resque-mcp 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 890b5b8eb96c160226ce467a2a626861f25e774e5cd80402a4e8256a5aa361f1
-  data.tar.gz: fb3e64270e1d0dd2fca69d4ecedbd9c06b72ff146dd6160b5fc305420bc49117
+  metadata.gz: aa2476b4d89a552651fd9fefbde7ebb001f75fbf684fa5182388c39cd501bcc5
+  data.tar.gz: bf79be53a377e49347c692bb78d2f2519e03756b63d07311bf473601414305ec
 SHA512:
-  metadata.gz: d066b59609ab3e12a1c0e7458bbf9503751b94f548c858e51aeb5a1cd921aa0675f1643d6d64c2bf83cc524314961104f9d11b5c25ec874731e5726f29799edf
-  data.tar.gz: 5e84b9b0249ee94416e9c505abba4637f01d8669dec570bab97a4bedb556a6008497525b4d0f19233c5b002f9228aede5c2ee8ae5e1467ae7a5c17d14d458c32
+  metadata.gz: 75df4bb783023d55034a99235970952ea70f931fea145b3cebd48efa7404654c982d65a604ec29ee52086c3b3bbffae9f360eca7acc44e594a2d44a368bf9c40
+  data.tar.gz: a182d35074d8e72bc0f638cff1793405b37427093750810f0061f750c57f0adce34974d1e970cfcb1e4fd58f4f6663d659880bdd80f486e4fc42ecf07ae3a679

data/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [0.5.0]
+
+- MCP SDK 1.x support: the `mcp` dependency widens to `>= 0.23, < 2`, admitting the SDK's API-stable 1.x line. No configuration changes; existing deployments behave as before.
+- Sessionless 2026-07-28 lifecycle (SEP-2575, needs `mcp >= 1.2`): clients may skip the `initialize` handshake and carry the protocol version per request, and discover the server via `server/discover`. Older `mcp` versions keep serving the handshake lifecycle unchanged.
+- Capabilities are now declared explicitly instead of taking the SDK's default, dropping the `listChanged`/`subscribe` notification flags a per-request stateless endpoint cannot push. Empty `prompts`/`resources` capabilities stay declared, so `prompts/list` and `resources/list` keep answering with empty lists.
+- `subscriptions/listen` is declined with a correlatable JSON-RPC `-32601` error instead of an opaque `500`: a per-request stateless server has no notification stream to open. The refusal ships with HTTP 200 so clients that only parse successful responses still see it.
+
+## [0.4.0]
+
+- Security: bump the minimum `mcp` dependency to `>= 0.23, < 1` for the DNS-rebinding fix (CVE-2026-63118); `<= 0.22` did not validate `Host`/`Origin` headers on the Streamable HTTP transport. Protection is now on by default, with loopback always allowed.
+- Config: `allowed_hosts` and `allowed_origins` for the DNS-rebinding allowlists. `allowed_hosts` defaults to inheriting the host's Rails `config.hosts` string entries, so apps that already configure Rails host authorization need nothing extra; an explicit list replaces it, and `[]` allows loopback only.
+- Config: `mcp_transport_options` forwards arbitrary settings to the mcp gem's transport (e.g. `max_request_bytes`); the DNS-rebinding keys always override it, so it can tune but never weaken protection.
+
 ## [0.3.0]
 
 - `worker_stats` tool: list registered workers (state, subscribed queues, per-worker processed/failed counts, start time, current job with filtered args preview) with a `state` filter (`working`/`idle`/`all`), global counts including `heartbeat_expired`, and the standard pagination envelope. Workers whose heartbeat is older than `Resque.prune_interval` are flagged as likely dead.

data/README.md

@@ -34,6 +34,22 @@ Resque::Mcp.configure do |c|
   # token could be created by e.g.: `bin/rails runner 'puts SecureRandom.base58(32)'`
   c.auth_token = Rails.application.credentials.dig(:resque_mcp, :token)
 
+  # DNS-rebinding protection (CVE-2026-63118) rejects any Host outside the
+  # allowlist with 403; loopback (127.0.0.1/::1/localhost) is always allowed.
+  # By default the allowlist is inherited from your Rails config.hosts, so if
+  # that already lists your domain(s) you need nothing here. Only plain
+  # hostname strings are honored (here and when inherited) — regexps, IPAddrs,
+  # and ".sub.domain" wildcards are dropped, so give concrete hostnames:
+  # c.allowed_hosts = ["resque.example.com"]
+
+  # Optional: extra permitted Origin values beyond same-origin.
+  # c.allowed_origins = ["https://resque.example.com"]
+
+  # Optional: escape hatch for mcp settings this gem doesn't expose directly,
+  # forwarded to the transport (the DNS-rebinding keys above always take
+  # precedence and can't be weakened here):
+  # c.mcp_transport_options = { max_request_bytes: 8 * 1024 * 1024 }
+
   # Optional: which job-args keys to mask as [FILTERED] in tool responses.
   # Defaults to your app's config.filter_parameters; an explicit list
   # replaces it (merge yourself if you want both):
@@ -41,7 +57,7 @@ Resque::Mcp.configure do |c|
 end
 ```
 
-The token is **required** — the endpoint answers `503` until one is configured, and `401` on any request without a matching `Authorization: Bearer` header. The engine talks to whatever `Resque.redis` your app already configured; it never opens its own Redis connection.
+The token is **required** — the endpoint answers `503` until one is configured, and `401` on any request without a matching `Authorization: Bearer` header. The endpoint also validates the `Host`/`Origin` headers against DNS rebinding: the allowed hosts default to your Rails `config.hosts`, so a non-loopback request gets `403` unless its Host is in that list (or in an explicit `allowed_hosts`). The engine talks to whatever `Resque.redis` your app already configured; it never opens its own Redis connection.
 
 Job arguments shown by any tool are filtered through `ActiveSupport::ParameterFilter` **before** preview/truncation, using your Rails `filter_parameters` by default — the same keys you hide from your logs are hidden from the model. Filters match hash keys (at any depth, same semantics as Rails log filtering, including anchored dot-notation like `/\Acredit_card\.code\z/`); positional scalar args have no key and pass through. Set `c.filter_parameters = []` to disable.
 

data/app/controllers/resque/mcp/endpoint_controller.rb

@@ -6,27 +6,93 @@ module Resque
       before_action :require_auth_token, only: :handle
 
       def handle
+        # Rack 3 input may not be rewindable: read before the transport does.
+        @raw_jsonrpc_body = request.raw_post
         server = ServerFactory.build(environment: Rails.env.to_s)
-        transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(
-          server, stateless: true, enable_json_response: true
+        config = Resque::Mcp.config
+        # Passthrough first; our security-critical keys override, so nothing
+        # in mcp_transport_options can weaken the DNS-rebinding posture.
+        options = config.mcp_transport_options.merge(
+          stateless: true,
+          enable_json_response: true,
+          dns_rebinding_protection: true,
+          allowed_hosts: config.allowed_hosts,
+          allowed_origins: config.allowed_origins
         )
+        transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(server, **options)
 
         status, headers, body = transport.handle_request(request)
-        headers.each { |key, value| response.set_header(key, value) }
+        render_transport_response(status, headers, body)
+      end
+
+      def method_not_allowed
+        head :method_not_allowed
+      end
+
+      private
+
+      # Rack 3 forbids these on a response; the SSE headers carry one.
+      HOP_BY_HOP_HEADERS = %w[
+        connection keep-alive proxy-authenticate proxy-authorization
+        te trailer transfer-encoding upgrade
+      ].freeze
+
+      # A callable body is a stream the transport wants to keep open (today
+      # only `subscriptions/listen`); stateless has nothing to push, so decline.
+      def render_transport_response(status, headers, body)
+        if body.respond_to?(:call)
+          # 200, not 501: clients that reject on `!response.ok` never parse the
+          # body, and the transport headers describe the declined stream.
+          return render json: {
+            jsonrpc: "2.0",
+            id: jsonrpc_request_id,
+            error: {
+              code: -32601,
+              message: "Method not found: #{jsonrpc_method_label} is not supported by this stateless endpoint"
+            }
+          }, status: :ok
+        end
+
+        headers.each do |key, value|
+          next if HOP_BY_HOP_HEADERS.include?(key.to_s.downcase)
+          response.set_header(key, value)
+        end
 
         payload = body.first
-        if payload
-          render json: payload, status: status
+        return head status unless payload
+
+        content_type = transport_content_type(headers)
