@contentrain/mcp 1.4.0: multi-tenant HTTP + App auth + published conformance fixtures

[ABB65]

Covers every MCP-side item surfaced in the Studio S2-S8 handoff audit, in a single release.

Headline: multi-tenant HTTP MCP

startHttpMcpServerWith now accepts a per-request provider resolver:

await startHttpMcpServerWith({
  resolveProvider: async (req) => {
    const projectId = req.headers['x-project-id']
    const { repo, auth } = await lookupProject(projectId)
    return createGitHubProvider({ auth, repo })
  },
  authToken: workspaceBearerToken,
  port: 3333,
  sessionTtlMs: 15 * 60 * 1000,
})

Resolver invoked once per MCP session; subsequent requests with the same Mcp-Session-Id header reuse the resolved server + transport pair. Idle sessions disposed after sessionTtlMs. Single-provider shape fully backward compatible. Unblocks Studio S6 (MCP Cloud).

Also shipping

GitHub App auth in createGitHubProvider

New auth: { type: 'app', appId, privateKey, installationId } factory mode: signs a JWT, exchanges for installation token, returns Octokit-backed client. Removes the old Phase 5.2 throw.

Public exports:

• exchangeInstallationToken — standalone helper, custom baseUrl for GHES
• signAppJwt — pure RS256 JWT signer
• Types: AppAuthConfig, InstallationTokenResult

Conformance fixtures published

@contentrain/mcp/testing/conformance subpath exposes the byte-parity scenarios the package tests itself against. External tools (Studio, alt-provider harnesses) can assert matching output without symlinking tests/.

Fixtures moved from tests/fixtures/conformance/ → testing/conformance/, shipped in the tarball via files[]. Helpers: fixturesDir, listConformanceScenarios, loadConformanceScenario.

validateProject(reader, options) overload pinned

New dedicated test exercises the Phase 5.5b overload: pure RepoReader, error surfacing, OverlayReader composition. Pins the contract Studio S3 depends on.

Docs

docs/guides/embedding-mcp.md Recipe 3 now shows three GitHub App auth patterns with a trade-off table — (a) factory auth.type:'app', (b) exchangeInstallationToken + external cache, (c) Octokit injection with @octokit/auth-app (Studio's pattern). New Recipe 3a documents the multi-tenant resolver.

Package description updated from "13 deterministic tools" to the current 17-tool surface.

Test plan

• oxlint monorepo → 0 warnings on 424 files
• @contentrain/mcp typecheck → 0 errors
• MCP fast suite → 471 passed / 2 skipped / 34 files (21 new tests beyond 1.3.0 baseline)
  • 4 app-auth (JWT + exchange + baseUrl + error)
  • 3 multi-tenant resolver (session isolation, 500 on resolver throw, single-provider handle.mcp)
  • 5 conformance subpath smoke tests
  • 3 validateProject reader overload
• vitepress build docs → success

Version

@contentrain/mcp: 1.3.0 → 1.4.0 (minor — new public exports, no breaking changes).

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for contentrain-ai ready!

Name	Link
🔨 Latest commit	cc066fe
🔍 Latest deploy log	https://app.netlify.com/projects/contentrain-ai/deploys/69e36f7398702f000868cd1a
😎 Deploy Preview	https://deploy-preview-49--contentrain-ai.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.