tiny-http-mcp-server 0.1.0

package/node_modules/mcp-oauth/dist/server/jwks-token-verifier.js

@@ -0,0 +1,388 @@
+import { decodeProtectedHeader, errors, importJWK, jwtVerify } from "jose";
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+const DEFAULT_ALLOWED_ALGORITHMS = [
+    "ES256",
+    "ES384",
+    "ES512",
+    "RS256",
+    "RS384",
+    "RS512",
+    "PS256",
+    "PS384",
+    "PS512",
+    "EdDSA"
+];
+function isTokenVerificationErrorShape(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const challengeError = error;
+    return (challengeError.error === "invalid_token" ||
+        challengeError.error === "insufficient_scope" ||
+        challengeError.error === "temporarily_unavailable");
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key)
+        ? record[key]
+        : undefined;
+}
+function getOwnString(record, key) {
+    const value = getOwnEntry(record, key);
+    return typeof value === "string" ? value : undefined;
+}
+function toUrl(value, label) {
+    try {
+        return new URL(String(value));
+    }
+    catch {
+        throw new Error(`${label} must be an absolute URL`);
+    }
+}
+function normalizeAudience(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    return isStringArray(value) ? [...value] : [];
+}
+function normalizeVerifiedAudience(value, expectedResource) {
+    const audiences = normalizeAudience(value);
+    for (const audience of audiences) {
+        try {
+            const normalizedAudience = canonicalizeResourceIndicator(audience);
+            if (normalizedAudience === expectedResource) {
+                return [normalizedAudience];
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    throw createInvalidTokenError("audience mismatch");
+}
+function parseScopes(payload) {
+    const scope = getOwnString(payload, "scope");
+    const scopes = getOwnEntry(payload, "scopes");
+    const raw = scope !== undefined ? scope : typeof scopes === "string" ? scopes : null;
+    if (raw !== null) {
+        return raw
+            .split(" ")
+            .map((scope) => scope.trim())
+            .filter((scope) => scope.length > 0);
+    }
+    return isStringArray(scopes) ? [...scopes] : [];
+}
+function toVerifiedAccessToken(token, payload, audience = normalizeAudience(getOwnEntry(payload, "aud"))) {
+    const issuer = getOwnString(payload, "iss");
+    const expiresAt = getOwnEntry(payload, "exp");
+    const subject = getOwnString(payload, "sub");
+    const clientId = getOwnString(payload, "client_id");
+    return {
+        token,
+        issuer: issuer ?? "",
+        audience,
+        scopes: parseScopes(payload),
+        expiresAt: expiresAt,
+        claims: { ...payload },
+        ...(subject !== undefined
+            ? {
+                subject
+            }
+            : {}),
+        ...(clientId !== undefined
+            ? {
+                clientId
+            }
+            : {})
+    };
+}
+function createTokenVerificationError(input) {
+    return Object.assign(new Error(input.errorDescription ?? input.error), input);
+}
+function createTemporarilyUnavailableError() {
+    return createTokenVerificationError({
+        error: "temporarily_unavailable",
+        errorDescription: "token verification temporarily unavailable"
+    });
+}
+function createInvalidTokenError(errorDescription) {
+    return createTokenVerificationError({
+        error: "invalid_token",
+        errorDescription
+    });
+}
+function normalizeVerificationError(error) {
+    if (isTokenVerificationErrorShape(error)) {
+        return error;
+    }
+    if (error instanceof errors.JWTExpired) {
+        return createInvalidTokenError("token expired");
+    }
+    if (error instanceof errors.JWTClaimValidationFailed) {
+        if (error.claim === "aud") {
+            return createInvalidTokenError("audience mismatch");
+        }
+        if (error.claim === "iss") {
+            return createInvalidTokenError("issuer mismatch");
+        }
+        if (error.claim === "nbf") {
+            return createInvalidTokenError("token not active yet");
+        }
