Update mcp-bridge

.gitignore

@@ -1,10 +1,5 @@
 .env
-.venv/
-venv/
 __pycache__/
 *.pyc
-*.pyo
-*.pyd
-.DS_Store
 .hf/
 *.zip

Dockerfile

@@ -1,11 +1,9 @@
 FROM python:3.11-slim
 
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PORT=7860
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
 
 WORKDIR /app
-
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 

README.md

@@ -1,97 +1,44 @@
 ---
-title: MCP Bridge
-emoji: 🌉
-colorFrom: indigo
-colorTo: blue
+title: mcp-bridge
 sdk: docker
 app_port: 7860
-pinned: false
 ---
 
-# MCP Bridge
+# mcp-bridge
 
-Generic MCP bridge for Hugging Face Spaces.
+A small authenticated MCP-over-SSE bridge for Hugging Face Spaces.
 
-It exposes a static MCP SSE endpoint:
+Public endpoints:
 
-```txt
-https://patdev-mcp-bridge.hf.space/sse
-```
-
-Tools exposed by this bridge:
-
-- `mcp_connect`
-- `mcp_tool_list`
-- `mcp_tool_call`
-- `mcp_disconnect`
-- `mcp_session_list`
+- `/` returns only `{"ok": true}`
+- `/health` returns only `{"ok": true}`
 
-## Authentication
+MCP endpoint:
 
-Set this Space Secret in Hugging Face:
-
-```txt
-MCP_API_KEY=your-long-random-secret
-```
+- `https://patdev-mcp-bridge.hf.space/sse`
 
-Clients must send either:
+Required auth for MCP routes:
 
 ```txt
-Authorization: Bearer your-long-random-secret
+Authorization: Bearer <MCP_API_KEY>
 ```
 
 or:
 
 ```txt
-x-api-key: your-long-random-secret
-```
-
-`/` and `/health` are public. `/sse` and `/messages` require the API key.
-
-## Deploy / sync
-
-Recommended cross-platform command:
-
-```bash
-python scripts/sync_hf.py --space-id patdev/mcp-bridge --api-key "your-long-random-secret" --restart
-```
-
-This creates the Space if needed, uploads the project, optionally sets `MCP_API_KEY`, and can restart the Space.
-
-Linux/macOS wrapper:
-
-```bash
-chmod +x scripts/sync_hf.sh
-./scripts/sync_hf.sh --api-key "your-long-random-secret" --restart
-```
-
-Windows PowerShell wrapper:
-
-```powershell
-powershell -ExecutionPolicy Bypass -File .\scripts\sync_hf.ps1 -ApiKey "your-long-random-secret" -Restart
+x-api-key: <MCP_API_KEY>
 ```
 
-The `-ExecutionPolicy Bypass` part only applies to this process; it does not change your permanent Windows policy.
-
-## Local run
-
-```bash
-export MCP_API_KEY="dev-secret"
-python -m uvicorn app:app --host 0.0.0.0 --port 7860
-```
-
-Then use:
+Set the Space secret:
 
 ```txt
-http://localhost:7860/sse
+MCP_API_KEY=<your-long-random-secret>
 ```
 
