tiny-http-mcp-server 0.1.22 → 0.1.24

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.22",
+      "version": "0.1.24",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -41,6 +41,7 @@ const verifier = createJwksTokenVerifier({
   - `mode: "dynamic"` with optional `metadata`
   - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
 - `allowInteractive: false` prevents interactive login while retaining cached tokens and silent refresh
+- `initialGrant: { resource, tokens }` optionally imports an existing Bearer grant for one HTTP resource; requires the original client ID
 - `browser.openBrowser(url)` optional
 - `browser.readLine()` optional
 - `browser.createServer()` optional
@@ -69,7 +70,10 @@ const verifier = createJwksTokenVerifier({
 Fixed redirects support `localhost`, `127.0.0.1`, and `::1` over HTTP. Their
 exact spelling, port, path and query are preserved through registration,
 authorization and code exchange. Credentials, fragments, port zero and reserved
-OAuth callback query parameters are rejected before binding a listener. Omit
+OAuth callback query parameters are rejected before binding a listener.
+`createDefaultOAuthClientProvider` also checks the configured redirect before
+creating the provider. Imported tokens that cannot be sent as HTTP header
+values fail with diagnostics that omit their contents. Omit
 `redirectUri` to allocate a random loopback port. Standalone callback sessions
 accept the same `redirectUri`, `signal` and `timeoutMs` options. Cancellation,
 timeout and explicit close settle pending code waits and release listeners.
@@ -83,6 +87,14 @@ observe the supplied signal and pass it to any work they start.
 Configure `client.metadata.scope` to request a precise scope set; broader
 discovery metadata does not override it.
 
+Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
+`tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
+and optional `scope`. A fresh imported token is used only for its resource.
+Discovery binds an expired or explicitly rejected grant before silent refresh,
+using the original configured client. Persisted sessions take precedence,
+including sessions whose tokens have been cleared; an import cannot revive them.
+Input tokens are copied and invalid expiry values fail before authorization.
+
 `createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
 
 ## Environment Variables

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -2,7 +2,7 @@ import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
 import { createAuthStoreClientStore, createAuthStoreSessionStore } from "./auth-store-session-store.js";
-import { createLoopbackAuthorizationSession } from "./loopback-authorization.js";
+import { createLoopbackAuthorizationSession, loopbackTarget } from "./loopback-authorization.js";
 import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
@@ -15,18 +15,51 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
+    loopbackTarget(options.browser);
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore);
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
     const refreshPromises = new Map();
     const authorizationPromises = new Map();
+    if (options.initialGrant !== undefined) {
+        let resource;
+        try {
+            resource = new URL(options.initialGrant.resource);
+        }
+        catch {
+            throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
+        }
+        if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.hash)
+            throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
+    }
+    const initialGrant = options.initialGrant === undefined ? undefined : {
+        resource: canonicalizeResourceIndicator(options.initialGrant.resource),
+        tokens: normalizeStoredTokens(options.initialGrant.tokens),
+        client: normalizeConfiguredClient(options.client)
+    };
+    if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
+        throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+    if (initialGrant?.tokens !== undefined) {
+        try {
+            new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
+        }
+        catch {
+            throw new Error("OAuth initial grant access token is not a valid HTTP header value");
+        }
+    }
+    let initialGrantConsumed = false;
     return {
         async authorizeRequest(input) {
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
             const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false, false, input.signal);
             const accessToken = session?.tokens?.accessToken;
+            if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl &&
+                initialGrant.tokens !== undefined && !isExpired(initialGrant.tokens, now)) {
+                input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
+                return;
+            }
             if (session === null ||
                 accessToken === undefined ||
                 session.tokens === undefined ||
@@ -42,7 +75,7 @@ export function createDefaultOAuthClientProvider(options) {
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
                 assertRequestMatchesResource(requestUrl, resource);
-                const forceRefresh = hasCachedAccessToken(await loadSession(resource)) &&
+                const forceRefresh = (hasCachedAccessToken(await loadSession(resource)) || (!initialGrantConsumed && initialGrant?.resource === resource)) &&
                     input.challenge?.params.error === "invalid_token";
                 const session = await ensureAuthorizedSession(resource, {
                     ...input.discovery,
@@ -66,6 +99,8 @@ export function createDefaultOAuthClientProvider(options) {
         signal?.throwIfAborted();
         const canonicalResource = canonicalizeResourceIndicator(resource);
         let session = await loadSession(canonicalResource);
+        if (session !== null && initialGrant?.resource === canonicalResource)
+            initialGrantConsumed = true;
         signal?.throwIfAborted();
         if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
             throw new Error("OAuth discovery authorization-server issuer mismatch");
@@ -76,6 +111,15 @@ export function createDefaultOAuthClientProvider(options) {
             await clearSession(canonicalResource);
             session = null;
         }
+        if (session === null && discovery !== undefined && !initialGrantConsumed && initialGrant?.resource === canonicalResource &&
+            initialGrant.tokens !== undefined && initialGrant.client !== null) {
+            assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+            session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
+                client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
+            await saveSession(canonicalResource, session);
+            initialGrantConsumed = true;
+            signal?.throwIfAborted();
+        }
         const sessionDiscovery = resolveDiscovery(discovery, session);
         if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
             return session;

