synapse-mcp 1.0.0 → 1.0.2

package/dist/health-rate-limiter.js

@@ -0,0 +1,159 @@
+import rateLimit from "express-rate-limit";
+/**
+ * Destructive subactions that require stricter rate limiting.
+ *
+ * These operations can cause data loss, service disruption, or consume
+ * significant resources on remote hosts. Mapped by tool action category.
+ *
+ * Flux container: exec, recreate
+ * Flux compose: down, recreate
+ * Flux docker: prune, rmi, build
+ * Scout: exec, emit (arbitrary command execution)
+ */
+const DESTRUCTIVE_SUBACTIONS = new Set([
+    // Flux container operations
+    "recreate",
+    "exec",
+    // Flux compose operations
+    "down",
+    "recreate",
+    // Flux docker operations
+    "prune",
+    "rmi",
+    "build",
+]);
+/**
+ * Scout actions that are inherently destructive (arbitrary command execution)
+ */
+const DESTRUCTIVE_SCOUT_ACTIONS = new Set(["exec", "emit"]);
+/**
+ * Determine whether an MCP request body represents a destructive operation.
+ *
+ * Inspects the JSON-RPC payload for `tools/call` method and checks whether
+ * the tool arguments indicate a destructive subaction.
+ *
+ * @param body - Parsed JSON-RPC request body
+ * @returns true if the operation is destructive
+ */
+export function isDestructiveOperation(body) {
+    if (typeof body !== "object" || body === null)
+        return false;
+    const rpc = body;
+    if (rpc.method !== "tools/call")
+        return false;
+    const params = rpc.params;
+    if (typeof params !== "object" || params === null)
+        return false;
+    const { name, arguments: args } = params;
+    if (typeof name !== "string")
+        return false;
+    if (typeof args !== "object" || args === null)
+        return false;
+    const toolArgs = args;
+    // Scout tool: exec and emit are inherently destructive
+    if (name === "scout") {
+        const action = toolArgs.action;
+        return typeof action === "string" && DESTRUCTIVE_SCOUT_ACTIONS.has(action);
+    }
+    // Flux tool: check subaction against destructive set
+    if (name === "flux") {
+        const subaction = toolArgs.subaction;
+        return typeof subaction === "string" && DESTRUCTIVE_SUBACTIONS.has(subaction);
+    }
+    // Manual type narrowing is pragmatic for this hot-path function.
+    // Zod validation on every request would add unnecessary overhead.
+    return false;
+}
+/**
+ * Creates a rate limiter middleware for the health endpoint.
+ *
+ * Health endpoints should be accessible for monitoring but protected from DDoS.
+ * Default: 30 requests per 60 seconds per IP.
+ *
+ * @returns Express rate limiter middleware
+ */
+export function createHealthRateLimiter() {
+    return rateLimit({
+        windowMs: 60 * 1000, // 1 minute
+        max: 30, // 30 requests per minute (reasonable for health checks)
+        standardHeaders: true, // Return rate limit info in RateLimit-* headers
+        legacyHeaders: false, // Disable X-RateLimit-* headers
+        message: {
+            error: "Too many requests to health endpoint, please try again later",
+        },
+        skipSuccessfulRequests: false,
+        skipFailedRequests: false,
+    });
+}
+/**
+ * Creates a rate limiter middleware for the MCP endpoint.
+ *
+ * Protects against DoS attacks on the MCP endpoint which can trigger
+ * expensive operations (SSH commands, Docker API calls, filesystem scans).
+ *
+ * CWE-770: Allocation of Resources Without Limits or Throttling
+ * CVSS 7.5 (High) - DoS vulnerability if unprotected
+ *
+ * Default: 60 requests per 60 seconds per IP (general operations)
+ *
+ * @returns Express rate limiter middleware
+ */
+export function createMcpRateLimiter() {
+    return rateLimit({
+        windowMs: 60 * 1000, // 1 minute
+        max: 60, // 60 requests per minute (allows bursts but prevents abuse)
+        standardHeaders: true, // Return rate limit info in RateLimit-* headers
+        legacyHeaders: false, // Disable X-RateLimit-* headers
+        message: {
+            error: "Too many requests to MCP endpoint, please try again later",
+        },
+        skipSuccessfulRequests: false,
+        skipFailedRequests: false,
+    });
+}
+/**
+ * Creates a stricter rate limiter for destructive MCP operations.
+ *
+ * Destructive operations (prune, remove, down, exec, etc.) are expensive
+ * and potentially dangerous. This limiter is tighter than the general MCP limiter:
+ * 10 requests per 60 seconds per IP.
+ *
+ * Applied conditionally via createDestructiveRateLimitMiddleware.
+ *
+ * @returns Express rate limiter middleware
+ */
+export function createDestructiveOperationRateLimiter() {
+    return rateLimit({
+        windowMs: 60 * 1000, // 1 minute
+        max: 10, // 10 destructive requests per minute (strict)
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: {
+            error: "Too many destructive operation requests, please try again later",
+        },
+        skipSuccessfulRequests: false,
+        skipFailedRequests: false,
+    });
+}
+/**
+ * Creates middleware that conditionally applies destructive rate limiting.
+ *
+ * Inspects each MCP request body to determine if it's a destructive operation.
+ * If so, applies the stricter destructive rate limiter (10 req/min/IP).
+ * Non-destructive requests pass through without additional limiting
+ * (they are still subject to the general 60 req/min/IP MCP limiter).
+ *
+ * @returns Express middleware
+ */
+export function createDestructiveRateLimitMiddleware() {
+    const destructiveLimiter = createDestructiveOperationRateLimiter();
+    return (req, res, next) => {
+        if (isDestructiveOperation(req.body)) {
+            destructiveLimiter(req, res, next);
+        }
+        else {
+            next();
+        }
+    };
+}
+//# sourceMappingURL=health-rate-limiter.js.map

package/dist/health-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-rate-limiter.js","sourceRoot":"","sources":["../src/health-rate-limiter.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,4BAA4B;IAC5B,UAAU;IACV,MAAM;IACN,0BAA0B;IAC1B,MAAM;IACN,UAAU;IACV,yBAAyB;IACzB,OAAO;IACP,KAAK;IACL,OAAO;CACR,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAE5D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAiC,CAAC;IACpE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAE5D,MAAM,QAAQ,GAAG,IAA+B,CAAC;IAEjD,uDAAuD;IACvD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,qDAAqD;IACrD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;IAED,iEAAiE;IACjE,kEAAkE;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,SAAS,CAAC;QACf,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW;QAChC,GAAG,EAAE,EAAE,EAAE,wDAAwD;QACjE,eAAe,EAAE,IAAI,EAAE,gDAAgD;QACvE,aAAa,EAAE,KAAK,EAAE,gCAAgC;QACtD,OAAO,EAAE;YACP,KAAK,EAAE,8DAA8D;SACtE;QACD,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,SAAS,CAAC;QACf,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW;QAChC,GAAG,EAAE,EAAE,EAAE,4DAA4D;QACrE,eAAe,EAAE,IAAI,EAAE,gDAAgD;QACvE,aAAa,EAAE,KAAK,EAAE,gCAAgC;QACtD,OAAO,EAAE;YACP,KAAK,EAAE,2DAA2D;SACnE;QACD,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qCAAqC;IACnD,OAAO,SAAS,CAAC;QACf,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW;QAChC,GAAG,EAAE,EAAE,EAAE,8CAA8C;QACvD,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE;YACP,KAAK,EAAE,iEAAiE;SACzE;QACD,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oCAAoC;IAKlD,MAAM,kBAAkB,GAAG,qCAAqC,EAAE,CAAC;IAEnE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.js

@@ -3,25 +3,28 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import express from "express";
-import rateLimit from "express-rate-limit";
-import { registerTools } from "./tools/index.js";
+import { createDestructiveRateLimitMiddleware, createHealthRateLimiter, createMcpRateLimiter, } from "./health-rate-limiter.js";
+import { asyncHandler, authMiddleware, csrfProtectionMiddleware, errorHandler, fallbackErrorHandler, requestIdMiddleware, } from "./middleware/index.js";
 import { createDefaultContainer } from "./services/container.js";
+import { registerTools } from "./tools/index.js";
+import { getCurrentTimestamp } from "./utils/time.js";
 // Server metadata
-const SERVER_NAME = "homelab-mcp-server";
+const SERVER_NAME = "synapse-mcp";
 const SERVER_VERSION = "1.0.0";
 // Global service container instance