-## Test client
+## Sync
 
-```bash
-python test_client.py --url http://localhost:7860/sse --api-key dev-secret
+```powershell
+python .\scripts\sync_hf.py --space-id patdev/mcp-bridge --api-key "YOUR_LONG_RANDOM_KEY" --restart
 ```
 
-## Notes
-
-Sessions are stored in memory. If the Space sleeps or restarts, run `mcp_connect` again.
+If you accidentally used a placeholder key, rotate it immediately by rerunning the command with a new random value.

app.py

@@ -1,162 +1,58 @@
-import json
 import os
-import secrets
 import uuid
 from typing import Any, Dict, Optional
-from urllib.parse import urlparse
 
 from fastmcp import Client, FastMCP
+from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
-from starlette.responses import JSONResponse, PlainTextResponse
+from starlette.responses import JSONResponse
 
-APP_NAME = "mcp-bridge"
-DEFAULT_TRANSPORT = "sse"
 
+mcp = FastMCP("mcp-bridge")
 SESSIONS: Dict[str, Dict[str, Any]] = {}
 
 
-def _configured_api_key() -> Optional[str]:
-    key = os.getenv("MCP_API_KEY", "").strip()
-    return key or None
+def _public_ok(request: Request) -> JSONResponse:
+    # Keep public routes intentionally boring: do not reveal tools, auth config,
+    # internal URLs, package versions, or environment details.
+    return JSONResponse({"ok": True})
 
 
-def _allowed_hosts() -> set[str]:
-    raw = os.getenv("ALLOWED_MCP_HOSTS", "").strip()
-    return {h.strip().lower() for h in raw.split(",") if h.strip()}
+class APIKeyMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        path = request.url.path.rstrip("/") or "/"
 
+        # Minimal public endpoints for liveness checks only.
+        if path in {"/", "/health"}:
+            return await call_next(request)
 
-def _check_remote_url(url: str) -> None:
-    parsed = urlparse(url)
-    if parsed.scheme not in {"http", "https"}:
-        raise ValueError("Remote MCP URL must start with http:// or https://")
+        expected = os.getenv("MCP_API_KEY", "").strip()
+        if not expected:
+            return JSONResponse({"error": "server_auth_not_configured"}, status_code=503)
 
-    allowed = _allowed_hosts()
-    if allowed and (parsed.hostname or "").lower() not in allowed:
-        raise ValueError(
-            f"Remote MCP host '{parsed.hostname}' is not in ALLOWED_MCP_HOSTS"
-        )
+        auth = request.headers.get("authorization", "")
+        x_api_key = request.headers.get("x-api-key", "")
 
+        bearer_ok = auth == f"Bearer {expected}"
+        key_ok = x_api_key == expected
 
-def _safe_headers(headers: Optional[Dict[str, str]]) -> Dict[str, str]:
-    if not headers:
-        return {}
-    return {str(k): str(v) for k, v in headers.items()}
+        if not (bearer_ok or key_ok):
+            return JSONResponse({"error": "unauthorized"}, status_code=401)
 
-
-def _jsonable(value: Any) -> Any:
-    """Convert FastMCP/Pydantic objects into JSON-friendly values."""
-    if hasattr(value, "model_dump"):
-        try:
-            return value.model_dump(mode="json")
-        except TypeError:
-            return value.model_dump()
-    if isinstance(value, dict):
-        return {str(k): _jsonable(v) for k, v in value.items()}
-    if isinstance(value, (list, tuple, set)):
-        return [_jsonable(v) for v in value]
-    try:
-        json.dumps(value)
-        return value
-    except TypeError:
-        return str(value)
-
-
-class APIKeyMiddleware:
-    """
-    Minimal API-key middleware for the MCP endpoint.
-
-    Public:
-      - GET /
-      - GET /health
-
-    Protected:
-      - /sse
-      - /messages
-      - any other route accidentally added later
-    """
-
-    def __init__(self, app):
-        self.app = app
-
-    async def __call__(self, scope, receive, send):
-        if scope.get("type") != "http":
-            await self.app(scope, receive, send)
-            return
-
-        path = scope.get("path", "") or ""
-        method = scope.get("method", "") or ""
-
-        if path in {"/", "/health"} and method in {"GET", "HEAD"}:
-            await self.app(scope, receive, send)
-            return
-
-        expected_key = _configured_api_key()
-        if not expected_key:
-            response = JSONResponse(
-                {
-                    "ok": False,
-                    "error": "MCP_API_KEY is not configured on this Space.",
-                },
-                status_code=503,
-            )
-            await response(scope, receive, send)
-            return
-
-        raw_headers = dict(scope.get("headers") or [])
-        auth_header = raw_headers.get(b"authorization", b"").decode("utf-8", "ignore")
-        x_api_key = raw_headers.get(b"x-api-key", b"").decode("utf-8", "ignore")
-
-        bearer = ""
-        if auth_header.lower().startswith("bearer "):
-            bearer = auth_header[7:].strip()
-
-        valid = secrets.compare_digest(x_api_key, expected_key) or secrets.compare_digest(
