resque-mcp 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 890b5b8eb96c160226ce467a2a626861f25e774e5cd80402a4e8256a5aa361f1
-  data.tar.gz: fb3e64270e1d0dd2fca69d4ecedbd9c06b72ff146dd6160b5fc305420bc49117
+  metadata.gz: 0415f5a9bbc7dddcc1c4def5de45835d49df86158b5261567af19ece94d6d36c
+  data.tar.gz: 6f4f8511f80a3107abd83e7e24053d0322dabb5feec212e52271bfe7bd844684
 SHA512:
-  metadata.gz: d066b59609ab3e12a1c0e7458bbf9503751b94f548c858e51aeb5a1cd921aa0675f1643d6d64c2bf83cc524314961104f9d11b5c25ec874731e5726f29799edf
-  data.tar.gz: 5e84b9b0249ee94416e9c505abba4637f01d8669dec570bab97a4bedb556a6008497525b4d0f19233c5b002f9228aede5c2ee8ae5e1467ae7a5c17d14d458c32
+  metadata.gz: 95a256a4a7e92257568a474254fbd052306f0e915cebad24bfc6ff237a4a678ead0ddfae17611b0f6ab0f4b2f9a195ace9cc4eda54cd0b2d5122afc0827ebdb3
+  data.tar.gz: 2494d7df431b2b14f5a27eabc148f6a19670246afbb7051ad0144c2637773c52acaeb5d022b86e0e47d87cf691d044f6e6e1574c8640dd0389f8356189a494cf

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.4.0]
+
+- Security: bump the minimum `mcp` dependency to `>= 0.23, < 1` for the DNS-rebinding fix (CVE-2026-63118); `<= 0.22` did not validate `Host`/`Origin` headers on the Streamable HTTP transport. Protection is now on by default, with loopback always allowed.
+- Config: `allowed_hosts` and `allowed_origins` for the DNS-rebinding allowlists. `allowed_hosts` defaults to inheriting the host's Rails `config.hosts` string entries, so apps that already configure Rails host authorization need nothing extra; an explicit list replaces it, and `[]` allows loopback only.
+- Config: `mcp_transport_options` forwards arbitrary settings to the mcp gem's transport (e.g. `max_request_bytes`); the DNS-rebinding keys always override it, so it can tune but never weaken protection.
+
 ## [0.3.0]
 
 - `worker_stats` tool: list registered workers (state, subscribed queues, per-worker processed/failed counts, start time, current job with filtered args preview) with a `state` filter (`working`/`idle`/`all`), global counts including `heartbeat_expired`, and the standard pagination envelope. Workers whose heartbeat is older than `Resque.prune_interval` are flagged as likely dead.

data/README.md

@@ -34,6 +34,22 @@ Resque::Mcp.configure do |c|
   # token could be created by e.g.: `bin/rails runner 'puts SecureRandom.base58(32)'`
   c.auth_token = Rails.application.credentials.dig(:resque_mcp, :token)
 
