MCP connection

import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
import { createHash } from 'node:crypto';
import { join } from 'node:path';
import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';

const endpoint = 'https://mcp.ottoai.services/mcp';
const [command, ...args] = process.argv.slice(2);
const hash = value => createHash('sha256').update(value).digest('hex');
const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
const load = path => JSON.parse(readFileSync(path, 'utf8'));
class InputError extends Error {}
const digest = request => hash(JSON.stringify({
  endpoint: request.endpoint, tool: request.tool, arguments: request.arguments,
  paymentSha256: request.paymentSha256,
}));
let client, directory, save, attempted = false, payment;

try {
  let request;
  if (command === 'inspect' && args.length === 1) {
    directory = args[0];
    request = { endpoint, tool: 'tools/list', arguments: {}, paymentSha256: null };
  } else if (command === 'call' && args.length === 3) {
    directory = args[2];
    request = { endpoint, tool: args[0], arguments: load(args[1]), paymentSha256: null };
  } else if (command === 'retry' && args.length === 3) {
    directory = args[2];
    request = load(join(args[0], 'request.json'));
    if (!object(request) ||
        !(request.paymentSha256 === null ||
          (typeof request.paymentSha256 === 'string' && /^[a-f0-9]{64}$/.test(request.paymentSha256))) ||
        request.requestSha256 !== digest(request)) {
      throw new InputError('SAVED_REQUEST_CHANGED');
    }
    payment = load(args[1]).x_payment;
    if (typeof payment !== 'string' || payment.length === 0 || payment.length > 32768) {
      throw new InputError('PAYMENT_FILE_INVALID');
    }
    if (request.paymentSha256 !== null && request.paymentSha256 !== hash(payment)) {
      throw new InputError('PAYMENT_CHANGED');
    }
  } else {
    throw new InputError('USAGE: inspect DIR | call TOOL ARGS.json DIR | retry PRIOR_DIR PAYMENT.json DIR');
  }

  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(directory ?? '')) {
    throw new InputError('OUTPUT_NAME_INVALID: use a new simple directory name inside the current folder');
  }
  if (request.endpoint !== endpoint || !object(request.arguments) ||
      'x_payment' in request.arguments ||
      !(command === 'inspect' ? request.tool === 'tools/list' : /^otto_[a-z0-9_]+$/.test(request.tool))) {
    throw new InputError('REQUEST_INVALID');
  }

  // Refuses an existing directory or symlink. Each attempt keeps its own evidence.
  mkdirSync(directory, { mode: 0o700 });
  save = (name, value) => writeFileSync(join(directory, name),
    JSON.stringify(value, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
  request = { endpoint, tool: request.tool, arguments: request.arguments,
    paymentSha256: payment ? hash(payment) : null,
    startedAt: new Date().toISOString() };
  request.requestSha256 = digest(request);
  save('request.json', request);

  client = new Client({ name: 'otto-public-example', version: '1.0.0' });
  await client.connect(new StreamableHTTPClientTransport(new URL(endpoint), {
    // Do not forward a payment through a redirect or automatically reconnect a request.
    fetch: (url, init) => fetch(url, { ...init, redirect: 'error' }),
    reconnectionOptions: { maxRetries: 0, initialReconnectionDelay: 1000,
      maxReconnectionDelay: 1000, reconnectionDelayGrowFactor: 1 },
  }));

  attempted = true;
  if (command === 'inspect') {
    const result = await client.listTools();
    save('tools.json', result);
    const summary = { outcome: 'tools_received', count: result.tools.length,
      morePages: Boolean(result.nextCursor), finishedAt: new Date().toISOString() };
    save('summary.json', summary);
    console.log(JSON.stringify({ directory, ...summary }));
  } else {
    // One call only. Paid delivery may outlive a normal MCP client's 60-second timeout.
    const result = await client.callTool({ name: request.tool, arguments: {
      ...request.arguments, ...(payment ? { x_payment: payment } : {}),
    } }, undefined, { timeout: 14 * 60_000 });
    save('response.mcp.json', result);
    const text = result.content.filter(part => part.type === 'text');
    if (text.length !== 1) throw new InputError('RESPONSE_TEXT_INVALID');
    const body = JSON.parse(text[0].text);
    if (!object(body)) throw new InputError('RESPONSE_JSON_OBJECT_REQUIRED');
    save('response.json', body);
    const refused = result.isError === true || Boolean(body.error);
    const summary = { outcome: refused ? 'tool_refused' : 'result_received',
      paymentPresented: Boolean(payment),
      settlementMetadataPresent: Boolean(result._meta?.['com.ottoai/payment-response']),
      finishedAt: new Date().toISOString() };
    save('summary.json', summary);
    console.log(JSON.stringify({ directory, ...summary }));
    if (refused) process.exitCode = 2;
  }
} catch (error) {
  // Never print upstream exception text: it can contain request or authorization data.
  const summary = { outcome: 'local_transport_or_protocol_error',
    reason: error instanceof InputError ? error.message :
      (error?.code === 'EEXIST' && !save ? 'OUTPUT_EXISTS: choose a new directory' : 'CHECK_INPUT_AND_SAVED_RESPONSE'),
    toolCallAttempted: attempted, delivery: attempted ? 'unknown' : 'not_attempted',
    finishedAt: new Date().toISOString() };
  if (save) { try { save('error.json', summary); } catch {} }
  console.error(JSON.stringify(summary));
  process.exitCode = 1;
} finally {
  if (client) { try { await client.close(); } catch {} }
}