-            bearer, expected_key
-        )
-
-        if not valid:
-            response = JSONResponse(
-                {
-                    "ok": False,
-                    "error": "Unauthorized. Send Authorization: Bearer <MCP_API_KEY> or x-api-key: <MCP_API_KEY>.",
-                },
-                status_code=401,
-            )
-            await response(scope, receive, send)
-            return
-
-        await self.app(scope, receive, send)
-
-
-mcp = FastMCP(APP_NAME)
+        return await call_next(request)
 
 
 @mcp.tool()
 async def mcp_connect(url: str, headers: Optional[Dict[str, str]] = None) -> Dict[str, Any]:
-    """
-    Register a remote MCP HTTP/SSE server URL and return a session_id.
-    """
-    _check_remote_url(url)
-
+    """Register a remote MCP HTTP/SSE server URL and return a session_id."""
     session_id = str(uuid.uuid4())
-    SESSIONS[session_id] = {
-        "url": url,
-        "headers": _safe_headers(headers),
-    }
-
-    return {
-        "ok": True,
-        "session_id": session_id,
-        "url": url,
-        "status": "connected_registered",
-    }
+    SESSIONS[session_id] = {"url": url, "headers": headers or {}}
+    return {"session_id": session_id, "status": "connected_registered"}
 
 
 @mcp.tool()
 async def mcp_tool_list(session_id: str) -> Dict[str, Any]:
-    """
-    List tools from a registered remote MCP server.
-    """
+    """List tools from a registered remote MCP server."""
     cfg = SESSIONS.get(session_id)
     if not cfg:
         raise ValueError("Unknown session_id")
@@ -165,106 +61,50 @@ async def mcp_tool_list(session_id: str) -> Dict[str, Any]:
         tools = await client.list_tools()
 
     return {
-        "ok": True,
         "session_id": session_id,
-        "tools": _jsonable(tools),
+        "tools": [tool.model_dump() if hasattr(tool, "model_dump") else str(tool) for tool in tools],
     }
 
 
 @mcp.tool()
-async def mcp_tool_call(
-    session_id: str,
-    tool_name: str,
-    arguments: Optional[Dict[str, Any]] = None,
-) -> Dict[str, Any]:
-    """
-    Call a tool on a registered remote MCP server.
-    """
+async def mcp_tool_call(session_id: str, tool_name: str, arguments: Dict[str, Any] = {}) -> Dict[str, Any]:
+    """Call a tool on a registered remote MCP server."""
     cfg = SESSIONS.get(session_id)
     if not cfg:
         raise ValueError("Unknown session_id")
 
     async with Client(cfg["url"], headers=cfg["headers"]) as client:
-        result = await client.call_tool(tool_name, arguments or {})
+        result = await client.call_tool(tool_name, arguments)
 
     return {
-        "ok": True,
         "session_id": session_id,
         "tool_name": tool_name,
-        "result": _jsonable(result),
+        "result": result.model_dump() if hasattr(result, "model_dump") else str(result),
     }
 
 
 @mcp.tool()
 async def mcp_disconnect(session_id: str) -> Dict[str, Any]:
-    """
-    Remove a registered remote MCP session from memory.
-    """
+    """Forget a registered remote MCP session."""
     existed = session_id in SESSIONS
     SESSIONS.pop(session_id, None)
-    return {
-        "ok": True,
-        "session_id": session_id,
-        "removed": existed,
-    }
+    return {"session_id": session_id, "disconnected": existed}
 
 
 @mcp.tool()
 async def mcp_session_list() -> Dict[str, Any]:
-    """
-    List registered remote MCP sessions without revealing headers.
-    """
+    """List registered session IDs without exposing headers."""
     return {
-        "ok": True,
         "count": len(SESSIONS),
         "sessions": [
-            {
-                "session_id": session_id,
-                "url": cfg["url"],
-                "has_headers": bool(cfg.get("headers")),
-            }
-            for session_id, cfg in SESSIONS.items()
+            {"session_id": sid, "url": cfg.get("url")}
+            for sid, cfg in SESSIONS.items()
         ],
     }
 
 
-async def root(request: Request) -> JSONResponse:
-    base_url = str(request.base_url).rstrip("/")
-    return JSONResponse(
-        {
-            "ok": True,
-            "name": APP_NAME,
-            "transport": os.getenv("MCP_TRANSPORT", DEFAULT_TRANSPORT),
-            "mcp_sse_url": f"{base_url}/sse",
-            "auth_configured": bool(_configured_api_key()),
-            "auth_header": "Authorization: Bearer <MCP_API_KEY>",
-            "tools": [
-                "mcp_connect",
-                "mcp_tool_list",
-                "mcp_tool_call",
-                "mcp_disconnect",
-                "mcp_session_list",
-            ],
-        }
-    )
-
-
-async def health(request: Request) -> JSONResponse:
-    return JSONResponse(
-        {
-            "ok": True,
-            "auth_configured": bool(_configured_api_key()),
-            "sessions": len(SESSIONS),
-        }
-    )
-
-
-transport = os.getenv("MCP_TRANSPORT", DEFAULT_TRANSPORT).strip() or DEFAULT_TRANSPORT
-
-# FastMCP returns a Starlette app, not a FastAPI app. Therefore use add_route()
-# instead of @app.get(...). This fixes:
-# AttributeError: 'StarletteWithLifespan' object has no attribute 'get'
-app = mcp.http_app(path="/sse", transport=transport)
-app.add_route("/", root, methods=["GET", "HEAD"])
-app.add_route("/health", health, methods=["GET", "HEAD"])
+# FastMCP returns a Starlette app. Add public routes with Starlette APIs only.
+app = mcp.http_app(path="/sse")
 app.add_middleware(APIKeyMiddleware)
+app.add_route("/", _public_ok, methods=["GET", "HEAD"])
+app.add_route("/health", _public_ok, methods=["GET", "HEAD"])

requirements.txt

@@ -1,6 +1,6 @@
-fastmcp>=2.14.0,<3.0.0
-uvicorn[standard]>=0.30.0
-starlette>=0.36.0
+fastmcp>=2.0.0
 httpx>=0.27.0
 pydantic>=2.0.0
+uvicorn[standard]>=0.30.0
+starlette>=0.37.0
 huggingface_hub>=0.23.0

scripts/sync_hf.ps1

@@ -1,17 +1,11 @@
 param(
   [string]$SpaceId = "patdev/mcp-bridge",
-  [string]$ApiKey = $env:MCP_API_KEY,
-  [switch]$Private,
+  [string]$ApiKey = "",
   [switch]$Restart
 )
 
 $ErrorActionPreference = "Stop"
-$ProjectRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
-Set-Location $ProjectRoot
-
-$argsList = @("scripts/sync_hf.py", "--space-id", $SpaceId)
-if ($ApiKey) { $argsList += @("--api-key", $ApiKey) }
-if ($Private) { $argsList += "--private" }
+$argsList = @("$PSScriptRoot\sync_hf.py", "--space-id", $SpaceId)
+if ($ApiKey -ne "") { $argsList += @("--api-key", $ApiKey) }
 if ($Restart) { $argsList += "--restart" }
-
 python @argsList

scripts/sync_hf.py

@@ -1,71 +1,50 @@
-#!/usr/bin/env python3
 import argparse
 import os
 from pathlib import Path
 
-from huggingface_hub import HfApi, whoami
+from huggingface_hub import HfApi, create_repo, whoami
 
 
 def main() -> None:
-    parser = argparse.ArgumentParser(description="Create/sync the Hugging Face Docker Space.")
-    parser.add_argument("--space-id", default=os.getenv("SPACE_ID", "patdev/mcp-bridge"))
-    parser.add_argument("--private", action="store_true", help="Create Space as private if it does not exist.")
-    parser.add_argument("--api-key", default=os.getenv("MCP_API_KEY"), help="Optional: set/update Space Secret MCP_API_KEY.")
-    parser.add_argument("--restart", action="store_true", help="Restart the Space after upload.")
+    parser = argparse.ArgumentParser(description="Sync mcp-bridge to a Hugging Face Docker Space")
+    parser.add_argument("--space-id", default="patdev/mcp-bridge", help="HF Space ID, e.g. patdev/mcp-bridge")
+    parser.add_argument("--api-key", default=None, help="Value for Space secret MCP_API_KEY")
+    parser.add_argument("--restart", action="store_true", help="Restart the Space after upload")
     args = parser.parse_args()
 
-    repo_root = Path(__file__).resolve().parents[1]
+    root = Path(__file__).resolve().parents[1]
     api = HfApi()
 
-    user = whoami()
-    print(f"Authenticated as: {user.get('name') or user.get('email') or user}")
+    user = whoami().get("name")
+    print(f"Authenticated as: {user}")
     print(f"Space ID: {args.space_id}")
 
     print("Creating Space if needed...")
-    api.create_repo(
-        repo_id=args.space_id,
-        repo_type="space",
-        space_sdk="docker",
-        private=args.private,
-        exist_ok=True,
-    )
+    create_repo(args.space_id, repo_type="space", space_sdk="docker", exist_ok=True)
 
     if args.api_key:
         print("Setting Space Secret MCP_API_KEY...")
-        api.add_space_secret(args.space_id, key="MCP_API_KEY", value=args.api_key)
+        api.add_space_secret(repo_id=args.space_id, key="MCP_API_KEY", value=args.api_key)
 
     print("Uploading project files...")
     commit = api.upload_folder(
         repo_id=args.space_id,
         repo_type="space",
-        folder_path=str(repo_root),
-        commit_message="Sync MCP Bridge",
-        ignore_patterns=[
-            ".git/*",
-            ".hf/*",
-            ".env",
-            ".venv/*",
-            "venv/*",
-            "__pycache__/*",
-            "*.pyc",
-            "*.pyo",
-            "*.pyd",
-            ".DS_Store",
-            "*.zip",
-        ],
+        folder_path=str(root),
+        path_in_repo=".",
+        ignore_patterns=[".git/*", ".hf/*", "__pycache__/*", "*.pyc", ".env", "*.zip"],
+        commit_message="Update mcp-bridge",
     )
     print(f"Uploaded: {commit.commit_url}")
 
     if args.restart:
         print("Restarting Space...")
-        api.restart_space(args.space_id)
+        api.restart_space(repo_id=args.space_id)
 
     owner, name = args.space_id.split("/", 1)
     print("\nDone.")
     print(f"Space: https://huggingface.co/spaces/{args.space_id}")
     print(f"MCP SSE: https://{owner}-{name}.hf.space/sse")
-    if not args.api_key:
-        print("\nReminder: set a Space Secret MCP_API_KEY, or /sse will return 503.")
 
 
 if __name__ == "__main__":