supersendtx-mcp 0.6.0 → 0.6.1

package/dist/index.js

@@ -907,12 +907,21 @@ async function runStdioServer() {
 
 // src/oauth-metadata.ts
 var MCP_HTTP_PATH = "/mcp";
+function appOriginForMcpOrigin(mcpOrigin) {
+  try {
+    const host = new URL(mcpOrigin).hostname.toLowerCase();
+    if (host === "mcp.ranla.ai") return "https://app.ranla.ai";
+    if (host === "mcp.supersendtx.com") return "https://app.supersendtx.com";
+  } catch {
+  }
+  return (process.env.SUPERSENDTX_OAUTH_ISSUER?.trim() || process.env.SUPERSENDTX_APP_URL?.trim() || "https://app.supersendtx.com").replace(/\/$/, "");
+}
 function buildProtectedResourceMetadata(origin) {
   const resource = `${origin.replace(/\/$/, "")}${MCP_HTTP_PATH}`;
-  const appOrigin = process.env.SUPERSENDTX_OAUTH_ISSUER?.trim() || process.env.SUPERSENDTX_APP_URL?.trim() || "https://app.supersendtx.com";
+  const appOrigin = appOriginForMcpOrigin(origin);
   return {
     resource,
-    authorization_servers: [appOrigin.replace(/\/$/, "")],
+    authorization_servers: [appOrigin],
     scopes_supported: ["full"],
     bearer_methods_supported: ["header"]
   };
@@ -923,14 +932,24 @@ function buildWwwAuthenticateChallenge(origin) {
 }
 
 // src/oauth-resolve.ts
-function getOAuthResolveUrl() {
-  const appBase = (process.env.SUPERSENDTX_APP_URL?.trim() || process.env.SUPERSENDTX_OAUTH_ISSUER?.trim() || "https://app.supersendtx.com").replace(/\/$/, "");
-  return `${appBase}/api/mcp/oauth/resolve`;
+function appOriginForMcpOrigin2(mcpOrigin) {
+  if (mcpOrigin) {
+    try {
+      const host = new URL(mcpOrigin).hostname.toLowerCase();
+      if (host === "mcp.ranla.ai") return "https://app.ranla.ai";
+      if (host === "mcp.supersendtx.com") return "https://app.supersendtx.com";
+    } catch {
+    }
+  }
+  return (process.env.SUPERSENDTX_APP_URL?.trim() || process.env.SUPERSENDTX_OAUTH_ISSUER?.trim() || "https://app.supersendtx.com").replace(/\/$/, "");
+}
+function getOAuthResolveUrl(mcpOrigin) {
+  return `${appOriginForMcpOrigin2(mcpOrigin)}/api/mcp/oauth/resolve`;
 }
-async function resolveOAuthAccessToken(accessToken) {
+async function resolveOAuthAccessToken(accessToken, mcpOrigin) {
   const resolveSecret = process.env.SUPERSENDTX_MCP_RESOLVE_SECRET?.trim() || process.env.SUPERSENDTX_CREDENTIALS_ENCRYPTION_KEY?.trim() || (process.env.NODE_ENV === "production" ? "" : "supersendtx-dev-mcp-resolve");
   if (!resolveSecret) return null;
-  const response = await fetch(getOAuthResolveUrl(), {
+  const response = await fetch(getOAuthResolveUrl(mcpOrigin), {
     method: "POST",
     headers: {
       authorization: `Bearer ${accessToken}`,
@@ -965,11 +984,11 @@ function getRequestOrigin(req) {
   const proto = firstHeaderValue(req.headers["x-forwarded-proto"]) || "http";
   return `${proto}://${host}`;
 }
-async function resolveApiKeyFromAuthorization(authorization, baseUrl) {
+async function resolveApiKeyFromAuthorization(authorization, baseUrl, mcpOrigin) {
   const bearer = parseBearerToken(authorization);
   if (!bearer) return null;
   if (isSuperSendTxApiKey(bearer)) return bearer;
-  return resolveOAuthAccessToken(bearer);
+  return resolveOAuthAccessToken(bearer, mcpOrigin);
 }
 async function handleHttpRequest(req, res, options = {}) {
   const origin = getRequestOrigin(req);
@@ -999,7 +1018,8 @@ async function handleHttpRequest(req, res, options = {}) {
   }
   const apiKey = await resolveApiKeyFromAuthorization(
     typeof req.headers.authorization === "string" ? req.headers.authorization : void 0,
-    options.baseUrl
+    options.baseUrl,
+    origin
   );
   if (!apiKey) {
     sendJson(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supersendtx-mcp",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "SuperSend TX MCP server — mail tools plus Arc agent-first tools for Cursor and Claude",
   "license": "MIT",
   "type": "module",