 let globalContainer;
 /**
  * Create and configure the MCP server
  */
-function createServer() {
+async function createServer() {
     const server = new McpServer({
         name: SERVER_NAME,
-        version: SERVER_VERSION
+        version: SERVER_VERSION,
     });
-    // Create and register service container
+    // Create and initialize service container (preloads host configs, enables caching)
     globalContainer = createDefaultContainer();
-    // Register all homelab tools
+    await globalContainer.initialize();
+    // Register all tools
     registerTools(server, globalContainer);
     return server;
 }
@@ -29,130 +32,90 @@ function createServer() {
  * Run server with stdio transport (for Claude Code, local integrations)
  */
 async function runStdio() {
-    const server = createServer();
+    const server = await createServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    // Log to stderr (stdout is reserved for MCP protocol)
-    console.error(`${SERVER_NAME} v${SERVER_VERSION} running on stdio`);
 }
-/**
- * Rate limiter for HTTP API
- */
-const limiter = rateLimit({
-    windowMs: 60 * 1000, // 1 minute
-    max: 100, // 100 requests per minute
-    standardHeaders: true,
-    legacyHeaders: false,
-    message: { error: "Too many requests, please try again later" }
-});
 /**
  * Run server with HTTP transport (for remote access, multiple clients)
  */
 async function runHTTP() {
-    const server = createServer();
+    // SECURITY (CWE-306): Warn when HTTP mode runs without authentication
+    if (!process.env.SYNAPSE_API_KEY) {
+        console.error("[SECURITY WARNING] HTTP transport active without SYNAPSE_API_KEY. " +
+            "All requests will be unauthenticated. Set SYNAPSE_API_KEY to enable API key authentication.");
+    }
+    const server = await createServer();
     const app = express();
-    app.use(express.json());
+    // Create transport once at startup and reuse across requests
+    // This eliminates 50-200ms per-request overhead from repeated server.connect() calls
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+        enableJsonResponse: true,
+    });
+    await server.connect(transport);
+    // Request ID middleware MUST be first
+    app.use(requestIdMiddleware);
+    app.use(express.json({ limit: "100kb" }));
     // Request logging middleware
     app.use((req, _res, next) => {
-        const timestamp = new Date().toISOString();
-        const forwarded = req.headers["x-forwarded-for"] || req.headers["x-real-ip"] || "";
-        console.error(`[${timestamp}] ${req.method} ${req.path} from ${req.ip} (fwd: ${forwarded})`);
+        const _timestamp = getCurrentTimestamp();
+        const _forwarded = req.headers["x-forwarded-for"] || req.headers["x-real-ip"] || "";
         next();
     });
-    // Health check endpoint (no rate limiting)
-    app.get("/health", (_req, res) => {
-        res.json({ status: "ok", server: SERVER_NAME, version: SERVER_VERSION });
-    });
-    // MCP endpoint - stateless JSON mode with rate limiting
-    app.post("/mcp", limiter, async (req, res) => {
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            enableJsonResponse: true
+    // Health check endpoint with rate limiting to prevent DDoS
+    const healthLimiter = createHealthRateLimiter();
+    app.get("/health", healthLimiter, (req, res) => {
+        res.json({
+            status: "ok",
+            server: SERVER_NAME,
+            version: SERVER_VERSION,
+            requestId: req.requestId,
         });
-        res.on("close", () => transport.close());
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
     });
-    const port = parseInt(process.env.HOMELAB_PORT || "3000", 10);
-    const host = process.env.HOMELAB_HOST || "127.0.0.1";
+    // MCP endpoint - reuses shared transport
+    // Rate limiting (S-C1) to prevent DoS attacks from expensive operations:
+    //   1. General limiter: 60 req/min/IP for all MCP operations
+    //   2. Destructive limiter: 10 req/min/IP for destructive ops (prune, remove, exec, etc.)
