tiny-http-mcp-server 0.1.19 → 0.1.21

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "license": "MIT"
     },
     {

package/node_modules/tiny-mcp-client/README.md

@@ -1,6 +1,6 @@
 # tiny-mcp-client
 
-`tiny-mcp-client` is a lightweight Model Context Protocol client used by tests, fixtures, and package integrations. It supports stdio transports, streamable HTTP transports, in-memory test pairs, JSON-RPC helpers, and OAuth metadata discovery for OAuth-protected MCP HTTP servers.
+`tiny-mcp-client` is a lightweight Model Context Protocol client used by tests, fixtures, and package integrations. It supports stdio transports, Streamable HTTP and legacy HTTP/SSE transports, in-memory test pairs, JSON-RPC helpers, and OAuth metadata discovery for OAuth-protected MCP HTTP servers.
 
 ## Usage
 
@@ -29,9 +29,16 @@ await client.close();
 | Transport                       | Description                                                                                                 |
 | ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
 | `StdioTransport`                | Spawns an MCP server process and communicates over stdio.                                                   |
-| `HttpTransport`                 | Connects to streamable HTTP MCP endpoints, including session IDs, SSE GET streams, and session termination. |
+| `HttpTransport`                 | Connects to Streamable HTTP endpoints, or legacy HTTP/SSE with `mode: "sse"`. |
 | `createInMemoryTransportPair()` | Creates paired streams for in-process tests.                                                                |
 
+Legacy SSE mode opens a GET stream and posts messages to the endpoint announced
+by the server. Announced endpoints must remain on the original origin without
+embedded credentials or fragments; endpoint changes close the connection.
+Both transports accept the same headers, OAuth provider and response limits.
+HTTP failures expose `HttpTransportError.status` and `.method`, so callers can
+make transport decisions without parsing error messages.
+
 ## OAuth HTTP support
 
 `HttpTransport` accepts `oauth` options from `mcp-oauth`. When a protected server returns a Bearer `WWW-Authenticate` challenge, the transport discovers protected-resource metadata, loads authorization-server metadata, lets the OAuth provider handle authorization, and retries the request when credentials are available.

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -583,8 +583,15 @@ interface StdioTransportOptions {
     spawn?: StdioSpawn;
 }
 type HttpTransportFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+declare class HttpTransportError extends Error {
+    readonly status: number;
+    readonly method: "GET" | "POST" | "DELETE";
+    constructor(message: string, status: number, method: "GET" | "POST" | "DELETE");
+}
 interface HttpTransportOptions {
     url: string;
+    /** Legacy SSE uses a GET stream that announces the RPC POST endpoint. */
+    mode?: "streamable-http" | "sse";
     headers?: RequestInit["headers"];
     fetch?: HttpTransportFetch;
     oauth?: OAuthClientProviderOptions;
@@ -610,6 +617,11 @@ declare class HttpTransport implements McpTransport {
     readonly writable: Writable;
     readonly closed: Promise<McpTransportClosedEvent>;
     private readonly url;
+    private readonly mode;
+    private legacyEndpoint;
+    private legacyEndpointReady;
+    private resolveLegacyEndpoint;
+    private rejectLegacyEndpoint;
     private readonly headers;
     private readonly fetchImpl;
     private readonly readStream;
@@ -628,7 +640,7 @@ declare class HttpTransport implements McpTransport {
     private readonly maxResponseBytes;
     private readonly toolParameterHeaders;
     private readonly onWarning;
-    constructor({ url, headers, fetch: fetchImpl, oauth, oauthDiscoveryCache, onWarning, maxResponseBytes, }: HttpTransportOptions);
+    constructor({ url, mode, headers, fetch: fetchImpl, oauth, oauthDiscoveryCache, onWarning, maxResponseBytes, }: HttpTransportOptions);
     filterTools(tools: Tool[], reset?: boolean): Tool[];
     dispose(reason?: Error): void;
     private closeWithSessionTermination;
@@ -643,6 +655,7 @@ declare class HttpTransport implements McpTransport {
     private authorizeRequestHeaders;
     private captureSessionId;
     private maybeOpenGetSseStream;
+    private ensureLegacyEndpoint;
     private sendSessionTerminationRequest;
     private consumeGetSseStream;
     private throwForPostHttpError;
@@ -735,5 +748,5 @@ declare class JsonRpcMessageLayer {
     private handleCancellationNotification;
 }
 
