openapi-to-mcp-cli 0.9.3__tar.gz → 0.11.0__tar.gz

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openapi-to-mcp-cli
-Version: 0.9.3
+Version: 0.11.0
 Summary: Generate, run, and test Node.js/TypeScript MCP servers from OpenAPI specifications.
 Project-URL: Homepage, https://github.com/nihal1294/openapi-to-mcp
 Project-URL: Documentation, https://nihal1294.github.io/openapi-to-mcp/
@@ -19,7 +19,7 @@ Classifier: Topic :: Software Development :: Code Generators
 Requires-Python: >=3.14
 Requires-Dist: click==8.5.0
 Requires-Dist: jinja2==3.1.6
-Requires-Dist: mcp==2.2.0
+Requires-Dist: mcp==2.3.0
 Requires-Dist: openapi-spec-validator==0.9.0
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: requests==2.34.2

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/adapters/generator.py

@@ -14,6 +14,7 @@ RUNTIME_TEMPLATE_NAMES = (
     "audit",
     "request_context",
     "auth",
+    "basic_auth",
     "cache",
     "circuit_breaker",
     "config",
@@ -36,6 +37,7 @@ RUNTIME_TEMPLATE_NAMES = (
     "tool_access",
     "validation",
 )
+HTTP_RUNTIME_TEMPLATE_NAMES = ("health",)
 CUSTOM_TEMPLATE_NAMES = ("tools",)
 
 
@@ -119,6 +121,7 @@ class Generator:
         Raises:
             GenerationError: If template rendering or file writing fails.
         """
+        self._remove_unused_http_runtime_files()
         generated_templates = {
             "package.json.j2": self.output_path / "package.json",
             "tsconfig.json.j2": self.output_path / "tsconfig.json",
@@ -134,11 +137,26 @@ class Generator:
         for template_name, output_file in self._custom_templates().items():
             self._render_if_missing(template_name, output_file)
 
+    def _remove_unused_http_runtime_files(self) -> None:
+        """Remove generated HTTP-only runtime files before a stdio regeneration."""
+        if self.context.get("transport") == "streamable-http":
+            return
+        runtime_output = self.output_path / "src" / "runtime"
+        try:
+            for name in HTTP_RUNTIME_TEMPLATE_NAMES:
+                (runtime_output / f"{name}.ts").unlink(missing_ok=True)
+        except OSError as e:
+            err_msg = f"Failed to remove unused HTTP runtime files: {e}"
+            raise GenerationError(err_msg) from e
+
     def _runtime_templates(self) -> dict[str, Path]:
         runtime_output = self.output_path / "src" / "runtime"
+        template_names = RUNTIME_TEMPLATE_NAMES
+        if self.context.get("transport") == "streamable-http":
+            template_names += HTTP_RUNTIME_TEMPLATE_NAMES
         return {
             f"src/runtime/{name}.ts.j2": runtime_output / f"{name}.ts"
-            for name in RUNTIME_TEMPLATE_NAMES
+            for name in template_names
         }
 
     def _custom_templates(self) -> dict[str, Path]:

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/common/tool_runtime.py

@@ -64,7 +64,7 @@ def derive_auth_env_vars(
             if not isinstance(scheme_name, str) or not isinstance(scheme_def, dict):
                 continue
             normalized = "".join(
-                c if c.isalnum() else "_" for c in scheme_name.upper()
+                c if c.isascii() and c.isalnum() else "_" for c in scheme_name.upper()
             ).strip("_")
             normalized = "_".join(part for part in normalized.split("_") if part)
             if not normalized:
@@ -73,6 +73,10 @@ def derive_auth_env_vars(
             http_scheme = str(scheme_def.get("scheme", "")).lower()
             if scheme_type == "apikey":
                 env_vars.add(f"AUTH_{normalized}_API_KEY")
+            elif scheme_type == "http" and http_scheme == "basic":
+                env_vars.update(
+                    (f"AUTH_{normalized}_USERNAME", f"AUTH_{normalized}_PASSWORD")
+                )
             elif (scheme_type == "http" and http_scheme == "bearer") or scheme_type in {
                 "oauth2",
                 "openidconnect",