+        if content_type && !content_type.start_with?("application/json")
+          render body: payload, content_type: content_type, status: status
         else
-          head status
+          render json: payload, status: status
         end
       end
 
-      def method_not_allowed
-        head :method_not_allowed
+      # A null id leaves a strict client unable to correlate the error.
+      def jsonrpc_payload
+        @jsonrpc_payload ||= begin
+          parsed = JSON.parse(@raw_jsonrpc_body.to_s)
+          parsed.is_a?(Hash) ? parsed : {}
+        rescue JSON::ParserError
+          {}
+        end
       end
 
-      private
+      def jsonrpc_request_id
+        id = jsonrpc_payload["id"]
+        id if id.is_a?(String) || id.is_a?(Integer)
+      end
+
+      def jsonrpc_method_label
+        method_name = jsonrpc_payload["method"]
+        method_name.is_a?(String) ? method_name : "this method"
+      end
+
+      def transport_content_type(headers)
+        _, value = headers.find { |key, _| key.to_s.casecmp("content-type").zero? }
+        value
+      end
 
       # No reliable boot-time hook exists (initializer ordering), so a
       # missing token is caught per request: 503, never silently open.

data/lib/resque/mcp/configuration.rb

@@ -4,6 +4,43 @@ module Resque
   module Mcp
     class Configuration
       attr_accessor :auth_token
+
+      # DNS-rebinding protection (mcp >= 0.23, CVE-2026-63118). The transport
+      # validates Host/Origin headers; loopback hosts are always allowed.
+      #
+      # nil (default) inherits the host's Rails config.hosts; an explicit list
+      # replaces it; [] means loopback only. Either way, only plain hostname
+      # strings are honored — regexps, IPAddrs, and leading-dot subdomain
+      # wildcards (".example.com") can't map to the SDK's exact-hostname
+      # matching (and a non-string would crash its downcase), so they're
+      # dropped from both paths. allowed_origins adds extra permitted Origin
+      # values beyond same-origin.
+      attr_writer :allowed_hosts, :allowed_origins
+
+      # Internal seam: a callable returning the host's config.hosts, read
+      # lazily (the engine wires it) so post-boot changes are never missed.
+      attr_accessor :default_allowed_hosts
+
+      def allowed_hosts
+        list = (defined?(@allowed_hosts) && @allowed_hosts) ? @allowed_hosts : default_allowed_hosts&.call
+        Array(list).select { |h| h.is_a?(String) && !h.start_with?(".") }
+      end
+
+      def allowed_origins
+        @allowed_origins || []
+      end
+
+      # Extra settings for the mcp gem, forwarded verbatim to its
+      # StreamableHTTPTransport (e.g. max_request_bytes:). Tuning only — the
+      # controller applies the security-critical keys (allowed_hosts,
+      # allowed_origins, stateless, dns_rebinding_protection) *after* these,
+      # so a passthrough value can never weaken them.
+      attr_writer :mcp_transport_options
+
+      def mcp_transport_options
+        @mcp_transport_options || {}
+      end
+
       # nil = inherit the host default (the engine wires Rails'
       # filter_parameters as a lazy source); an explicit list replaces it
       # ([] disables filtering).

data/lib/resque/mcp/engine.rb

@@ -14,6 +14,13 @@ module Resque
       initializer "resque_mcp.filter_parameters" do
         Resque::Mcp.config.default_filter_parameters = -> { Rails.application.config.filter_parameters }
       end
+
+      # allowed_hosts inherits the host's config.hosts (the same list Rails'
+      # own host authorization uses) unless explicitly configured, read
+      # lazily for the same reason as the filter list above.
+      initializer "resque_mcp.allowed_hosts" do
+        Resque::Mcp.config.default_allowed_hosts = -> { Rails.application.config.hosts }
+      end
     end
   end
 end

data/lib/resque/mcp/server_factory.rb

@@ -10,6 +10,10 @@ module Resque
           name: "resque-mcp",
           version: Resque::Mcp::VERSION,
           tools: [Tools::Overview, Tools::QueueStats, Tools::WorkerStats, Tools::ListFailures, Tools::GetFailure],
+          # Explicit, or the SDK advertises `listChanged`/`subscribe` streams
+          # we decline. This hash replaces the defaults and the SDK refuses
+          # methods whose key is absent — hence the empty prompts/resources.
+          capabilities: {tools: {}, prompts: {}, resources: {}, logging: {}},
           server_context: {adapter: Adapter.new, environment: environment}
         )
       end

data/lib/resque/mcp/version.rb

@@ -2,6 +2,6 @@
 
 module Resque
   module Mcp
-    VERSION = "0.3.0"
+    VERSION = "0.5.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: resque-mcp
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Josch Bockler
@@ -33,16 +33,22 @@ dependencies:
   name: mcp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.23'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.23'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '2'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement