mcpsmith 0.2.0__tar.gz → 0.2.2__tar.gz

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mcpsmith",
   "displayName": "mcpsmith",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Turn an OpenAPI file or a recorded website session into a curated, tested MCP server. Skills and an MCP server for your coding agent.",
   "author": {
     "name": "Sepehr Radmard",
@@ -23,7 +23,7 @@
     "mcpsmith": {
       "command": "uvx",
       "args": [
-        "mcpsmith@0.2.0",
+        "mcpsmith@0.2.2",
         "mcp"
       ]
     }

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpsmith
-Version: 0.2.0
+Version: 0.2.2
 Summary: Turn an OpenAPI file or a recorded website session into a curated, tested MCP server, with an LLM designing the tools.
 Project-URL: Homepage, https://github.com/sepehr071/mcpsmith
 Project-URL: Issues, https://github.com/sepehr071/mcpsmith/issues
@@ -22,6 +22,7 @@ Requires-Dist: httpx>=0.27
 Requires-Dist: keyring>=25
 Requires-Dist: mcp<3,>=2.2
 Requires-Dist: pyyaml>=6
+Requires-Dist: truststore>=0.9
 Requires-Dist: tzdata>=2024.1; sys_platform == 'win32'
 Requires-Dist: websockets>=12
 Provides-Extra: capture

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcpsmith"
-version = "0.2.0"
+version = "0.2.2"
 description = "Turn an OpenAPI file or a recorded website session into a curated, tested MCP server, with an LLM designing the tools."
 readme = "README.md"
 license = "MIT"
@@ -22,6 +22,7 @@ classifiers = [
 dependencies = [
     "mcp>=2.2,<3",
     "httpx>=0.27",
+    "truststore>=0.9",
     "pyyaml>=6",
     "websockets>=12",
     "keyring>=25",

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/server.json

@@ -8,13 +8,13 @@
     "source": "github"
   },
   "websiteUrl": "https://github.com/sepehr071/mcpsmith",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "packages": [
     {
       "registryType": "pypi",
       "registryBaseUrl": "https://pypi.org",
       "identifier": "mcpsmith",
-      "version": "0.2.0",
+      "version": "0.2.2",
       "runtimeHint": "uvx",
       "transport": {
         "type": "stdio"

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/skills/design-mcp-tools/SKILL.md

@@ -49,7 +49,7 @@ Safety and server
 - `example` for every tool with required args; real values that return data.
 - `instructions`: the cross-tool workflow ("search, then details by id"), units, currency, language, rate limits, limits of the data.
 - Secrets only via env vars (`<P>_...`) or `mcpsmith secret set`, never in args or descriptions.
-- Site that needs the user's login: `auth: {type: browser, login_path: /login}` (hub only; `login_path` is where the site redirects when logged out). `generate` refuses it: switch to token auth to export.
+- Site that needs the user's login: `auth: {type: browser, login_path: /login}` (hub only; `login_path` is where the site redirects when logged out). Also set `session_cookie`, the login cookie's name: compare the cookie NAMES Chrome holds logged in vs logged out (`mcpsmith.browser.cookies_for`, names only, never print values). Some sites answer an ended session with HTTP 200 and an empty body. `generate` refuses it: switch to token auth to export.
 
 ## Measure
 

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/skills/extract-api/SKILL.md