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/doctor/analyzer.py

@@ -6,6 +6,7 @@ from typing import Any
 
 from openapi_to_mcp.doctor.models import DoctorReport
 from openapi_to_mcp.doctor.security import (
+    check_security_header_conflicts,
     check_security_scheme,
     referenced_scheme_names,
     security_schemes,
@@ -151,6 +152,12 @@ class DoctorAnalyzer:
         schemes: dict[str, Any],
         location: str,
     ) -> None:
+        check_security_header_conflicts(
+            report,
+            source=source,
+            schemes=schemes,
+            location=location,
+        )
         for scheme_name in referenced_scheme_names(source):
             check_security_scheme(
                 report,

openapi_to_mcp_cli-0.11.0/openapi_to_mcp/doctor/security.py

@@ -0,0 +1,136 @@
+"""Security-scheme diagnostics helpers for doctor."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+_SUPPORTED_SECURITY_TYPES = {"apiKey", "oauth2", "openIdConnect"}
+
+if TYPE_CHECKING:
+    from openapi_to_mcp.doctor.models import DoctorReport
+
+
+def security_schemes(spec: dict[str, Any]) -> dict[str, Any]:
+    """Return normalized OpenAPI security scheme definitions."""
+    components = spec.get("components", {})
+    if isinstance(components, dict):
+        schemes = components.get("securitySchemes")
+        if isinstance(schemes, dict):
+            return schemes
+    definitions = spec.get("securityDefinitions", {})
+    return definitions if isinstance(definitions, dict) else {}
+
+
+def referenced_scheme_names(source: object) -> list[str]:
+    """Extract security scheme names from a requirement list."""
+    if not isinstance(source, list):
+        return []
+    names: list[str] = []
+    for requirement in source:
+        if not isinstance(requirement, dict):
+            continue
+        names.extend(name for name in requirement if isinstance(name, str))
+    return names
+
+
+def check_security_header_conflicts(
+    report: DoctorReport,
+    *,
+    source: object,
+    schemes: dict[str, Any],
+    location: str,
+) -> None:
+    """Warn when one security requirement targets the same header twice."""
+    if not isinstance(source, list) or not isinstance(schemes, dict):
+        return
+    for requirement in source:
+        if not isinstance(requirement, dict) or not _valid_scope_values(requirement):
+            continue
+        headers: dict[str, list[str]] = {}
+        for scheme_name in requirement:
+            if not isinstance(scheme_name, str):
+                continue
+            header = _runtime_auth_header(schemes.get(scheme_name))
+            if header is None:
+                continue
+            headers.setdefault(header.lower(), []).append(scheme_name)
+        conflicts = [names for names in headers.values() if len(names) > 1]
+        if not conflicts:
+            continue
+        names = ", ".join(name for conflict in conflicts for name in conflict)
+        report.add_warning(
+            "conflicting_auth_headers",
+            f"Security requirement combines schemes `{names}` that target the same HTTP header.",
+            location,
+            "Distinct auth values cannot share one header; use security alternatives or distinct header locations.",
+        )
+
+
+def _valid_scope_values(requirement: dict[object, object]) -> bool:
+    """Return whether a security requirement has valid scope-array values."""
+    return all(
+        isinstance(scopes, list) and all(isinstance(scope, str) for scope in scopes)
+        for scopes in requirement.values()
+    )
+
+
+def _runtime_auth_header(scheme: object) -> str | None:
+    """Return the header targeted by a supported runtime auth scheme."""
+    if not isinstance(scheme, dict):
+        return None
+    scheme_type = scheme.get("type")
+    if scheme_type == "http":
+        http_scheme = scheme.get("scheme")
+        if isinstance(http_scheme, str) and http_scheme.lower() in {"basic", "bearer"}:
+            return "Authorization"
+    elif scheme_type in {"oauth2", "openIdConnect"}:
+        return "Authorization"
+    elif scheme_type == "apiKey":
+        location = scheme.get("in")
+        name = scheme.get("name")
+        if (
+            isinstance(location, str)
+            and location.lower() == "header"
+            and isinstance(name, str)
+            and name.strip()
+        ):
+            return name
+    return None
+
+
+def check_security_scheme(
+    report: DoctorReport,
+    *,
+    name: str,
+    scheme: dict[str, Any] | None,
+    location: str,
+) -> None:
+    """Record a doctor issue for undefined or unsupported security schemes."""
+    if not isinstance(scheme, dict):
+        report.add_error(
+            "undefined_security_scheme",
+            f"Security requirement references undefined scheme `{name}`.",
+            location,
+            "Define the scheme under `components.securitySchemes`.",
+        )
+        return
+    scheme_type = scheme.get("type")
+    if scheme_type in _SUPPORTED_SECURITY_TYPES:
+        return
+    if scheme_type == "http":
+        http_scheme = scheme.get("scheme")
+        if isinstance(http_scheme, str) and http_scheme.lower() in {"bearer", "basic"}:
+            return
+        report.add_error(
+            "unsupported_http_auth",
+            f"Security scheme `{name}` uses unsupported HTTP scheme `{http_scheme}`.",
+            location,
+            "Use HTTP basic/bearer, apiKey, oauth2, or openIdConnect for generated runtime auth.",
+        )
+        return
+    report.add_error(
+        "unsupported_security_scheme",
+        f"Security scheme `{name}` uses unsupported type `{scheme_type}`.",
+        location,
+        "Use HTTP basic/bearer, apiKey, oauth2, or openIdConnect for generated runtime auth.",
+    )

