skybridge 0.0.0-dev.81ea105 → 0.0.0-dev.81fd90a

package/dist/server/auth-extra.test-d.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth-extra.test-d.js

@@ -0,0 +1,71 @@
+import { expectTypeOf, test } from "vitest";
+import { z } from "zod";
+import { customProvider } from "./auth/providers/custom.js";
+import { workosProvider } from "./auth/providers/workos.js";
+import { McpServer } from "./server.js";
+const workosOAuth = await workosProvider({ domain: "d", audience: "a" });
+const customOAuth = await workosProvider({
+    domain: "d",
+    audience: "a",
+});
+test("a server with no oauth keeps the untyped claim bag", () => {
+    new McpServer({ name: "t", version: "0" }).registerTool({ name: "plain", inputSchema: { q: z.string() } }, (_args, extra) => {
+        expectTypeOf(extra.http?.authInfo?.extra).toEqualTypeOf();
+        return { content: "ok" };
+    });
+});
+test("provider claims reach tool handlers", () => {
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: workosOAuth })
+        .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
+        expectTypeOf(extra.http?.authInfo?.extra?.permissions).toEqualTypeOf();
+        // @ts-expect-error not a WorkOS claim
+        extra.http?.authInfo?.extra?.nope;
+        return { content: "a" };
+    })
+        .registerTool({ name: "b", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.http?.authInfo?.extra?.sid).toEqualTypeOf();
+        return { content: "b" };
+    });
+});
+test("registered claims survive the mapping into extra", () => {
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: workosOAuth }).registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.http?.authInfo?.extra?.iss).toEqualTypeOf();
+        expectTypeOf(extra.http?.authInfo?.extra?.iat).toEqualTypeOf();
+        return { content: "a" };
+    });
+});
+test("a hand-written verifier carries its own claims", async () => {
+    const verifier = {
+        async verifyAccessToken(token) {
+            return { token, clientId: "c", scopes: [], expiresAt: 1, extra: {} };
+        },
+    };
+    const { oauthMetadata } = await customProvider({
+        issuer: "https://idp.example.com",
+    });
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: { oauthMetadata, verifier } }).registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.http?.authInfo?.extra?.email).toEqualTypeOf();
+        return { content: "a" };
+    });
+});
+test("a config must carry a verifier", () => {
+    // @ts-expect-error a verifier is required
+    const missing = {
+        oauthMetadata: workosOAuth.oauthMetadata,
+    };
+    void missing;
+});
+test("a provider override adds claims without dropping the provider's", () => {
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: customOAuth })
+        .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf();
+        expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf();
+        return { content: "a" };
+    })
+        .mcpMiddleware("tools/call", (_request, extra, next) => {
+        expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf();
+        return next();
+    });
+});
+//# sourceMappingURL=auth-extra.test-d.js.map