package/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -21,5 +21,10 @@ export interface LoopbackAuthorizationSession {
     close(): void;
 }
 export declare function createLoopbackAuthorizationSession(options?: LoopbackAuthorizationOptions): Promise<LoopbackAuthorizationSession>;
+export declare function loopbackTarget(options: LoopbackAuthorizationOptions): {
+    port: number;
+    host: string;
+    callbackPath: string;
+};
 export declare function extractCodeFromInput(input: string): string | null;
 export declare function buildSuccessPage(landingPage?: OAuthLandingPage): string;

package/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -54,7 +54,7 @@ export async function createLoopbackAuthorizationSession(options = {}) {
         }
     };
 }
-function loopbackTarget(options) {
+export function loopbackTarget(options) {
     if (options.redirectUri !== undefined) {
         let url;
         try {

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -99,6 +99,11 @@ export interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Import an existing grant for one resource. Persisted sessions take precedence. */
+    initialGrant?: {
+        resource: string;
+        tokens: StoredOAuthTokens;
+    };
     browser: {
         openBrowser?(url: string): Promise<void>;
         /** Exact registered HTTP loopback redirect URI. */

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -176,6 +176,11 @@ interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Import an existing grant for one resource. Persisted sessions take precedence. */
+    initialGrant?: {
+        resource: string;
+        tokens: StoredOAuthTokens;
+    };
     browser: {
         openBrowser?(url: string): Promise<void>;
         /** Exact registered HTTP loopback redirect URI. */

package/node_modules/tiny-mcp-client/dist/index.js

@@ -152,11 +152,17 @@ var HttpResponseMessages = class {
 };
 
