Security & Authentication

┌──────────────────────────────────────────────────────────────┐
│                       AI Client Request                      │
└───────────────────────────┬──────────────────────────────────┘
                            │
                ┌───────────▼───────────┐
                │   Transport Layer     │
                │                       │
                │  stdio: process-level │
                │  HTTP:  API key auth  │
                │  REST:  rate limiting │
                └───────────┬───────────┘
                            │
                ┌───────────▼───────────┐
                │   Request Logging     │
                │  JSON format, daily   │
                │  rotation, sanitized  │
                └───────────┬───────────┘
                            │
                ┌───────────▼───────────┐
                │   User Resolution     │
                │  email → user (safe   │
                │  fields only via      │
                │  Prisma select)       │
                └───────────┬───────────┘
                            │
                ┌───────────▼───────────┐
                │   Tool Execution      │
                │  Per-tool sanitize    │
                │  rules applied to     │
                │  response data        │
                └───────────┬───────────┘
                            │
                ┌───────────▼───────────┐
                │   Sanitized Response  │
                │  No fileUrl, no       │
                │  publicKey, truncated │
                │  addresses, no PII    │
                └───────────────────────┘

{
  "mcpServers": {
    "yani-advisor": {
      "command": "npx",
      "args": ["tsx", "mcp-server-yani/src/index.ts"],
      "cwd": "/path/to/yanipay-animation",
      "env": {
        "DATABASE_URL": "postgresql://user:pass@localhost:5432/yanipay"
      }
    }
  }
}

const MCP_API_KEY = process.env.MCP_API_KEY;

function apiKeyAuth(req: Request, res: Response, next: NextFunction): void {
  if (!MCP_API_KEY) {
    // No key configured = open access (dev mode)
    next();
    return;
  }

  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    res.status(401).json({
      jsonrpc: '2.0',
      error: { code: -32001, message: 'Missing Authorization: Bearer <key>' },
      id: null,
    });
    return;
  }

  const token = authHeader.slice(7);
  if (token !== MCP_API_KEY) {
    res.status(403).json({
      jsonrpc: '2.0',
      error: { code: -32002, message: 'Invalid API key' },
      id: null,
    });
    return;
  }

  next();
}

# Set your API key
export MCP_API_KEY="your-secret-api-key-here"

# Start the HTTP server
MCP_API_KEY=$MCP_API_KEY npx tsx src/server-http.ts

# Authenticated request (from client)
curl -X POST http://localhost:3100/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your-secret-api-key-here" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "params": {
      "name": "yani_get_balance",
      "arguments": { "email": "user@example.com" }
    },
    "id": 1
  }'

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60 * 1000,       // 1 minute window
  max: 100,                   // 100 requests per IP per window
  standardHeaders: true,      // RateLimit-* headers (RFC draft)
  legacyHeaders: false,       // Disable X-RateLimit-* headers
  message: { error: 'Too many requests, please try again later.' },
});

app.use(limiter);

/**
 * Resolve a user by email address.
 * This is the security gate: all platform tools identify users by email,
 * never by internal UUID. This ensures auditability and prevents
 * direct ID enumeration.
 */
export async function resolveUser(email: string) {
  const db = getDb();
  const user = await db.user.findUnique({
    where: { email },
    select: {
      id: true,         // Internal use only, not exposed in responses
      email: true,       // Safe: provided by the caller
      name: true,        // Safe: display name
      firstName: true,   // Safe: display name
      lastName: true,    // Safe: display name
      role: true,        // Safe: non-sensitive enum
      kycStatus: true,   // Safe: status enum
      createdAt: true,   // Safe: non-sensitive timestamp
    },
  });

  if (!user) throw new UserNotFoundError(email);
  return user;
}

function truncateAddress(address: string | null | undefined): string {
  if (!address) return 'N/A';
  if (address.length <= 12) return address;
  return `${address.slice(0, 6)}...${address.slice(-4)}`;
}

// Examples:
// "0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18"
//  → "0x742d...bD18"
// "bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq"
//  → "bc1qar...5mdq"

// HTTP/1.1 429 Too Many Requests
// RateLimit-Limit: 100
// RateLimit-Remaining: 0
// RateLimit-Reset: 23
// Retry-After: 23

{
  "error": "Too many requests, please try again later."
}

export function requestLogger() {
  return (req: Request, res: Response, next: NextFunction): void => {
    const start = Date.now();

    res.on('finish', () => {
      const entry = {
        timestamp: new Date().toISOString(),
        method: req.method,
        path: req.path,
        status: res.statusCode,
        durationMs: Date.now() - start,
        ip: req.ip || req.socket.remoteAddress || 'unknown',
      };

      appendFileSync(getLogFile(), JSON.stringify(entry) + '\n');
    });

    next();
  };
}

{"timestamp":"2026-02-22T14:30:01.123Z","method":"POST","path":"/mcp","status":200,"durationMs":45,"ip":"127.0.0.1"}
{"timestamp":"2026-02-22T14:30:02.456Z","method":"GET","path":"/health","status":200,"durationMs":2,"ip":"127.0.0.1"}
{"timestamp":"2026-02-22T14:30:15.789Z","method":"POST","path":"/tools/yani_get_balance","status":200,"durationMs":120,"ip":"192.168.1.50"}
{"timestamp":"2026-02-22T14:31:00.012Z","method":"POST","path":"/tools/yani_get_balance","status":429,"durationMs":1,"ip":"10.0.0.5"}

# Generate a strong API key
export MCP_API_KEY=$(openssl rand -hex 32)

# Database with SSL
export DATABASE_URL="postgresql://user:pass@db.example.com:5432/yanipay?sslmode=verify-full"

# Start with explicit host binding
HOST=127.0.0.1 PORT=3100 MCP_API_KEY=$MCP_API_KEY npx tsx src/server-http.ts

# Example nginx reverse proxy config
# server {
#   listen 443 ssl;
#   server_name mcp.yanipay.com;
#
#   ssl_certificate     /etc/ssl/certs/yanipay.pem;
#   ssl_certificate_key /etc/ssl/private/yanipay.key;
#
#   location /mcp {
#     proxy_pass http://127.0.0.1:3100;
#     proxy_set_header Host $host;
#     proxy_set_header X-Real-IP $remote_addr;
#     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#     proxy_set_header X-Forwarded-Proto $scheme;
#   }
# }