aiohttp-tiny-mcp 0.3.3__tar.gz → 0.3.5__tar.gz

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aiohttp-tiny-mcp
-Version: 0.3.3
+Version: 0.3.5
 Summary: Remote MCP server and client library for aiohttp
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -146,7 +146,11 @@ async def deploy(args: Deploy, ex: Exchange) -> str:
     return f"deployed {args.service}"
 
 
-app = Endpoint(registry).app("/mcp")
+app = Endpoint(
+    registry,
+    # Behind a reverse proxy, uncomment this and let the proxy check Origin.
+    # trust_proxy_origin_validation=True,
+).app("/mcp")
 
 if __name__ == "__main__":
     web.run_app(app, host="127.0.0.1", port=8080)

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/README.md

@@ -104,7 +104,11 @@ async def deploy(args: Deploy, ex: Exchange) -> str:
     return f"deployed {args.service}"
 
 
-app = Endpoint(registry).app("/mcp")
+app = Endpoint(
+    registry,
+    # Behind a reverse proxy, uncomment this and let the proxy check Origin.
+    # trust_proxy_origin_validation=True,
+).app("/mcp")
 
 if __name__ == "__main__":
     web.run_app(app, host="127.0.0.1", port=8080)

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "aiohttp-tiny-mcp"
-version = "0.3.3"
+version = "0.3.5"
 description = "Remote MCP server and client library for aiohttp"
 readme = "README.md"
 license = "Apache-2.0"

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "aiohttp-tiny-mcp"
-version = "0.3.3"
+version = "0.3.5"
 description = "Remote MCP server and client library for aiohttp"
 readme = "README.md"
 license = "Apache-2.0"

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/adapter.py

@@ -90,6 +90,7 @@ class Adapter(ABC):
             FailureKind.MALFORMED: (-32600, 400),
             FailureKind.INVALID_PARAMS: (-32602, 200),
             FailureKind.ORIGIN_REJECTED: (-32600, 403),
+            FailureKind.SESSION_NOT_FOUND: (-32001, 404),
             FailureKind.INTERNAL: (-32603, 200),
             FailureKind.INVALID_ARGUMENTS: (-32603, 200),
             FailureKind.UNKNOWN_METHOD: (-32601, 200),

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/client.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import logging
 from collections.abc import AsyncIterator, Callable, Mapping
 from typing import Any
 
@@ -19,6 +20,8 @@ NOTIFICATIONS_METHOD = "notifications/message"
 
 BASE_HEADERS = {"Content-Type": "application/json", "Accept": "application/json, text/event-stream"}
 
+log = logging.getLogger(__name__)
+
 
 async def frames(resp: aiohttp.ClientResponse) -> AsyncIterator[dict[str, Any]]:
     """Yield JSON or SSE messages immediately; waiting for EOF would deadlock pushed questions."""
@@ -76,23 +79,62 @@ class Client(BaseClient):
             headers["Mcp-Session-Id"] = self.session_id
         return headers
 
+    def lost_session(self, resp: aiohttp.ClientResponse) -> bool:
+        """Whether the server no longer holds the session this request named.
+
+        The spec answers such a request with 404. A 404 without a session id
+        in flight is an ordinary reply and is read as one.
+        """
+        return resp.status == 404 and self.session_id is not None
+
+    async def reopen(self) -> None:
+        """Start over with initialize, which mints a session and restores the log level."""
+        log.debug("session %s is gone, opening a new one", self.session_id)
+        self.session_id = None
+        await self.initialize()
+
     async def exchange(
         self, envelope: dict[str, Any], *, method: str, name: str | None
     ) -> AsyncIterator[dict[str, Any]]:
         assert self.session is not None, "use 'async with Client(...) as client:'"
         tool = self.tool_definitions.get(name) if name is not None else None
-        headers = self.headers(method, name, envelope.get("params"), tool)
-        async with self.session.post(self.base_url, json=envelope, headers=headers) as resp:
-            issued = resp.headers.get("Mcp-Session-Id")
-            if issued:
-                self.session_id = issued
+        params = envelope.get("params")
+        async with self.session.post(
+            self.base_url, json=envelope, headers=self.headers(method, name, params, tool)
+        ) as resp:
+            if not self.lost_session(resp):
+                self.adopt(resp)
+                async for frame in frames(resp):
+                    yield frame
+                return
+        # Retry once on a fresh session; a second 404 is reported as any other reply.
+        await self.reopen()
+        async with self.session.post(
+            self.base_url, json=envelope, headers=self.headers(method, name, params, tool)
+        ) as resp:
+            self.adopt(resp)
             async for frame in frames(resp):
                 yield frame
 
