toolcraft 0.0.232 → 0.0.234

package/node_modules/tiny-http-mcp-server/dist/http-transport.js

@@ -4,6 +4,7 @@ import { formatErrorResponse, formatSuccessResponse } from "tiny-stdio-mcp-serve
 import { JsonRpcMessageError, readAndClassifyBody } from "./parse-body.js";
 import { createSessionStore, defaultSessionIdGenerator } from "./session.js";
 import { formatSseEvent, SSE_HEADERS } from "./sse.js";
+import { validateModernHeaders } from "./modern-headers.js";
 const ALLOWED_METHODS = "POST, GET, DELETE, OPTIONS";
 const MCP_SESSION_ID_HEADER = "Mcp-Session-Id";
 const LOCAL_HOSTS = ["localhost", "127.0.0.1", "::1"];
@@ -25,6 +26,7 @@ export class StreamableHttpTransport {
     allowedOrigins;
     allowedHosts;
     maxRequestBytes;
+    maxResponseBytes;
     maxBatchSize;
     maxSessions;
     maxSessionsPerSubject;
@@ -45,6 +47,8 @@ export class StreamableHttpTransport {
     responseRequestIds = new WeakMap();
     responseOrigins = new WeakMap();
     responseRejectionReasons = new WeakMap();
+    modernRequests = new Map();
+    modernStreams = new Set();
     nextNotificationEventId = 1;
     nextRequestId = 1;
     activeToolCalls = 0;
@@ -62,10 +66,13 @@ export class StreamableHttpTransport {
         this.allowedHosts = new Set((options.allowedHosts ?? LOCAL_HOSTS).map((host) => this.normalizeHost(host)));
         this.maxRequestBytes = validateOptionalIntegerOption("maxRequestBytes", options.maxRequestBytes, 1);
         this.maxBatchSize = validateOptionalIntegerOption("maxBatchSize", options.maxBatchSize, 1);
+        this.maxResponseBytes = validateOptionalIntegerOption("maxResponseBytes", options.maxResponseBytes, 1) ?? 16 * 1024 * 1024;
         this.maxSessions = validateOptionalIntegerOption("maxSessions", options.maxSessions, 1) ?? 128;
         this.maxSessionsPerSubject =
-            validateOptionalIntegerOption("maxSessionsPerSubject", options.maxSessionsPerSubject, 1) ?? 16;
-        this.sessionTtlMs = validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1) ?? 15 * 60_000;
+            validateOptionalIntegerOption("maxSessionsPerSubject", options.maxSessionsPerSubject, 1) ??
+                16;
+        this.sessionTtlMs =
+            validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1) ?? 15 * 60_000;
         this.maxStreamsPerSession =
             validateOptionalIntegerOption("maxStreamsPerSession", options.maxStreamsPerSession, 1) ?? 1;
         this.maxStreamBufferBytes =
@@ -120,6 +127,12 @@ export class StreamableHttpTransport {
                 this.respondWithRejection(res, 403, "origin_not_allowed", `Origin ${JSON.stringify(this.readOrigin(req) ?? "")} is not allowed; add it to allowedOrigins.`);
                 return;
             }
+            if (req.headers["mcp-protocol-version"] === "2026-07-28" &&
+                req.method !== "POST" &&
+                req.method !== "OPTIONS") {
+                this.respondWithStatus(res, 405, undefined, { Allow: "POST, OPTIONS" });
+                return;
+            }
             switch (req.method) {
                 case "POST":
                     await this.handlePost(req, res);
@@ -172,6 +185,12 @@ export class StreamableHttpTransport {
     }
     async close() {
         this.closed = true;
+        for (const [response, controller] of this.modernRequests) {
+            controller.abort();
+            response.end();
+        }
+        this.modernRequests.clear();
+        this.modernStreams.clear();
         if (this.sessionExpiryInterval !== undefined) {
             clearInterval(this.sessionExpiryInterval);
             this.sessionExpiryInterval = undefined;
@@ -221,6 +240,20 @@ export class StreamableHttpTransport {
             this.respondWithJsonRpcError(res, 400, code, message, id);
             return;
         }
+        const modern = req.headers["mcp-protocol-version"] === "2026-07-28" ||
+            classified.messages.some((message) => {
+                if (!("method" in message))
+                    return false;
+                const metadata = message.params?._meta;
+                return (message.method === "server/discover" ||
+                    (typeof metadata === "object" &&
+                        metadata !== null &&
+                        Object.prototype.hasOwnProperty.call(metadata, "io.modelcontextprotocol/protocolVersion")));
+            });
+        if (modern) {
+            await this.handleModernPost(req, res, classified);
+            return;
+        }
         const initMessage = classified.messages.find((message) => this.isRequest(message) && message.method === "initialize");
         let sessionId;
         let activeSession;
@@ -237,7 +270,8 @@ export class StreamableHttpTransport {
                     return;
                 }
                 const authSubject = this.readAuthSubject(req);
-                if (authSubject !== undefined && this.sessionCount(authSubject) >= this.maxSessionsPerSubject) {
+                if (authSubject !== undefined &&
+                    this.sessionCount(authSubject) >= this.maxSessionsPerSubject) {
                     this.respondWithRejection(res, 429, "subject_session_limit_reached", "The authenticated subject has reached its session limit; close a session or retry later.");
                     return;
                 }
@@ -283,6 +317,15 @@ export class StreamableHttpTransport {
                 if (!("method" in message)) {
                     continue;
                 }
+                if (this.sessionIdGenerator === undefined &&
+                    (message.method === "resources/subscribe" || message.method === "resources/unsubscribe")) {
+                    if (this.isRequest(message))
+                        responses.push(formatErrorResponse(message.id, {
+                            code: JSON_RPC_ERROR_CODES.METHOD_NOT_FOUND,
+                            message: "Method not found"
+                        }));
+                    continue;
+                }
                 const session = activeSession;
                 if (session !== undefined &&
                     message.method !== "initialize" &&
@@ -333,7 +376,23 @@ export class StreamableHttpTransport {
                         this.activeToolCalls -= 1;
                     }
                 }
-                const { error, result } = handled;
+                const { error } = handled;
+                let { result } = handled;
+                if (error === undefined &&
+                    message.method === "initialize" &&
+                    result !== undefined &&
+                    this.sessionIdGenerator === undefined) {
+                    const initialization = result;
+                    const capabilities = structuredClone(initialization.capabilities);
+                    for (const category of ["tools", "prompts", "resources"]) {
+                        const capability = capabilities[category];
+                        if (capability !== undefined)
+                            delete capability.listChanged;
+                    }
+                    if (capabilities.resources !== undefined)
+                        delete capabilities.resources.subscribe;
+                    result = { ...initialization, capabilities };
+                }
                 if (isToolCall) {
                     this.emit({
                         type: "tool.end",
@@ -380,12 +439,115 @@ export class StreamableHttpTransport {
             this.respondWithStatus(res, 200, sessionId, { "Content-Type": "application/json" }, body);
             return;
         }
+        const frames = formattedResponses.map((data) => formatSseEvent({ data }));
+        if (frames.some((frame) => Buffer.byteLength(frame, "utf8") > this.maxResponseBytes)) {
+            res.destroy();
+            return;
+        }
         res.writeHead(200, this.withSessionHeader(SSE_HEADERS, sessionId, res));
-        for (const formattedResponse of formattedResponses) {
-            res.write(formatSseEvent({ data: formattedResponse }));
+        for (const frame of frames) {
+            this.writeToLiveStream(res, frame);
         }
         res.end();
     }
+    async handleModernPost(req, res, body) {
+        const message = body.messages[0];
+        if (body.isBatch ||
+            body.messages.length !== 1 ||
+            message === undefined ||
+            !("method" in message)) {
+            this.respondWithJsonRpcError(res, 400, JSON_RPC_ERROR_CODES.INVALID_REQUEST, "Modern HTTP requires a single request or notification");
+            return;
+        }
+        const id = this.isRequest(message) ? message.id : null;
+        if (!this.acceptsResponseType(req, "application/json") ||
+            !this.acceptsResponseType(req, "text/event-stream")) {
+            this.respondWithRejection(res, 406, "response_type_not_acceptable", "Accept must allow application/json and text/event-stream.");
+            return;
+        }
+        const headerError = validateModernHeaders(req.headers, message);
+        if (headerError !== undefined) {
+            this.respondWithJsonRpcError(res, 400, headerError.code, headerError.message, id);
+            return;
+        }
+        const controller = new AbortController();
+        const cancel = () => controller.abort();
+        res.once("close", cancel);
+        req.once("aborted", cancel);
+        this.modernRequests.set(res, controller);
+        let streaming = false;
+        const write = (data) => {
+            if (controller.signal.aborted || res.destroyed || res.writableEnded)
+                return;
+            const frame = formatSseEvent({ data });
+            if (Buffer.byteLength(frame, "utf8") > this.maxResponseBytes) {
+                controller.abort(new Error("Modern SSE response size limit exceeded"));
+                res.destroy();
+                return;
+            }
+            if ((res.writableLength ?? 0) > this.maxStreamBufferBytes) {
+                controller.abort(new Error("Modern SSE output buffer limit exceeded"));
+                res.destroy();
+                return;
+            }
+            if (!streaming) {
+                res.writeHead(200, this.withSessionHeader({ ...SSE_HEADERS, "X-Accel-Buffering": "no" }, undefined, res));
+                streaming = true;
+                res.flushHeaders();
+                this.modernStreams.add(res);
+                this.startSseKeepAlive();
+            }
+            res.write(frame);
+        };
+        const session = this.server.createMessageSession((notification) => write(JSON.stringify(notification)));
+        try {
+            if (!this.isRequest(message) && !message.method.startsWith("notifications/")) {
+                this.respondWithJsonRpcError(res, 400, JSON_RPC_ERROR_CODES.INVALID_REQUEST, "A request ID is required");
+                return;
+            }
+            const handled = await this.runWithRequestContext(req, () => session.handleMessage(message.method, message.params, {
+                ...(this.isRequest(message) ? { requestId: message.id } : {}),
+                signal: controller.signal,
+                parameterHeaders: req.headers
