tiny-http-mcp-server 0.1.52 → 0.1.53

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.52",
+      "version": "0.1.53",
       "license": "MIT"
     },
     {

package/node_modules/tiny-mcp-client/README.md

@@ -23,8 +23,14 @@ await client.close();
 ```
 
 Omit `protocolVersion` for automatic modern discovery and legacy negotiation.
-Set it to `"2025-03-26"` or `"2026-07-28"` to pin a protocol. A modern pin
+Set it to `"2025-03-26"`, `"2025-06-18"`, `"2025-11-25"` or `"2026-07-28"`
+to pin a protocol. `McpProtocolVersion` and the immutable
+`MCP_PROTOCOL_VERSIONS` list expose these supported revisions. A modern pin
 rejects failed or timed-out discovery without sending legacy initialization.
+Legacy pins skip modern discovery and require the selected revision to match.
+Automatic legacy negotiation still offers `2025-03-26` and accepts any supported
+legacy revision selected by the server. Subsequent HTTP POST, GET and DELETE
+requests use that selected revision, including endpoints without session IDs.
 Unsupported pins fail before connection setup.
 
 `Tool` includes MCP `outputSchema` when a server advertises typed tool output.

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -384,11 +384,13 @@ interface ElicitationResult {
     action: "accept" | "decline" | "cancel";
     content?: Record<string, string | number | boolean | string[]>;
 }
+declare const MCP_PROTOCOL_VERSIONS: readonly ["2025-03-26", "2025-06-18", "2025-11-25", "2026-07-28"];
+type McpProtocolVersion = typeof MCP_PROTOCOL_VERSIONS[number];
 interface McpClientOptions {
     clientInfo: Implementation;
     requestTimeoutMs?: number;
     maxConcurrentRequests?: number;
-    protocolVersion?: "2025-03-26" | "2026-07-28";
+    protocolVersion?: McpProtocolVersion;
     capabilities?: ClientCapabilities;
     onToolsChanged?: () => void | Promise<void>;
     onResourcesChanged?: () => void | Promise<void>;
@@ -655,6 +657,7 @@ interface McpTransport {
     completeInitialization?(options: {
         signal?: AbortSignal;
         timeoutMs: number;
+        protocolVersion?: string;
     }): Promise<void>;
 }
 interface InMemoryServerTransport {
@@ -734,6 +737,8 @@ declare class HttpTransport implements McpTransport {
     private readonly writeStream;
     private resolveClosed;
     private sessionId;
+    private legacyProtocolVersion;
+    private initializationRequestId;
     private lastEventId;
     private getSseStreamStarted;
     private disposed;
@@ -752,6 +757,7 @@ declare class HttpTransport implements McpTransport {
     completeInitialization(options: {
         signal?: AbortSignal;
         timeoutMs: number;
+        protocolVersion?: string;
     }): Promise<void>;
     filterTools(tools: Tool[], reset?: boolean): Tool[];
     dispose(reason?: Error): void;
@@ -860,5 +866,5 @@ declare class JsonRpcMessageLayer {
     private handleCancellationNotification;
 }
 
-export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse };
-export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };
+export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, MCP_PROTOCOL_VERSIONS, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse };
+export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpProtocolVersion, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };

package/node_modules/tiny-mcp-client/dist/index.js

@@ -6642,6 +6642,7 @@ var inputResponseTypes = {
   "sampling/createMessage": "CreateMessageResult",
   "elicitation/create": "ElicitResult"
 };
+var MCP_PROTOCOL_VERSIONS = Object.freeze(["2025-03-26", "2025-06-18", "2025-11-25", "2026-07-28"]);
 var MCP_PROTOCOL_VERSION = "2025-03-26";
 var McpClient = class {
   currentState = "disconnected";
@@ -6685,8 +6686,8 @@ var McpClient = class {
   }
   async connect(transport, options = {}) {
     options.signal?.throwIfAborted();
-    if (this.options.protocolVersion !== void 0 && this.options.protocolVersion !== MCP_PROTOCOL_VERSION && this.options.protocolVersion !== "2026-07-28")
-      throw new Error("Unsupported protocolVersion; use 2025-03-26 or 2026-07-28");
+    if (this.options.protocolVersion !== void 0 && !MCP_PROTOCOL_VERSIONS.includes(this.options.protocolVersion))
+      throw new Error(`Unsupported protocolVersion; use ${MCP_PROTOCOL_VERSIONS.join(", ")}`);
     if (this.currentState !== "disconnected" && this.currentState !== "closed") {
       throw new Error("MCP client is already connected");
     }
@@ -6855,7 +6856,7 @@ var McpClient = class {
       }
       let discovery;
       try {
-        if (this.options.protocolVersion !== "2025-03-26") discovery = await messageLayer.sendRequest("server/discover", {
+        if (this.options.protocolVersion === void 0 || this.options.protocolVersion === "2026-07-28") discovery = await messageLayer.sendRequest("server/discover", {
           _meta: {
             "io.modelcontextprotocol/protocolVersion": "2026-07-28",
             "io.modelcontextprotocol/clientCapabilities": capabilities
@@ -6907,7 +6908,7 @@ var McpClient = class {
         };
       }
       const initializeResultValue = await messageLayer.sendRequest("initialize", {
-        protocolVersion: MCP_PROTOCOL_VERSION,
+        protocolVersion: this.options.protocolVersion ?? MCP_PROTOCOL_VERSION,
         clientInfo: this.options.clientInfo,
         capabilities
       }, { signal: options.signal });
@@ -6915,12 +6916,14 @@ var McpClient = class {
         throw new McpError(ERROR_INVALID_REQUEST, "Invalid initialize result");
       }
       const initializeResult = initializeResultValue;
-      if (initializeResult.protocolVersion !== MCP_PROTOCOL_VERSION) {
+      if (initializeResult.protocolVersion === "2026-07-28" || !MCP_PROTOCOL_VERSIONS.includes(initializeResult.protocolVersion)) {
         throw new McpError(
           ERROR_INVALID_REQUEST,
           `Unsupported protocol version: ${initializeResult.protocolVersion}`
         );
       }
+      if (this.options.protocolVersion !== void 0 && initializeResult.protocolVersion !== this.options.protocolVersion)
+        throw new McpError(ERROR_INVALID_REQUEST, `Pinned protocol version ${this.options.protocolVersion} rejected: server selected ${initializeResult.protocolVersion}`);
       this.currentServerCapabilities = structuredClone(initializeResult.capabilities);
       this.currentServerInfo = structuredClone(initializeResult.serverInfo);
       this.currentInstructions = initializeResult.instructions;
@@ -6936,7 +6939,7 @@ var McpClient = class {
         );
       }
       if (transport.completeInitialization === void 0) messageLayer.sendNotification("notifications/initialized");
-      else await transport.completeInitialization({ signal: options.signal, timeoutMs: this.options.requestTimeoutMs ?? 3e4 });
+      else await transport.completeInitialization({ signal: options.signal, timeoutMs: this.options.requestTimeoutMs ?? 3e4, protocolVersion: initializeResult.protocolVersion });
       this.currentState = "ready";
       return initializeResult;
     } catch (error) {
@@ -7568,6 +7571,8 @@ var HttpTransport = class {
   writeStream = new PassThrough();
   resolveClosed;
   sessionId;
+  legacyProtocolVersion;
+  initializationRequestId;
   lastEventId;
   getSseStreamStarted = false;
   disposed = false;
@@ -7626,6 +7631,8 @@ var HttpTransport = class {
     const signals = [options.signal, deadline].filter((signal2) => signal2 !== void 0);
     const signal = signals.length === 0 ? new AbortController().signal : AbortSignal.any(signals);
     signal.throwIfAborted();
+    if (options.protocolVersion !== void 0) this.legacyProtocolVersion = options.protocolVersion;
+    this.maybeOpenGetSseStream();
     try {
       await this.sendPost(serializeJsonRpcMessage({ jsonrpc: "2.0", method: "notifications/initialized" }), signal);
       signal.throwIfAborted();
@@ -7754,8 +7761,13 @@ var HttpTransport = class {
     const metadata = isObjectRecord5(message?.params) ? message.params._meta : void 0;
     const modern = isObjectRecord5(metadata) && typeof metadata["io.modelcontextprotocol/protocolVersion"] === "string";
     if (modern) this.modernMode = true;
-    if (parsed.type === "request" && parsed.message.method === "initialize")
+    if (parsed.type === "request" && parsed.message.method === "initialize") {
       this.modernMode = false;
+      this.initializationRequestId = parsed.message.id;
+      this.legacyProtocolVersion = MCP_PROTOCOL_VERSION;
+      if (isObjectRecord5(parsed.message.params) && typeof parsed.message.params.protocolVersion === "string")
+        this.legacyProtocolVersion = parsed.message.params.protocolVersion;
+    }
     if (this.modernMode && parsed.type === "notification" && parsed.message.method === "notifications/cancelled") {
       const requestId = isObjectRecord5(parsed.message.params) ? parsed.message.params.requestId : void 0;
       if (typeof requestId === "string" || typeof requestId === "number")
@@ -7800,10 +7812,12 @@ var HttpTransport = class {
       }
       if (!modern && this.mode !== "sse") {
         this.captureSessionId(response);
-        this.maybeOpenGetSseStream();
+        if (message?.method !== "initialize") this.maybeOpenGetSseStream();
       }
-      if (controller !== void 0) await this.forwardResponseMessages(response, controller.signal, parsed.type === "request" ? new HttpResponseMessages(parsed.message) : void 0);
-      else
+      if (controller !== void 0 || message?.method === "initialize") {
+        await this.forwardResponseMessages(response, controller?.signal, controller === void 0 || parsed.type !== "request" ? void 0 : new HttpResponseMessages(parsed.message), message?.method === "initialize");
+        if (message?.method === "initialize") this.maybeOpenGetSseStream();
+      } else
         void this.forwardResponseMessages(response).catch((error) => {
           this.dispose(error instanceof Error ? error : new Error(String(error)));
         });
@@ -7843,8 +7857,9 @@ var HttpTransport = class {
       }
     } else if (this.sessionId !== void 0) {