 // ../toolcraft-schema/dist/json.js
-function isJsonValue(value) {
+function isJsonValue(value, options = {}) {
+  const maxNodes = options.maxNodes ?? 1e4;
+  const maxDepth = options.maxDepth ?? 64;
+  if (!Number.isSafeInteger(maxNodes) || maxNodes < 1)
+    throw new Error("maxNodes must be a positive safe integer");
+  if (!Number.isSafeInteger(maxDepth) || maxDepth < 0 || maxDepth > 256)
+    throw new Error("maxDepth must be an integer between 0 and 256");
   const ancestors = /* @__PURE__ */ new Set();
   let nodes = 0;
   const visit = (item, depth) => {
-    if (++nodes > 1e4 || depth > 64)
+    if (++nodes > maxNodes || depth > maxDepth)
       return false;
     if (item === null || typeof item === "string" || typeof item === "boolean")
       return true;
@@ -182,7 +188,7 @@ function isJsonValue(value) {
     ancestors.add(item);
     let valid = true;
     if (Array.isArray(item)) {
-      if (item.length > 1e4)
+      if (item.length > maxNodes)
         valid = false;
       else
         for (let index = 0; index < item.length; index++) {
@@ -4588,18 +4594,48 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
+  loopbackTarget(options.browser);
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore);
   const now = options.now ?? Date.now;
   const registeredClients = /* @__PURE__ */ new Map();
   const refreshPromises = /* @__PURE__ */ new Map();
   const authorizationPromises = /* @__PURE__ */ new Map();
+  if (options.initialGrant !== void 0) {
+    let resource;
+    try {
+      resource = new URL2(options.initialGrant.resource);
+    } catch {
+      throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
+    }
+    if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.hash)
+      throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
+  }
+  const initialGrant = options.initialGrant === void 0 ? void 0 : {
+    resource: canonicalizeResourceIndicator(options.initialGrant.resource),
+    tokens: normalizeStoredTokens(options.initialGrant.tokens),
+    client: normalizeConfiguredClient(options.client)
+  };
+  if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
+    throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+  if (initialGrant?.tokens !== void 0) {
+    try {
+      new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
+    } catch {
+      throw new Error("OAuth initial grant access token is not a valid HTTP header value");
+    }
+  }
+  let initialGrantConsumed = false;
   return {
     async authorizeRequest(input) {
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
       const session = await ensureAuthorizedSession(requestUrl, void 0, input.fetch, false, false, input.signal);
       const accessToken = session?.tokens?.accessToken;
+      if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl && initialGrant.tokens !== void 0 && !isExpired(initialGrant.tokens, now)) {
+        input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
+        return;
+      }
       if (session === null || accessToken === void 0 || session.tokens === void 0 || isExpired(session.tokens, now)) {
         return;
       }
@@ -4612,7 +4648,7 @@ function createDefaultOAuthClientProvider(options) {
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
-        const forceRefresh = hasCachedAccessToken(await loadSession(resource)) && input.challenge?.params.error === "invalid_token";
+        const forceRefresh = (hasCachedAccessToken(await loadSession(resource)) || !initialGrantConsumed && initialGrant?.resource === resource) && input.challenge?.params.error === "invalid_token";
         const session = await ensureAuthorizedSession(resource, {
           ...input.discovery,
           resource
@@ -4634,6 +4670,8 @@ function createDefaultOAuthClientProvider(options) {
     signal?.throwIfAborted();
     const canonicalResource = canonicalizeResourceIndicator(resource);
     let session = await loadSession(canonicalResource);
+    if (session !== null && initialGrant?.resource === canonicalResource)
+      initialGrantConsumed = true;
     signal?.throwIfAborted();
     if (discovery !== void 0 && getOwnString2(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
       throw new Error("OAuth discovery authorization-server issuer mismatch");
@@ -4642,6 +4680,19 @@ function createDefaultOAuthClientProvider(options) {
       await clearSession(canonicalResource);
       session = null;
     }
+    if (session === null && discovery !== void 0 && !initialGrantConsumed && initialGrant?.resource === canonicalResource && initialGrant.tokens !== void 0 && initialGrant.client !== null) {
+      assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+      session = {
+        resource: canonicalResource,
+        authorizationServer: discovery.authorizationServer,
+        client: initialGrant.client,
+        tokens: initialGrant.tokens,
+        discovery: toStoredDiscovery(discovery)
+      };
+      await saveSession(canonicalResource, session);
+      initialGrantConsumed = true;
+      signal?.throwIfAborted();
+    }
     const sessionDiscovery = resolveDiscovery(discovery, session);
     if (session?.tokens !== void 0 && !forceRefresh && !isExpired(session.tokens, now)) {
       return session;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",