+        if (error.claim === "exp") {
+            if (error.reason === "missing") {
+                return createInvalidTokenError("token missing expiry");
+            }
+            return createInvalidTokenError("token expired");
+        }
+        if (error.claim === "typ") {
+            return createInvalidTokenError("invalid access token type");
+        }
+    }
+    if (error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported) {
+        return createInvalidTokenError("unsupported token algorithm");
+    }
+    if (error instanceof errors.JWKSNoMatchingKey ||
+        error instanceof errors.JWKSMultipleMatchingKeys ||
+        error instanceof errors.JWSSignatureVerificationFailed) {
+        return createInvalidTokenError("token signature invalid");
+    }
+    if (error instanceof errors.JWKSInvalid || error instanceof errors.JWKSTimeout) {
+        return createTemporarilyUnavailableError();
+    }
+    return createInvalidTokenError("token verification failed");
+}
+async function loadJwks(jwksUrl, fetchImplementation, timeoutMs) {
+    try {
+        const response = await fetchImplementation(jwksUrl, {
+            headers: {
+                Accept: "application/json"
+            },
+            signal: AbortSignal.timeout(timeoutMs)
+        });
+        if (!response.ok) {
+            throw createTemporarilyUnavailableError();
+        }
+        const payload = (await response.json());
+        const keys = isObjectRecord(payload) ? getOwnEntry(payload, "keys") : undefined;
+        if (!isObjectRecord(payload) || !Array.isArray(keys) || !keys.every(isObjectRecord)) {
+            throw createTemporarilyUnavailableError();
+        }
+        return { keys };
+    }
+    catch (error) {
+        if (isTokenVerificationErrorShape(error)) {
+            throw error;
+        }
+        throw createTemporarilyUnavailableError();
+    }
+}
+function resolveAlgorithm(token, allowedAlgorithms) {
+    const header = decodeProtectedHeader(token);
+    const alg = getOwnString(header, "alg");
+    if (hasCriticalHeaderClaims(header)) {
+        throw createInvalidTokenError("unsupported critical token claims");
+    }
+    if (typeof alg !== "string" ||
+        alg === "none" ||
+        alg.startsWith("HS") ||
+        !allowedAlgorithms.includes(alg)) {
+        throw createInvalidTokenError("unsupported token algorithm");
+    }
+    return alg;
+}
+function hasCriticalHeaderClaims(header) {
+    const criticalClaims = getOwnEntry(header, "crit");
+    return Array.isArray(criticalClaims) && criticalClaims.length > 0;
+}
+function isVerificationCandidate(key, alg, kid) {
+    const keyId = getOwnString(key, "kid");
+    const keyAlgorithm = getOwnString(key, "alg");
+    const keyUse = getOwnString(key, "use");
+    const keyOps = getOwnEntry(key, "key_ops");
+    if (kid !== undefined && keyId !== kid) {
+        return false;
+    }
+    if (keyAlgorithm !== undefined && keyAlgorithm !== alg) {
+        return false;
+    }
+    if (keyUse !== undefined && keyUse !== "sig") {
+        return false;
+    }
+    if (Array.isArray(keyOps) && !keyOps.includes("verify")) {
+        return false;
+    }
+    return true;
+}
+function shouldContinueWithNextKey(error) {
+    return error instanceof errors.JWSSignatureVerificationFailed;
+}
+async function verifyJwtAgainstJwks(input) {
+    const protectedHeader = decodeProtectedHeader(input.token);
+    const kid = getOwnString(protectedHeader, "kid");
+    const candidateKeys = input.jwks.keys.filter((key) => isVerificationCandidate(key, input.alg, kid));
+    if (candidateKeys.length === 0) {
+        throw new NoMatchingKeyError();
+    }
+    let lastSignatureError;
+    let hasMalformedKey = false;
+    for (const candidate of candidateKeys) {
+        let key;
+        try {
+            key = await importJWK(candidate, input.alg);
+        }
+        catch {
+            hasMalformedKey = true;
+            continue;
+        }
+        try {
+            return await jwtVerify(input.token, key, {
+                algorithms: [input.alg],