+            }));
+            if (controller.signal.aborted || res.destroyed || res.writableEnded)
+                return;
+            if (!this.isRequest(message) ||
+                (handled.result === undefined && handled.error === undefined)) {
+                if (streaming)
+                    res.end();
+                else
+                    this.respondWithStatus(res, 202);
+                return;
+            }
+            const formatted = handled.error === undefined
+                ? formatSuccessResponse(message.id, handled.result)
+                : formatErrorResponse(message.id, handled.error);
+            const status = handled.error?.code === JSON_RPC_ERROR_CODES.METHOD_NOT_FOUND
+                ? 404
+                : handled.error?.code === JSON_RPC_ERROR_CODES.INVALID_PARAMS ||
+                    handled.error?.code === JSON_RPC_ERROR_CODES.UNSUPPORTED_PROTOCOL_VERSION ||
+                    handled.error?.code === -32020 ||
+                    handled.error?.code === -32021
+                    ? 400
+                    : 200;
+            if (streaming || (!this.enableJsonResponse && status === 200)) {
+                write(formatted);
+                if (!res.destroyed)
+                    res.end();
+            }
+            else
+                this.respondWithStatus(res, status, undefined, { "Content-Type": "application/json" }, formatted);
+        }
+        finally {
+            session.close();
+            res.off("close", cancel);
+            req.off("aborted", cancel);
+            this.modernRequests.delete(res);
+            this.modernStreams.delete(res);
+            this.stopSseKeepAliveIfIdle();
+        }
+    }
     async handleGet(req, res) {
         if (this.sessionIdGenerator === undefined) {
             this.respondWithStatus(res, 405, undefined, {
@@ -675,10 +837,14 @@ export class StreamableHttpTransport {
             return;
         }
         this.sseKeepAliveInterval = setInterval(() => {
+            for (const response of this.modernStreams) {
+                if (!response.writableEnded)
+                    this.writeToLiveStream(response, ": keepalive\n\n");
+            }
             for (const streams of this.sseStreams.values()) {
                 for (const response of streams) {
                     if (!response.writableEnded) {
-                        this.writeToLiveGetStream(response, ": keepalive\n\n");
+                        this.writeToLiveStream(response, ": keepalive\n\n");
                     }
                 }
             }
@@ -686,7 +852,8 @@ export class StreamableHttpTransport {
         this.sseKeepAliveInterval.unref();
     }
     stopSseKeepAliveIfIdle() {
-        if ([...this.sseStreams.values()].some((streams) => streams.size > 0)) {
+        if (this.modernStreams.size > 0 ||
+            [...this.sseStreams.values()].some((streams) => streams.size > 0)) {
             return;
         }
         this.stopSseKeepAlive();
@@ -704,15 +871,19 @@ export class StreamableHttpTransport {
         }
         const id = this.nextNotificationEventId++;
         const data = JSON.stringify(notification);
-        this.recordSseEvent(sessionId, id, data);
         const streams = this.sseStreams.get(sessionId);
-        if (streams === undefined) {
-            return;
-        }
         const event = formatSseEvent({
             id: String(id),
             data
         });
+        if (Buffer.byteLength(event, "utf8") > this.maxResponseBytes) {
+            for (const response of streams ?? [])
+                response.destroy();
+            return;
+        }
+        this.recordSseEvent(sessionId, id, data);
+        if (streams === undefined)
+            return;
         let latestResponse;
         for (const response of streams) {
             if (!response.writableEnded) {
@@ -720,10 +891,16 @@ export class StreamableHttpTransport {
             }
         }
         if (latestResponse !== undefined) {
-            this.writeToLiveGetStream(latestResponse, event);
+            this.writeToLiveStream(latestResponse, event);
         }
     }
-    writeToLiveGetStream(response, data) {
+    writeToLiveStream(response, data) {
+        if (response.destroyed || response.writableEnded)
+            return;
+        if (Buffer.byteLength(data, "utf8") > this.maxResponseBytes) {
+            response.destroy();
+            return;
+        }
         if ((response.writableLength ?? 0) > this.maxStreamBufferBytes) {
             response.end();
             return;
@@ -754,7 +931,7 @@ export class StreamableHttpTransport {
         const history = this.sseEventHistory.get(sessionId) ?? [];
         for (const event of history) {
             if (event.id > lastEventId && !res.writableEnded) {
-                this.writeToLiveGetStream(res, formatSseEvent({ id: String(event.id), data: event.data }));
+                this.writeToLiveStream(res, formatSseEvent({ id: String(event.id), data: event.data }));
             }
         }
     }
@@ -877,6 +1054,10 @@ export class StreamableHttpTransport {
         this.respondWithStatus(res, statusCode, undefined, { "Content-Type": "application/json" }, JSON.stringify({ error: reason, message }));
     }
     respondWithStatus(res, statusCode, sessionId, headers, body) {
+        if (body !== undefined && Buffer.byteLength(body, "utf8") > this.maxResponseBytes) {
+            res.destroy();
+            return;
+        }
         res.writeHead(statusCode, this.withSessionHeader(headers, sessionId, res));
         res.end(body);
     }

