()
| 139 | }); |
| 140 | |
| 141 | export const makeCloudMcpAgentHandler = () => { |
| 142 | const serveOptions = { |
| 143 | binding: "MCP_SESSION", |
| 144 | transport: "streamable-http", |
| 145 | } as const; |
| 146 | // The agents SDK builds an exact-match `URLPattern` from the path handed to |
| 147 | // `serve` (see `createStreamingHttpHandler` in `agents/dist/mcp/index.js`) — |
| 148 | // a single `/mcp` handler never matches `/mcp/toolkits/<slug>` and falls |
| 149 | // through to its own internal 404. A second `serve` mounted on the |
| 150 | // parameterized path picks it up (`URLPattern` supports `:slug` segments); |
| 151 | // the auth/ownership/props logic above is unchanged and shared, only the |
| 152 | // final dispatch target differs. |
| 153 | const serve = McpSessionDOSqlite.serve("/mcp", serveOptions); |
| 154 | const serveToolkit = McpSessionDOSqlite.serve("/mcp/toolkits/:slug", serveOptions); |
| 155 | |
| 156 | const ALLOWED_METHODS = new Set(["GET", "POST", "DELETE", "OPTIONS"]); |
| 157 | |
| 158 | return async (request: Request, env: Env, ctx: ExecutionContext): Promise<Response> => { |
| 159 | if (request.method === "OPTIONS") return corsPreflightResponse(); |
| 160 | // The old envelope (packages/hosts/mcp/src/envelope.ts) answered anything |
| 161 | // outside GET/POST/DELETE/OPTIONS with a JSON-RPC 405; the agents SDK |
| 162 | // handler only understands its own transport verbs and falls through to |
| 163 | // a bare 404. Reject before authenticating so PUT/PATCH/etc never reach |
| 164 | // the session engine. |
| 165 | if (!ALLOWED_METHODS.has(request.method)) { |
| 166 | return jsonRpcResponse(405, -32001, "Method not allowed"); |
| 167 | } |
| 168 | const sessionId = request.headers.get("mcp-session-id"); |
| 169 | |
| 170 | const { auth, outcome } = await runTraced(request, authenticate(request)); |
| 171 | if (!Predicate.isTagged(outcome, "Authenticated")) { |
| 172 | // Destroying a live session on auth grounds requires a POSITIVE |
| 173 | // determination that access is genuinely gone — only `Forbidden` carries |
| 174 | // that (valid bearer, org absent/revoked). `Unavailable` (transient WorkOS |
| 175 | // / JWKS failure) and `Unauthorized` (retry with a fresh token) must leave |
| 176 | // the session intact, so the condemn path is gated on `Forbidden` alone. |
| 177 | if (Predicate.isTagged(outcome, "Forbidden") && sessionId) { |
| 178 | await Effect.runPromise( |
| 179 | Effect.ignore( |
| 180 | Effect.tryPromise(() => |
| 181 | mcpSessionStub(env.MCP_SESSION, sessionId)._cf_scheduleDestroy(), |
| 182 | ), |
| 183 | ), |
| 184 | ); |
| 185 | } |
| 186 | return renderAuthError(auth, request, outcome); |
| 187 | } |
| 188 | |
| 189 | if (!sessionId && request.method === "DELETE") { |
| 190 | // Matches the old envelope's contract (@modelcontextprotocol/sdk's |
| 191 | // `WebStandardStreamableHTTPServerTransport.handleDeleteRequest`): 200, |
| 192 | // not 204 — see e2e/cloud/mcp-protocol.test.ts. |
| 193 | return new Response(null, { |
| 194 | status: 200, |
| 195 | headers: { "access-control-allow-origin": "*" }, |
| 196 | }); |
| 197 | } |
| 198 |
no test coverage detected