-export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, JsonRpcMessageLayer, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse };
+export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse };
 export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };

package/node_modules/tiny-mcp-client/dist/index.js

@@ -6505,6 +6505,16 @@ async function createTestPair(server, createClient) {
   };
   return { client, cleanup };
 }
+var HttpTransportError = class extends Error {
+  constructor(message, status, method) {
+    super(message);
+    this.status = status;
+    this.method = method;
+    this.name = "HttpTransportError";
+  }
+  status;
+  method;
+};
 function defaultStdioSpawn(command, args, options) {
   return spawn2(command, args, options);
 }
@@ -6615,6 +6625,11 @@ var HttpTransport = class {
   writable;
   closed;
   url;
+  mode;
+  legacyEndpoint;
+  legacyEndpointReady;
+  resolveLegacyEndpoint;
+  rejectLegacyEndpoint;
   headers;
   fetchImpl;
   readStream = new PassThrough();
@@ -6635,6 +6650,7 @@ var HttpTransport = class {
   onWarning;
   constructor({
     url,
+    mode = "streamable-http",
     headers = {},
     fetch: fetchImpl = defaultHttpTransportFetch,
     oauth,
@@ -6646,6 +6662,7 @@ var HttpTransport = class {
       throw new Error("HTTP response byte limit must be a positive safe integer");
     this.maxResponseBytes = maxResponseBytes;
     this.url = url;
+    this.mode = mode;
     this.headers = headers;
     this.fetchImpl = fetchImpl;
     this.onWarning = onWarning;
@@ -6690,6 +6707,9 @@ var HttpTransport = class {
       return;
     }
     this.disposed = true;
+    this.rejectLegacyEndpoint?.(reason);
+    this.rejectLegacyEndpoint = void 0;
+    this.resolveLegacyEndpoint = void 0;
     this.toolParameterHeaders.clear();
     this.abortInFlightFetches();
     this.cancelOpenResponseReaders();
@@ -6793,8 +6813,10 @@ var HttpTransport = class {
     const id = parsed.type === "request" ? parsed.message.id : void 0;
     if (controller !== void 0 && id !== void 0) this.modernRequests.set(id, controller);
     try {
+      const postUrl = this.mode === "sse" ? await this.ensureLegacyEndpoint() : this.url;
       const hasSessionId = !modern && this.sessionId !== void 0;
       const response = await this.fetchWithOAuthRetry({
+        url: postUrl,
         method: "POST",
         createHeaders: () => this.createPostHeaders(message, modern),
         body: line,
@@ -6807,7 +6829,7 @@ var HttpTransport = class {
       if (hasSessionId && response.status === 404) {
         void response.body?.cancel().catch(() => void 0);
         this.sessionId = void 0;
-        this.dispose(new Error("HTTP transport session expired (404 response)"));
+        this.dispose(new HttpTransportError("HTTP transport session expired (404 response)", 404, "POST"));
         return;
       }
       if (await this.throwForPostHttpError(
@@ -6820,7 +6842,7 @@ var HttpTransport = class {
         void response.body?.cancel().catch(() => void 0);
         return;
       }
-      if (!modern) {
+      if (!modern && this.mode !== "sse") {
         this.captureSessionId(response);
         this.maybeOpenGetSseStream();
       }
@@ -6916,6 +6938,17 @@ var HttpTransport = class {
       this.dispose(error instanceof Error ? error : new Error(String(error)));
     });
   }
+  ensureLegacyEndpoint() {
+    if (this.legacyEndpointReady !== void 0) return this.legacyEndpointReady;
+    this.legacyEndpointReady = new Promise((resolve, reject) => {
+      this.resolveLegacyEndpoint = resolve;
+      this.rejectLegacyEndpoint = reject;
