tiny-http-mcp-server 0.1.23 → 0.1.24

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.23",
+      "version": "0.1.24",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -70,7 +70,10 @@ const verifier = createJwksTokenVerifier({
 Fixed redirects support `localhost`, `127.0.0.1`, and `::1` over HTTP. Their
 exact spelling, port, path and query are preserved through registration,
 authorization and code exchange. Credentials, fragments, port zero and reserved
-OAuth callback query parameters are rejected before binding a listener. Omit
+OAuth callback query parameters are rejected before binding a listener.
+`createDefaultOAuthClientProvider` also checks the configured redirect before
+creating the provider. Imported tokens that cannot be sent as HTTP header
+values fail with diagnostics that omit their contents. Omit
 `redirectUri` to allocate a random loopback port. Standalone callback sessions
 accept the same `redirectUri`, `signal` and `timeoutMs` options. Cancellation,
 timeout and explicit close settle pending code waits and release listeners.

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -2,7 +2,7 @@ import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
 import { createAuthStoreClientStore, createAuthStoreSessionStore } from "./auth-store-session-store.js";
-import { createLoopbackAuthorizationSession } from "./loopback-authorization.js";
+import { createLoopbackAuthorizationSession, loopbackTarget } from "./loopback-authorization.js";
 import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
@@ -15,6 +15,7 @@ export function createOAuthClientProvider(options) {
     return createDefaultOAuthClientProvider(options);
 }
 export function createDefaultOAuthClientProvider(options) {
+    loopbackTarget(options.browser);
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore);
     const now = options.now ?? Date.now;
@@ -39,6 +40,14 @@ export function createDefaultOAuthClientProvider(options) {
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
         throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+    if (initialGrant?.tokens !== undefined) {
+        try {
+            new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
+        }
+        catch {
+            throw new Error("OAuth initial grant access token is not a valid HTTP header value");
+        }
+    }
     let initialGrantConsumed = false;
     return {
         async authorizeRequest(input) {

package/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -21,5 +21,10 @@ export interface LoopbackAuthorizationSession {
     close(): void;
 }
 export declare function createLoopbackAuthorizationSession(options?: LoopbackAuthorizationOptions): Promise<LoopbackAuthorizationSession>;
+export declare function loopbackTarget(options: LoopbackAuthorizationOptions): {
+    port: number;
+    host: string;
+    callbackPath: string;
+};
 export declare function extractCodeFromInput(input: string): string | null;
 export declare function buildSuccessPage(landingPage?: OAuthLandingPage): string;

package/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -54,7 +54,7 @@ export async function createLoopbackAuthorizationSession(options = {}) {
         }
     };
 }
-function loopbackTarget(options) {
+export function loopbackTarget(options) {
     if (options.redirectUri !== undefined) {
         let url;
         try {

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4594,6 +4594,7 @@ function createOAuthClientProvider(options) {
   return createDefaultOAuthClientProvider(options);
 }
 function createDefaultOAuthClientProvider(options) {
+  loopbackTarget(options.browser);
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore);
   const now = options.now ?? Date.now;
@@ -4617,6 +4618,13 @@ function createDefaultOAuthClientProvider(options) {
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
     throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+  if (initialGrant?.tokens !== void 0) {
+    try {
+      new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
+    } catch {
+      throw new Error("OAuth initial grant access token is not a valid HTTP header value");
+    }
+  }
   let initialGrantConsumed = false;
   return {
     async authorizeRequest(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",