supersendtx-mcp 0.3.0 → 0.4.1

package/README.md

@@ -10,14 +10,14 @@ MCP server for [SuperSend TX](https://supersendtx.com) — send email and manage
 |------|---------------|------|
 | **stdio** (default) | `npx -y supersendtx-mcp` | `SUPERSENDTX_API_KEY=stx_…` |
 | **HTTP** (local) | `npx -y supersendtx-mcp --http --port 3000` | `Authorization: Bearer stx_…` on each request |
-| **HTTP** (hosted) | `https://mcp.supersendtx.com/mcp` | `Authorization: Bearer stx_…` on each request |
+| **HTTP** (hosted) | `https://mcp.supersendtx.com/mcp` | **OAuth** (recommended) or `Authorization: Bearer stx_…` |
 
 Optional: `SUPERSENDTX_API_URL` (e.g. `http://localhost:3003/api` for local API).
 
 Local HTTP endpoint: `http://127.0.0.1:3000/mcp` · health: `GET /health`  
 Hosted health: `GET https://mcp.supersendtx.com/health`
 
-OAuth for remote clients is planned separately; Bearer works on hosted today.
+Hosted OAuth: add only `"url": "https://mcp.supersendtx.com/mcp"` — the client runs the browser consent flow. Bearer `stx_…` still works for advanced setups.
 
 ---
 

package/dist/index.js

@@ -60,16 +60,16 @@ Environment:
   SUPERSENDTX_API_URL   Optional API base (default https://api.supersendtx.com)
 
 HTTP auth:
-  Authorization: Bearer stx_\u2026
+  Authorization: Bearer stx_\u2026 (API key) or MCP OAuth access token
 `);
 }
-function parseBearerApiKey(authorization) {
+function isSuperSendTxApiKey(token) {
+  return /^stx_[a-f0-9]{48}$/i.test(token.trim());
+}
+function parseBearerToken(authorization) {
   if (!authorization) return null;
   const match = /^Bearer\s+(\S+)/i.exec(authorization.trim());
-  if (!match) return null;
-  const key = match[1];
-  if (!key.startsWith("stx_")) return null;
-  return key;
+  return match?.[1] || null;
 }
 
 // src/http.ts
@@ -543,23 +543,80 @@ async function runStdioServer() {
   await server.connect(transport);
 }
 