+    // CSRF protection middleware (S-M6) BEFORE auth to prevent CSRF attacks
+    // Auth middleware (S-C1) protects this endpoint when SYNAPSE_API_KEY is configured
+    const mcpLimiter = createMcpRateLimiter();
+    const destructiveLimiter = createDestructiveRateLimitMiddleware();
+    app.post("/mcp", mcpLimiter, destructiveLimiter, csrfProtectionMiddleware, authMiddleware, asyncHandler(async (req, res) => {
+        await transport.handleRequest(req, res, req.body);
+    }));
+    // Error handling middleware MUST be after all routes
+    app.use(errorHandler);
+    app.use(fallbackErrorHandler);
+    const port = Number.parseInt(process.env.SYNAPSE_PORT || "53000", 10);
+    const host = process.env.SYNAPSE_HOST || "127.0.0.1";
     app.listen(port, host, () => {
-        console.error(`${SERVER_NAME} v${SERVER_VERSION} running on http://${host}:${port}/mcp`);
+        /* Server started successfully - intentionally no logging to preserve stdio for MCP protocol */
     });
 }
 /**
  * Print usage information
  */
 function printUsage() {
-    console.log(`
-${SERVER_NAME} v${SERVER_VERSION}
-
-MCP server for managing homelab Docker infrastructure across multiple hosts.
-
-USAGE:
-  node dist/index.js [--stdio | --http]
-
-OPTIONS:
-  --stdio     Run with stdio transport (default, for Claude Code)
-  --http      Run with HTTP transport (for remote access)
-  --help      Show this help message
-
-CONFIGURATION:
-  Create a config file at one of these locations (checked in order):
-    1. Path specified by HOMELAB_CONFIG_FILE env var
-    2. ./homelab.config.json (current directory)
-    3. ~/.config/homelab-mcp/config.json
-    4. ~/.homelab-mcp.json
-
-  Example config file:
-  {
-    "hosts": [
-      {"name": "unraid", "host": "unraid.local", "port": 2375, "protocol": "http"},
-      {"name": "proxmox", "host": "proxmox.local", "port": 2375, "protocol": "http"},
-      {"name": "local", "host": "localhost", "dockerSocketPath": "/var/run/docker.sock"}
-    ]
-  }
-
-ENVIRONMENT VARIABLES:
-  HOMELAB_CONFIG_FILE     Path to config file (optional, overrides default paths)
-  HOMELAB_HOSTS_CONFIG    JSON config as env var (fallback if no config file)
-  HOMELAB_PORT            HTTP server port (default: 3000)
-  HOMELAB_HOST            HTTP server bind address (default: 127.0.0.1)
-
-CLAUDE CODE CONFIG (~/.claude/claude_code_config.json):
-  {
-    "mcpServers": {
-      "homelab": {
-        "command": "node",
-        "args": ["/path/to/homelab-mcp-server/dist/index.js"],
-        "env": {
-          "HOMELAB_CONFIG_FILE": "/path/to/your/homelab.config.json"
-        }
-      }
-    }
-  }
-`);
+    /* Reserved for future CLI usage documentation */
 }
 /**
  * Graceful shutdown handler
  */
-async function shutdown(signal) {
-    console.error(`\nReceived ${signal}, shutting down gracefully...`);
+async function shutdown(_signal) {
     if (globalContainer) {
-        await globalContainer.cleanup();
+        await globalContainer.shutdown();
     }
-    console.error("Cleanup complete");
     process.exit(0);
 }
 // Register signal handlers for graceful shutdown
 process.on("SIGINT", () => {
-    shutdown("SIGINT").catch((error) => {
-        console.error("Error during shutdown:", error);
+    shutdown("SIGINT").catch((_error) => {
         process.exit(1);
     });
 });
 process.on("SIGTERM", () => {
-    shutdown("SIGTERM").catch((error) => {
-        console.error("Error during shutdown:", error);
+    shutdown("SIGTERM").catch((_error) => {
         process.exit(1);
     });
 });
@@ -164,14 +127,12 @@ if (args.includes("--help") || args.includes("-h")) {
 }
 const transportMode = args.includes("--http") ? "http" : "stdio";
 if (transportMode === "http") {
-    runHTTP().catch((error) => {
-        console.error("Server error:", error);
+    runHTTP().catch((_error) => {
         process.exit(1);
     });
 }
 else {
-    runStdio().catch((error) => {
-        console.error("Server error:", error);
+    runStdio().catch((_error) => {
         process.exit(1);