+    def adopt(self, resp: aiohttp.ClientResponse) -> None:
+        """Keep the session id a handshake reply carries."""
+        issued = resp.headers.get("Mcp-Session-Id")
+        if issued:
+            self.session_id = issued
+
     async def send_notification(self, envelope: dict[str, Any], *, method: str) -> None:
         assert self.session is not None, "use 'async with Client(...) as client:'"
-        headers = self.headers(method, params=envelope.get("params"))
-        async with self.session.post(self.base_url, json=envelope, headers=headers) as resp:
+        params = envelope.get("params")
+        async with self.session.post(
+            self.base_url, json=envelope, headers=self.headers(method, params=params)
+        ) as resp:
+            if not self.lost_session(resp):
+                await resp.read()
+                return
+        await self.reopen()
+        async with self.session.post(
+            self.base_url, json=envelope, headers=self.headers(method, params=params)
+        ) as resp:
             await resp.read()
 
     async def stream_notifications(

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/console/console.css

@@ -71,6 +71,8 @@ body {
 }
 
 .field { display: flex; align-items: center; gap: 6px; }
+.field.grow { flex: 1 1 12em; min-width: 0; }
+.field.grow > input { flex: 1 1 auto; min-width: 8em; }
 .field > span { color: var(--ink-soft); font-size: 12px; }
 
 input[type="text"], input[type="number"], select, textarea {

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/console/console.js

@@ -384,6 +384,34 @@ const page = {
 let client = null;
 let chosen = null;
 let endpointUrl = null;
+//: Where the page was told the endpoint is. The field starts from it and may add a query.
+let configuredEndpoint = null;
+
+// The endpoint field: the path, plus any query string a person adds, such as
+// `?mcp=2025-06-18` to pin a revision or whatever the server reads from the URL.
+// The value is kept for the next visit while its path is still the configured one,
+// so a server moved elsewhere is not chased at a stale address.
+function endpointKey() {
+  return `mcp-console-endpoint:${location.pathname}`;
+}
+
+function rememberedEndpoint() {
+  const kept = localStorage.getItem(endpointKey());
+  if (!kept) return null;
+  const url = new URL(kept, location.origin);
+  return url.pathname === configuredEndpoint.pathname ? kept : null;
+}
+
+function chosenEndpoint() {
+  const typed = page.endpoint.value.trim() || configuredEndpoint.pathname;
+  const url = new URL(typed, location.origin);
+  if (url.origin !== location.origin) {
+    throw new Error(`The endpoint must be on this server, not ${url.origin}.`);
+  }
+  page.endpoint.value = url.pathname + url.search;
+  localStorage.setItem(endpointKey(), page.endpoint.value);
+  return url;
+}
 
 function element(tag, className, text) {
   const made = document.createElement(tag);
@@ -1297,6 +1325,7 @@ function disconnect() {
   page.refresh.disabled = true;
   page.revision.disabled = false;
   page.answerable.disabled = false;
+  page.endpoint.disabled = false;
   page.connect.textContent = "Connect";
   say("not connected", "");
 }
@@ -1305,9 +1334,11 @@ async function connect() {
   page.connect.disabled = true;
   page.revision.disabled = true;
   page.answerable.disabled = true;
+  page.endpoint.disabled = true;
   say("connecting", "");
   page.outcome.textContent = "";
   try {
+    endpointUrl = chosenEndpoint();
     client = new Client(endpointUrl.href, page.revision.value, {
       answerable: page.answerable.checked,
       onFrame: record,
@@ -1330,6 +1361,7 @@ async function connect() {
     page.refresh.disabled = true;
     page.revision.disabled = false;
     page.answerable.disabled = false;
+    page.endpoint.disabled = false;
     page.connect.textContent = "Connect";
     say(error.message, "off");
     report("Could not connect", connectionHelp(error), true);
@@ -1340,7 +1372,7 @@ async function connect() {
 