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/policy/swagger.py

@@ -51,7 +51,7 @@ def _runtime_supports_scheme(scheme: object) -> bool:
         return False
     scheme_type = str(scheme.get("type", "")).lower()
     if scheme_type == "http":
-        return str(scheme.get("scheme", "")).lower() == "bearer"
+        return str(scheme.get("scheme", "")).lower() in {"bearer", "basic"}
     if scheme_type == "apikey":
         location = scheme.get("in")
         name = scheme.get("name")

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/templates/README.md.j2

@@ -81,6 +81,8 @@ The `conservative` preset leaves caching off by default, but if you later enable
     *   **Runtime Validation:**
         *   Generated tool input validation is set to `{{ runtime_validation }}`.
         *   When set to `input`, tool arguments are validated against the generated `inputSchema` before the upstream API call.
+        *   Regardless of this setting, a tool call may contain at most 10,000 nested argument elements. Larger inputs are rejected before schema validation or an upstream call with the standard JSON-RPC `Invalid Params` error (`-32602`). This is a structural count of object properties and array entries, not a byte limit for scalar strings. For `streamable-http`, Express separately rejects request bodies over 1 MiB.
+        *   **Migration:** This guard has no environment override. For legitimate larger structured payloads, split work across tool calls or pass a bounded reference that the upstream API can retrieve.
     *   **Structured Tool Errors:**
         *   Tool failures return machine-readable metadata under `_meta.error`.
         *   `_meta.error.retryable` is advisory only and does not define any retry interval or backoff policy.
@@ -92,6 +94,9 @@ The `conservative` preset leaves caching off by default, but if you later enable
     *   **Streamable HTTP Settings (if transport is `streamable-http`):**
         *   `MCP_HTTP_HOST`, `MCP_HTTP_PORT`, `MCP_HTTP_ENDPOINT`, `MCP_ALLOWED_ORIGINS`, `MCP_ALLOWED_HOSTS`
         *   Invalid `TARGET_API_BASE_URL` values also fail fast at startup. Use an absolute `http` or `https` URL.
+        *   The fixed `/healthz` and `/readyz` paths provide local probes. `GET /healthz` returns `200` with `{"status":"ok"}`; `GET /readyz` returns `200` with `{"status":"ready"}` once the listener is ready, or `503` with `{"status":"not_ready"}` while marked not ready. Before the listener binds, probes are unreachable.
+        *   Probes set `Cache-Control: no-store`, use the same Host and Origin allowlists, and require no MCP session, tool identity, upstream credentials, or dependency availability. `HEAD` follows GET semantics; other methods return `405`.
+        *   `/healthz` and `/readyz` are reserved paths, including case and trailing-slash equivalents. If `MCP_HTTP_ENDPOINT` equals or matches one of them, change it to a separate path such as `/mcp` and update clients before deploying; conflicts fail at startup. Probes stop succeeding when the server shuts down; readiness does not add a draining grace period or promise upstream availability.
 
