ruby-mcp-client 2.0.0 → 2.1.0

data/lib/mcp_client/http_transport_base.rb

@@ -33,7 +33,7 @@ module MCPClient
     def rpc_request(method, params = {}, timeout: nil)
       ensure_connected
 
-      with_retry do
+      with_retry(method) do
         request_id = @mutex.synchronize { @request_id += 1 }
         request = build_jsonrpc_request(method, params, request_id)
         begin
@@ -112,6 +112,29 @@ module MCPClient
       end
     end
 
+    # Resend a request against the freshly restarted session — unless doing so
+    # could execute a side effect twice.
+    #
+    # A 404 usually means the server rejected the request outright, but it does
+    # not prove that: a session can expire after the tool ran. Automatic
+    # session recovery is worth having for idempotent methods, and would
+    # otherwise be a hole straight through the no-replay guarantee that
+    # with_retry enforces for NON_IDEMPOTENT_METHODS.
+    #
+    # Raises ConnectionError (which with_retry never retries) so no other path
+    # can turn this into a second attempt.
+    # @param request [Hash] the JSON-RPC request that hit the expired session
+    # @return [Faraday::Response] the response to the resent request
+    # @raise [MCPClient::Errors::ConnectionError] for a non-idempotent method
+    def resend_after_session_restart(request)
+      method = request['method']
+      return send_http_request(request) unless NON_IDEMPOTENT_METHODS.include?(method)
+
+      raise MCPClient::Errors::ConnectionError,
+            "Session expired during #{method}; a new session was started but the request was NOT resent " \
+            'because it may already have executed. Retry it explicitly if that is safe.'
+    end
+
     # Validate session ID format
     # Per MCP 2025-11-25, the server-assigned session ID "MUST only contain
     # visible ASCII characters (ranging from 0x21 to 0x7E)" — e.g. a UUID, a
@@ -181,7 +204,7 @@ module MCPClient
     # @raise [MCPClient::Errors::TransportError] if response isn't valid JSON
     # @raise [MCPClient::Errors::ToolCallError] for other errors during request execution
     def send_jsonrpc_request(request, timeout: nil)
-      @logger.debug("Sending JSON-RPC request: #{request.to_json}")
+      @logger.debug("Sending JSON-RPC request: #{describe_jsonrpc_message(request)}")
 
       begin
         response = send_http_request(request, timeout: timeout)
@@ -189,7 +212,7 @@ module MCPClient
       rescue MCPClient::Errors::ConnectionError, MCPClient::Errors::TransportError, MCPClient::Errors::ServerError
         raise
       rescue JSON::ParserError => e
-        raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{e.message}"
+        raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{describe_parse_error(e)}"
       rescue Errno::ECONNREFUSED => e
         raise MCPClient::Errors::ConnectionError, "Server connection lost: #{e.message}"
       rescue StandardError => e
@@ -274,14 +297,14 @@ module MCPClient
         # Recheck now that the monitor is held: another caller may already
         # have restarted the session while this one waited. If so, skip the
         # extra initialize and just resend against the fresh session.
-        return send_http_request(request) if @session_id != expired_session_id
+        return resend_after_session_restart(request) if @session_id != expired_session_id
 
         @logger.warn("Session #{@session_id} no longer valid (HTTP 404); starting a new session")
         @restarting_session = true
         @session_id = nil
         @last_event_id = nil if instance_variable_defined?(:@last_event_id)
         perform_initialize
-        send_http_request(request)
+        resend_after_session_restart(request)
       ensure
         @restarting_session = false
       end
@@ -471,7 +494,7 @@ module MCPClient
     # Log HTTP response (to be overridden by specific transports)
     # @param response [Faraday::Response] the HTTP response
     def log_response(response)
-      @logger.debug("Received HTTP response: #{response.status} #{response.body}")
+      @logger.debug("Received HTTP response: #{response.status} (#{describe_body_size(response.body)})")
     end
 
     # Parse HTTP response (to be implemented by specific transports)

data/lib/mcp_client/json_rpc_common.rb

@@ -3,6 +3,14 @@
 module MCPClient
   # Shared retry/backoff logic for JSON-RPC transports
   module JsonRpcCommon
+    # JSON-RPC methods with arbitrary side effects that MUST NOT be re-sent
+    # automatically. Even a "transient" failure (5xx, dropped connection,
+    # malformed response) can arrive AFTER the server received the request,
+    # so a retry could execute the operation twice — and JSON-RPC has no
+    # idempotency key to make the duplicate safe. Callers who want to retry
+    # such an operation must decide that explicitly.
+    NON_IDEMPOTENT_METHODS = %w[tools/call].freeze
+
     # Execute the block with retry/backoff for transient errors only.
     #
     # Retries genuinely transient failures where the request most likely did not
@@ -14,10 +22,15 @@ module MCPClient
     # server received and processed (or deterministically rejected) the request.
     # Re-sending those would silently re-execute a non-idempotent operation
     # (e.g. a tools/call), which JSON-RPC provides no way to make safe.
+    #
+    # It also never retries a NON_IDEMPOTENT_METHODS request (pass the
+    # JSON-RPC method being sent): an ambiguous failure may follow server-side
+    # receipt, so those fail fast instead of risking a duplicate execution.
+    # @param method [String, nil] the JSON-RPC method the block sends
     # @yield block to execute
     # @return [Object] result of block
     # @raise original exception if max retries exceeded or the error is not retryable
-    def with_retry
+    def with_retry(method = nil)
       attempts = 0
       begin
         yield
@@ -25,7 +38,16 @@ module MCPClient
              Errno::ETIMEDOUT, Errno::ECONNRESET, Errno::EPIPE => e
         # A timed-out request may still be executing server-side; re-sending
         # it could run a non-idempotent operation twice. Never retry those.
+        # An oversized response is the same story from the other direction:
+        # the server already ran the request, so a re-send risks a duplicate
+        # side effect (and re-does the oversized decode).
         raise if e.is_a?(MCPClient::Errors::RequestTimeoutError)
+        raise if e.is_a?(MCPClient::Errors::ResponseTooLargeError)
+
+        if NON_IDEMPOTENT_METHODS.include?(method)
+          @logger.debug("Not retrying non-idempotent #{method} after error: #{e.message}")
+          raise
+        end
 
         attempts += 1
         if attempts <= @max_retries
@@ -38,6 +60,53 @@ module MCPClient
       end
     end
 