package/dist/server/auth-extra.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-extra.test-d.js","sourceRoot":"","sources":["../../src/server/auth-extra.test-d.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAqB;IAC3D,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;CACd,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EACjD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACf,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,aAAa,EAEpD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACnE,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,aAAa,EAEjE,CAAC;QACJ,sCAAsC;QACtC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,IAAI,SAAS,CACX,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAC3B,EAAE,EACF,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEzD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;IAEhE,MAAM,QAAQ,GAA0B;QACtC,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC;KACF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC;QAC7C,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC;IACH,IAAI,SAAS,CACX,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAC3B,EAAE,EACF,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CACvC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,aAAa,EAE3D,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,0CAA0C;IAC1C,MAAM,OAAO,GAAgB;QAC3B,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC;IACF,KAAK,OAAO,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACnE,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,aAAa,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAE5D,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC","sourcesContent":["import { expectTypeOf, test } from \"vitest\";\nimport { z } from \"zod\";\nimport type { OAuthConfig } from \"./auth/index.js\";\nimport { customProvider } from \"./auth/providers/custom.js\";\nimport { workosProvider } from \"./auth/providers/workos.js\";\nimport type { TokenVerifier } from \"./auth.js\";\nimport { McpServer } from \"./server.js\";\n\nconst workosOAuth = await workosProvider({ domain: \"d\", audience: \"a\" });\nconst customOAuth = await workosProvider<{ tenant: string }>({\n  domain: \"d\",\n  audience: \"a\",\n});\n\ntest(\"a server with no oauth keeps the untyped claim bag\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n    { name: \"plain\", inputSchema: { q: z.string() } },\n    (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra).toEqualTypeOf<\n        Record<string, unknown> | undefined\n      >();\n      return { content: \"ok\" };\n    },\n  );\n});\n\ntest(\"provider claims reach tool handlers\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }, {}, { oauth: workosOAuth })\n    .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n        string | undefined\n      >();\n      expectTypeOf(extra.http?.authInfo?.extra?.permissions).toEqualTypeOf<\n        string[] | undefined\n      >();\n      // @ts-expect-error not a WorkOS claim\n      extra.http?.authInfo?.extra?.nope;\n      return { content: \"a\" };\n    })\n    .registerTool({ name: \"b\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.sid).toEqualTypeOf<\n        string | undefined\n      >();\n      return { content: \"b\" };\n    });\n});\n\ntest(\"registered claims survive the mapping into extra\", () => {\n  new McpServer(\n    { name: \"t\", version: \"0\" },\n    {},\n    { oauth: workosOAuth },\n  ).registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n    expectTypeOf(extra.http?.authInfo?.extra?.iss).toEqualTypeOf<\n      string | undefined\n    >();\n    expectTypeOf(extra.http?.authInfo?.extra?.iat).toEqualTypeOf<\n      number | undefined\n    >();\n    return { content: \"a\" };\n  });\n});\n\ntest(\"a hand-written verifier carries its own claims\", async () => {\n  type Claims = { subject?: string; email?: string };\n  const verifier: TokenVerifier<Claims> = {\n    async verifyAccessToken(token) {\n      return { token, clientId: \"c\", scopes: [], expiresAt: 1, extra: {} };\n    },\n  };\n  const { oauthMetadata } = await customProvider({\n    issuer: \"https://idp.example.com\",\n  });\n  new McpServer(\n    { name: \"t\", version: \"0\" },\n    {},\n    { oauth: { oauthMetadata, verifier } },\n  ).registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n    expectTypeOf(extra.http?.authInfo?.extra?.email).toEqualTypeOf<\n      string | undefined\n    >();\n    return { content: \"a\" };\n  });\n});\n\ntest(\"a config must carry a verifier\", () => {\n  // @ts-expect-error a verifier is required\n  const missing: OAuthConfig = {\n    oauthMetadata: workosOAuth.oauthMetadata,\n  };\n  void missing;\n});\n\ntest(\"a provider override adds claims without dropping the provider's\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }, {}, { oauth: customOAuth })\n    .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf<\n        string | undefined\n      >();\n      expectTypeOf(extra.http?.authInfo?.extra?.org_id).toEqualTypeOf<\n        string | undefined\n      >();\n      return { content: \"a\" };\n    })\n    .mcpMiddleware(\"tools/call\", (_request, extra, next) => {\n      expectTypeOf(extra.http?.authInfo?.extra?.tenant).toEqualTypeOf<\n        string | undefined\n      >();\n      return next();\n    });\n});\n"]}

package/dist/server/auth.d.ts

@@ -1,9 +1,46 @@
-import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/express";
+import type { AuthInfo as SdkAuthInfo } from "@modelcontextprotocol/server";
 import type { RequestHandler } from "express";
-export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-export { type BearerAuthMiddlewareOptions, requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-export { type AuthMetadataOptions, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
-export type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+export { type AuthMetadataOptions, type BearerAuthMiddlewareOptions, mcpAuthMetadataRouter, requireBearerAuth, } from "@modelcontextprotocol/express";
+export { OAuthError } from "@modelcontextprotocol/server";
+/** Claims a verifier puts in `AuthInfo["extra"]`: any JSON-ish bag of them. */
+export type ExtraClaims = Record<string, unknown>;
+/**
+ * A validated access token, as resolved by a
+ * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to
+ * handlers on `extra.authInfo`.
+ *
+ * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The
+ * claims are owned by whoever verifies the token: parameterize the verifier and
+ * the shape flows through {@link OAuthConfig} to every handler.
+ *
+ * @typeParam TExtra - Claims populated in `extra`.
+ *
+ * @example
+ * ```ts
+ * type Claims = { subject?: string; email?: string };
+ *
+ * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {
+ *   // ...
+ * }
+ * ```
+ */
+export type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<SdkAuthInfo, "extra"> & {
+    extra?: TExtra;
+};
+/**
+ * Checks a bearer token and resolves the claims it carries. The type parameter
+ * is what makes `extra.authInfo.extra` typed downstream, so a verifier is the
+ * single source for the claim shape.
+ *
+ * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,
+ * or hand it to the `oauth` server option inside an {@link OAuthConfig}.
+ *
+ * @typeParam TExtra - Claims this verifier populates in `AuthInfo["extra"]`.
+ */
+export type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {
+    verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;
+};
 /**
  * Like `requireBearerAuth`, but lets requests through when no
  * `Authorization` header is present. Used for mixed-auth servers where some

