tiny-http-mcp-server 0.1.18 → 0.1.20

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.18",
+      "version": "0.1.20",
       "license": "MIT"
     },
     {

package/node_modules/tiny-mcp-client/README.md

@@ -1,6 +1,6 @@
 # tiny-mcp-client
 
-`tiny-mcp-client` is a lightweight Model Context Protocol client used by tests, fixtures, and package integrations. It supports stdio transports, streamable HTTP transports, in-memory test pairs, JSON-RPC helpers, and OAuth metadata discovery for OAuth-protected MCP HTTP servers.
+`tiny-mcp-client` is a lightweight Model Context Protocol client used by tests, fixtures, and package integrations. It supports stdio transports, Streamable HTTP and legacy HTTP/SSE transports, in-memory test pairs, JSON-RPC helpers, and OAuth metadata discovery for OAuth-protected MCP HTTP servers.
 
 ## Usage
 
@@ -29,9 +29,14 @@ await client.close();
 | Transport                       | Description                                                                                                 |
 | ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
 | `StdioTransport`                | Spawns an MCP server process and communicates over stdio.                                                   |
-| `HttpTransport`                 | Connects to streamable HTTP MCP endpoints, including session IDs, SSE GET streams, and session termination. |
+| `HttpTransport`                 | Connects to Streamable HTTP endpoints, or legacy HTTP/SSE with `mode: "sse"`. |
 | `createInMemoryTransportPair()` | Creates paired streams for in-process tests.                                                                |
 
+Legacy SSE mode opens a GET stream and posts messages to the endpoint announced
+by the server. Announced endpoints must remain on the original origin without
+embedded credentials or fragments; endpoint changes close the connection.
+Both transports accept the same headers, OAuth provider and response limits.
+
 ## OAuth HTTP support
 
 `HttpTransport` accepts `oauth` options from `mcp-oauth`. When a protected server returns a Bearer `WWW-Authenticate` challenge, the transport discovers protected-resource metadata, loads authorization-server metadata, lets the OAuth provider handle authorization, and retries the request when credentials are available.