     });
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAyB,MAAM,yBAAyB,CAAC;AAExF,kBAAkB;AAClB,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,oCAAoC;AACpC,IAAI,eAA6C,CAAC;AAElD;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,wCAAwC;IACxC,eAAe,GAAG,sBAAsB,EAAE,CAAC;IAE3C,6BAA6B;IAC7B,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ;IACrB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,sDAAsD;IACtD,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,KAAK,cAAc,mBAAmB,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,GAAG,SAAS,CAAC;IACxB,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW;IAChC,GAAG,EAAE,GAAG,EAAE,0BAA0B;IACpC,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE;CAChE,CAAC,CAAC;AAEH;;GAEG;AACH,KAAK,UAAU,OAAO;IACpB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACnF,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,UAAU,SAAS,GAAG,CAAC,CAAC;QAC7F,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,2CAA2C;IAC3C,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,WAAW,CAAC;IAErD,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,KAAK,cAAc,sBAAsB,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC;EACZ,WAAW,KAAK,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8C/B,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ,CAAC,MAAc;IACpC,OAAO,CAAC,KAAK,CAAC,cAAc,MAAM,+BAA+B,CAAC,CAAC;IACnE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,iDAAiD;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,mBAAmB;AACnB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,UAAU,EAAE,CAAC;IACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAEjE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,CAAC;IACN,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAyB,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,kBAAkB;AAClB,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,oCAAoC;AACpC,IAAI,eAA6C,CAAC;AAElD;;GAEG;AACH,KAAK,UAAU,YAAY;IACzB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,mFAAmF;IACnF,eAAe,GAAG,sBAAsB,EAAE,CAAC;IAC3C,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IAEnC,qBAAqB;IACrB,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ;IACrB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,OAAO;IACpB,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CACX,oEAAoE;YAClE,6FAA6F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,6DAA6D;IAC7D,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;QAC7B,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,sCAAsC;IACtC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAE7B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE1C,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACpF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,aAAa,GAAG,uBAAuB,EAAE,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,yEAAyE;IACzE,6DAA6D;IAC7D,0FAA0F;IAC1F,wEAAwE;IACxE,mFAAmF;IACnF,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,MAAM,kBAAkB,GAAG,oCAAoC,EAAE,CAAC;IAClE,GAAG,CAAC,IAAI,CACN,MAAM,EACN,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CACH,CAAC;IAEF,qDAAqD;IACrD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE9B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,WAAW,CAAC;IAErD,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC1B,+FAA+F;IACjG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,iDAAiD;AACnD,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,eAAe,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,iDAAiD;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,mBAAmB;AACnB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,UAAU,EAAE,CAAC;IACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAEjE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;KAAM,CAAC;IACN,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/async-handler.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Async Handler Wrapper - Eliminates try-catch boilerplate
+ *
+ * Wraps async route handlers to automatically catch promise rejections
+ * and forward them to Express error handling middleware.