package/dist/server/auth.js

@@ -1,7 +1,6 @@
-import { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-export { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-export { mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { requireBearerAuth, } from "@modelcontextprotocol/express";
+export { mcpAuthMetadataRouter, requireBearerAuth, } from "@modelcontextprotocol/express";
+export { OAuthError } from "@modelcontextprotocol/server";
 /**
  * Like `requireBearerAuth`, but lets requests through when no
  * `Authorization` header is present. Used for mixed-auth servers where some

package/dist/server/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AAIxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAEL,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAGzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\n\nimport type { RequestHandler } from \"express\";\n\nexport { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nexport {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nexport {\n  type AuthMetadataOptions,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nexport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EAGL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AA2C1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nimport type { AuthInfo as SdkAuthInfo } from \"@modelcontextprotocol/server\";\n\nimport type { RequestHandler } from \"express\";\n\nexport {\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  mcpAuthMetadataRouter,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/express\";\nexport { OAuthError } from \"@modelcontextprotocol/server\";\n/** Claims a verifier puts in `AuthInfo[\"extra\"]`: any JSON-ish bag of them. */\nexport type ExtraClaims = Record<string, unknown>;\n\n/**\n * A validated access token, as resolved by a\n * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to\n * handlers on `extra.authInfo`.\n *\n * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The\n * claims are owned by whoever verifies the token: parameterize the verifier and\n * the shape flows through {@link OAuthConfig} to every handler.\n *\n * @typeParam TExtra - Claims populated in `extra`.\n *\n * @example\n * ```ts\n * type Claims = { subject?: string; email?: string };\n *\n * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {\n *   // ...\n * }\n * ```\n */\nexport type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<\n  SdkAuthInfo,\n  \"extra\"\n> & { extra?: TExtra };\n\n/**\n * Checks a bearer token and resolves the claims it carries. The type parameter\n * is what makes `extra.authInfo.extra` typed downstream, so a verifier is the\n * single source for the claim shape.\n *\n * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,\n * or hand it to the `oauth` server option inside an {@link OAuthConfig}.\n *\n * @typeParam TExtra - Claims this verifier populates in `AuthInfo[\"extra\"]`.\n */\nexport type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {\n  verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;\n};\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}

package/dist/server/content-helpers.d.ts

@@ -1,4 +1,4 @@
-import type { AudioContent, EmbeddedResource, ImageContent, ResourceLink, TextContent } from "@modelcontextprotocol/sdk/types.js";
+import type { AudioContent, EmbeddedResource, ImageContent, ResourceLink, TextContent } from "@modelcontextprotocol/server";
 /**
  * MCP content annotations applied to any returned block.
  *

package/dist/server/content-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-helpers.js","sourceRoot":"","sources":["../../src/server/content-helpers.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAyB;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,WAAgC;IAEhC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAEoD,EACpD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAOC,EACD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,IAAI;QACP,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AudioContent,\n  EmbeddedResource,\n  ImageContent,\n  ResourceLink,\n  TextContent,\n} from \"@modelcontextprotocol/sdk/types.js\";\n\n/**\n * MCP content annotations applied to any returned block.\n *\n * - `audience` — who is meant to see the content (`\"user\"`, `\"assistant\"`, or both).\n * - `priority` — relative importance hint for the host.\n * - `lastModified` — ISO timestamp for when the content was produced.\n */\ntype ContentAnnotations = {\n  audience?: (\"user\" | \"assistant\")[];\n  priority?: number;\n  lastModified?: string;\n};\n\n/**\n * Returns a base64-encoded string.\n * - `Uint8Array` input is encoded via `Buffer.toString(\"base64\")`.\n * - `string` input is assumed to be **already base64-encoded** and is returned\n *   as-is. Passing raw/unencoded string bytes will produce invalid MCP content.\n */\nfunction toBase64(data: string | Uint8Array): string {\n  if (typeof data === \"string\") {\n    return data;\n  }\n  return Buffer.from(data).toString(\"base64\");\n}\n\n/**\n * Build an MCP text content block.\n *\n * @example\n * ```ts\n * return { content: [text(\"Found 3 results.\")] };\n * ```\n */\nexport function text(\n  value: string,\n  annotations?: ContentAnnotations,\n): TextContent {\n  return { type: \"text\", text: value, ...(annotations && { annotations }) };\n}\n\n/**\n * Build an MCP image content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**. Passing a raw byte-string will produce invalid\n * content.\n */\nexport function image(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): ImageContent {\n  return {\n    type: \"image\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP audio content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**.\n */\nexport function audio(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): AudioContent {\n  return {\n    type: \"audio\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP embedded resource — the full content travels inline. Use this\n * when the client needs the bytes themselves rather than a link.\n *\n * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).\n */\nexport function embeddedResource(\n  resource:\n    | { uri: string; mimeType?: string; text: string }\n    | { uri: string; mimeType?: string; blob: string },\n  annotations?: ContentAnnotations,\n): EmbeddedResource {\n  return {\n    type: \"resource\",\n    resource,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP resource link — a `type: \"resource_link\"` block carrying a URI\n * the client can fetch (or subscribe to) on demand. Use a link when the\n * client should retrieve the bytes itself; use {@link embeddedResource} when\n * the content must travel inline with the response.\n */\nexport function resourceLink(\n  link: {\n    uri: string;\n    name: string;\n    title?: string;\n    description?: string;\n    mimeType?: string;\n    size?: number;\n  },\n  annotations?: ContentAnnotations,\n): ResourceLink {\n  return {\n    type: \"resource_link\",\n    ...link,\n    ...(annotations && { annotations }),\n  };\n}\n"]}
+{"version":3,"file":"content-helpers.js","sourceRoot":"","sources":["../../src/server/content-helpers.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAyB;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,WAAgC;IAEhC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,QAAgB,EAChB,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAEoD,EACpD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ;QACR,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAOC,EACD,WAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,IAAI;QACP,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AudioContent,\n  EmbeddedResource,\n  ImageContent,\n  ResourceLink,\n  TextContent,\n} from \"@modelcontextprotocol/server\";\n\n/**\n * MCP content annotations applied to any returned block.\n *\n * - `audience` — who is meant to see the content (`\"user\"`, `\"assistant\"`, or both).\n * - `priority` — relative importance hint for the host.\n * - `lastModified` — ISO timestamp for when the content was produced.\n */\ntype ContentAnnotations = {\n  audience?: (\"user\" | \"assistant\")[];\n  priority?: number;\n  lastModified?: string;\n};\n\n/**\n * Returns a base64-encoded string.\n * - `Uint8Array` input is encoded via `Buffer.toString(\"base64\")`.\n * - `string` input is assumed to be **already base64-encoded** and is returned\n *   as-is. Passing raw/unencoded string bytes will produce invalid MCP content.\n */\nfunction toBase64(data: string | Uint8Array): string {\n  if (typeof data === \"string\") {\n    return data;\n  }\n  return Buffer.from(data).toString(\"base64\");\n}\n\n/**\n * Build an MCP text content block.\n *\n * @example\n * ```ts\n * return { content: [text(\"Found 3 results.\")] };\n * ```\n */\nexport function text(\n  value: string,\n  annotations?: ContentAnnotations,\n): TextContent {\n  return { type: \"text\", text: value, ...(annotations && { annotations }) };\n}\n\n/**\n * Build an MCP image content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**. Passing a raw byte-string will produce invalid\n * content.\n */\nexport function image(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): ImageContent {\n  return {\n    type: \"image\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP audio content block.\n *\n * `data` may be a `Uint8Array` (encoded to base64 for you) or a string that is\n * **already base64-encoded**.\n */\nexport function audio(\n  data: string | Uint8Array,\n  mimeType: string,\n  annotations?: ContentAnnotations,\n): AudioContent {\n  return {\n    type: \"audio\",\n    data: toBase64(data),\n    mimeType,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP embedded resource — the full content travels inline. Use this\n * when the client needs the bytes themselves rather than a link.\n *\n * Pass either `text` (UTF-8 string) or `blob` (base64-encoded bytes).\n */\nexport function embeddedResource(\n  resource:\n    | { uri: string; mimeType?: string; text: string }\n    | { uri: string; mimeType?: string; blob: string },\n  annotations?: ContentAnnotations,\n): EmbeddedResource {\n  return {\n    type: \"resource\",\n    resource,\n    ...(annotations && { annotations }),\n  };\n}\n\n/**\n * Build an MCP resource link — a `type: \"resource_link\"` block carrying a URI\n * the client can fetch (or subscribe to) on demand. Use a link when the\n * client should retrieve the bytes itself; use {@link embeddedResource} when\n * the content must travel inline with the response.\n */\nexport function resourceLink(\n  link: {\n    uri: string;\n    name: string;\n    title?: string;\n    description?: string;\n    mimeType?: string;\n    size?: number;\n  },\n  annotations?: ContentAnnotations,\n): ResourceLink {\n  return {\n    type: \"resource_link\",\n    ...link,\n    ...(annotations && { annotations }),\n  };\n}\n"]}

package/dist/server/express.js

@@ -1,5 +1,6 @@
 import path from "node:path";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { toNodeHandler } from "@modelcontextprotocol/node";
+import { createMcpHandler } from "@modelcontextprotocol/server";
 import cors from "cors";
 import express from "express";
 function parseControlPort(raw) {
@@ -61,37 +62,17 @@ export async function createApp({ mcpServer, httpServer, errorMiddleware = [], }
     return app;
 }
 const mcpMiddleware = (server) => {
+    const handler = toNodeHandler(createMcpHandler(() => server.createStatelessServerInstance(), {
+        onerror: (error) => {
+            console.error("Error handling MCP request:", error);
+        },
+    }));
     return async (req, res, next) => {
-        if (req.method !== "POST") {
-            res.writeHead(405).end(JSON.stringify({
-                jsonrpc: "2.0",
-                error: {
-                    code: -32000,
-                    message: "Method not allowed.",
-                },
-                id: null,
-            }));
-            return;
-        }
         try {
-            const transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: undefined,
-                // Respond with a single JSON body instead of SSE. Skybridge's stateless
-                // transport never streams server-initiated messages, so SSE adds no
-                // capability — and on workerd specifically, `cloudflare:node`'s http
-                // bridge silently drops chunked writes that happen after the request
-                // handler awaits, which manifests as a 200 with empty body for any
-                // async tools/call.
-                enableJsonResponse: true,
-            });
-            res.on("close", () => {
-                transport.close();
-            });
-            await server.connectStatelessTransport(transport);
             // Express strips the mount path from req.url (e.g. "/mcp" becomes "/").
-            // Restore it so the SDK builds the correct requestInfo.url.
+            // Restore it so the SDK builds the correct request URL.
             req.url = req.originalUrl;
-            await transport.handleRequest(req, res, req.body);
+            await handler(req, res, req.body);
         }
         catch (error) {
             next(error);

package/dist/server/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/server/express.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoB,EACpB,WAGE;IAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAY,EACZ,IAAqB,EACrB,GAAqB,EACrB,KAA2B;IAE3B,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;YACzD,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,SAAS,EACT,UAAU,EACV,eAAe,GAAG,EAAE,GAQrB;IACC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;IAE9B,+FAA+F;IAC/F,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAE1C,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACxE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAC9C,0BAA0B,CAC3B,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CACV,0CAA0C,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE9D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1C,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAEvC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,MAAiB,EAA0B,EAAE;IAClE,OAAO,KAAK,EACV,GAAoB,EACpB,GAAqB,EACrB,IAA0B,EAC1B,EAAE;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CACpB,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,qBAAqB;iBAC/B;gBACD,EAAE,EAAE,IAAI;aACT,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,SAAS;gBAC7B,wEAAwE;gBACxE,oEAAoE;gBACpE,qEAAqE;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,oBAAoB;gBACpB,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,SAAS,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;YAClD,wEAAwE;YACxE,4DAA4D;YAC5D,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC;YAC1B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport cors from \"cors\";\nimport express from \"express\";\nimport type { McpServer } from \"./server.js\";\n\nfunction parseControlPort(raw: string | undefined): number | null {\n  if (raw === undefined) {\n    return null;\n  }\n  const n = Number.parseInt(raw, 10);\n  if (!Number.isFinite(n) || n <= 0 || n >= 65536) {\n    return null;\n  }\n  return n;\n}\n\nfunction applyMiddlewares(\n  app: express.Express,\n  middlewares: Array<{\n    path?: string;\n    handlers: express.ErrorRequestHandler[];\n  }>,\n): void {\n  for (const middleware of middlewares) {\n    if (middleware.path) {\n      app.use(middleware.path, ...middleware.handlers);\n    } else {\n      app.use(...middleware.handlers);\n    }\n  }\n}\n\nfunction defaultErrorHandler(\n  err: unknown,\n  _req: express.Request,\n  res: express.Response,\n  _next: express.NextFunction,\n) {\n  console.error(\"Error handling MCP request:\", err);\n  if (!res.headersSent) {\n    res.status(500).json({\n      jsonrpc: \"2.0\",\n      error: { code: -32603, message: \"Internal server error\" },\n      id: null,\n    });\n  }\n}\n\nexport async function createApp({\n  mcpServer,\n  httpServer,\n  errorMiddleware = [],\n}: {\n  mcpServer: McpServer;\n  httpServer: http.Server;\n  errorMiddleware?: {\n    path?: string;\n    handlers: express.ErrorRequestHandler[];\n  }[];\n}): Promise<express.Express> {\n  const app = mcpServer.express;\n\n  // Read `process.env.NODE_ENV` inline: wrangler/esbuild only substitute the literal expression,\n  // so a local const would defeat dead-code elimination of the dev-only imports below.\n  if (process.env.NODE_ENV !== \"production\") {\n    const { devtoolsStaticServer } = await import(\"@skybridge/devtools\");\n    app.use(await devtoolsStaticServer());\n    const { viewsDevServer } = await import(\"./viewsDevServer.js\");\n    app.use(await viewsDevServer(httpServer));\n\n    const controlPort = parseControlPort(process.env.__TUNNEL_CONTROL_PORT);\n    if (controlPort !== null) {\n      const { createTunnelProxyRouter } = await import(\n        \"./tunnel-proxy-router.js\"\n      );\n      app.use(createTunnelProxyRouter(controlPort));\n    } else if (process.env.__TUNNEL_CONTROL_PORT !== undefined) {\n      console.warn(\n        `Ignoring invalid __TUNNEL_CONTROL_PORT=${process.env.__TUNNEL_CONTROL_PORT}`,\n      );\n    }\n  } else {\n    const assetsPath = path.join(process.cwd(), \"dist\", \"assets\");\n\n    app.use(\"/assets\", cors());\n    app.use(\"/assets\", express.static(assetsPath));\n  }\n\n  app.use(\"/mcp\", mcpMiddleware(mcpServer));\n\n  applyMiddlewares(app, errorMiddleware);\n\n  app.use(\"/mcp\", defaultErrorHandler);\n\n  return app;\n}\n\nconst mcpMiddleware = (server: McpServer): express.RequestHandler => {\n  return async (\n    req: express.Request,\n    res: express.Response,\n    next: express.NextFunction,\n  ) => {\n    if (req.method !== \"POST\") {\n      res.writeHead(405).end(\n        JSON.stringify({\n          jsonrpc: \"2.0\",\n          error: {\n            code: -32000,\n            message: \"Method not allowed.\",\n          },\n          id: null,\n        }),\n      );\n      return;\n    }\n\n    try {\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n        // Respond with a single JSON body instead of SSE. Skybridge's stateless\n        // transport never streams server-initiated messages, so SSE adds no\n        // capability — and on workerd specifically, `cloudflare:node`'s http\n        // bridge silently drops chunked writes that happen after the request\n        // handler awaits, which manifests as a 200 with empty body for any\n        // async tools/call.