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -585,6 +585,8 @@ interface StdioTransportOptions {
 type HttpTransportFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
 interface HttpTransportOptions {
     url: string;
+    /** Legacy SSE uses a GET stream that announces the RPC POST endpoint. */
+    mode?: "streamable-http" | "sse";
     headers?: RequestInit["headers"];
     fetch?: HttpTransportFetch;
     oauth?: OAuthClientProviderOptions;
@@ -610,6 +612,11 @@ declare class HttpTransport implements McpTransport {
     readonly writable: Writable;
     readonly closed: Promise<McpTransportClosedEvent>;
     private readonly url;
+    private readonly mode;
+    private legacyEndpoint;
+    private legacyEndpointReady;
+    private resolveLegacyEndpoint;
+    private rejectLegacyEndpoint;
     private readonly headers;
     private readonly fetchImpl;
     private readonly readStream;
@@ -628,7 +635,7 @@ declare class HttpTransport implements McpTransport {
     private readonly maxResponseBytes;
     private readonly toolParameterHeaders;
     private readonly onWarning;
-    constructor({ url, headers, fetch: fetchImpl, oauth, oauthDiscoveryCache, onWarning, maxResponseBytes, }: HttpTransportOptions);
+    constructor({ url, mode, headers, fetch: fetchImpl, oauth, oauthDiscoveryCache, onWarning, maxResponseBytes, }: HttpTransportOptions);
     filterTools(tools: Tool[], reset?: boolean): Tool[];
     dispose(reason?: Error): void;
     private closeWithSessionTermination;
@@ -643,6 +650,7 @@ declare class HttpTransport implements McpTransport {
     private authorizeRequestHeaders;
     private captureSessionId;
     private maybeOpenGetSseStream;
+    private ensureLegacyEndpoint;
     private sendSessionTerminationRequest;
     private consumeGetSseStream;
     private throwForPostHttpError;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -6615,6 +6615,11 @@ var HttpTransport = class {
   writable;
   closed;
   url;
+  mode;
+  legacyEndpoint;
+  legacyEndpointReady;
+  resolveLegacyEndpoint;
+  rejectLegacyEndpoint;
   headers;
   fetchImpl;
   readStream = new PassThrough();
@@ -6635,6 +6640,7 @@ var HttpTransport = class {
   onWarning;
   constructor({
     url,
+    mode = "streamable-http",
     headers = {},
     fetch: fetchImpl = defaultHttpTransportFetch,
     oauth,
@@ -6646,6 +6652,7 @@ var HttpTransport = class {
       throw new Error("HTTP response byte limit must be a positive safe integer");
     this.maxResponseBytes = maxResponseBytes;
     this.url = url;
+    this.mode = mode;
     this.headers = headers;
     this.fetchImpl = fetchImpl;
     this.onWarning = onWarning;
@@ -6690,6 +6697,9 @@ var HttpTransport = class {
       return;
     }
     this.disposed = true;
+    this.rejectLegacyEndpoint?.(reason);
+    this.rejectLegacyEndpoint = void 0;
+    this.resolveLegacyEndpoint = void 0;
     this.toolParameterHeaders.clear();
     this.abortInFlightFetches();
     this.cancelOpenResponseReaders();
@@ -6793,8 +6803,10 @@ var HttpTransport = class {
     const id = parsed.type === "request" ? parsed.message.id : void 0;
     if (controller !== void 0 && id !== void 0) this.modernRequests.set(id, controller);
     try {
+      const postUrl = this.mode === "sse" ? await this.ensureLegacyEndpoint() : this.url;
       const hasSessionId = !modern && this.sessionId !== void 0;
       const response = await this.fetchWithOAuthRetry({
+        url: postUrl,
         method: "POST",
         createHeaders: () => this.createPostHeaders(message, modern),
         body: line,
@@ -6820,7 +6832,7 @@ var HttpTransport = class {
         void response.body?.cancel().catch(() => void 0);
         return;
       }
-      if (!modern) {
+      if (!modern && this.mode !== "sse") {
         this.captureSessionId(response);
         this.maybeOpenGetSseStream();
       }
@@ -6916,6 +6928,17 @@ var HttpTransport = class {
       this.dispose(error instanceof Error ? error : new Error(String(error)));
     });
   }
+  ensureLegacyEndpoint() {
+    if (this.legacyEndpointReady !== void 0) return this.legacyEndpointReady;
+    this.legacyEndpointReady = new Promise((resolve, reject) => {
+      this.resolveLegacyEndpoint = resolve;
+      this.rejectLegacyEndpoint = reject;
+    });
+    void this.consumeGetSseStream().catch((error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+    return this.legacyEndpointReady;
+  }
   async sendSessionTerminationRequest(sessionId, signal) {
     const headers = await this.createDeleteHeaders(sessionId);
     signal.throwIfAborted();
@@ -6964,10 +6987,15 @@ var HttpTransport = class {
     const contentType = response.headers.get("Content-Type");
     if (contentType === null) {
       void response.body?.cancel().catch(() => void 0);
+      if (this.mode === "sse") throw new Error("Legacy SSE GET returned an unsupported content type");
       return;
     }
     if (contentType.split(";")[0]?.trim().toLowerCase() === "text/event-stream") {
-      await this.forwardSseResponseMessages(response);
+      await this.forwardSseResponseMessages(response, void 0, void 0, this.mode === "sse");
+      if (this.mode === "sse") {
+        if (!this.disposed) throw new Error("Legacy SSE stream ended");
+        return;
+      }
       this.getSseStreamStarted = false;
       if (!this.disposed && this.sessionId !== void 0 && this.lastEventId !== void 0) {
         this.maybeOpenGetSseStream();
@@ -6975,6 +7003,7 @@ var HttpTransport = class {
       return;
     }
     void response.body?.cancel().catch(() => void 0);
+    if (this.mode === "sse") throw new Error("Legacy SSE GET returned an unsupported content type");
   }
   async throwForPostHttpError(response, request, signal) {
     if (response.status < 400) {
@@ -7074,11 +7103,11 @@ var HttpTransport = class {
     void response.body?.cancel().catch(() => void 0);
     throw new Error("HTTP transport POST returned an unsupported response content type");
   }
-  async forwardSseResponseMessages(response, signal, context) {
+  async forwardSseResponseMessages(response, signal, context, acceptEndpoint = false) {
     if (response.body === null) {
       return;
     }
-    const parser = new SseParser(this.maxResponseBytes);
+    const parser = new SseParser(this.maxResponseBytes, acceptEndpoint);
     const decoder = new TextDecoder("utf-8", { fatal: true });
     const reader = response.body.getReader();
     this.openResponseReaders.add(reader);
@@ -7142,6 +7171,19 @@ var HttpTransport = class {
   }
   writeSseMessages(messages, context) {
     for (const message of messages) {
+      if (message.event === "endpoint") {
+        const endpoint = new URL(message.data, this.url);
+        const resource = new URL(this.url);
+        if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:" || endpoint.origin !== resource.origin || endpoint.username || endpoint.password || endpoint.hash)
+          throw new Error("Unsafe legacy SSE endpoint");
+        if (this.legacyEndpoint !== void 0 && this.legacyEndpoint !== endpoint.href)
+          throw new Error("Legacy SSE endpoint changed during the active connection");
+        this.legacyEndpoint = endpoint.href;
+        this.resolveLegacyEndpoint?.(endpoint.href);
+        this.resolveLegacyEndpoint = void 0;
+        this.rejectLegacyEndpoint = void 0;
+        continue;
+      }
       this.writeReadableLine(context?.validate(message.data, true) ?? message.data);
       if (context?.completed) return;
     }
@@ -7155,7 +7197,7 @@ var HttpTransport = class {
   }
   async fetchWithOAuthRetry(input) {
     const request = async () => this.fetchWithAbort(
-      this.url,
+      input.url ?? this.url,
       {
         method: input.method,
         headers: await input.createHeaders(),
@@ -7252,12 +7294,14 @@ async function* readLines(stream, maxLineBytes = 16 * 1024 * 1024) {
   if (parts.length > 0) yield normalizeLine(parts.join(""));
 }
 var SseParser = class {
-  constructor(maxEventBytes = 16 * 1024 * 1024) {
+  constructor(maxEventBytes = 16 * 1024 * 1024, acceptEndpoint = false) {
     this.maxEventBytes = maxEventBytes;
+    this.acceptEndpoint = acceptEndpoint;
     if (!Number.isSafeInteger(maxEventBytes) || maxEventBytes < 1)
       throw new Error("SSE event byte limit must be a positive safe integer");
   }
   maxEventBytes;
+  acceptEndpoint;
   buffer = "";
   skipLf = false;
   eventType;
@@ -7338,13 +7382,14 @@ var SseParser = class {
     if (this.hasEventId) {
       this._lastEventId = this.eventId;
     }
-    if (this.dataLines.length === 0 || eventType !== "message") {
+    if (this.dataLines.length === 0 || eventType !== "message" && !(this.acceptEndpoint && eventType === "endpoint")) {
       this.resetEvent();
       return;
     }
     const message = {
       data: this.dataLines.join("\n")
     };
+    if (eventType === "endpoint") message.event = "endpoint";
     if (this.hasEventId) {
       message.id = this.eventId;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",