       headers.set("Mcp-Session-Id", this.sessionId);
-      headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
     }
+    if (!modern && message?.method !== "initialize" && this.legacyProtocolVersion !== void 0)
+      headers.set("MCP-Protocol-Version", this.legacyProtocolVersion);
     return this.authorizeRequestHeaders(headers, signal);
   }
   async createGetHeaders(signal) {
@@ -7852,8 +7867,8 @@ var HttpTransport = class {
     headers.set("Accept", "text/event-stream");
     if (this.sessionId !== void 0) {
       headers.set("Mcp-Session-Id", this.sessionId);
-      headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
     }
+    if (this.legacyProtocolVersion !== void 0) headers.set("MCP-Protocol-Version", this.legacyProtocolVersion);
     if (this.lastEventId !== void 0) {
       headers.set("Last-Event-ID", this.lastEventId);
     }
@@ -7862,7 +7877,7 @@ var HttpTransport = class {
   async createDeleteHeaders(sessionId, signal) {
     const headers = new Headers(this.headers);
     headers.set("Mcp-Session-Id", sessionId);
-    headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
+    headers.set("MCP-Protocol-Version", this.legacyProtocolVersion ?? MCP_PROTOCOL_VERSION);
     return this.authorizeRequestHeaders(headers, signal);
   }
   async authorizeRequestHeaders(headers, signal) {
@@ -7966,7 +7981,7 @@ var HttpTransport = class {
       return;
     }
     if (contentType.split(";")[0]?.trim().toLowerCase() === "text/event-stream") {
-      await this.forwardSseResponseMessages(response, void 0, void 0, this.mode === "sse");
+      await this.forwardSseResponseMessages(response, void 0, void 0, { acceptEndpoint: this.mode === "sse" });
       if (this.mode === "sse") {
         if (!this.disposed) throw new Error("Legacy SSE stream ended");
         return;
@@ -8063,7 +8078,7 @@ var HttpTransport = class {
       throw error;
     }
   }
-  async forwardResponseMessages(response, signal, context) {
+  async forwardResponseMessages(response, signal, context, initialization = false) {
     if (response.status === 202) {
       void response.body?.cancel().catch(() => void 0);
       return;
@@ -8075,7 +8090,7 @@ var HttpTransport = class {
     }
     const normalizedContentType = contentType.split(";")[0]?.trim().toLowerCase();
     if (normalizedContentType === "text/event-stream") {
-      await this.forwardSseResponseMessages(response, signal, context);
+      await this.forwardSseResponseMessages(response, signal, context, { stopAfterInitialization: initialization });
       return;
     }
     if (normalizedContentType === "application/json") {
@@ -8085,11 +8100,11 @@ var HttpTransport = class {
     void response.body?.cancel().catch(() => void 0);
     throw new Error("HTTP transport POST returned an unsupported response content type");
   }
-  async forwardSseResponseMessages(response, signal, context, acceptEndpoint = false) {
+  async forwardSseResponseMessages(response, signal, context, options = {}) {
     if (response.body === null) {
       return;
     }
-    const parser = new SseParser(this.maxResponseBytes, acceptEndpoint);
+    const parser = new SseParser(this.maxResponseBytes, options.acceptEndpoint);
     const decoder = new TextDecoder("utf-8", { fatal: true });
     const reader = response.body.getReader();
     this.openResponseReaders.add(reader);
@@ -8110,7 +8125,7 @@ var HttpTransport = class {
         }
         const messages = parser.push(decoder.decode(value, { stream: true }));
         this.writeSseMessages(messages, context);
-        if (context?.completed) {
+        if (context?.completed || options.stopAfterInitialization && this.initializationRequestId === void 0) {
           void reader.cancel().catch(() => void 0);
           return;
         }
@@ -8174,6 +8189,21 @@ var HttpTransport = class {
     if (this.disposed || this.readStream.destroyed || this.readStream.writableEnded) {
       return;
     }
+    if (this.initializationRequestId !== void 0) {
+      try {
+        const payload = JSON.parse(line);
+        for (const response of Array.isArray(payload) ? payload : [payload]) {
+          if (!isObjectRecord5(response) || response.id !== this.initializationRequestId || !isObjectRecord5(response.result)) continue;
+          const version = response.result.protocolVersion;
+          if (typeof version === "string" && version !== "2026-07-28" && MCP_PROTOCOL_VERSIONS.includes(version))
+            this.legacyProtocolVersion = version;
+          this.initializationRequestId = void 0;
+          this.maybeOpenGetSseStream();
+          break;
+        }
+      } catch {
+      }
+    }
     this.readStream.write(`${line}
 `);
   }
@@ -9114,6 +9144,7 @@ export {
   HttpTransport,
   HttpTransportError,
   JsonRpcMessageLayer,
+  MCP_PROTOCOL_VERSIONS,
   McpClient,
   McpError,
   OAuthMetadataDiscovery,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.52",
+  "version": "0.1.53",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",