+    });
+    void this.consumeGetSseStream().catch((error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+    return this.legacyEndpointReady;
+  }
   async sendSessionTerminationRequest(sessionId, signal) {
     const headers = await this.createDeleteHeaders(sessionId);
     signal.throwIfAborted();
@@ -6935,7 +6968,7 @@ var HttpTransport = class {
     const responseBody = (await readBoundedResponseText(response, this.maxResponseBytes, this.openResponseReaders, signal)).trim();
     const statusDescriptor = `${response.status} ${response.statusText}`.trim();
     const message = responseBody.length === 0 ? `HTTP transport DELETE failed (${statusDescriptor})` : `HTTP transport DELETE failed (${statusDescriptor}): ${responseBody}`;
-    throw new Error(message);
+    throw new HttpTransportError(message, response.status, "DELETE");
   }
   async consumeGetSseStream() {
     const response = await this.fetchWithOAuthRetry({
@@ -6948,26 +6981,32 @@ var HttpTransport = class {
     }
     if (response.status === 405) {
       void response.body?.cancel().catch(() => void 0);
+      if (this.mode === "sse") throw new HttpTransportError("Legacy SSE GET failed (405)", 405, "GET");
       throw new HttpTransportGetSseNotSupportedError();
     }
     if (response.status === 404) {
       void response.body?.cancel().catch(() => void 0);
       this.sessionId = void 0;
-      throw new Error("HTTP transport session expired (GET 404 response)");
+      throw new HttpTransportError("HTTP transport session expired (GET 404 response)", 404, "GET");
     }
     if (!response.ok) {
       const responseBody = (await readBoundedResponseText(response, this.maxResponseBytes, this.openResponseReaders)).trim();
       const statusDescriptor = `${response.status} ${response.statusText}`.trim();
       const message = responseBody.length === 0 ? `HTTP transport GET failed (${statusDescriptor})` : `HTTP transport GET failed (${statusDescriptor}): ${responseBody}`;
-      throw new Error(message);
+      throw new HttpTransportError(message, response.status, "GET");
     }
     const contentType = response.headers.get("Content-Type");
     if (contentType === null) {
       void response.body?.cancel().catch(() => void 0);
+      if (this.mode === "sse") throw new Error("Legacy SSE GET returned an unsupported content type");
       return;
     }
     if (contentType.split(";")[0]?.trim().toLowerCase() === "text/event-stream") {
-      await this.forwardSseResponseMessages(response);
+      await this.forwardSseResponseMessages(response, void 0, void 0, this.mode === "sse");
+      if (this.mode === "sse") {
+        if (!this.disposed) throw new Error("Legacy SSE stream ended");
+        return;
+      }
       this.getSseStreamStarted = false;
       if (!this.disposed && this.sessionId !== void 0 && this.lastEventId !== void 0) {
         this.maybeOpenGetSseStream();
@@ -6975,6 +7014,7 @@ var HttpTransport = class {
       return;
     }
     void response.body?.cancel().catch(() => void 0);
+    if (this.mode === "sse") throw new Error("Legacy SSE GET returned an unsupported content type");
   }
   async throwForPostHttpError(response, request, signal) {
     if (response.status < 400) {
@@ -7014,7 +7054,7 @@ var HttpTransport = class {
     }
     const statusDescriptor = `${response.status} ${response.statusText}`.trim();
     const message = responseBody.length === 0 ? `HTTP transport POST failed (${statusDescriptor})` : `HTTP transport POST failed (${statusDescriptor}): ${responseBody}`;
-    throw new Error(message);