 function connectionHelp(error) {
   const lines = [error.message];
-  if (error instanceof TypeError || /fetch/i.test(error.message)) {
+  if (endpointUrl && (error instanceof TypeError || /fetch/i.test(error.message))) {
     lines.push("", `The request to ${endpointUrl.href} did not reach a server.`);
   }
   return lines.join("\n");
@@ -1409,8 +1441,14 @@ function start() {
   const remembered = localStorage.getItem("mcp-console-revision");
   page.revision.value = REVISIONS[remembered] ? remembered : Object.keys(REVISIONS)[0];
 
-  endpointUrl = new URL(document.documentElement.dataset.endpoint || "/mcp", location.origin);
-  page.endpoint.textContent = endpointUrl.pathname;
+  configuredEndpoint = new URL(document.documentElement.dataset.endpoint || "/mcp", location.origin);
+  page.endpoint.value = rememberedEndpoint() || configuredEndpoint.pathname + configuredEndpoint.search;
+  page.endpoint.onkeydown = (event) => {
+    if (event.key === "Enter" && !client) {
+      event.preventDefault();
+      connect();
+    }
+  };
 
   page.connect.onclick = () => (client ? disconnect() : connect());
   page.refresh.onclick = async () => {

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/console/index.html

@@ -11,10 +11,10 @@
 
 <header class="bar">
   <h1>{{TITLE}}</h1>
-  <span class="field">
+  <label class="field grow" title="The path the server serves MCP on. A query string is sent as typed">
     <span>Endpoint</span>
-    <code id="endpoint" class="endpoint"></code>
-  </span>
+    <input id="endpoint" class="endpoint" type="text" spellcheck="false" autocomplete="off">
+  </label>
   <label class="field">
     <span>Revision</span>
     <select id="revision" class="revision"></select>

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/core.py

@@ -89,6 +89,7 @@ class FailureKind(StringEnum):
     HEADER_MISMATCH = "header_mismatch"
     UNSUPPORTED_VERSION = "unsupported_version"
     ORIGIN_REJECTED = "origin_rejected"
+    SESSION_NOT_FOUND = "session_not_found"
     INPUT_UNSUPPORTED = "input_unsupported"
     MISSING_REQUIRED_CAPABILITY = "missing_required_capability"
     INTERNAL = "internal"

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/endpoint.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import re
 from collections.abc import Mapping
 from contextlib import suppress
 from dataclasses import replace
@@ -51,6 +52,24 @@ log = logging.getLogger("aiohttp_tiny_mcp")
 MAY_ASK = frozenset({Operation.CALL_TOOL, Operation.GET_PROMPT, Operation.READ_RESOURCE})
 
 
+def origin_pattern(spec: str) -> re.Pattern[str]:
+    """Compile an allowed origin with wildcards.
+
+    `*` matches one host label, `**` matches one or more labels, so
+    `https://*.example.com` admits `https://app.example.com` and `https://**.example.com`
+    admits `https://a.b.example.com` as well. Everything else matches literally.
+    """
+    parts = []
+    for piece in re.split(r"(\*\*|\*)", spec):
+        if piece == "**":
+            parts.append(r"[^./]+(?:\.[^./]+)*")
+        elif piece == "*":
+            parts.append(r"[^./]+")
+        else:
+            parts.append(re.escape(piece))
+    return re.compile("".join(parts))
+
+
 class Endpoint:
     """The MCP endpoint, in the spec's sense: one path that accepts POST.
 