 3.  **Install Dependencies:**
     ```bash
@@ -119,6 +124,10 @@ To run the server in development mode with automatic rebuilding and restarting o
 npm run dev
 ```
 
+The generated npm manifest uses a scoped override to keep nodemon's glob matcher
+on a patched minimatch release. Preserve that override when updating development
+dependencies until nodemon's own dependency range includes the fix.
+
 ## Safe customization
 
 - `src/custom/tools.ts` is the preserved entry point for user-owned MCP tools.
@@ -135,6 +144,28 @@ delimiters (`#`, `&`, `=`, `+`, `[`, and `]`) remain percent encoded so a value
 cannot create another query field or fragment. Parameter names continue to use
 safe standard encoding.
 
+## Upstream HTTP Basic authentication
+
+For an OpenAPI 3 `type: http`, `scheme: basic` security scheme, set
+`AUTH_<SCHEME>_USERNAME` and `AUTH_<SCHEME>_PASSWORD` in the server environment or
+`.env`. Use the exact names listed in `.env.example`; for `BasicAuth`, they are
+`AUTH_BASICAUTH_USERNAME` and `AUTH_BASICAUTH_PASSWORD`. These are upstream API
+credentials and do not authenticate incoming MCP clients.
+
+The username must be nonempty, and the password must be defined (an explicitly
+empty password is supported). Spaces are preserved. Usernames cannot contain
+colons, and neither value can contain ASCII control characters. Invalid or
+missing values fail before an upstream request with `invalid_credentials` or
+`missing_credentials` errors that name the affected variables without their values.
+
+The runtime sends UTF-8 Base64 credentials in `Authorization: Basic`, taking
+precedence over `TARGET_API_AUTH_HEADER`. It does not negotiate legacy encodings.
+Use HTTPS upstream because Base64 does not encrypt credentials. Default audit
+logging redacts the Authorization header.
+Combined security schemes cannot send different values in the same HTTP header.
+Conflicts (such as Basic and Bearer both requiring Authorization) fail with
+`invalid_credentials`, unless another security alternative can be satisfied.
+
 ## MCP Tools
 
 This server exposes the following tools based on the OpenAPI specification:

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/templates/package.json.j2

@@ -20,8 +20,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    {% if transport == 'streamable-http' %}"@modelcontextprotocol/node": "^2.0.0",
-    {% endif %}"@modelcontextprotocol/server": "^2.0.0",
+    {% if transport == 'streamable-http' %}"@modelcontextprotocol/node": "^2.1.2",
+    {% endif %}"@modelcontextprotocol/server": "^2.4.0",
     {%- if runtime_validation == 'input' %}
     "ajv": "^8.20.0",
     {%- endif %}
@@ -36,5 +36,10 @@
     "@types/node": "^22.20.4",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
+  },
+  "overrides": {
+    "nodemon": {
+      "minimatch": "^11.0.8"
+    }
   }
 }

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/templates/src/runtime/auth.ts.j2

@@ -1,3 +1,4 @@
+import { resolveBasicCredentials } from './basic_auth.js';
 import type { ToolRuntimeMetadata } from './generated.js';
 
 export interface ResolvedAuth {
@@ -6,6 +7,7 @@ export interface ResolvedAuth {
   query: Record<string, unknown>;
   cookies: Record<string, string>;
   missing: string[];
+  invalid?: string[];
 }
 
 function normalizeSchemeName(name: string): string {
@@ -16,6 +18,22 @@ function normalizeSchemeName(name: string): string {
     .replace(/_+/g, '_');
 }
 
+function mergeAuthHeaders(
+  headers: Record<string, string>,
+  values: Array<[string, string]>
+): string[] {
+  const conflicts: string[] = [];