+ */
+import type { NextFunction, Request, RequestHandler, Response } from "express";
+/**
+ * Async route handler function type
+ *
+ * Standard Express handler signature but returns a Promise.
+ * Used by asyncHandler to wrap async route handlers.
+ */
+export type AsyncRouteHandler = (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/**
+ * Wraps async route handlers to catch promise rejections
+ *
+ * Eliminates the need for try-catch blocks in every async route handler.
+ * Any promise rejection is automatically caught and forwarded to the
+ * Express error handling middleware via next(error).
+ *
+ * Uses Promise.resolve() to handle both async functions and functions
+ * that return promises, ensuring all rejections are caught.
+ *
+ * @param handler - Async route handler function to wrap
+ * @returns Wrapped Express RequestHandler that catches errors
+ *
+ * @example
+ * ```typescript
+ * // Without asyncHandler (verbose):
+ * app.get("/data", async (req, res, next) => {
+ *   try {
+ *     const data = await fetchData();
+ *     res.json(data);
+ *   } catch (error) {
+ *     next(error);
+ *   }
+ * });
+ *
+ * // With asyncHandler (clean):
+ * app.get("/data", asyncHandler(async (req, res) => {
+ *   const data = await fetchData(); // Errors automatically caught
+ *   res.json(data);
+ * }));
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Works with any async operation:
+ * app.post("/users", asyncHandler(async (req, res) => {
+ *   const user = await createUser(req.body);
+ *   res.status(201).json(user);
+ * }));
+ *
+ * app.delete("/users/:id", asyncHandler(async (req, res) => {
+ *   await deleteUser(req.params.id);
+ *   res.status(204).send();
+ * }));
+ * ```
+ */
+export declare function asyncHandler(handler: AsyncRouteHandler): RequestHandler;
+//# sourceMappingURL=async-handler.d.ts.map

package/dist/middleware/async-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/async-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,cAAc,CAIvE"}

package/dist/middleware/async-handler.js

@@ -0,0 +1,58 @@
+/**
+ * Async Handler Wrapper - Eliminates try-catch boilerplate
+ *
+ * Wraps async route handlers to automatically catch promise rejections
+ * and forward them to Express error handling middleware.
+ */
+/**
+ * Wraps async route handlers to catch promise rejections
+ *
+ * Eliminates the need for try-catch blocks in every async route handler.
+ * Any promise rejection is automatically caught and forwarded to the
+ * Express error handling middleware via next(error).
+ *
+ * Uses Promise.resolve() to handle both async functions and functions
+ * that return promises, ensuring all rejections are caught.
+ *
+ * @param handler - Async route handler function to wrap
+ * @returns Wrapped Express RequestHandler that catches errors
+ *
+ * @example
+ * ```typescript
+ * // Without asyncHandler (verbose):
+ * app.get("/data", async (req, res, next) => {
+ *   try {
+ *     const data = await fetchData();
+ *     res.json(data);
+ *   } catch (error) {
+ *     next(error);
+ *   }
+ * });
+ *
+ * // With asyncHandler (clean):
+ * app.get("/data", asyncHandler(async (req, res) => {
+ *   const data = await fetchData(); // Errors automatically caught
+ *   res.json(data);
+ * }));
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Works with any async operation:
+ * app.post("/users", asyncHandler(async (req, res) => {
+ *   const user = await createUser(req.body);
+ *   res.status(201).json(user);
+ * }));
+ *
+ * app.delete("/users/:id", asyncHandler(async (req, res) => {
+ *   await deleteUser(req.params.id);
+ *   res.status(204).send();
+ * }));
+ * ```
+ */
+export function asyncHandler(handler) {
+    return (req, res, next) => {
+        Promise.resolve(handler(req, res, next)).catch(next);
+    };
+}
+//# sourceMappingURL=async-handler.js.map

package/dist/middleware/async-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-handler.js","sourceRoot":"","sources":["../../src/middleware/async-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,YAAY,CAAC,OAA0B;IACrD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,32 @@
+import type { NextFunction, Request, Response } from "express";
+/**
+ * Authentication middleware for HTTP transport.