@@ -81,6 +100,7 @@ class Endpoint:
         self.adapters = adapters or AdapterSet.default()
         self.dispatcher = Dispatcher(registry)
         self.allowed_origins = allowed_origins
+        self.origin_patterns = [origin_pattern(o) for o in allowed_origins or () if "*" in o]
         self.trust_proxy_origin_validation = trust_proxy_origin_validation
         self.compress = compress
 
@@ -187,8 +207,11 @@ class Endpoint:
             return
         if origin == self.own_origin(request):
             return
-        if self.allowed_origins is None or origin not in self.allowed_origins:
-            raise Rejected(Failure(FailureKind.ORIGIN_REJECTED, "origin not allowed"))
+        if self.allowed_origins is not None and origin in self.allowed_origins:
+            return
+        if any(pattern.fullmatch(origin) for pattern in self.origin_patterns):
+            return
+        raise Rejected(Failure(FailureKind.ORIGIN_REJECTED, "origin not allowed"))
 
     def own_origin(self, request: web.Request) -> str:
         """Origin of pages served by this endpoint. A rebound page retains the attacker's origin
@@ -268,14 +291,12 @@ class Endpoint:
             await relay_reply(self.registry.hub, pre.body)
             return web.Response(status=202)
 
-        session = await self.load_session(request)
-        if not self.owns(session, principal):
-            session = None
-        held = self.open_values(request, session)
         try:
+            session = await self.load_session(request, principal)
             adapter = self.adapters.select(pre, stored_version(session))
         except Rejected as e:
             return self.render_failure(self.adapters.fallback(), e.failure)
+        held = self.open_values(request, session)
 
         log.debug("<- [%s] %s", adapter.version, raw.decode("utf-8", "replace"))
 
@@ -376,9 +397,10 @@ class Endpoint:
             assert self.registry.auth is not None
             return self.refuse(self.registry.auth, refusal)
 
-        record = await self.load_session(request)
-        if not self.owns(record, principal):
-            record = None
+        try:
+            record = await self.load_session(request, principal)
+        except Rejected as e:
+            return self.render_failure(self.adapters.fallback(), e.failure)
         adapter = self.stream_adapter(request, record)
         if not adapter.has_handshake:
             return web.Response(
@@ -412,9 +434,7 @@ class Endpoint:
             found = await events.poll()
             if not found:
                 continue
-            accepted = wanted(
-                capabilities, self.open_values(request, await self.load_session(request))
-            )
+            accepted = wanted(capabilities, self.open_values(request, await self.stored(request)))
             for event in found:
                 if relays(event.message, accepted):
                     text = json.dumps(event.message, ensure_ascii=False)
@@ -449,13 +469,35 @@ class Endpoint:
             return True
         return principal is not None and principal.identity == owner
 
-    async def load_session(self, request: web.Request) -> SessionRecord | None:
-        """Load a legacy handshake, or None if no session exists or it has expired."""
+    async def stored(self, request: web.Request) -> SessionRecord | None:
+        """The record the session header names, or None where there is no header or no record."""
         session_id = request.headers.get(SESSION_HEADER)
         if not session_id:
             return None
         return await self.registry.session_store.get(scoped(session_id))
 
+    async def load_session(self, request: web.Request, principal: Any) -> SessionRecord | None:
+        """Load the legacy handshake this request names, or None without a session header.
+
+        Raises `Rejected` where the header names a session the store does not
+        hold or another principal owns. The spec answers that with 404 so the
+        client opens a new session with `initialize` instead of going on with
+        capabilities and a log level this server no longer remembers.
+
+        A found session has its TTL renewed: it lives while the client keeps
+        talking, not for a fixed time after the handshake.
+        """
+        session_id = request.headers.get(SESSION_HEADER)
+        if not session_id:
+            return None
+        record = await self.registry.session_store.get(scoped(session_id))
+        if record is None or not self.owns(record, principal):
+            raise Rejected(Failure(FailureKind.SESSION_NOT_FOUND, "session not found"))
+        await self.registry.session_store.touch(
+            scoped(session_id), ttl_seconds=self.registry.session_ttl_seconds
+        )
+        return record
+
     def open_values(self, request: web.Request, record: SessionRecord | None) -> Session | None:
         """The application-owned half of this request's session, if any."""
         session_id = request.headers.get(SESSION_HEADER)

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/postgres.py

@@ -301,6 +301,19 @@ class PostgresSessionStore(SessionStore):
             ]
         )
 