package/node_modules/tiny-http-mcp-server/dist/index.d.ts

@@ -1,9 +1,9 @@
 export { createServer, defineSchema, Image, Audio, File, toContentBlocks, fileTypeFromBuffer, JSON_RPC_ERROR_CODES, ToolError } from "tiny-stdio-mcp-server";
-export type { Server, TypedSchema, ImageContent, AudioContent, EmbeddedResource, TextResourceContents, BlobResourceContents, ContentBlock, TextContent, FileTypeResult, ToolReturn, ServerOptions, ToolHandler, ToolDefinition, Tool, ToolAnnotations, ToolExecution, Icon, ContentAnnotations, ResourceLink, CallToolResult, PromptContentItem, PromptArgument, Prompt, PromptMessage, GetPromptResult, PromptHandler, PromptDefinition, Resource, ResourceTemplate, ResourceContents, ReadResourceResult, ResourceHandler, ResourceDefinition, ResourceTemplateDefinition, HandleResult, ContentItem, JSONSchema, JSONSchemaProperty, Transport, SDKTransport, JSONRPCRequest, JSONRPCResponse, JSONRPCError, JSONRPCMessage, JSONRPCNotification, InitializeResult } from "tiny-stdio-mcp-server";
+export type { Server, MessageRequestContext, MessageSession, MessageSessionContext, TypedSchema, TypedOutputSchema, ImageContent, AudioContent, EmbeddedResource, TextResourceContents, BlobResourceContents, ContentBlock, TextContent, FileTypeResult, ToolReturn, ServerOptions, ToolHandler, HandlerRequestContext, InputRequiredResult, ToolDefinition, Tool, ToolAnnotations, ToolExecution, Icon, ContentAnnotations, ResourceLink, CallToolResult, PromptContentItem, PromptArgument, Prompt, PromptMessage, GetPromptResult, PromptHandler, PromptDefinition, Resource, ResourceTemplate, ResourceContents, ReadResourceResult, ResourceHandler, ResourceDefinition, ResourceTemplateDefinition, HandleResult, ContentItem, JSONSchema, OutputSchema, JSONSchemaProperty, Transport, SDKTransport, JSONRPCRequest, JSONRPCResponse, JSONRPCError, JSONRPCMessage, JSONRPCNotification, InitializeResult, DiscoverResult } from "tiny-stdio-mcp-server";
 export { createExpressMiddleware, createExpressOAuthHandlers, createProtectedResourceMetadataRouter } from "./express-middleware.js";
 export type { CreateExpressOAuthHandlersOptions } from "./express-middleware.js";
 export { createHttpServer, createProtectedResourceMetadataDocument } from "./http-server.js";
-export type { HttpToolContext, HttpToolHandler, HttpAdditionalRequestHandler, HttpListenOptions, HttpServer, HttpServerHandle, HttpTransportOptions, ProtectedResourceMetadataOptions, TinyHttpMcpServerOAuthOptions } from "./http-server.js";
+export type { HttpToolContext, HttpRequestContext, HttpToolHandler, HttpAdditionalRequestHandler, HttpListenOptions, HttpServer, HttpServerHandle, HttpTransportOptions, ProtectedResourceMetadataOptions, TinyHttpMcpServerOAuthOptions } from "./http-server.js";
 export { TokenVerificationError } from "./auth.js";
 export type { RequestAuthInfo, TokenVerifier, VerifiedAccessToken } from "./auth.js";
 export { StreamableHttpTransport } from "./http-transport.js";

package/node_modules/tiny-http-mcp-server/dist/modern-headers.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingHttpHeaders } from "node:http";
+import { type JSONRPCError, type JSONRPCNotification, type JSONRPCRequest } from "tiny-stdio-mcp-server";
+export declare function validateModernHeaders(headers: IncomingHttpHeaders, request: JSONRPCRequest | JSONRPCNotification): JSONRPCError | undefined;

package/node_modules/tiny-http-mcp-server/dist/modern-headers.js

@@ -0,0 +1,35 @@
+import { JSON_RPC_ERROR_CODES } from "tiny-stdio-mcp-server";
+import { decodeHeaderValue } from "tiny-stdio-mcp-server/headers";
+export function validateModernHeaders(headers, request) {
+    const metadata = request.params?._meta;
+    const version = typeof metadata === "object" && metadata !== null
+        ? metadata["io.modelcontextprotocol/protocolVersion"]
+        : undefined;
+    if (typeof version !== "string")
+        return {
+            code: JSON_RPC_ERROR_CODES.INVALID_PARAMS,
+            message: "Missing protocol version request metadata"
+        };
+    const expected = { "mcp-protocol-version": version };
+    // Notifications require the protocol version header but no method/name mirrors.
+    if ("id" in request) {
+        expected["mcp-method"] = request.method;
+        if (request.method === "tools/call" || request.method === "prompts/get")
+            expected["mcp-name"] = request.params?.name;
+        else if (request.method === "resources/read")
+            expected["mcp-name"] = request.params?.uri;
+    }
+    for (const [field, value] of Object.entries(expected)) {
+        const header = headers[field];
+        const actual = field === "mcp-name"
+            ? decodeHeaderValue(header)
+            : typeof header === "string"
+                ? header
+                : undefined;
+        if (typeof value !== "string" || actual === undefined || actual !== value)
+            return {
+                code: -32020,
+                message: `Header mismatch: ${field} must match the request body`
+            };
+    }
+}

package/node_modules/tiny-http-mcp-server/dist/parse-body.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage } from "node:http";
 import type { JSONRPCMessage, JSONRPCNotification, JSONRPCRequest, JSONRPCResponse } from "tiny-stdio-mcp-server";
 export interface ClassifiedBody {
+    isBatch: boolean;
     entries: Array<JSONRPCMessage | null>;
     messages: JSONRPCMessage[];
     hasRequests: boolean;

package/node_modules/tiny-http-mcp-server/dist/parse-body.js

@@ -21,9 +21,7 @@ function isValidResponse(value) {
     if (!hasOwn(value, "id")) {
         return false;
     }
-    if (value.id !== null &&
-        typeof value.id !== "string" &&
-        typeof value.id !== "number") {
+    if (value.id !== null && typeof value.id !== "string" && typeof value.id !== "number") {
         return false;
     }
     const hasResult = hasOwn(value, "result");
@@ -61,7 +59,12 @@ async function readStreamBody(req, maxBytes) {
         }
         chunks.push(bytes);
     }
-    return Buffer.concat(chunks).toString("utf8");
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+    }
+    catch {
+        throw new Error("Parse error");
+    }
 }
 async function readRawBody(req, preParsed, options) {
     const reqWithBody = req;
@@ -145,6 +148,7 @@ export async function readAndClassifyBody(req, preParsed, options = {}) {
         entries.push(request);
     }
     return {
+        isBatch,
         entries,
         messages,
         hasRequests: requests.length > 0,
@@ -152,6 +156,6 @@ export async function readAndClassifyBody(req, preParsed, options = {}) {
         hasResponses: responses.length > 0,
         requests,
         notifications,
-        responses,
+        responses
     };
 }

package/node_modules/tiny-http-mcp-server/dist/test-support.js

@@ -166,6 +166,7 @@ async function fetchInMemory(server, url, init) {
     response.headerValues = new Headers();
     response.headersSent = false;
     response.writableEnded = false;
+    response.destroyed = false;
     const setResponseHeader = (name, value) => {
         response.headerValues.delete(name);
         if (Array.isArray(value) && name.toLowerCase() === "set-cookie") {
@@ -224,6 +225,22 @@ async function fetchInMemory(server, url, init) {
         }
         return response;
     });
+    response.destroy = ((error) => {
+        if (!response.destroyed) {
+            response.destroyed = true;
+            try {
+                if (error === undefined)
+                    streamController?.close();
+                else
+                    streamController?.error(error);
+            }
+            catch {
+                // The consumer may have cancelled the stream already.
+            }
+            response.emit("close");
+        }
+        return response;
+    });
     response.flushHeaders = (() => {
         response.headersSent = true;
     });

package/node_modules/tiny-http-mcp-server/dist/testing.d.ts

@@ -56,4 +56,4 @@ export declare function createInMemoryTokenVerifier(options?: Partial<{
     now: () => number;
 }>): InMemoryTokenVerifier;
 export declare function createHttpTestPair(server: HttpServer): Promise<HttpTestPair>;
-export declare function createHttpTestPairWithTinyClient(server: HttpServer): Promise<TinyHttpTestPair>;
+export declare function createHttpTestPairWithTinyClient(server: HttpServer, clientOptions?: Pick<import("tiny-mcp-client").McpClientOptions, "protocolVersion">): Promise<TinyHttpTestPair>;

package/node_modules/tiny-http-mcp-server/dist/testing.js

@@ -135,7 +135,7 @@ export async function createHttpTestPair(server) {
         }
     };
 }
-export async function createHttpTestPairWithTinyClient(server) {
+export async function createHttpTestPairWithTinyClient(server, clientOptions = {}) {
     let tinyMcpClient;
     try {
         tinyMcpClient = await import("tiny-mcp-client");
@@ -147,7 +147,8 @@ export async function createHttpTestPairWithTinyClient(server) {
     const handle = await server.listenHttp({ port: 0 });
     const requests = [];
     const client = new tinyMcpClient.McpClient({
-        clientInfo: { name: "tiny-http-test-client", version: "1.0.0" }
+        clientInfo: { name: "tiny-http-test-client", version: "1.0.0" },
+        ...clientOptions
     });
     const transport = new tinyMcpClient.HttpTransport({
         url: handle.url,