+ *
+ * Security: Prevents CWE-306 (Missing Authentication for Critical Function) by
+ * requiring API key authentication when SYNAPSE_API_KEY is configured.
+ *
+ * If SYNAPSE_API_KEY is not set, authentication is disabled and all requests are allowed.
+ * This provides backward compatibility and allows local development without authentication.
+ *
+ * When enabled, requires X-API-Key header that matches SYNAPSE_API_KEY exactly.
+ * Uses timing-safe comparison to prevent timing attacks.
+ *
+ * @see https://cwe.mitre.org/data/definitions/306.html
+ *
+ * @example
+ * ```typescript
+ * // Disable authentication (development/local only)
+ * // No SYNAPSE_API_KEY env var set
+ *
+ * // Enable authentication
+ * process.env.SYNAPSE_API_KEY = "my-secret-key-12345";
+ * app.use('/mcp', authMiddleware);
+ *
+ * // Client request
+ * fetch('/mcp', {
+ *   headers: { 'X-API-Key': 'my-secret-key-12345' }
+ * });
+ * ```
+ */
+export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAsCpF"}

package/dist/middleware/auth.js

@@ -0,0 +1,63 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+/**
+ * Authentication middleware for HTTP transport.
+ *
+ * Security: Prevents CWE-306 (Missing Authentication for Critical Function) by
+ * requiring API key authentication when SYNAPSE_API_KEY is configured.
+ *
+ * If SYNAPSE_API_KEY is not set, authentication is disabled and all requests are allowed.
+ * This provides backward compatibility and allows local development without authentication.
+ *
+ * When enabled, requires X-API-Key header that matches SYNAPSE_API_KEY exactly.
+ * Uses timing-safe comparison to prevent timing attacks.
+ *
+ * @see https://cwe.mitre.org/data/definitions/306.html
+ *
+ * @example
+ * ```typescript
+ * // Disable authentication (development/local only)
+ * // No SYNAPSE_API_KEY env var set
+ *
+ * // Enable authentication
+ * process.env.SYNAPSE_API_KEY = "my-secret-key-12345";
+ * app.use('/mcp', authMiddleware);
+ *
+ * // Client request
+ * fetch('/mcp', {
+ *   headers: { 'X-API-Key': 'my-secret-key-12345' }
+ * });
+ * ```
+ */
+export function authMiddleware(req, res, next) {
+    const configuredKey = process.env.SYNAPSE_API_KEY;
+    // If no API key is configured, skip authentication (allow all)
+    if (!configuredKey) {
+        next();
+        return;
+    }
+    // Get provided API key from header (case-insensitive)
+    const providedKey = req.headers["x-api-key"];
+    // Reject if no key provided or key is empty/whitespace
+    if (!providedKey || providedKey.trim().length === 0) {
+        res.status(401).json({
+            error: "Unauthorized",
+            message: "Missing or invalid X-API-Key header",
+        });
+        return;
+    }
+    // Use timing-safe comparison to prevent timing attacks
+    // Both strings must be same length for timingSafeEqual, so hash both
+    const providedHash = createHash("sha256").update(providedKey).digest();
+    const configuredHash = createHash("sha256").update(configuredKey).digest();
+    const isValid = timingSafeEqual(providedHash, configuredHash);
+    if (!isValid) {
+        res.status(401).json({
+            error: "Unauthorized",
+            message: "Missing or invalid X-API-Key header",
+        });
+        return;
+    }
+    // Authentication successful
+    next();
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC5E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAElD,+DAA+D;IAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAuB,CAAC;IAEnE,uDAAuD;IACvD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,uDAAuD;IACvD,qEAAqE;IACrE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC;IAE3E,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAE9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,4BAA4B;IAC5B,IAAI,EAAE,CAAC;AACT,CAAC"}