+                issuer: [...input.authorizationServers],
+                clockTolerance: input.clockSkewSeconds,
+                requiredClaims: ["exp"],
+                ...(input.requireAccessTokenType ? { typ: "at+jwt" } : {})
+            });
+        }
+        catch (error) {
+            if (shouldContinueWithNextKey(error)) {
+                lastSignatureError = error;
+                continue;
+            }
+            throw error;
+        }
+    }
+    if (hasMalformedKey) {
+        throw createTemporarilyUnavailableError();
+    }
+    throw lastSignatureError ?? createInvalidTokenError("token signature invalid");
+}
+class NoMatchingKeyError extends Error {
+}
+function isLoopbackHostname(hostname) {
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+        return true;
+    }
+    if (hostname === "[::1]" || hostname === "::1") {
+        return true;
+    }
+    const parts = hostname.split(".");
+    return (parts.length === 4 &&
+        parts[0] === "127" &&
+        parts.slice(1).every((part) => {
+            const value = Number(part);
+            return Number.isInteger(value) && value >= 0 && value <= 255;
+        }));
+}
+export function createJwksTokenVerifier(options) {
+    const jwksUrl = toUrl(options.jwksUrl, "jwksUrl");
+    const clockSkewSeconds = options.clockSkewSeconds ?? 30;
+    const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;
+    const jwksCacheTtlMs = options.jwksCacheTtlMs ?? 300_000;
+    const jwksFetchTimeoutMs = options.jwksFetchTimeoutMs ?? 5_000;
+    const jwksRefreshCooldownMs = options.jwksRefreshCooldownMs ?? 30_000;
+    const requireAccessTokenType = options.requireAccessTokenType ?? false;
+    const fetchImplementation = options.fetch ?? globalThis.fetch;
+    let cachedJwks;
+    let pendingJwks;
+    let pendingForcedRefresh;
+    let lastForcedRefreshAt = Number.NEGATIVE_INFINITY;
+    if (jwksUrl.protocol !== "https:" &&
+        !isLoopbackHostname(jwksUrl.hostname) &&
+        options.allowInsecureJwks !== true) {
+        throw new Error("jwksUrl must use HTTPS for non-loopback hosts");
+    }
+    if (typeof fetchImplementation !== "function") {
+        throw new Error("fetch is not available; pass options.fetch explicitly");
+    }
+    async function getJwks(forceRefresh = false) {
+        const now = Date.now();
+        if (!forceRefresh && cachedJwks !== undefined && cachedJwks.expiresAt > now) {
+            return cachedJwks.value;
+        }
+        if (pendingJwks !== undefined) {
+            return pendingJwks;
+        }
+        pendingJwks = loadJwks(jwksUrl, fetchImplementation, jwksFetchTimeoutMs)
+            .then((jwks) => {
+            cachedJwks = {
+                value: jwks,
+                expiresAt: Date.now() + jwksCacheTtlMs
+            };
+            return jwks;
+        })
+            .finally(() => {
+            pendingJwks = undefined;
+        });
+        return pendingJwks;
+    }
+    function refreshJwksAfterUnknownKey() {
+        if (pendingForcedRefresh !== undefined) {
+            return pendingForcedRefresh;
+        }
+        const now = Date.now();
+        if (now - lastForcedRefreshAt < jwksRefreshCooldownMs) {
+            throw new NoMatchingKeyError();
+        }
+        lastForcedRefreshAt = now;
+        pendingForcedRefresh = getJwks(true).finally(() => {
+            pendingForcedRefresh = undefined;
+        });
+        return pendingForcedRefresh;
+    }
+    return {
+        async verify(input) {
+            try {
+                const expectedResource = canonicalizeResourceIndicator(input.resource);
+                const algorithm = resolveAlgorithm(input.token, allowedAlgorithms);
+                let jwks = await getJwks();
+                let verified;
+                try {
+                    verified = await verifyJwtAgainstJwks({
+                        token: input.token,
+                        jwks,
+                        alg: algorithm,
+                        authorizationServers: input.authorizationServers,
+                        clockSkewSeconds,
+                        requireAccessTokenType
+                    });
+                }
+                catch (error) {
+                    if (!(error instanceof NoMatchingKeyError)) {
+                        throw error;
+                    }
+                    jwks = await refreshJwksAfterUnknownKey();
+                    verified = await verifyJwtAgainstJwks({
+                        token: input.token,
+                        jwks,
+                        alg: algorithm,
+                        authorizationServers: input.authorizationServers,
+                        clockSkewSeconds,
+                        requireAccessTokenType
+                    });
+                }
+                const audience = normalizeVerifiedAudience(getOwnEntry(verified.payload, "aud"), expectedResource);
+                const accessToken = toVerifiedAccessToken(input.token, verified.payload, audience);
+                if (input.requiredScopes.length > 0 &&
+                    !input.requiredScopes.every((scope) => accessToken.scopes.includes(scope))) {
+                    throw createTokenVerificationError({
+                        error: "insufficient_scope",
+                        errorDescription: "insufficient scope",
+                        scope: [...input.requiredScopes]
+                    });
+                }
+                return accessToken;
+            }
+            catch (error) {
+                if (error instanceof NoMatchingKeyError) {
+                    throw createInvalidTokenError("token signature invalid");
+                }
+                throw normalizeVerificationError(error);
+            }
+        }
+    };
+}

package/node_modules/mcp-oauth/dist/types.compile-check.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/mcp-oauth/dist/types.compile-check.js

@@ -0,0 +1,22 @@
+const ignoredImplicitGrantOptions = {
+    client: {
+        mode: "static",
+        clientId: "client-id",
+        // @ts-expect-error implicit response types are not configurable via the public API
+        responseType: "token",
+    },
+    browser: {
+        openBrowser: async () => { },
+    },
+};
+const ignoredPasswordGrantOptions = {
+    client: {
+        mode: "dynamic",
+        // @ts-expect-error password grants are not configurable via the public API
+        grantType: "password",
+    },
+    browser: {
+        openBrowser: async () => { },
+    },
+};
+export {};

package/node_modules/mcp-oauth/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "mcp-oauth",
+  "version": "0.0.1",
+  "license": "MIT",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc"
+  },
+  "dependencies": {
+    "jose": "^6.1.2"
+  },
+  "devDependencies": {
+    "tiny-oauth-test-server": "*"
+  },
+  "files": [
+    "dist",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/poe-platform/poe-code.git",
+    "directory": "packages/mcp-oauth"
+  }
+}

package/node_modules/tiny-mcp-client/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Poe Platform
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/tiny-mcp-client/README.md

@@ -0,0 +1,104 @@
+# tiny-mcp-client
+
+`tiny-mcp-client` is a lightweight Model Context Protocol client used by tests, fixtures, and package integrations. It supports stdio transports, streamable HTTP transports, in-memory test pairs, JSON-RPC helpers, and OAuth metadata discovery for OAuth-protected MCP HTTP servers.
+
+## Usage
+
+```ts
+import { HttpTransport, McpClient } from "tiny-mcp-client";
+
+const client = new McpClient({
+  clientInfo: { name: "demo", version: "0.1.0" }
+});
+
+await client.connect(new HttpTransport({ url: "http://127.0.0.1:3000/mcp" }));
+const tools = await client.listTools();
+console.log(tools);
+const result = await client.callTool({
+  name: "search",
+  arguments: { query: "typed outputs" }
+});
+console.log(result.structuredContent);
+await client.close();
+```
+
+`Tool` includes MCP `outputSchema` when a server advertises typed tool output. `CallToolResult` includes `structuredContent?: Record<string, unknown>` for typed results; legacy/content-block tools still use `content[]`.