\n        enableJsonResponse: true,\n      });\n\n      res.on(\"close\", () => {\n        transport.close();\n      });\n\n      await server.connectStatelessTransport(transport);\n      // Express strips the mount path from req.url (e.g. \"/mcp\" becomes \"/\").\n      // Restore it so the SDK builds the correct requestInfo.url.\n      req.url = req.originalUrl;\n      await transport.handleRequest(req, res, req.body);\n    } catch (error) {\n      next(error);\n    }\n  };\n};\n"]}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/server/express.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoB,EACpB,WAGE;IAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAY,EACZ,IAAqB,EACrB,GAAqB,EACrB,KAA2B;IAE3B,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;YACzD,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,SAAS,EACT,UAAU,EACV,eAAe,GAAG,EAAE,GAQrB;IACC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;IAE9B,+FAA+F;IAC/F,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAE1C,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACxE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAC9C,0BAA0B,CAC3B,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CACV,0CAA0C,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE9D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1C,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAEvC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,MAAiB,EAA0B,EAAE;IAClE,MAAM,OAAO,GAAG,aAAa,CAC3B,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,6BAA6B,EAAE,EAAE;QAC7D,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;KACF,CAAC,CACH,CAAC;IAEF,OAAO,KAAK,EACV,GAAoB,EACpB,GAAqB,EACrB,IAA0B,EAC1B,EAAE;QACF,IAAI,CAAC;YACH,wEAAwE;YACxE,wDAAwD;YACxD,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC;YAC1B,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport { toNodeHandler } from \"@modelcontextprotocol/node\";\nimport { createMcpHandler } from \"@modelcontextprotocol/server\";\nimport cors from \"cors\";\nimport express from \"express\";\nimport type { McpServer } from \"./server.js\";\n\nfunction parseControlPort(raw: string | undefined): number | null {\n  if (raw === undefined) {\n    return null;\n  }\n  const n = Number.parseInt(raw, 10);\n  if (!Number.isFinite(n) || n <= 0 || n >= 65536) {\n    return null;\n  }\n  return n;\n}\n\nfunction applyMiddlewares(\n  app: express.Express,\n  middlewares: Array<{\n    path?: string;\n    handlers: express.ErrorRequestHandler[];\n  }>,\n): void {\n  for (const middleware of middlewares) {\n    if (middleware.path) {\n      app.use(middleware.path, ...middleware.handlers);\n    } else {\n      app.use(...middleware.handlers);\n    }\n  }\n}\n\nfunction defaultErrorHandler(\n  err: unknown,\n  _req: express.Request,\n  res: express.Response,\n  _next: express.NextFunction,\n) {\n  console.error(\"Error handling MCP request:\", err);\n  if (!res.headersSent) {\n    res.status(500).json({\n      jsonrpc: \"2.0\",\n      error: { code: -32603, message: \"Internal server error\" },\n      id: null,\n    });\n  }\n}\n\nexport async function createApp({\n  mcpServer,\n  httpServer,\n  errorMiddleware = [],\n}: {\n  mcpServer: McpServer;\n  httpServer: http.Server;\n  errorMiddleware?: {\n    path?: string;\n    handlers: express.ErrorRequestHandler[];\n  }[];\n}): Promise<express.Express> {\n  const app = mcpServer.express;\n\n  // Read `process.env.NODE_ENV` inline: wrangler/esbuild only substitute the literal expression,\n  // so a local const would defeat dead-code elimination of the dev-only imports below.\n  if (process.env.NODE_ENV !== \"production\") {\n    const { devtoolsStaticServer } = await import(\"@skybridge/devtools\");\n    app.use(await devtoolsStaticServer());\n    const { viewsDevServer } = await import(\"./viewsDevServer.js\");\n    app.use(await viewsDevServer(httpServer));\n\n    const controlPort = parseControlPort(process.env.__TUNNEL_CONTROL_PORT);\n    if (controlPort !== null) {\n      const { createTunnelProxyRouter } = await import(\n        \"./tunnel-proxy-router.js\"\n      );\n      app.use(createTunnelProxyRouter(controlPort));\n    } else if (process.env.__TUNNEL_CONTROL_PORT !== undefined) {\n      console.warn(\n        `Ignoring invalid __TUNNEL_CONTROL_PORT=${process.env.__TUNNEL_CONTROL_PORT}`,\n      );\n    }\n  } else {\n    const assetsPath = path.join(process.cwd(), \"dist\", \"assets\");\n\n    app.use(\"/assets\", cors());\n    app.use(\"/assets\", express.static(assetsPath));\n  }\n\n  app.use(\"/mcp\", mcpMiddleware(mcpServer));\n\n  applyMiddlewares(app, errorMiddleware);\n\n  app.use(\"/mcp\", defaultErrorHandler);\n\n  return app;\n}\n\nconst mcpMiddleware = (server: McpServer): express.RequestHandler => {\n  const handler = toNodeHandler(\n    createMcpHandler(() => server.createStatelessServerInstance(), {\n      onerror: (error) => {\n        console.error(\"Error handling MCP request:\", error);\n      },\n    }),\n  );\n\n  return async (\n    req: express.Request,\n    res: express.Response,\n    next: express.NextFunction,\n  ) => {\n    try {\n      // Express strips the mount path from req.url (e.g. \"/mcp\" becomes \"/\").\n      // Restore it so the SDK builds the correct request URL.\n      req.url = req.originalUrl;\n      await handler(req, res, req.body);\n    } catch (error) {\n      next(error);\n    }\n  };\n};\n"]}

