mail_mcp 1.0.2 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: caf27cd17b2adac73fae31883b7f0ae1e20b7c2be61e583180d9fe7d230e3c23
-  data.tar.gz: bab6dfc1f67f681fd30689a4c38eb4ab4cac6ec0abe485755e74f25333e1c761
+  metadata.gz: 2f0b9d571be35c953b87ae56a9fdf4b0fb06d025daf74679fe34f3c17d956bf2
+  data.tar.gz: ab679102a9001f05852218155c57fef7ddafa7ac5259cb5bd884b54ddb0ee20e
 SHA512:
-  metadata.gz: bad25881c7462f141971105d5455b9cec71af498aa3dadc7617caea6ba2aa5802cfa91b4f899ef637bafcbf8d23c7d902a8f3af3c942b9e83c1f26e324433fc1
-  data.tar.gz: 438d165458bf0b62c1a66d45ad65766f99c9517e5d0d986b1be4e370968a53e0d81254a83a17152eecdc7117f19cdca473df4d8bfffffa365c0398ff4548f62e
+  metadata.gz: 79c646575acf2f6e5dade303538b05622316152951fa66d3f265422ae409a12e0dbd0b42038a67deae8b30e5c4027849520bbd599b5d95714320dcf52a249ce7
+  data.tar.gz: 35c9e8c6ae7e4d791838a3ccf61cbfb89bfb14052514365c4ea320d8ee8e9747b5d26a7e3d03ba2284fac3184db2123bd53c28d40be2dff5fa46ab430ca7814b

data/lib/mail_mcp/app.rb

@@ -37,7 +37,11 @@ module MailMCP
         tools: MCP_TOOLS,
         server_context: server_context
       )
-      transport = MCP::Server::Transports::StreamableHTTPTransport.new(mcp_server, stateless: true)
+      transport = MCP::Server::Transports::StreamableHTTPTransport.new(
+        mcp_server,
+        stateless: true,
+        allowed_hosts: allowed_mcp_hosts
+      )
       status_code, resp_headers, body = transport.call(env)
       halt status_code, resp_headers, body
     end
@@ -60,6 +64,7 @@ module MailMCP
                       token_endpoint: "#{base_url}/oauth/token",
                       response_types_supported: ["code"],
                       grant_types_supported: ["authorization_code"],
+                      token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post],
                       code_challenge_methods_supported: ["S256"]
                     })
     end
@@ -102,9 +107,8 @@ module MailMCP
     post "/oauth/token" do
       content_type :json
 
-      grant_type    = params[:grant_type]
-      client_id     = params[:client_id]
-      client_secret = params[:client_secret]
+      grant_type = params[:grant_type]
+      client_id, client_secret = client_credentials
 
       client_config = begin
         JwtService.decode_client_id(client_id.to_s)
@@ -142,6 +146,16 @@ module MailMCP
 
     private
 
+    # RFC 6749 section 2.3.1: clients may authenticate with HTTP Basic, whose
+    # user and password are the form-encoded client_id and client_secret, or
+    # with both in the request body.
+    def client_credentials
+      auth = Rack::Auth::Basic::Request.new(request.env)
+      return [params[:client_id], params[:client_secret]] unless auth.provided? && auth.basic?
+
+      auth.credentials.map { |part| URI.decode_www_form_component(part) }
+    end
+
     def resolve_mcp_context
       auth = request.env["HTTP_AUTHORIZATION"]
       return [nil, unauthorized_response("missing bearer token")] unless auth&.start_with?("Bearer ")
@@ -220,6 +234,13 @@ module MailMCP
       ENV.fetch("BASE_URL")
     end
 
+    # The MCP transport's DNS-rebinding protection only accepts loopback `Host` values
+    # out of the box. This server is reached at its public hostname, so allow-list it —
+    # a bare host name matches any port.
+    def allowed_mcp_hosts
+      [URI.parse(base_url).host]
+    end
+
     def decode_client_id!(client_id)
       JwtService.decode_client_id(client_id.to_s)
     rescue JwtService::Error => e

data/lib/mail_mcp/version.rb

@@ -1,3 +1,3 @@
 module MailMCP
-  VERSION = "1.0.2".freeze
+  VERSION = "1.0.4".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mail_mcp
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.4
 platform: ruby
 authors:
 - Edgars Beigarts
@@ -71,14 +71,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.14'
+        version: 0.25.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.14'
+        version: 0.25.0
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement