tiny-http-mcp-server 0.1.17 → 0.1.18

package/dist/test-support.js

@@ -166,6 +166,7 @@ async function fetchInMemory(server, url, init) {
     response.headerValues = new Headers();
     response.headersSent = false;
     response.writableEnded = false;
+    response.destroyed = false;
     const setResponseHeader = (name, value) => {
         response.headerValues.delete(name);
         if (Array.isArray(value) && name.toLowerCase() === "set-cookie") {
@@ -224,6 +225,22 @@ async function fetchInMemory(server, url, init) {
         }
         return response;
     });
+    response.destroy = ((error) => {
+        if (!response.destroyed) {
+            response.destroyed = true;
+            try {
+                if (error === undefined)
+                    streamController?.close();
+                else
+                    streamController?.error(error);
+            }
+            catch {
+                // The consumer may have cancelled the stream already.
+            }
+            response.emit("close");
+        }
+        return response;
+    });
     response.flushHeaders = (() => {
         response.headersSent = true;
     });

package/dist/testing.d.ts

@@ -56,4 +56,4 @@ export declare function createInMemoryTokenVerifier(options?: Partial<{
     now: () => number;
 }>): InMemoryTokenVerifier;
 export declare function createHttpTestPair(server: HttpServer): Promise<HttpTestPair>;
-export declare function createHttpTestPairWithTinyClient(server: HttpServer): Promise<TinyHttpTestPair>;
+export declare function createHttpTestPairWithTinyClient(server: HttpServer, clientOptions?: Pick<import("tiny-mcp-client").McpClientOptions, "protocolVersion">): Promise<TinyHttpTestPair>;

package/dist/testing.js

@@ -135,7 +135,7 @@ export async function createHttpTestPair(server) {
         }
     };
 }
-export async function createHttpTestPairWithTinyClient(server) {
+export async function createHttpTestPairWithTinyClient(server, clientOptions = {}) {
     let tinyMcpClient;
     try {
         tinyMcpClient = await import("tiny-mcp-client");
@@ -147,7 +147,8 @@ export async function createHttpTestPairWithTinyClient(server) {
     const handle = await server.listenHttp({ port: 0 });
     const requests = [];
     const client = new tinyMcpClient.McpClient({
-        clientInfo: { name: "tiny-http-test-client", version: "1.0.0" }
+        clientInfo: { name: "tiny-http-test-client", version: "1.0.0" },
+        ...clientOptions
     });
     const transport = new tinyMcpClient.HttpTransport({
         url: handle.url,

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,5 @@
+import { isIP } from "node:net";
+import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
 import { createAuthStoreClientStore, createAuthStoreSessionStore } from "./auth-store-session-store.js";
 import { createLoopbackAuthorizationSession } from "./loopback-authorization.js";
@@ -62,6 +64,15 @@ export function createDefaultOAuthClientProvider(options) {
     async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         let session = await loadSession(canonicalResource);
+        if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
+            throw new Error("OAuth discovery authorization-server issuer mismatch");
+        }
+        if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource
+            || getOwnString(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer
+            || (discovery !== undefined && discovery.authorizationServer !== session.authorizationServer))) {
+            await clearSession(canonicalResource);
+            session = null;
+        }
         const sessionDiscovery = resolveDiscovery(discovery, session);
         if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
             return session;
@@ -281,14 +292,16 @@ export function createDefaultOAuthClientProvider(options) {
             }
         }
         const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
-        const response = await fetch(registrationEndpoint, {
+        const signal = AbortSignal.timeout(30_000);
+        const response = await fetchMcpResponse(fetch, registrationEndpoint, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json"
             },
-            body: JSON.stringify(registrationBody)
+            body: JSON.stringify(registrationBody),
+            signal
         });
-        const payload = await readOAuthJsonObjectResponse(response);
+        const payload = await readOAuthJsonObjectResponse(response, signal);
         const clientId = getOwnString(payload, "client_id");
         if (clientId === undefined || clientId.trim().length === 0) {
             throw new Error("OAuth client registration response missing client_id");
@@ -545,10 +558,14 @@ function isLoopbackHostname(hostname) {
     const normalizedHostname = normalizeHostname(hostname);
     return (normalizedHostname === "localhost" ||
         normalizedHostname === "::1" ||
-        normalizedHostname.startsWith("127."));
+        normalizedHostname === "[::1]" ||
+        (isIP(normalizedHostname) === 4 && normalizedHostname.startsWith("127.")));
 }
 function assertSecureUrl(value, label) {
     const url = new URL(value);
+    if (url.username !== "" || url.password !== "" || url.hash !== "") {
+        throw new Error(`${label} must not include credentials or fragment`);
+    }
     if (url.protocol === "https:") {
         return;
     }

package/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -36,5 +36,5 @@ export declare function refreshAccessToken(input: {
     fetch: OAuthMetadataFetch;
     now: () => number;
 }): Promise<StoredOAuthTokens>;
-export declare function readOAuthJsonObjectResponse(response: Response): Promise<Record<string, unknown>>;
+export declare function readOAuthJsonObjectResponse(response: Response, signal?: AbortSignal): Promise<Record<string, unknown>>;
 export {};

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,4 +1,6 @@
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { readBoundedResponseText } from "../http-response.js";
+import { fetchMcpResponse } from "../http-fetch.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export class OAuthError extends Error {
     error;
@@ -68,14 +70,16 @@ async function requestTokens(input) {
     if (input.clientSecret !== undefined) {
         body.set("client_secret", input.clientSecret);
     }
-    const response = await input.fetch(input.tokenEndpoint, {
+    const signal = AbortSignal.timeout(30_000);
+    const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
         headers: {
             "Content-Type": "application/x-www-form-urlencoded"
         },
-        body: body.toString()
+        body: body.toString(),
+        signal
     });
-    const payload = await readOAuthJsonObjectResponse(response);
+    const payload = await readOAuthJsonObjectResponse(response, signal);
     const accessToken = getOwnEntry(payload, "access_token");
     if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
         throw new Error("OAuth token response missing access_token");
@@ -115,13 +119,17 @@ async function requestTokens(input) {
         scope: normalizedScope === undefined ? undefined : normalizedScope
     };
 }
-export async function readOAuthJsonObjectResponse(response) {
+export async function readOAuthJsonObjectResponse(response, signal) {
     const fallbackError = createFallbackOAuthError(response.status);
     let payload;
     try {
-        payload = await response.json();
+        payload = JSON.parse(await readBoundedResponseText(response, 1024 * 1024, undefined, signal));
     }
-    catch {
+    catch (error) {
+        if (signal?.aborted)
+            throw signal.reason;
+        if (error instanceof Error && error.message.startsWith("HTTP response exceeds "))
+            throw error;
         if (!response.ok) {
             throw fallbackError;
         }

package/node_modules/mcp-oauth/dist/http-fetch.d.ts

@@ -0,0 +1 @@
+export declare function fetchMcpResponse(fetchImplementation: (input: string | URL, init?: RequestInit) => Promise<Response>, input: string | URL, init?: RequestInit): Promise<Response>;

package/node_modules/mcp-oauth/dist/http-fetch.js

@@ -0,0 +1,8 @@
+export async function fetchMcpResponse(fetchImplementation, input, init = {}) {
+    const response = await fetchImplementation(input, { ...init, redirect: "error" });
+    if (response.redirected || response.type === "opaqueredirect") {
+        void response.body?.cancel().catch(() => undefined);
+        throw new Error("MCP HTTP redirects are not allowed");
+    }
+    return response;
+}

package/node_modules/mcp-oauth/dist/http-response.d.ts

@@ -0,0 +1 @@
+export declare function readBoundedResponseText(response: Response, maxBytes: number, readers?: Set<ReadableStreamDefaultReader<Uint8Array>>, signal?: AbortSignal): Promise<string>;

package/node_modules/mcp-oauth/dist/http-response.js

@@ -0,0 +1,50 @@
+export async function readBoundedResponseText(response, maxBytes, readers, signal) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+        throw new Error("HTTP response byte limit must be a positive safe integer");
+    if (signal?.aborted) {
+        void response.body?.cancel().catch(() => undefined);
+        throw signal.reason;
+    }
+    const length = response.headers.get("Content-Length");
+    if (length !== null &&
+        length.length > 0 &&
+        [...length].every((character) => character >= "0" && character <= "9") &&
+        Number(length) > maxBytes) {
+        void response.body?.cancel().catch(() => undefined);
+        throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
+    }
+    if (response.body === null)
+        return "";
+    const reader = response.body.getReader();
+    readers?.add(reader);
+    const abort = () => {
+        void reader.cancel().catch(() => undefined);
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    let bytes = 0;
+    let text = "";
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            signal?.throwIfAborted();
+            if (chunk.done)
+                return text + decoder.decode();
+            bytes += chunk.value.byteLength;
+            if (bytes > maxBytes)
+                throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+    }
+    catch (error) {
+        void reader.cancel().catch(() => undefined);
+        throw error;
+    }
+    finally {
+        signal?.removeEventListener("abort", abort);
+        readers?.delete(reader);
+        reader.releaseLock();
+    }
+}