package/dist/server/express.test.js

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { Client, StreamableHTTPClientTransport, } from "@modelcontextprotocol/client";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { McpServer } from "./server.js";
 vi.mock("@skybridge/devtools", () => ({
@@ -95,7 +96,9 @@ describe("McpServer.express", () => {
             res.status(503).json({ from: "useOnError" });
         });
         // Force the /mcp handler to throw so the error pipeline runs.
-        vi.spyOn(server, "connectStatelessTransport").mockRejectedValue(new Error("boom"));
+        server.use("/mcp", () => {
+            throw new Error("boom");
+        });
         const httpServer = http.createServer();
         await createApp({
             mcpServer: server,
@@ -288,10 +291,11 @@ describe("createApp", () => {
         const { createApp } = await import("./express.js");
         const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => { });
         const mcpServer = new McpServer({ name: "t", version: "0.0.0" });
-        // Force the express-level error path: make connectStatelessTransport
-        // reject so the request handler hits its try/catch and calls next(error),
-        // which lands in the default /mcp error handler.
-        vi.spyOn(mcpServer, "connectStatelessTransport").mockRejectedValue(new Error("boom"));
+        // Force the express-level error path: make a /mcp middleware throw so the
+        // error pipeline runs and lands in the default /mcp error handler.
+        mcpServer.use("/mcp", () => {
+            throw new Error("boom");
+        });
         const httpServer = http.createServer();
         const app = await createApp({ mcpServer, httpServer });
         const { port, server: httpListening } = await listen(app);
@@ -314,7 +318,9 @@ describe("createApp", () => {
             res.status(503).json({ custom: true });
         };
         const mcpServer = new McpServer({ name: "t", version: "0.0.0" });
-        vi.spyOn(mcpServer, "connectStatelessTransport").mockRejectedValue(new Error("boom"));
+        mcpServer.use("/mcp", () => {
+            throw new Error("boom");
+        });
         const httpServer = http.createServer();
         const app = await createApp({
             mcpServer,
@@ -339,7 +345,9 @@ describe("createApp", () => {
             next(new Error("api error"));
         };
         const mcpServer = new McpServer({ name: "t", version: "0.0.0" });
-        vi.spyOn(mcpServer, "connectStatelessTransport").mockRejectedValue(new Error("boom"));
+        mcpServer.use("/mcp", () => {
+            throw new Error("boom");
+        });
         mcpServer.use("/api/test", throwingApiRoute);
         const httpServer = http.createServer();
         const app = await createApp({
@@ -488,4 +496,31 @@ describe("createApp tunnel routes", () => {
         }
     });
 });
+describe("createApp mount path", () => {
+    it("serves /mcp with the mount path intact on the request URL", async () => {
+        const { createApp } = await import("./express.js");
+        const mcpServer = new McpServer({
+            name: "t",
+            version: "0.0.0",
+        }).registerTool({
+            name: "echo-url",
+            description: "Echoes the request URL.",
+            inputSchema: {},
+        }, (_args, extra) => ({
+            content: [{ type: "text", text: extra.http?.req?.url ?? "" }],
+        }));
+        const httpServer = http.createServer();
+        const app = await createApp({ mcpServer, httpServer });
+        const { port, server } = await listen(app);
+        openServer = server;
+        const client = new Client({ name: "test-client", version: "0.0.0" });
+        await client.connect(new StreamableHTTPClientTransport(new URL(`http://localhost:${port}/mcp`)));
+        const result = (await client.callTool({
+            name: "echo-url",
+            arguments: {},
+        }));
+        await client.close();
+        expect(new URL(result.content[0]?.text ?? "").pathname).toBe("/mcp");
+    });
+});
 //# sourceMappingURL=express.test.js.map