Blame · Line-by-line history

`mcp.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

mcp.tsBlame95 lines · 1 contributor

Normal view Raw

2c2163eClaude	1	/**
	2	* Model Context Protocol HTTP transport.
	3	*
	4	* POST /mcp — JSON-RPC 2.0 requests; body is a single request
	5	* or an array (batch). Response shape mirrors.
	6	* GET /mcp — Lightweight discovery: returns server info +
	7	* protocol version + tool count.
	8	*
	9	* Auth: softAuth — `userId` in the McpContext is the cookie/PAT/OAuth
	10	* user when present, null otherwise. v1 tools are read-only and public-
	11	* only, so anonymous works; write tools (v2) will require requireAuth +
	12	* write-access on the target repo.
	13	*
	14	* Streamable-HTTP-mode is the recommended MCP transport for stateless
	15	* cloud servers. We don't emit server-sent notifications yet, so the
	16	* route is plain JSON in / JSON out.
	17	*/
	18
	19	import { Hono } from "hono";
	20	import { softAuth } from "../middleware/auth";
	21	import type { AuthEnv } from "../middleware/auth";
	22	import {
	23	routeMcpRequest,
	24	MCP_PROTOCOL_VERSION,
	25	MCP_SERVER_NAME,
	26	MCP_SERVER_VERSION,
	27	} from "../lib/mcp";
	28	import { defaultTools } from "../lib/mcp-tools";
	29
	30	const mcp = new Hono<AuthEnv>();
	31
	32	mcp.use("*", softAuth);
	33
	34	mcp.get("/mcp", (c) => {
	35	const tools = defaultTools();
	36	return c.json({
	37	protocolVersion: MCP_PROTOCOL_VERSION,
	38	serverInfo: { name: MCP_SERVER_NAME, version: MCP_SERVER_VERSION },
	39	transport: "http",
	40	toolCount: Object.keys(tools).length,
	41	docs:
	42	"POST /mcp with a JSON-RPC 2.0 envelope to call. See https://spec.modelcontextprotocol.io/",
	43	});
	44	});
	45
	46	mcp.post("/mcp", async (c) => {
	47	const user = c.get("user") ?? null;
0feb720Claude	48	// Scope derivation mirrors the API-auth middleware:
	49	// - OAuth bearer (glct_) → oauthScopes from middleware
	50	// - PAT (glc_) → oauthScopes from middleware
	51	// - Session cookie → full ["repo","user","admin"]
	52	// - Anonymous → []
	53	const oauthScopes = c.get("oauthScopes");
	54	let scopes: string[] = [];
	55	if (Array.isArray(oauthScopes)) {
	56	scopes = oauthScopes;
	57	} else if (user) {
	58	scopes = ["repo", "user", "admin"];
	59	}
	60	const ctx = { userId: user?.id ?? null, scopes };
2c2163eClaude	61	const tools = defaultTools();
	62
	63	let body: unknown;
	64	try {
	65	body = await c.req.json();
	66	} catch {
	67	return c.json(
	68	{
	69	jsonrpc: "2.0",
	70	id: null,
	71	error: { code: -32700, message: "Parse error" },
	72	},
	73	400
	74	);
	75	}
	76
	77	if (Array.isArray(body)) {
	78	// Batched request — pass each through, drop nulls (notifications).
	79	const out = await Promise.all(
	80	body.map((entry) => routeMcpRequest(entry, { ctx, tools }))
	81	);
	82	const filtered = out.filter((r): r is NonNullable<typeof r> => r !== null);
	83	if (filtered.length === 0) return c.body(null, 204);
	84	return c.json(filtered);
	85	}
	86
	87	const result = await routeMcpRequest(body, { ctx, tools });
	88	if (result === null) {
	89	// Notification — no response body, 204.
	90	return c.body(null, 204);
	91	}
	92	return c.json(result);
	93	});
	94
	95	export default mcp;