, null, 2));
+            const tool = this.tools[name];
+            if (!tool) {
+                throw new Error(`Unknown tool: ${name}`);
+            }
+            try {
+                const result = await tool.execute(args);
+                console.log(`[HTTP][MCP] Tool execution successful`);
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify(result, null, 2),
+                        },
+                    ],
+                };
+            }
+            catch (error) {
+                console.error(`[HTTP][MCP] Tool execution failed:`, error.message);
+                throw new Error(`Tool execution failed: ${error.message}`);
+            }
+        });
+    }
+    async start() {
+        await this.mcpServer.connect(this.mcpTransport);
+        this.server.listen(this.config.httpPort, this.config.httpHost, () => {
+            console.log('[HTTP] ShaBaas Pay MCP Server started');
+            console.log(`[HTTP] Listening on http://${this.config.httpHost}:${this.config.httpPort}`);
+            console.log(`[HTTP] Environment: ${this.config.environment}`);
+            console.log(`[HTTP] Tools available: ${Object.keys(this.tools).length}`);
+            console.log('[HTTP] Endpoints:');
+            console.log('  - GET  /health          - Health check');
+            console.log('  - GET  /tools           - List available tools');
+            console.log('  - POST /tools/execute   - Execute a tool');
+            console.log('  - POST/GET /mcp         - MCP Streamable HTTP (VS Code / MCP HTTP clients)');
+        });
+    }
+    async stop() {
+        await this.mcpTransport.close();
+        await new Promise((resolve) => {
+            this.server.close(() => {
+                console.log('[HTTP] Server stopped');
+                resolve();
+            });
+        });
+        await this.mcpServer.close();
+    }
+}
+exports.HttpMcpServer = HttpMcpServer;

package/dist/server/stdio-server.d.ts

@@ -0,0 +1,13 @@
+import { Config } from '../config/index.js';
+export declare class StdioMcpServer {
+    private server;
+    private tools;
+    private rateLimiter;
+    private rateLimitClientId;
+    private config;
+    private readTools;
+    private writeTools;
+    constructor(config: Config);
+    private setupHandlers;
+    start(): Promise<void>;
+}

package/dist/server/stdio-server.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StdioMcpServer = void 0;
+const zod_to_json_schema_1 = require("zod-to-json-schema");
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const client_js_1 = require("../api/client.js");
+const index_js_2 = require("../tools/index.js");
+const rate_limiter_js_1 = require("../security/rate-limiter.js");
+const policy_js_1 = require("../security/policy.js");
+class StdioMcpServer {
+    server;
+    tools;
+    rateLimiter;
+    rateLimitClientId = 'stdio-session';
+    config;
+    readTools = new Set(['get_payment_agreement', 'get_payment_initiation', 'get_auth_token']);
+    writeTools = new Set(['create_payment_agreement', 'initiate_payment']);
+    constructor(config) {
+        this.config = config;
+        // Initialize API client
+        const apiClient = new client_js_1.ShabaasApiClient(config);
+        // Create tools
+        this.tools = (0, index_js_2.createAllTools)(apiClient, config);
+        // Rate limiter (reuse HTTP settings for consistency)
+        this.rateLimiter = new rate_limiter_js_1.RateLimiter(config.rateLimitPerMinute, config.rateLimitPerHour);
+        // Create MCP server
+        this.server = new index_js_1.Server({
+            name: 'shabaaspay-mcp',
+            version: '1.0.0',
+        }, {
+            capabilities: {
+                tools: {},
+            },
+        });
+        this.setupHandlers();
+    }
+    setupHandlers() {
+        const self = this;
+        // List available tools
+        this.server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
+            const toolsList = Object.values(self.tools).map(tool => ({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: (0, zod_to_json_schema_1.zodToJsonSchema)(tool.inputSchema),
+            }));
+            console.error(`[STDIO] Listing ${toolsList.length} tools`);
+            return {
+                tools: toolsList,
+            };
+        });
+        // Execute tool calls
+        this.server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+            const { name, arguments: args } = request.params;
+            console.error(`[STDIO] Executing tool: ${name}`);
+            console.error(`[STDIO] Arguments:`, JSON.stringify(args, null, 2));
+            // Auth guard: require authorization field in args (UUID or configured key)
+            const authToken = args?.authorization;
+            if (!authToken) {
+                throw new Error('STDIO authorization failed: missing authorization');
+            }
+            if (self.config.mcpStdioApiKey && authToken !== self.config.mcpStdioApiKey) {
+                throw new Error('STDIO authorization failed: invalid authorization');
+            }
+            // Tool allowlist via policy
+            const policyResult = (0, policy_js_1.lookupClientPolicy)(authToken, self.config.environment);
+            if (!policyResult.policy) {
+                throw new Error('STDIO authorization failed: access denied');
+            }
+            if (!(0, policy_js_1.isToolAllowed)(policyResult.policy, name)) {
+                throw new Error('STDIO authorization failed: tool not permitted');
+            }
+            // Rate limiting per stdio session (no client context available)
+            const minuteLimit = self.rateLimiter.checkLimit(self.rateLimitClientId, 'minute');
+            const hourLimit = self.rateLimiter.checkLimit(self.rateLimitClientId, 'hour');
+            if (!minuteLimit.allowed || !hourLimit.allowed) {
+                const limitInfo = !minuteLimit.allowed ? minuteLimit : hourLimit;
+                throw new Error(`Rate limit exceeded (${limitInfo.limit} requests per ${!minuteLimit.allowed ? 'minute' : 'hour'}). ` +
+                    `Retry after ${Math.ceil((limitInfo.reset - Date.now()) / 1000)} seconds.`);
+            }
+            const tool = self.tools[name];
+            if (!tool) {
+                throw new Error(`Unknown tool: ${name}`);
+            }
+            try {
+                const result = await tool.execute(args);
+                console.error(`[STDIO] Tool execution successful`);
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify(result, null, 2),
+                        },
+                    ],
+                };
+            }
+            catch (error) {
+                console.error(`[STDIO] Tool execution failed:`, error.message);
+                throw new Error(`Tool execution failed`);
+            }
+        });
+    }
+    async start() {
+        console.error('[STDIO] Starting ShaBaas Pay MCP Server...');
+        console.error(`[STDIO] Environment: ${process.env.SHABAAS_ENVIRONMENT || 'sandbox'}`);
+        console.error(`[STDIO] Tools available: ${Object.keys(this.tools).length}`);
+        const transport = new stdio_js_1.StdioServerTransport();
+        await this.server.connect(transport);
+        console.error('[STDIO] Server started successfully');
+        console.error('[STDIO] Waiting for requests...');
+    }
+}
+exports.StdioMcpServer = StdioMcpServer;

package/dist/server-http.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/server-http.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_js_1 = require("./config/index.js");
+const http_server_js_1 = require("./server/http-server.js");
+async function main() {
+    try {
+        // Load configuration
+        const config = (0, index_js_1.loadConfig)();
+        // Create and start server
+        const server = new http_server_js_1.HttpMcpServer(config);
+        await server.start();
+        // Handle shutdown
+        const shutdown = async () => {
+            console.log('\n[HTTP] Shutting down gracefully...');
+            await server.stop();
+            process.exit(0);
+        };
+        process.on('SIGINT', shutdown);
+        process.on('SIGTERM', shutdown);
+    }
+    catch (error) {
+        console.error('[HTTP] Fatal error:', error);
+        process.exit(1);
+    }
+}
+main();