+  for (const [name, value] of values) {
+    const existing = Object.keys(headers).find((key) => key.toLowerCase() === name.toLowerCase());
+    if (existing !== undefined && headers[existing] !== value) {
+      conflicts.push(`conflicting values for auth header ${name}`);
+    } else {
+      headers[existing ?? name] = value;
+    }
+  }
+  return conflicts;
+}
+
 export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
   const securityRequirements = tool.security;
   const securitySchemes = tool.securitySchemes || {};
@@ -24,6 +42,7 @@ export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
   }
 
   const missingAcrossRequirements: Set<string> = new Set();
+  const invalidAcrossRequirements: Set<string> = new Set();
   for (const requirement of securityRequirements) {
     if (!requirement || typeof requirement !== 'object') {
       continue;
@@ -34,6 +53,7 @@ export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
     }
 
     const headers: Record<string, string> = {};
+    const headerValues: Array<[string, string]> = [];
     const query: Record<string, unknown> = {};
     const cookies: Record<string, string> = {};
     let satisfied = true;
@@ -63,8 +83,20 @@ export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
         } else if (apiKeyIn === 'cookie') {
           cookies[apiKeyName] = apiKey;
         } else {
-          headers[apiKeyName] = apiKey;
+          headerValues.push([apiKeyName, apiKey]);
+        }
+        continue;
+      }
+
+      if (schemeType === 'http' && httpScheme === 'basic') {
+        const credentials = resolveBasicCredentials(normalizedScheme);
+        if (!credentials.authorization) {
+          satisfied = false;
+          credentials.missing.forEach((name) => missingAcrossRequirements.add(name));
+          credentials.invalid.forEach((issue) => invalidAcrossRequirements.add(issue));
+          break;
         }
+        headerValues.push(['Authorization', credentials.authorization]);
         continue;
       }
 
@@ -75,7 +107,7 @@ export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
           missingAcrossRequirements.add(`AUTH_${normalizedScheme}_TOKEN`);
           break;
         }
-        headers.Authorization = `Bearer ${token}`;
+        headerValues.push(['Authorization', `Bearer ${token}`]);
         continue;
       }
 
@@ -86,7 +118,7 @@ export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
           missingAcrossRequirements.add(`AUTH_${normalizedScheme}_TOKEN`);
           break;
         }
-        headers.Authorization = `Bearer ${token}`;
+        headerValues.push(['Authorization', `Bearer ${token}`]);
         continue;
       }
 
@@ -103,6 +135,11 @@ export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
       break;
     }
 
+    if (satisfied) {
+      const conflicts = mergeAuthHeaders(headers, headerValues);
+      conflicts.forEach((issue) => invalidAcrossRequirements.add(issue));
+      satisfied = conflicts.length === 0;
+    }
     if (satisfied) {
       return { ok: true, headers, query, cookies, missing: [] };
     }
@@ -114,5 +151,6 @@ export function resolveAuthForTool(tool: ToolRuntimeMetadata): ResolvedAuth {
     query: {},
     cookies: {},
     missing: [...missingAcrossRequirements],
+    invalid: [...invalidAcrossRequirements],
   };
 }

openapi_to_mcp_cli-0.11.0/openapi_to_mcp/templates/src/runtime/basic_auth.ts.j2

@@ -0,0 +1,36 @@
+import { Buffer } from 'node:buffer';
+
+interface BasicCredentials {
+  authorization?: string;
+  missing: string[];
+  invalid: string[];
+}
+
+/** Resolve upstream Basic credentials without including their values in errors. */
+export function resolveBasicCredentials(normalizedScheme: string): BasicCredentials {
+  const usernameEnv = `AUTH_${normalizedScheme}_USERNAME`;
+  const passwordEnv = `AUTH_${normalizedScheme}_PASSWORD`;
+  const username = process.env[usernameEnv];
+  const password = process.env[passwordEnv];
+  const missing: string[] = [];
+  const invalid: string[] = [];
+  if (!username) missing.push(usernameEnv);
+  if (password === undefined) missing.push(passwordEnv);
+
+  // RFC 7617 forbids control characters in credentials and ':' in user IDs.
+  const controlCharacters = /[\x00-\x1f\x7f]/;
+  if (username && (username.includes(':') || controlCharacters.test(username))) {
+    invalid.push(`${usernameEnv} (must not contain colons or control characters)`);
+  }
+  if (password !== undefined && controlCharacters.test(password)) {
+    invalid.push(`${passwordEnv} (must not contain control characters)`);
+  }
+  if (missing.length > 0 || invalid.length > 0) {
+    return { missing, invalid };
+  }
+  return {
+    authorization: `Basic ${Buffer.from(`${username}:${password}`, 'utf8').toString('base64')}`,
+    missing,
+    invalid,
+  };
+}

openapi_to_mcp_cli-0.11.0/openapi_to_mcp/templates/src/runtime/health.ts.j2

@@ -0,0 +1,106 @@
+import express, { type Express, type Request, type Response } from 'express';
+
+export const HEALTH_PATH = '/healthz';
+export const READINESS_PATH = '/readyz';
+
+export type Readiness = {
+  isReady: () => boolean;
+  markNotReady: () => void;
+  markReady: () => void;
+};
+
+type RequestGuard = (req: Request, res: Response) => boolean;
+
+export function createReadiness(): Readiness {
+  let ready = false;
+
+  return {
+    isReady: () => ready,
+    markNotReady: () => {
+      ready = false;
+    },
+    markReady: () => {
+      ready = true;
+    },
+  };
+}
+
+export async function assertOperationalRouteSeparation(
+  endpoint: string
+): Promise<void> {
+  const probePaths = [HEALTH_PATH, READINESS_PATH].flatMap((path) => [path, `${path}/`]);
+  for (const path of probePaths) {
+    if (await endpointMatchesPath(endpoint, path)) {
+      throw new Error(
+        `Invalid MCP_HTTP_ENDPOINT '${endpoint}'. It conflicts with reserved operational route '${path}'.`
+      );
+    }
+  }
+}
+
+export function registerOperationalRoutes(
+  app: Express,
+  readiness: Readiness,
+  isRequestAllowed: RequestGuard
+): void {
+  registerOperationalRoute(app, HEALTH_PATH, isRequestAllowed, () => ({
+    status: 200,
+    body: { status: 'ok' },
+  }));
+  registerOperationalRoute(app, READINESS_PATH, isRequestAllowed, () => ({
+    status: readiness.isReady() ? 200 : 503,
+    body: { status: readiness.isReady() ? 'ready' : 'not_ready' },
+  }));
+}
+
+function registerOperationalRoute(
+  app: Express,
+  path: string,
+  isRequestAllowed: RequestGuard,
+  response: () => { status: number; body: { status: string } }
+): void {
+  app.all(path, (req, res) => {
+    res.set('Cache-Control', 'no-store');
+    if (!isRequestAllowed(req, res)) {
+      return;
+    }
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.set('Allow', 'GET, HEAD').status(405).json({ error: 'Method not allowed' });
+      return;
+    }
+    const { status, body } = response();
+    res.status(status).json(body);
+  });
+}
+
+async function endpointMatchesPath(endpoint: string, path: string): Promise<boolean> {
+  const matcher = express();
+  let matched = false;
+  matcher.all(endpoint, (_req, _res, next) => {