@@ -49,7 +49,7 @@ Read the digest and the guide fully, then edit `<workdir>/plan.yaml` yourself (s
 - Keep only tools for the goals from step 1; drop analytics, menus, config, auth plumbing.
 - Rename cryptic fields and args to what a person says (`emp_id` to `employee_id`, `Item_dev_sort_date` through `map: {newest: ...}`).
 - Add `transform` on args and `output.transforms` for dates, unix times, minutes, currency. Set `timezone` (IANA name; empty means the machine's local zone).
-- Set `auth: {type: browser, login_path: /Account/Login}`; `login_path` is the path the site redirects to when logged out.
+- Set `auth: {type: browser, login_path: /Account/Login}`; `login_path` is the path the site redirects to when logged out. Also set `session_cookie` to the login cookie's name: compare the cookie NAMES Chrome holds logged in vs logged out (`mcpsmith.browser.cookies_for`, names only, never print values). Some sites answer an ended session with HTTP 200 and an empty body.
 - Fill `example` for every tool with values seen in the recording; `read_only: false` for anything that writes.
 
 ```

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/src/mcpsmith/__init__.py

@@ -1,3 +1,3 @@
 """mcpsmith: turn an OpenAPI file or a recorded website session into a curated, tested MCP server."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/src/mcpsmith/design/_validate.py

@@ -119,6 +119,13 @@ def validate(plan: Plan, source: Source | None = None) -> list[Issue]:
     check("plan.timezone", check_timezone, plan.timezone)
     if plan.auth and plan.auth.type == "browser":
         warn("plan.auth", "browser auth needs the hub's Chrome; switch to token auth before exporting.")
+        if not plan.auth.session_cookie:
+            warn(
+                "plan.auth.session_cookie",
+                "set auth.session_cookie so an ended session is reported instead of returning empty data.",
+            )
+    elif plan.auth and plan.auth.session_cookie:
+        err("plan.auth.session_cookie", "session_cookie only applies to browser auth.")
     if len(plan.tools) > 20:
         warn("plan.tools", f"{len(plan.tools)} tools; merge near-duplicates and drop noise to stay at 20 or fewer.")
 

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/src/mcpsmith/design/guide.md

@@ -89,10 +89,12 @@ Raw API responses waste the agent's context and bury the answer. For every tool:
 
 Plan: `name` (e.g. `petstore-mcp`), `title`, `description` (<= 100 chars), `instructions`, `prefix` (tool name
 prefix, e.g. `pet`), `version`, `base_url`, `env_prefix` (upper case, `^[A-Z][A-Z0-9_]*$`, ending in `_MCP`; `auth.env` must start with it; e.g.
-`PETSTORE_MCP`), `headers`, `auth` (`{name, type: bearer|header|query|cookie|basic|browser, param, env, login_path}`;
+`PETSTORE_MCP`), `headers`, `auth` (`{name, type: bearer|header|query|cookie|basic|browser, param, env, login_path, session_cookie}`;
 `browser` and `login_path` only work in the hub, not in exported servers: `browser` reuses the developer's
 logged-in shared Chrome session, `login_path` is the path prefix the site redirects to when logged out, e.g.
-`/login`; `generate` refuses browser-auth plans, switch to bearer/header/cookie auth to export),
+`/login`; `session_cookie` is the name of the cookie that proves the login (some sites answer an ended session with
+HTTP 200 and an empty body, so no redirect shows it; find it by comparing the cookie names Chrome holds logged in vs
+logged out, never their values); `generate` refuses browser-auth plans, switch to bearer/header/cookie auth to export),
 `impersonate`, `concurrency`, `cache_ttl`, `timezone` (IANA name for date transforms; empty = system local),
 `author`, `repository`, `tools`.
 

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/src/mcpsmith/importers/__init__.py

@@ -10,13 +10,14 @@ import yaml
 
 from mcpsmith.importers import har, openapi, rea
 from mcpsmith.model import Source
+from mcpsmith.runtime.http import tls_context
 
 
 def load(path_or_url: str, hosts: list[str] | None = None) -> Source:
     """`hosts` filters HAR traffic to those hosts (exact or subdomain); ignored for OpenAPI."""
     origin = None
     if path_or_url.startswith(("http://", "https://")):
-        resp = httpx.get(path_or_url, follow_redirects=True, timeout=60)
+        resp = httpx.get(path_or_url, follow_redirects=True, timeout=60, verify=tls_context())
         resp.raise_for_status()
         text, origin = resp.text, str(resp.url)
     else:

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/src/mcpsmith/model.py

@@ -150,6 +150,10 @@ class AuthScheme(BaseModel):
     login_path: str = Field(
         "", description="Browser auth: path prefix whose redirect means logged out, e.g. '/Account/Login'."