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,5 @@
+import { isIP } from "node:net";
+import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
 import { createAuthStoreClientStore, createAuthStoreSessionStore } from "./auth-store-session-store.js";
 import { createLoopbackAuthorizationSession } from "./loopback-authorization.js";
@@ -62,6 +64,15 @@ export function createDefaultOAuthClientProvider(options) {
     async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         let session = await loadSession(canonicalResource);
+        if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
+            throw new Error("OAuth discovery authorization-server issuer mismatch");
+        }
+        if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource
+            || getOwnString(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer
+            || (discovery !== undefined && discovery.authorizationServer !== session.authorizationServer))) {
+            await clearSession(canonicalResource);
+            session = null;
+        }
         const sessionDiscovery = resolveDiscovery(discovery, session);
         if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
             return session;
@@ -281,14 +292,16 @@ export function createDefaultOAuthClientProvider(options) {
             }
         }
         const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
-        const response = await fetch(registrationEndpoint, {
+        const signal = AbortSignal.timeout(30_000);
+        const response = await fetchMcpResponse(fetch, registrationEndpoint, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json"
             },
-            body: JSON.stringify(registrationBody)
+            body: JSON.stringify(registrationBody),
+            signal
         });
-        const payload = await readOAuthJsonObjectResponse(response);
+        const payload = await readOAuthJsonObjectResponse(response, signal);
         const clientId = getOwnString(payload, "client_id");
         if (clientId === undefined || clientId.trim().length === 0) {
             throw new Error("OAuth client registration response missing client_id");
@@ -545,10 +558,14 @@ function isLoopbackHostname(hostname) {
     const normalizedHostname = normalizeHostname(hostname);
     return (normalizedHostname === "localhost" ||
         normalizedHostname === "::1" ||
-        normalizedHostname.startsWith("127."));
+        normalizedHostname === "[::1]" ||
+        (isIP(normalizedHostname) === 4 && normalizedHostname.startsWith("127.")));
 }
 function assertSecureUrl(value, label) {
     const url = new URL(value);
+    if (url.username !== "" || url.password !== "" || url.hash !== "") {
+        throw new Error(`${label} must not include credentials or fragment`);
+    }
     if (url.protocol === "https:") {
         return;
     }

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -36,5 +36,5 @@ export declare function refreshAccessToken(input: {
     fetch: OAuthMetadataFetch;
     now: () => number;
 }): Promise<StoredOAuthTokens>;
-export declare function readOAuthJsonObjectResponse(response: Response): Promise<Record<string, unknown>>;
+export declare function readOAuthJsonObjectResponse(response: Response, signal?: AbortSignal): Promise<Record<string, unknown>>;
 export {};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,4 +1,6 @@
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { readBoundedResponseText } from "../http-response.js";
+import { fetchMcpResponse } from "../http-fetch.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export class OAuthError extends Error {
     error;
@@ -68,14 +70,16 @@ async function requestTokens(input) {
     if (input.clientSecret !== undefined) {
         body.set("client_secret", input.clientSecret);
     }
-    const response = await input.fetch(input.tokenEndpoint, {
+    const signal = AbortSignal.timeout(30_000);
+    const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
         headers: {
             "Content-Type": "application/x-www-form-urlencoded"
         },
-        body: body.toString()
+        body: body.toString(),
+        signal
     });
-    const payload = await readOAuthJsonObjectResponse(response);
+    const payload = await readOAuthJsonObjectResponse(response, signal);
     const accessToken = getOwnEntry(payload, "access_token");
     if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
         throw new Error("OAuth token response missing access_token");
@@ -115,13 +119,17 @@ async function requestTokens(input) {
         scope: normalizedScope === undefined ? undefined : normalizedScope
     };
 }
-export async function readOAuthJsonObjectResponse(response) {
+export async function readOAuthJsonObjectResponse(response, signal) {
     const fallbackError = createFallbackOAuthError(response.status);
     let payload;
     try {
-        payload = await response.json();
+        payload = JSON.parse(await readBoundedResponseText(response, 1024 * 1024, undefined, signal));
     }
-    catch {
+    catch (error) {
+        if (signal?.aborted)
+            throw signal.reason;
+        if (error instanceof Error && error.message.startsWith("HTTP response exceeds "))
+            throw error;
         if (!response.ok) {
             throw fallbackError;
         }

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-fetch.d.ts

@@ -0,0 +1 @@
+export declare function fetchMcpResponse(fetchImplementation: (input: string | URL, init?: RequestInit) => Promise<Response>, input: string | URL, init?: RequestInit): Promise<Response>;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-fetch.js

@@ -0,0 +1,8 @@
+export async function fetchMcpResponse(fetchImplementation, input, init = {}) {
+    const response = await fetchImplementation(input, { ...init, redirect: "error" });
+    if (response.redirected || response.type === "opaqueredirect") {
+        void response.body?.cancel().catch(() => undefined);
+        throw new Error("MCP HTTP redirects are not allowed");
+    }
+    return response;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/http-response.d.ts

@@ -0,0 +1 @@
+export declare function readBoundedResponseText(response: Response, maxBytes: number, readers?: Set<ReadableStreamDefaultReader<Uint8Array>>, signal?: AbortSignal): Promise<string>;