eslint magic

eslint.config.js

@@ -8,10 +8,19 @@ import tsPlugin from "typescript-eslint";
 
 /** @type {import('eslint').Linter.Config[]} */
 export default [
+  {
+    ignores: [
+      "node_modules/**",
+      "dist/**",
+      "build/**",
+      "coverage/**",
+      "*.min.js",
+      "src/gen/**", // Exclude generated API files
+    ],
+  },
   securityPlugin.configs.recommended,
   {
-    files: ["**/*.ts"],
-    ignores: ["src/gen/**"],
+    files: ["src/**/*.ts"],
   },
   {
     languageOptions: { globals: globals.node },
@@ -60,16 +69,7 @@ export default [
       "import/order": [
         "error",
         {
-          groups: [
-            "builtin",
-            "external",
-            "internal",
-            "parent",
-            "sibling",
-            "index",
-            "object",
-            "type",
-          ],
+          groups: ["builtin", "external", "internal", "parent", "sibling", "index", "object", "type"],
           "newlines-between": "always",
           alphabetize: {
             order: "asc",

src/main.ts

@@ -1,12 +1,13 @@
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import pino from "pino";
-import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import crypto from "crypto";
+import express from "express";
+import pino from "pino";
+import { z } from "zod";
 
 import { outlineMcpFactory } from "./outline";
 
+const sessionIdSchema = z.string().uuid();
+
 async function main() {
   const logger = pino({
     level: "debug",
@@ -24,12 +25,40 @@ async function main() {
       },
       "Received MCP request"
     );
-    const sessionId = req.headers["mcp-session-id"] as string | undefined;
+    const sessionIdHeader = req.headers["mcp-session-id"] as string | undefined;
     let transport: StreamableHTTPServerTransport;
 
-    if (sessionId && transports[sessionId]) {
+    if (sessionIdHeader) {
+      const safeSessionId = sessionIdSchema.safeParse(sessionIdHeader);
+      if (!safeSessionId.success) {
+        logger.error("Invalid session ID format");
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32000,
+            message: "Invalid session ID format",
+          },
+          id: null,
+        });
+        return;
+      }
+
+      const sessionId = safeSessionId.data;
+      if (transports[sessionId]) {
         transport = transports[sessionId];
-    } else if (!sessionId && isInitializeRequest(req.body)) {
+      } else {
+        logger.error("Session not found");
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32000,
+            message: "Session not found",
+          },
+          id: null,
+        });
+        return;
+      }
+    } else if (isInitializeRequest(req.body)) {
       transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: () => crypto.randomUUID(),
         onsessioninitialized: (sessionId) => {
@@ -42,7 +71,9 @@ async function main() {
           delete transports[transport.sessionId];
         }
       };
-      const outlineMcpServer = outlineMcpFactory(logger);
+      const outlineMcpServer = outlineMcpFactory(
+        logger.child({ sessionId: transport.sessionId })
+      );
 
       await outlineMcpServer.connect(transport);
     } else {

src/outline.ts

@@ -7,11 +7,7 @@ import { registerDocumentTools } from "./tools/document";
 
 import type { Logger } from "pino";
 
-const createOutlineClient = (
-  baseUrl: string,
-  apiKey: string,
-  logger: Logger
-) => {
+const createOutlineClient = (baseUrl: string, apiKey: string, logger: Logger) => {
   const config = new Configuration({
     basePath: baseUrl,
     accessToken: () => Promise.resolve(apiKey),

src/tools/collection.ts

@@ -6,11 +6,7 @@ import type { ToolsFactory } from "./toolsFactory";
 import type { CollectionsApi } from "../gen/api/outline";
 import type { Logger } from "pino";
 
-export const registerCollectionTools: ToolsFactory<CollectionsApi> = (
-  server: McpServer,
-  client: CollectionsApi,
-  logger: Logger
-) => {
+export const registerCollectionTools: ToolsFactory<CollectionsApi> = (server: McpServer, client: CollectionsApi, logger: Logger) => {
   server.registerTool(
     "collections_list",
     {
@@ -21,15 +17,9 @@ export const registerCollectionTools: ToolsFactory<CollectionsApi> = (
     async () => {
       try {
         const response = await client.collectionsList();
-        return handleSuccess(
-          response,
-          logger.child({ tool: "collections_list" })
-        );
+        return handleSuccess(response, logger.child({ tool: "collections_list" }));
       } catch (err) {
-        const error = handleError(
-          err,
-          logger.child({ tool: "collections_list" })
-        );
+        const error = handleError(err, logger.child({ tool: "collections_list" }));
         logger.error(error);
         return error;
       }

src/tools/document.ts

@@ -1,45 +1,22 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import type { Logger } from "pino";
 
-import {
-  backlinkDocumentId,
-  collectionId,
-  direction,
-  limit,
-  offset,
-  parentDocumentId,
-  sort,
-  userId,
-} from "./common";
+import { backlinkDocumentId, collectionId, direction, limit, offset, parentDocumentId, sort, userId } from "./common";
 import { handleSuccess, handleError } from "./utils";
+
 import type { ToolsFactory } from "./toolsFactory";
 import type { DocumentsApi } from "../gen/api/outline";
+import type { Logger } from "pino";
 
-export const registerDocumentTools: ToolsFactory<DocumentsApi> = (
-  server: McpServer,
-  client: DocumentsApi,
-  logger: Logger
-): void => {
+export const registerDocumentTools: ToolsFactory<DocumentsApi> = (server: McpServer, client: DocumentsApi, logger: Logger): void => {
   server.registerTool(
     "documents_info",
     {
       title: "Get Document Info",
-      description:
-        "Retrieve a document by its UUID, urlId, or shareId. At least one of these parameters must be provided.",
+      description: "Retrieve a document by its UUID, urlId, or shareId. At least one of these parameters must be provided.",
       inputSchema: {
-        id: z
-          .string()
-          .optional()
-          .describe(
-            "Unique identifier for the document. Either the UUID or the urlId is acceptable."
-          ),
-        shareId: z
-          .string()
-          .optional()
-          .describe(
-            "Unique identifier for a document share, a shareId may be used in place of a document UUID"
-          ),
+        id: z.string().optional().describe("Unique identifier for the document. Either the UUID or the urlId is acceptable."),
+        shareId: z.string().optional().describe("Unique identifier for a document share, a shareId may be used in place of a document UUID"),
       },
     },
     async (args) => {
@@ -50,10 +27,7 @@ export const registerDocumentTools: ToolsFactory<DocumentsApi> = (
             shareId: args?.shareId,
           },
         });
-        return handleSuccess(
-          response,
-          logger.child({ tool: "documents_info" })
-        );
+        return handleSuccess(response, logger.child({ tool: "documents_info" }));
       } catch (error) {
         return handleError(error, logger.child({ tool: "documents_info" }));
       }
@@ -76,8 +50,7 @@ export const registerDocumentTools: ToolsFactory<DocumentsApi> = (
     "documents_list",
     {
       title: "List Documents",
-      description:
-        "This method will list all published documents and draft documents belonging to the current user.",
+      description: "This method will list all published documents and draft documents belonging to the current user.",
       inputSchema: documentsListSchema.shape,
     },
     async (args) => {
@@ -86,10 +59,7 @@ export const registerDocumentTools: ToolsFactory<DocumentsApi> = (
         const response = await client.documentsList({
           documentsListRequest: validatedArgs,
         });
-        return handleSuccess(
-          response,
-          logger.child({ tool: "documents_list" })
-        );
+        return handleSuccess(response, logger.child({ tool: "documents_list" }));
       } catch (error) {
         return handleError(error, logger.child({ tool: "documents_list" }));
       }