     )
+    session_cookie: str = Field(
+        "",
+        description="Browser auth: name of the cookie that proves the user is logged in; absent means session ended.",
+    )
 
     @field_validator("env")
     @classmethod

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/src/mcpsmith/runtime/http.py

@@ -16,12 +16,14 @@ import logging
 import os
 import random
 import re
+import ssl
 import time
 from collections.abc import Awaitable, Callable
 from typing import Any
 from urllib.parse import quote
 
 import httpx
+import truststore
 from mcp.server.mcpserver.exceptions import ToolError
 
 log = logging.getLogger("mcpsmith")
@@ -38,6 +40,12 @@ class ApiError(ToolError):
         self.status = status
 
 
+@functools.cache
+def tls_context() -> ssl.SSLContext:
+    """Verify with the OS trust store (fixes incomplete chains, honors corporate CAs); verification stays on."""
+    return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+
+
 @functools.cache
 def _curl() -> tuple[type, Any] | None:
     """The curl_cffi transport class (Chrome TLS/HTTP2 fingerprint) and CurlOpt, or None without the extra."""
@@ -83,6 +91,7 @@ class Api:
         secret: Callable[[str], str | None] | None = None,
         cookie_provider: Callable[[str], Awaitable[dict[str, str]]] | None = None,
         login_path: str = "",
+        session_cookie: str = "",
         proxy: str | None = None,
     ):
         if auth and (auth.get("type") not in AUTH_TYPES or not (auth.get("env") or auth.get("type") == "browser")):
@@ -100,6 +109,7 @@ class Api:
         self.secret = secret
         self.cookie_provider = cookie_provider
         self.login_path = login_path
+        self.session_cookie = session_cookie
         self.proxy = proxy
         self._transport: httpx.AsyncBaseTransport | None = None
         self._client: httpx.AsyncClient | None = None
@@ -141,11 +151,14 @@ class Api:
             sent = self._add_auth(query, headers, cookies)
             if self.auth and self.auth["type"] == "browser" and self.cookie_provider:
                 try:
-                    cookies.update(await self.cookie_provider(host))
+                    jar = await self.cookie_provider(host)
                 except (OSError, httpx.HTTPError, RuntimeError):
                     raise ApiError(
                         "The mcpsmith Chrome is not running. Start it with `mcpsmith browser`, log in, then retry."
                     ) from None
+                if self.session_cookie and self.session_cookie not in jar:
+                    raise ApiError(self._expired_message(host))
+                cookies.update(jar)
                 sent = True
         if any(re.search(r"[;\r\n]", str(v)) for v in cookies.values()) or any(
             re.search(r"[\r\n]", str(v)) for v in headers.values()
@@ -178,9 +191,7 @@ class Api:
             break
 
         if self.auth and self.auth["type"] == "browser" and sent and self._expired(r):
-            raise ApiError(
-                f"{host} says the session has expired. Log in again in the mcpsmith Chrome window, then retry."
-            )
+            raise ApiError(self._expired_message(host))
         if r.status_code >= 300:
             raise ApiError(self._status_message(r, content, host, sent), r.status_code)
         if not content:
@@ -196,6 +207,10 @@ class Api:
             self._cache[key] = (time.monotonic(), copy.deepcopy(data))
         return data
 
+    @staticmethod
+    def _expired_message(host: str) -> str:
+        return f"{host} says the session has expired. Log in again in the mcpsmith Chrome window, then retry."
+
     def _expired(self, r: httpx.Response) -> bool:
         """A 401, or a redirect to the site's login page."""
         loc = httpx.URL(r.headers.get("location", "")).path
@@ -283,7 +298,9 @@ class Api:
                 proxy=proxy,
                 max_connections=2 * self.concurrency,
             )
-        return httpx.AsyncHTTPTransport(proxy=proxy, limits=httpx.Limits(max_connections=2 * self.concurrency))
+        return httpx.AsyncHTTPTransport(
+            verify=tls_context(), proxy=proxy, limits=httpx.Limits(max_connections=2 * self.concurrency)
+        )
 
     async def _request(self, method, url, query, headers, payload, host) -> tuple[httpx.Response, bytes]:
         client, limit = self._get_client()

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/src/mcpsmith/runtime/interpret.py

@@ -65,7 +65,11 @@ def make_api(plan: Plan, source: Source | None, *, proxy: str | None = None, coo
                 raise ConnectionError("mcpsmith Chrome is not running")
             return await browser.cookies_for(host, st["port"])
 
-        extra = {"cookie_provider": cookie_provider or from_chrome, "login_path": plan.auth.login_path}
+        extra = {
+            "cookie_provider": cookie_provider or from_chrome,
+            "login_path": plan.auth.login_path,
+            "session_cookie": plan.auth.session_cookie,
+        }
     return Api(**api_kwargs(plan, source), secret=secret, proxy=proxy, **extra)
 
 

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/tests/test_design.py

@@ -225,6 +225,16 @@ def test_browser_auth_warns():
     assert any(i.level == "warning" and "token" in i.message for i in issues)
 
 
+def test_session_cookie_validation():
+    plan = valid_plan()
+    plan.auth = AuthScheme(name="b", type="browser", login_path="/Login")
+    assert any(i.level == "warning" and "session_cookie" in i.message for i in validate(plan))
+    plan.auth.session_cookie = "sid"
+    assert not [i for i in validate(plan) if "session_cookie" in i.message]
+    plan.auth = AuthScheme(name="t", type="bearer", env="EX_MCP_TOKEN", session_cookie="sid")
+    assert any("only applies to browser" in e.message for e in _errors(plan))
+
+
 def test_plan_schema_and_new_fields():
     assert "transform" in Plan.model_json_schema()["$defs"]["ToolArg"]["properties"]
     plan = valid_plan()

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/tests/test_runtime.py

@@ -1,8 +1,10 @@
 import json
+import ssl
 from typing import Annotated
 
 import httpx
 import pytest
+import truststore
 from mcp import Client
 from pydantic import Field
 
@@ -307,6 +309,27 @@ async def test_browser_auth_session_expired(status, loc):
     assert "TOPSECRET" not in str(e.value)
 
 
+@pytest.mark.parametrize("jar,sent", [({"tok": "CSRF-SECRET"}, 0), ({"tok": "CSRF-SECRET", "login": "x"}, 1)])
+async def test_browser_auth_session_cookie(jar, sent):
+    seen = []
+
+    async def provider(host):
+        return jar
+
+    def handler(request):
+        seen.append(request)
+        return httpx.Response(200, json={})
+
+    api = make_api(handler, auth={"type": "browser"}, cookie_provider=provider, session_cookie="login")
+    if sent:
+        await api.call("GET", "/x")
+    else:
+        with pytest.raises(ApiError, match="says the session has expired") as e:
+            await api.call("GET", "/x")
+        assert "CSRF-SECRET" not in str(e.value)
+    assert len(seen) == sent
+
+
 async def test_browser_auth_chrome_not_running():
     async def down(host):
         raise ConnectionError("no chrome")
@@ -334,11 +357,11 @@ async def test_make_api_browser_needs_running_chrome(monkeypatch):
         prefix="x",
         base_url="https://api.example.com",
         env_prefix="EX_MCP",
-        auth=AuthScheme(name="b", type="browser", login_path="/Login"),
+        auth=AuthScheme(name="b", type="browser", login_path="/Login", session_cookie="sid"),
     )
     api = build(plan, None)
     api.set_transport(httpx.MockTransport(lambda r: httpx.Response(200, json={})))
-    assert api.login_path == "/Login"
+    assert api.login_path == "/Login" and api.session_cookie == "sid"
     with pytest.raises(ApiError, match="not running"):
         await api.call("GET", "/x")
 
@@ -351,3 +374,10 @@ async def test_browser_auth_cookie_errors_map_to_not_running(exc):
     api = make_api(lambda r: httpx.Response(200, json={}), auth={"type": "browser"}, cookie_provider=down)
     with pytest.raises(ApiError, match="The mcpsmith Chrome is not running"):
         await api.call("GET", "/x")
+
+
+def test_plain_transport_verifies_with_os_trust_store():
+    transport = Api(base_url="https://api.example.com", env_prefix="EX_MCP")._make_transport(None)
+    ctx = transport._pool._ssl_context
+    assert isinstance(ctx, truststore.SSLContext) and ctx is http.tls_context()
+    assert ctx.verify_mode == ssl.CERT_REQUIRED

{mcpsmith-0.2.0 → mcpsmith-0.2.2}/uv.lock

@@ -689,13 +689,14 @@ wheels = [
 
 [[package]]
 name = "mcpsmith"
-version = "0.2.0"
+version = "0.2.2"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },
     { name = "keyring" },
     { name = "mcp" },
     { name = "pyyaml" },
+    { name = "truststore" },
     { name = "tzdata", marker = "sys_platform == 'win32'" },
     { name = "websockets", version = "16.1.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
     { name = "websockets", version = "17.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
@@ -726,6 +727,7 @@ requires-dist = [
     { name = "mcp", specifier = ">=2.2,<3" },
     { name = "playwright", marker = "extra == 'capture'", specifier = ">=1.45" },
     { name = "pyyaml", specifier = ">=6" },
+    { name = "truststore", specifier = ">=0.9" },
     { name = "tzdata", marker = "sys_platform == 'win32'", specifier = ">=2024.1" },
     { name = "websockets", specifier = ">=12" },
 ]