+    @cached_property
+    def _query_touch(self) -> sql.Composed:
+        return sql.Composed(
+            [
+                sql.SQL("UPDATE "),
+                self.storage.sessions_table,
+                sql.SQL("""
+                SET expires_at = now() + make_interval(secs => %s)
+                WHERE id = %s AND expires_at > now()
+                """),
+            ]
+        )
+
     @cached_property
     def _query_delete(self) -> sql.Composed:
         return sql.Composed(
@@ -343,6 +356,12 @@ class PostgresSessionStore(SessionStore):
             )
             return found.rowcount > 0
 
+    async def touch(self, session_id: str, *, ttl_seconds: int) -> bool:
+        pool = await self.storage.open()
+        async with pool.connection() as connection:
+            found = await connection.execute(self._query_touch, (ttl_seconds, session_id))
+            return found.rowcount > 0
+
     async def delete(self, session_id: str) -> None:
         pool = await self.storage.open()
         async with pool.connection() as connection:

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/redis.py

@@ -126,6 +126,12 @@ class RedisSessionStore(SessionStore):
         )
         return bool(written)
 
+    async def touch(self, session_id: str, *, ttl_seconds: int) -> bool:
+        """EXPIRE answers 1 only for a key that exists, so a lost session reads False."""
+        client = await self.storage.open()
+        renewed: Any = await client.expire(self.key(session_id), ttl_seconds)
+        return bool(renewed)
+
     async def delete(self, session_id: str) -> None:
         client = await self.storage.open()
         await client.delete(self.key(session_id))

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/sessions.py

@@ -43,11 +43,12 @@ class SessionStore(Protocol):
     """Application-provided storage, safe across workers.
 
     create() atomically returns False for an existing id. save() atomically returns False when
-    expected_version no longer matches. Store only JSON-serializable values, never requests,
-    sockets, queues, or tasks.
+    expected_version no longer matches. touch() renews the TTL without a write to the data, so
+    a session stays alive as long as its client keeps sending requests. Store only
+    JSON-serializable values, never requests, sockets, queues, or tasks.
 
     Subclass it to have the methods checked and the missing ones refused, or
-    supply any object with these four methods: this is a protocol, so a
+    supply any object with these five methods: this is a protocol, so a
     backend that inherits nothing is still a SessionStore.
     """
 
@@ -70,6 +71,12 @@ class SessionStore(Protocol):
     ) -> bool:
         """Replace the data and renew the TTL, or return False where the version moved."""
 
+    @abstractmethod
+    async def touch(self, session_id: str, *, ttl_seconds: int) -> bool:
+        """Renew the TTL of a live record, keeping its data and version. Return False where
+        it is missing or expired.
+        """
+
     @abstractmethod
     async def delete(self, session_id: str) -> None:
         """Forget it."""
@@ -118,6 +125,14 @@ class MemorySessionStore(SessionStore):
         self.records[session_id] = (dict(data), expected_version + 1, self.clock() + ttl_seconds)
         return True
 
+    async def touch(self, session_id: str, *, ttl_seconds: int) -> bool:
+        entry = self.live(session_id)
+        if entry is None:
+            return False
+        data, version, _ = entry
+        self.records[session_id] = (data, version, self.clock() + ttl_seconds)
+        return True
+
     async def delete(self, session_id: str) -> None:
         self.records.pop(session_id, None)
 

{aiohttp_tiny_mcp-0.3.3 → aiohttp_tiny_mcp-0.3.5}/src/aiohttp_tiny_mcp/sqlite.py

@@ -165,6 +165,14 @@ class SqliteSessionStore(SessionStore):
         )
         return cursor.rowcount > 0
 
+    async def touch(self, session_id: str, *, ttl_seconds: int) -> bool:
+        connection = await self.storage.open()
+        cursor = await connection.execute(
+            f"UPDATE mcp_sessions SET expires_at = {NOW} + ? WHERE id = ? AND expires_at > {NOW}",
+            (ttl_seconds, session_id),
+        )
+        return cursor.rowcount > 0
+
     async def delete(self, session_id: str) -> None:
         connection = await self.storage.open()
         await connection.execute("DELETE FROM mcp_sessions WHERE id = ?", (session_id,))