+    throw new HttpTransportError(message, response.status, "POST");
   }
   async maybeHandleUnauthorizedResponse(response) {
     if (response.status !== 401 || this.oauthProvider === void 0) {
@@ -7074,11 +7114,11 @@ var HttpTransport = class {
     void response.body?.cancel().catch(() => void 0);
     throw new Error("HTTP transport POST returned an unsupported response content type");
   }
-  async forwardSseResponseMessages(response, signal, context) {
+  async forwardSseResponseMessages(response, signal, context, acceptEndpoint = false) {
     if (response.body === null) {
       return;
     }
-    const parser = new SseParser(this.maxResponseBytes);
+    const parser = new SseParser(this.maxResponseBytes, acceptEndpoint);
     const decoder = new TextDecoder("utf-8", { fatal: true });
     const reader = response.body.getReader();
     this.openResponseReaders.add(reader);
@@ -7142,6 +7182,19 @@ var HttpTransport = class {
   }
   writeSseMessages(messages, context) {
     for (const message of messages) {
+      if (message.event === "endpoint") {
+        const endpoint = new URL(message.data, this.url);
+        const resource = new URL(this.url);
+        if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:" || endpoint.origin !== resource.origin || endpoint.username || endpoint.password || endpoint.hash)
+          throw new Error("Unsafe legacy SSE endpoint");
+        if (this.legacyEndpoint !== void 0 && this.legacyEndpoint !== endpoint.href)
+          throw new Error("Legacy SSE endpoint changed during the active connection");
+        this.legacyEndpoint = endpoint.href;
+        this.resolveLegacyEndpoint?.(endpoint.href);
+        this.resolveLegacyEndpoint = void 0;
+        this.rejectLegacyEndpoint = void 0;
+        continue;
+      }
       this.writeReadableLine(context?.validate(message.data, true) ?? message.data);
       if (context?.completed) return;
     }
@@ -7155,7 +7208,7 @@ var HttpTransport = class {
   }
   async fetchWithOAuthRetry(input) {
     const request = async () => this.fetchWithAbort(
-      this.url,
+      input.url ?? this.url,
       {
         method: input.method,
         headers: await input.createHeaders(),
@@ -7252,12 +7305,14 @@ async function* readLines(stream, maxLineBytes = 16 * 1024 * 1024) {
   if (parts.length > 0) yield normalizeLine(parts.join(""));
 }
 var SseParser = class {
-  constructor(maxEventBytes = 16 * 1024 * 1024) {
+  constructor(maxEventBytes = 16 * 1024 * 1024, acceptEndpoint = false) {
     this.maxEventBytes = maxEventBytes;
+    this.acceptEndpoint = acceptEndpoint;
     if (!Number.isSafeInteger(maxEventBytes) || maxEventBytes < 1)
       throw new Error("SSE event byte limit must be a positive safe integer");
   }
   maxEventBytes;
+  acceptEndpoint;
   buffer = "";
   skipLf = false;
   eventType;
@@ -7338,13 +7393,14 @@ var SseParser = class {
     if (this.hasEventId) {
       this._lastEventId = this.eventId;
     }
-    if (this.dataLines.length === 0 || eventType !== "message") {
+    if (this.dataLines.length === 0 || eventType !== "message" && !(this.acceptEndpoint && eventType === "endpoint")) {
       this.resetEvent();
       return;
     }
     const message = {
       data: this.dataLines.join("\n")
     };
+    if (eventType === "endpoint") message.event = "endpoint";
     if (this.hasEventId) {
       message.id = this.eventId;
     }
@@ -8078,6 +8134,7 @@ export {
   ERROR_METHOD_NOT_FOUND,
   ERROR_PARSE,
   HttpTransport,
+  HttpTransportError,
   JsonRpcMessageLayer,
   McpClient,
   McpError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",