mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
1a4e13f0e9
Wire protocol: replace @modelcontextprotocol/sdk 1.30 with @modelcontextprotocol/server + /node 2.0.0 (zod 4). One per-request factory (mcp-server-factory.ts, extracted from index.ts) serves both eras through mcp-http.ts: 2026-07-28 clients via createMcpHandler (legacy:'reject', JSON response mode, server/discover, Mcp-Method routing), 2025 clients through the existing stateless transport with enableJsonResponse — routed on the SDK's own isLegacyRequest predicate, because the built-in stateless fallback would answer every current client with SSE and lose the gzip win. Capabilities now declare listChanged:false explicitly; cacheHints stamp ttlMs/cacheScope:'private' on discover/list results (5 min) and resource reads (60 min) — the catalog is role-dependent, so never public. Authorization: advertise client_id_metadata_document_supported; an https client_id is a Client ID Metadata Document resolved by cimd.ts (URL-shape checks, SSRF gate on every resolved address before any request, no redirects, 5 s / 16 KB caps, exact client_id match, bounded redirect_uris, 10-60 min cache). The requested redirect_uri still has to pass the dynamic-registration allowlist; HMAC-signed DCR client_ids remain the fallback. Field limits moved to oauth-limits.ts (no import cycle). Tests: mcp-http.test.ts drives the real v2 client over loopback HTTP in both eras and pins role parity; cimd.test.ts / oauth-cimd.test.ts cover recognition, SSRF, validation, cache and the router paths. Package 1.5 -> 1.6. OKF doc docs/mcp/protocol-eras-and-cimd.md; mcp-oauth-flow.md updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>