+    matched = true;
+    next();
+  });
+
+  const request = {
+    baseUrl: '',
+    headers: {},
+    method: 'GET',
+    originalUrl: path,
+    url: path,
+  } as Request;
+  const response = {
+    setHeader: () => undefined,
+  } as unknown as Response;
+
+  await new Promise<void>((resolve, reject) => {
+    matcher(request, response, (error?: unknown) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve();
+    });
+  });
+
+  return matched;
+}

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/templates/src/runtime/request.ts.j2

@@ -142,11 +142,14 @@ function applyAuthContext(
 ): string[] {
   const resolvedAuth = resolveAuthForTool(tool);
   if (!resolvedAuth.ok) {
+    const invalid = resolvedAuth.invalid || [];
     throw createToolExecutionError(
-      'missing_credentials',
+      invalid.length > 0 ? 'invalid_credentials' : 'missing_credentials',
       'auth',
       false,
-      `Missing credentials for required security scheme(s): ${resolvedAuth.missing.join(', ')}`
+      invalid.length > 0
+        ? `Invalid credentials for required security scheme(s): ${invalid.join(', ')}${resolvedAuth.missing.length > 0 ? `; missing: ${resolvedAuth.missing.join(', ')}` : ''}`
+        : `Missing credentials for required security scheme(s): ${resolvedAuth.missing.join(', ')}`
     );
   }
   Object.assign(headers, resolvedAuth.headers);
@@ -157,7 +160,7 @@ function applyAuthContext(
 }
 
 function applyDefaultAuthHeader(headers: Record<string, string>): void {
-  if (!TARGET_API_AUTH_HEADER || headers.Authorization) {
+  if (!TARGET_API_AUTH_HEADER || Object.keys(headers).some((name) => name.toLowerCase() === 'authorization')) {
     return;
   }
   const separatorIndex = TARGET_API_AUTH_HEADER.indexOf(':');

{openapi_to_mcp_cli-0.9.3 → openapi_to_mcp_cli-0.11.0}/openapi_to_mcp/templates/src/server.ts.j2

@@ -21,6 +21,46 @@ import {
   filterToolsForCaller,
 } from './runtime/tool_access.js';
 
+const MAX_TOOL_ARGUMENT_ELEMENTS = 10_000;
+
+function assertToolArgumentBounds(args: Record<string, unknown>): void {
+  const pending: unknown[] = [args];
+  let elementCount = 0;
+
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (Array.isArray(current)) {
+      for (const value of current) {
+        elementCount += 1;
+        if (elementCount > MAX_TOOL_ARGUMENT_ELEMENTS) {
+          throw new ProtocolError(
+            ProtocolErrorCode.InvalidParams,
+            `Tool arguments exceed the ${MAX_TOOL_ARGUMENT_ELEMENTS} element limit.`
+          );
+        }
+        pending.push(value);
+      }
+      continue;
+    }
+    if (current && typeof current === 'object') {
+      const record = current as Record<string, unknown>;
+      for (const key in record) {
+        if (!Object.hasOwn(record, key)) {
+          continue;
+        }
+        elementCount += 1;
+        if (elementCount > MAX_TOOL_ARGUMENT_ELEMENTS) {
+          throw new ProtocolError(
+            ProtocolErrorCode.InvalidParams,
+            `Tool arguments exceed the ${MAX_TOOL_ARGUMENT_ELEMENTS} element limit.`
+          );
+        }
+        pending.push(record[key]);
+      }
+    }
+  }
+}
+
 function buildCustomToolMap(): Map<string, CustomToolDefinition> {
   const customToolMap = new Map<string, CustomToolDefinition>();
   for (const customTool of getCustomTools()) {
@@ -116,6 +156,7 @@ export class OpenApiMcpServer {
             `Tool '${toolName}' not found.`
           );
         }
+        assertToolArgumentBounds(args);
         try {
           assertToolAllowed(toolName);
           const result = customTool