+
+## Transports
+
+| Transport                       | Description                                                                                                 |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `StdioTransport`                | Spawns an MCP server process and communicates over stdio.                                                   |
+| `HttpTransport`                 | Connects to streamable HTTP MCP endpoints, including session IDs, SSE GET streams, and session termination. |
+| `createInMemoryTransportPair()` | Creates paired streams for in-process tests.                                                                |
+
+## OAuth HTTP support
+
+`HttpTransport` accepts `oauth` options from `mcp-oauth`. When a protected server returns a Bearer `WWW-Authenticate` challenge, the transport discovers protected-resource metadata, loads authorization-server metadata, lets the OAuth provider handle authorization, and retries the request when credentials are available.
+
+```ts
+import { HttpTransport, createDefaultOAuthClientProvider } from "tiny-mcp-client";
+
+const transport = new HttpTransport({
+  url: "https://mcp.example.com/mcp",
+  oauth: {
+    provider: createDefaultOAuthClientProvider({
+      client: {
+        mode: "dynamic",
+        metadata: {
+          clientName: "tiny-client"
+        }
+      },
+      browser: {
+        openBrowser: async (url) => {
+          console.log(`Open ${url}`);
+        }
+      }
+    })
+  }
+});
+```
+
+You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache.
+
+## Testing helpers
+
+- `createTestPair()` and `createSdkTestPair()` create paired client/server fixtures.
+- `createInMemoryTransportPair()` is useful for fast unit tests without opening sockets or spawning processes.
+- JSON-RPC error constants are exported for assertions: `ERROR_PARSE`, `ERROR_INVALID_REQUEST`, `ERROR_METHOD_NOT_FOUND`, `ERROR_INVALID_PARAMS`, and `ERROR_INTERNAL`.
+
+## Configuration Options
+
+### `McpClientOptions`
+
+| Option                                                     | Type                                | Description                                      |
+| ---------------------------------------------------------- | ----------------------------------- | ------------------------------------------------ |
+| `clientInfo`                                               | `{ name: string; version: string }` | Required client identity sent during initialize. |
+| `capabilities`                                             | `ClientCapabilities`                | Optional MCP client capabilities.                |
+| `onToolsChanged`, `onResourcesChanged`, `onPromptsChanged` | callbacks                           | Optional notification handlers.                  |
+| `onResourceUpdated`, `onLog`, `onProgress`                 | callbacks                           | Optional resource/log/progress handlers.         |
+| `onSamplingRequest`, `onRootsList`                         | callbacks                           | Optional server-to-client request handlers.      |
+
+### `HttpTransportOptions`
+
+| Option                | Type                                  | Description                           |
+| --------------------- | ------------------------------------- | ------------------------------------- |
+| `url`                 | `string`                              | MCP HTTP endpoint URL.                |
+| `headers`             | `HeadersInit`                         | Static headers added to requests.     |
+| `fetch`               | `(input, init?) => Promise<Response>` | Custom fetch implementation.          |
+| `oauth`               | `OAuthClientProviderOptions`          | Enables OAuth authorization handling. |
+| `oauthDiscoveryCache` | `OAuthDiscoveryCache`                 | Optional shared metadata cache.       |
+
+### `StdioTransportOptions`
+
+| Option    | Type                | Description                      |
+| --------- | ------------------- | -------------------------------- |
+| `command` | `string`            | Server executable.               |
+| `args`    | `string[]`          | Server args.                     |
+| `cwd`     | `string`            | Server working directory.        |
+| `env`     | `NodeJS.ProcessEnv` | Server environment.              |
+| `spawn`   | `StdioSpawn`        | Custom spawn function for tests. |
+
+## Environment Variables
+
+This package does not expose public environment variables. Pass process environment explicitly through `StdioTransportOptions.env` when a spawned MCP server needs it.