+  # DNS-rebinding protection (CVE-2026-63118) rejects any Host outside the
+  # allowlist with 403; loopback (127.0.0.1/::1/localhost) is always allowed.
+  # By default the allowlist is inherited from your Rails config.hosts, so if
+  # that already lists your domain(s) you need nothing here. Only plain
+  # hostname strings are honored (here and when inherited) — regexps, IPAddrs,
+  # and ".sub.domain" wildcards are dropped, so give concrete hostnames:
+  # c.allowed_hosts = ["resque.example.com"]
+
+  # Optional: extra permitted Origin values beyond same-origin.
+  # c.allowed_origins = ["https://resque.example.com"]
+
+  # Optional: escape hatch for mcp settings this gem doesn't expose directly,
+  # forwarded to the transport (the DNS-rebinding keys above always take
+  # precedence and can't be weakened here):
+  # c.mcp_transport_options = { max_request_bytes: 8 * 1024 * 1024 }
+
   # Optional: which job-args keys to mask as [FILTERED] in tool responses.
   # Defaults to your app's config.filter_parameters; an explicit list
   # replaces it (merge yourself if you want both):
@@ -41,7 +57,7 @@ Resque::Mcp.configure do |c|
 end
 ```
 
-The token is **required** — the endpoint answers `503` until one is configured, and `401` on any request without a matching `Authorization: Bearer` header. The engine talks to whatever `Resque.redis` your app already configured; it never opens its own Redis connection.
+The token is **required** — the endpoint answers `503` until one is configured, and `401` on any request without a matching `Authorization: Bearer` header. The endpoint also validates the `Host`/`Origin` headers against DNS rebinding: the allowed hosts default to your Rails `config.hosts`, so a non-loopback request gets `403` unless its Host is in that list (or in an explicit `allowed_hosts`). The engine talks to whatever `Resque.redis` your app already configured; it never opens its own Redis connection.
 
 Job arguments shown by any tool are filtered through `ActiveSupport::ParameterFilter` **before** preview/truncation, using your Rails `filter_parameters` by default — the same keys you hide from your logs are hidden from the model. Filters match hash keys (at any depth, same semantics as Rails log filtering, including anchored dot-notation like `/\Acredit_card\.code\z/`); positional scalar args have no key and pass through. Set `c.filter_parameters = []` to disable.
 

data/app/controllers/resque/mcp/endpoint_controller.rb

@@ -7,9 +7,17 @@ module Resque
 
       def handle
         server = ServerFactory.build(environment: Rails.env.to_s)
-        transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(
-          server, stateless: true, enable_json_response: true
+        config = Resque::Mcp.config
+        # Passthrough first; our security-critical keys override, so nothing
+        # in mcp_transport_options can weaken the DNS-rebinding posture.
+        options = config.mcp_transport_options.merge(
+          stateless: true,
+          enable_json_response: true,
+          dns_rebinding_protection: true,
+          allowed_hosts: config.allowed_hosts,
+          allowed_origins: config.allowed_origins
         )
+        transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(server, **options)
 
         status, headers, body = transport.handle_request(request)
         headers.each { |key, value| response.set_header(key, value) }

data/lib/resque/mcp/configuration.rb

@@ -4,6 +4,43 @@ module Resque
   module Mcp
     class Configuration
       attr_accessor :auth_token
+
+      # DNS-rebinding protection (mcp >= 0.23, CVE-2026-63118). The transport
+      # validates Host/Origin headers; loopback hosts are always allowed.
+      #
+      # nil (default) inherits the host's Rails config.hosts; an explicit list
+      # replaces it; [] means loopback only. Either way, only plain hostname
+      # strings are honored — regexps, IPAddrs, and leading-dot subdomain
+      # wildcards (".example.com") can't map to the SDK's exact-hostname
+      # matching (and a non-string would crash its downcase), so they're
+      # dropped from both paths. allowed_origins adds extra permitted Origin
+      # values beyond same-origin.
+      attr_writer :allowed_hosts, :allowed_origins
+
+      # Internal seam: a callable returning the host's config.hosts, read
+      # lazily (the engine wires it) so post-boot changes are never missed.
+      attr_accessor :default_allowed_hosts
+
+      def allowed_hosts
+        list = (defined?(@allowed_hosts) && @allowed_hosts) ? @allowed_hosts : default_allowed_hosts&.call
+        Array(list).select { |h| h.is_a?(String) && !h.start_with?(".") }
+      end
+
+      def allowed_origins
+        @allowed_origins || []
+      end
+
+      # Extra settings for the mcp gem, forwarded verbatim to its
+      # StreamableHTTPTransport (e.g. max_request_bytes:). Tuning only — the
+      # controller applies the security-critical keys (allowed_hosts,
+      # allowed_origins, stateless, dns_rebinding_protection) *after* these,
+      # so a passthrough value can never weaken them.
+      attr_writer :mcp_transport_options
+
+      def mcp_transport_options
+        @mcp_transport_options || {}
+      end
+
       # nil = inherit the host default (the engine wires Rails'
       # filter_parameters as a lazy source); an explicit list replaces it
       # ([] disables filtering).

data/lib/resque/mcp/engine.rb

@@ -14,6 +14,13 @@ module Resque
       initializer "resque_mcp.filter_parameters" do
         Resque::Mcp.config.default_filter_parameters = -> { Rails.application.config.filter_parameters }
       end
+
+      # allowed_hosts inherits the host's config.hosts (the same list Rails'
+      # own host authorization uses) unless explicitly configured, read
+      # lazily for the same reason as the filter list above.
+      initializer "resque_mcp.allowed_hosts" do
+        Resque::Mcp.config.default_allowed_hosts = -> { Rails.application.config.hosts }
+      end
     end
   end
 end

data/lib/resque/mcp/version.rb

@@ -2,6 +2,6 @@
 
 module Resque
   module Mcp
-    VERSION = "0.3.0"
+    VERSION = "0.4.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: resque-mcp
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Josch Bockler
@@ -33,16 +33,22 @@ dependencies:
   name: mcp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.23'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.23'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement