aiohttp-tiny-mcp 0.3.3__tar.gz → 0.3.4__tar.gz

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aiohttp-tiny-mcp
-Version: 0.3.3
+Version: 0.3.4
 Summary: Remote MCP server and client library for aiohttp
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -146,7 +146,11 @@ async def deploy(args: Deploy, ex: Exchange) -> str:
     return f"deployed {args.service}"
 
 
-app = Endpoint(registry).app("/mcp")
+app = Endpoint(
+    registry,
+    # Behind a reverse proxy, uncomment this and let the proxy check Origin.
+    # trust_proxy_origin_validation=True,
+).app("/mcp")
 
 if __name__ == "__main__":
     web.run_app(app, host="127.0.0.1", port=8080)

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/README.md

@@ -104,7 +104,11 @@ async def deploy(args: Deploy, ex: Exchange) -> str:
     return f"deployed {args.service}"
 
 
-app = Endpoint(registry).app("/mcp")
+app = Endpoint(
+    registry,
+    # Behind a reverse proxy, uncomment this and let the proxy check Origin.
+    # trust_proxy_origin_validation=True,
+).app("/mcp")
 
 if __name__ == "__main__":
     web.run_app(app, host="127.0.0.1", port=8080)

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "aiohttp-tiny-mcp"
-version = "0.3.3"
+version = "0.3.4"
 description = "Remote MCP server and client library for aiohttp"
 readme = "README.md"
 license = "Apache-2.0"

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "aiohttp-tiny-mcp"
-version = "0.3.3"
+version = "0.3.4"
 description = "Remote MCP server and client library for aiohttp"
 readme = "README.md"
 license = "Apache-2.0"

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/src/aiohttp_tiny_mcp/console/console.css

@@ -71,6 +71,8 @@ body {
 }
 
 .field { display: flex; align-items: center; gap: 6px; }
+.field.grow { flex: 1 1 12em; min-width: 0; }
+.field.grow > input { flex: 1 1 auto; min-width: 8em; }
 .field > span { color: var(--ink-soft); font-size: 12px; }
 
 input[type="text"], input[type="number"], select, textarea {

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/src/aiohttp_tiny_mcp/console/console.js

@@ -384,6 +384,34 @@ const page = {
 let client = null;
 let chosen = null;
 let endpointUrl = null;
+//: Where the page was told the endpoint is. The field starts from it and may add a query.
+let configuredEndpoint = null;
+
+// The endpoint field: the path, plus any query string a person adds, such as
+// `?mcp=2025-06-18` to pin a revision or whatever the server reads from the URL.
+// The value is kept for the next visit while its path is still the configured one,
+// so a server moved elsewhere is not chased at a stale address.
+function endpointKey() {
+  return `mcp-console-endpoint:${location.pathname}`;
+}
+
+function rememberedEndpoint() {
+  const kept = localStorage.getItem(endpointKey());
+  if (!kept) return null;
+  const url = new URL(kept, location.origin);
+  return url.pathname === configuredEndpoint.pathname ? kept : null;
+}
+
+function chosenEndpoint() {
+  const typed = page.endpoint.value.trim() || configuredEndpoint.pathname;
+  const url = new URL(typed, location.origin);
+  if (url.origin !== location.origin) {
+    throw new Error(`The endpoint must be on this server, not ${url.origin}.`);
+  }
+  page.endpoint.value = url.pathname + url.search;
+  localStorage.setItem(endpointKey(), page.endpoint.value);
+  return url;
+}
 
 function element(tag, className, text) {
   const made = document.createElement(tag);
@@ -1297,6 +1325,7 @@ function disconnect() {
   page.refresh.disabled = true;
   page.revision.disabled = false;
   page.answerable.disabled = false;
+  page.endpoint.disabled = false;
   page.connect.textContent = "Connect";
   say("not connected", "");
 }
@@ -1305,9 +1334,11 @@ async function connect() {
   page.connect.disabled = true;
   page.revision.disabled = true;
   page.answerable.disabled = true;
+  page.endpoint.disabled = true;
   say("connecting", "");
   page.outcome.textContent = "";
   try {
+    endpointUrl = chosenEndpoint();
     client = new Client(endpointUrl.href, page.revision.value, {
       answerable: page.answerable.checked,
       onFrame: record,
@@ -1330,6 +1361,7 @@ async function connect() {
     page.refresh.disabled = true;
     page.revision.disabled = false;
     page.answerable.disabled = false;
+    page.endpoint.disabled = false;
     page.connect.textContent = "Connect";
     say(error.message, "off");
     report("Could not connect", connectionHelp(error), true);
@@ -1340,7 +1372,7 @@ async function connect() {
 
 function connectionHelp(error) {
   const lines = [error.message];
-  if (error instanceof TypeError || /fetch/i.test(error.message)) {
+  if (endpointUrl && (error instanceof TypeError || /fetch/i.test(error.message))) {
     lines.push("", `The request to ${endpointUrl.href} did not reach a server.`);
   }
   return lines.join("\n");
@@ -1409,8 +1441,14 @@ function start() {
   const remembered = localStorage.getItem("mcp-console-revision");
   page.revision.value = REVISIONS[remembered] ? remembered : Object.keys(REVISIONS)[0];
 
-  endpointUrl = new URL(document.documentElement.dataset.endpoint || "/mcp", location.origin);
-  page.endpoint.textContent = endpointUrl.pathname;
+  configuredEndpoint = new URL(document.documentElement.dataset.endpoint || "/mcp", location.origin);
+  page.endpoint.value = rememberedEndpoint() || configuredEndpoint.pathname + configuredEndpoint.search;
+  page.endpoint.onkeydown = (event) => {
+    if (event.key === "Enter" && !client) {
+      event.preventDefault();
+      connect();
+    }
+  };
 
   page.connect.onclick = () => (client ? disconnect() : connect());
   page.refresh.onclick = async () => {

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/src/aiohttp_tiny_mcp/console/index.html

@@ -11,10 +11,10 @@
 
 <header class="bar">
   <h1>{{TITLE}}</h1>
-  <span class="field">
+  <label class="field grow" title="The path the server serves MCP on. A query string is sent as typed">
     <span>Endpoint</span>
-    <code id="endpoint" class="endpoint"></code>
-  </span>
+    <input id="endpoint" class="endpoint" type="text" spellcheck="false" autocomplete="off">
+  </label>
   <label class="field">
     <span>Revision</span>
     <select id="revision" class="revision"></select>

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.4}/src/aiohttp_tiny_mcp/endpoint.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import re
 from collections.abc import Mapping
 from contextlib import suppress
 from dataclasses import replace
@@ -51,6 +52,24 @@ log = logging.getLogger("aiohttp_tiny_mcp")
 MAY_ASK = frozenset({Operation.CALL_TOOL, Operation.GET_PROMPT, Operation.READ_RESOURCE})
 
 
+def origin_pattern(spec: str) -> re.Pattern[str]:
+    """Compile an allowed origin with wildcards.
+
+    `*` matches one host label, `**` matches one or more labels, so
+    `https://*.example.com` admits `https://app.example.com` and `https://**.example.com`
+    admits `https://a.b.example.com` as well. Everything else matches literally.
+    """
+    parts = []
+    for piece in re.split(r"(\*\*|\*)", spec):
+        if piece == "**":
+            parts.append(r"[^./]+(?:\.[^./]+)*")
+        elif piece == "*":
+            parts.append(r"[^./]+")
+        else:
+            parts.append(re.escape(piece))
+    return re.compile("".join(parts))
+
+
 class Endpoint:
     """The MCP endpoint, in the spec's sense: one path that accepts POST.
 
@@ -81,6 +100,7 @@ class Endpoint:
         self.adapters = adapters or AdapterSet.default()
         self.dispatcher = Dispatcher(registry)
         self.allowed_origins = allowed_origins
+        self.origin_patterns = [origin_pattern(o) for o in allowed_origins or () if "*" in o]
         self.trust_proxy_origin_validation = trust_proxy_origin_validation
         self.compress = compress
 
@@ -187,8 +207,11 @@ class Endpoint:
             return
         if origin == self.own_origin(request):
             return
-        if self.allowed_origins is None or origin not in self.allowed_origins:
-            raise Rejected(Failure(FailureKind.ORIGIN_REJECTED, "origin not allowed"))
+        if self.allowed_origins is not None and origin in self.allowed_origins:
+            return
+        if any(pattern.fullmatch(origin) for pattern in self.origin_patterns):
+            return
+        raise Rejected(Failure(FailureKind.ORIGIN_REJECTED, "origin not allowed"))
 
     def own_origin(self, request: web.Request) -> str:
         """Origin of pages served by this endpoint. A rebound page retains the attacker's origin