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -8,3 +8,5 @@ export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
 export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, StoredOAuthSession, StoredOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
+export { readBoundedResponseText } from "./http-response.js";
+export { fetchMcpResponse } from "./http-fetch.js";

package/node_modules/mcp-oauth/dist/index.js

@@ -5,3 +5,5 @@ export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
+export { readBoundedResponseText } from "./http-response.js";
+export { fetchMcpResponse } from "./http-fetch.js";

package/node_modules/mcp-oauth/dist/server/jwks-token-verifier.js

@@ -1,3 +1,5 @@
+import { readBoundedResponseText } from "../http-response.js";
+import { fetchMcpResponse } from "../http-fetch.js";
 import { decodeProtectedHeader, errors, importJWK, jwtVerify } from "jose";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 const DEFAULT_ALLOWED_ALGORITHMS = [
@@ -158,16 +160,18 @@ function normalizeVerificationError(error) {
 }
 async function loadJwks(jwksUrl, fetchImplementation, timeoutMs) {
     try {
-        const response = await fetchImplementation(jwksUrl, {
+        const signal = AbortSignal.timeout(timeoutMs);
+        const response = await fetchMcpResponse(fetchImplementation, jwksUrl, {
             headers: {
                 Accept: "application/json"
             },
-            signal: AbortSignal.timeout(timeoutMs)
+            signal
         });
         if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
             throw createTemporarilyUnavailableError();
         }
-        const payload = (await response.json());
+        const payload = JSON.parse(await readBoundedResponseText(response, 1024 * 1024, undefined, signal));
         const keys = isObjectRecord(payload) ? getOwnEntry(payload, "keys") : undefined;
         if (!isObjectRecord(payload) || !Array.isArray(keys) || !keys.every(isObjectRecord)) {
             throw createTemporarilyUnavailableError();
@@ -280,6 +284,9 @@ function isLoopbackHostname(hostname) {
 }
 export function createJwksTokenVerifier(options) {
     const jwksUrl = toUrl(options.jwksUrl, "jwksUrl");
+    if ((jwksUrl.protocol !== "http:" && jwksUrl.protocol !== "https:") || jwksUrl.username !== "" || jwksUrl.password !== "") {
+        throw new Error("jwksUrl must be an HTTP or HTTPS URL without credentials");
+    }
     const clockSkewSeconds = options.clockSkewSeconds ?? 30;
     const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;
     const jwksCacheTtlMs = options.jwksCacheTtlMs ?? 300_000;
@@ -287,6 +294,17 @@ export function createJwksTokenVerifier(options) {
     const jwksRefreshCooldownMs = options.jwksRefreshCooldownMs ?? 30_000;
     const requireAccessTokenType = options.requireAccessTokenType ?? false;
     const fetchImplementation = options.fetch ?? globalThis.fetch;
+    if (!Number.isFinite(clockSkewSeconds) || clockSkewSeconds < 0) {
+        throw new Error("clockSkewSeconds must be a finite non-negative number");
+    }
+    for (const key of ["jwksCacheTtlMs", "jwksRefreshCooldownMs"]) {
+        const value = key === "jwksCacheTtlMs" ? jwksCacheTtlMs : jwksRefreshCooldownMs;
+        if (!Number.isSafeInteger(value) || value < 0)
+            throw new Error(`${key} must be a non-negative safe integer`);
+    }
+    if (!Number.isInteger(jwksFetchTimeoutMs) || jwksFetchTimeoutMs <= 0 || jwksFetchTimeoutMs > 2_147_483_647) {
+        throw new Error("jwksFetchTimeoutMs must be a positive integer no greater than 2147483647");
+    }
     let cachedJwks;
     let pendingJwks;
     let pendingForcedRefresh;

package/node_modules/tiny-mcp-client/README.md

@@ -88,6 +88,7 @@ You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or ins
 | `fetch`               | `(input, init?) => Promise<Response>` | Custom fetch implementation.          |
 | `oauth`               | `OAuthClientProviderOptions`          | Enables OAuth authorization handling. |
 | `oauthDiscoveryCache` | `OAuthDiscoveryCache`                 | Optional shared metadata cache.       |
+| `maxResponseBytes`     | `number`                              | Maximum JSON/error body or retained SSE event bytes; defaults to 16 MiB and must be a positive safe integer. |
 
 ### `StdioTransportOptions`