+// src/oauth-metadata.ts
+var MCP_HTTP_PATH = "/mcp";
+function buildProtectedResourceMetadata(origin) {
+  const resource = `${origin.replace(/\/$/, "")}${MCP_HTTP_PATH}`;
+  const appOrigin = process.env.SUPERSENDTX_OAUTH_ISSUER?.trim() || process.env.SUPERSENDTX_APP_URL?.trim() || "https://app.supersendtx.com";
+  return {
+    resource,
+    authorization_servers: [appOrigin.replace(/\/$/, "")],
+    scopes_supported: ["full"],
+    bearer_methods_supported: ["header"]
+  };
+}
+function buildWwwAuthenticateChallenge(origin) {
+  const metadataUrl = `${origin.replace(/\/$/, "")}/.well-known/oauth-protected-resource`;
+  return `Bearer error="invalid_token", error_description="OAuth authentication required", resource_metadata="${metadataUrl}"`;
+}
+
+// src/oauth-resolve.ts
+async function resolveOAuthAccessToken(accessToken, baseUrl) {
+  const apiBase = (baseUrl || process.env.SUPERSENDTX_API_URL || "https://api.supersendtx.com").replace(
+    /\/$/,
+    ""
+  );
+  const resolveSecret = process.env.SUPERSENDTX_MCP_RESOLVE_SECRET?.trim() || process.env.SUPERSENDTX_CREDENTIALS_ENCRYPTION_KEY?.trim() || (process.env.NODE_ENV === "production" ? "" : "supersendtx-dev-mcp-resolve");
+  if (!resolveSecret) return null;
+  const response = await fetch(`${apiBase}/mcp/oauth/resolve`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${accessToken}`,
+      "content-type": "application/json",
+      "x-supersendtx-mcp-resolve": resolveSecret
+    }
+  });
+  if (!response.ok) return null;
+  const data = await response.json().catch(() => null);
+  const apiKey = data?.apiKey?.trim();
+  return apiKey || null;
+}
+
 // src/http.ts
-function sendJson(res, status, body) {
+function sendJson(res, status, body, headers = {}) {
   const payload = JSON.stringify(body);
   res.writeHead(status, {
     "content-type": "application/json; charset=utf-8",
-    "content-length": Buffer.byteLength(payload)
+    "content-length": Buffer.byteLength(payload),
+    ...headers
   });
   res.end(payload);
 }
+function firstHeaderValue(value) {
+  if (!value) return void 0;
+  const raw = Array.isArray(value) ? value[0] : value;
+  const trimmed = raw?.split(",")[0]?.trim();
+  return trimmed || void 0;
+}
+function getRequestOrigin(req) {
+  const host = firstHeaderValue(req.headers["x-forwarded-host"]) || firstHeaderValue(req.headers.host) || "127.0.0.1";
+  const proto = firstHeaderValue(req.headers["x-forwarded-proto"]) || "http";
+  return `${proto}://${host}`;
+}
+async function resolveApiKeyFromAuthorization(authorization, baseUrl) {
+  const bearer = parseBearerToken(authorization);
+  if (!bearer) return null;
+  if (isSuperSendTxApiKey(bearer)) return bearer;
+  return resolveOAuthAccessToken(bearer, baseUrl);
+}
 async function handleHttpRequest(req, res, options = {}) {
-  const hostHeader = req.headers.host || "127.0.0.1";
-  const url = new URL(req.url || "/", `http://${hostHeader}`);
+  const origin = getRequestOrigin(req);
+  const url = new URL(req.url || "/", origin);
   if (req.method === "OPTIONS") {
     res.writeHead(204, {
       "access-control-allow-origin": "*",
       "access-control-allow-methods": "GET, POST, DELETE, OPTIONS",
-      "access-control-allow-headers": "Authorization, Content-Type, Accept, Mcp-Session-Id"
+      "access-control-allow-headers": "Authorization, Content-Type, Accept, Mcp-Session-Id, X-Supersendtx-Mcp-Resolve"
     });
     res.end();
     return;
@@ -568,19 +625,27 @@ async function handleHttpRequest(req, res, options = {}) {
     sendJson(res, 200, { ok: true, service: "supersendtx-mcp" });
     return;
   }
+  if (url.pathname === "/.well-known/oauth-protected-resource") {
+    sendJson(res, 200, buildProtectedResourceMetadata(origin), {
+      "cache-control": "public, max-age=300, s-maxage=3600"
+    });
+    return;
+  }
   if (url.pathname !== "/mcp" && url.pathname !== "/") {
     sendJson(res, 404, { error: "Not found. MCP endpoint is POST/GET /mcp" });
     return;
   }
-  const apiKey = parseBearerApiKey(
-    typeof req.headers.authorization === "string" ? req.headers.authorization : void 0
+  const apiKey = await resolveApiKeyFromAuthorization(
+    typeof req.headers.authorization === "string" ? req.headers.authorization : void 0,
+    options.baseUrl
   );
   if (!apiKey) {
-    res.writeHead(401, {
-      "content-type": "application/json; charset=utf-8",
-      "www-authenticate": "Bearer"
-    });
-    res.end(JSON.stringify({ error: "Missing or invalid Authorization: Bearer stx_\u2026 header" }));
+    sendJson(
+      res,
+      401,
+      { error: "Missing or invalid Authorization. Use Bearer stx_\u2026 or complete MCP OAuth." },
+      { "www-authenticate": buildWwwAuthenticateChallenge(origin) }
+    );
     return;
   }
   const server = createMcpServer(apiKey, options.baseUrl);
@@ -615,7 +680,7 @@ async function runHttpServer(options) {
     httpServer.listen(port, host, () => resolve());
   });
   console.error(`SuperSend TX MCP HTTP listening on http://${host}:${port}/mcp`);
-  console.error("Authenticate with: Authorization: Bearer stx_\u2026");
+  console.error("Authenticate with Bearer stx_\u2026 or MCP OAuth access token");
 }
 
 // src/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supersendtx-mcp",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "SuperSend TX MCP server — stdio or local HTTP (--http) for Cursor and Claude",
   "license": "MIT",
   "type": "module",
@@ -40,7 +40,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "supersendtx": "0.8.1"
+    "supersendtx": "0.8.2"
   },
   "devDependencies": {
     "tsup": "^8.5.0",