+    # A log-safe description of a JSON-RPC message: its method and id only.
+    #
+    # Params and results are deliberately omitted. tools/call arguments and
+    # tool results routinely carry credentials, personal data or customer
+    # content, and logs are frequently shipped to lower-trust destinations
+    # (aggregators, CI artifacts, support bundles) — so enabling DEBUG must
+    # not silently start recording payloads.
+    # @param message [Hash] a JSON-RPC request, notification or response
+    # @return [String] method/id summary, never payload content
+    def describe_jsonrpc_message(message)
+      return '(non-object message)' unless message.is_a?(Hash)
+
+      parts = []
+      parts << (message['method'] || message[:method] || '(response)').to_s
+      id = message['id'] || message[:id]
+      parts << "id=#{id}" if id
+      parts << 'error' if message['error'] || message[:error]
+      parts.join(' ')
+    end
+
+    # A log-safe description of a JSON parse failure.
+    #
+    # JSON::ParserError#message quotes the offending token — e.g.
+    # "expected object key, got 'SECRET-123' at line 1 column 2" — so
+    # interpolating it puts peer-controlled bytes straight into logs and
+    # exception messages. Keep the position, which is what actually helps
+    # diagnose a broken server, and drop the quoted content.
+    # @param error [JSON::ParserError] the parse failure
+    # @param payload [String, nil] the payload that failed to parse
+    # @return [String] position and size, never payload content
+    def describe_parse_error(error, payload = nil)
+      location = error.message[/at line \d+ column \d+/]
+      parts = ['malformed JSON']
+      parts << location if location
+      parts << describe_body_size(payload) if payload
+      parts.join(', ')
+    end
+
+    # A log-safe description of a payload body: its size, never its content.
+    # @param body [String, nil] the response/request body
+    # @return [String]
+    def describe_body_size(body)
+      return 'empty body' if body.nil? || body.empty?
+
+      "#{body.bytesize} bytes"
+    end
+
     # Ping the server to keep the connection alive
     # @return [Hash] the result of the ping request
     # @raise [MCPClient::Errors::ToolCallError] if ping times out or fails

data/lib/mcp_client/resource.rb

@@ -36,7 +36,6 @@ module MCPClient
     # @param icons [Array<Hash>, nil] optional icons for display in user interfaces (MCP 2025-11-25)
     # @param meta [Hash, nil] optional `_meta` metadata attached to the resource (MCP 2025-11-25)
     # @param server [MCPClient::ServerBase, nil] the server this resource belongs to
-    # rubocop:disable Metrics/ParameterLists
     def initialize(uri:, name:, title: nil, description: nil, mime_type: nil, size: nil, annotations: nil,
                    icons: nil, meta: nil, server: nil)
       @uri = uri
@@ -50,7 +49,6 @@ module MCPClient
       @meta = meta
       @server = server
     end
-    # rubocop:enable Metrics/ParameterLists
 
     # Return the lastModified annotation value (ISO 8601 timestamp string)
     # @return [String, nil] the lastModified timestamp, or nil if not set

data/lib/mcp_client/resource_link.rb

@@ -35,7 +35,6 @@ module MCPClient
     # @param size [Integer, nil] optional size of the resource in bytes
     # @param icons [Array<Hash>, nil] optional icons for display in user interfaces (MCP 2025-11-25)
     # @param meta [Hash, nil] optional `_meta` metadata attached to the resource link (MCP 2025-11-25)
-    # rubocop:disable Metrics/ParameterLists
     def initialize(uri:, name:, description: nil, mime_type: nil, annotations: nil, title: nil, size: nil,
                    icons: nil, meta: nil)
       @uri = uri
@@ -48,7 +47,6 @@ module MCPClient
       @icons = icons
       @meta = meta
     end
-    # rubocop:enable Metrics/ParameterLists
 
     # Create a ResourceLink instance from JSON data
     # @param data [Hash] JSON data from MCP server (content item with type 'resource_link')

data/lib/mcp_client/resource_template.rb

@@ -34,7 +34,6 @@ module MCPClient
     # @param icons [Array<Hash>, nil] optional icons for display in user interfaces (MCP 2025-11-25)
     # @param meta [Hash, nil] optional `_meta` metadata attached to the resource template (MCP 2025-11-25)
     # @param server [MCPClient::ServerBase, nil] the server this resource template belongs to
-    # rubocop:disable Metrics/ParameterLists
     def initialize(uri_template:, name:, title: nil, description: nil, mime_type: nil, annotations: nil,
                    icons: nil, meta: nil, server: nil)
       @uri_template = uri_template
@@ -47,7 +46,6 @@ module MCPClient
       @meta = meta
       @server = server
     end
-    # rubocop:enable Metrics/ParameterLists
 
     # Create a ResourceTemplate instance from JSON data
     # @param data [Hash] JSON data from MCP server

data/lib/mcp_client/schema_validator.rb

@@ -35,6 +35,19 @@ module MCPClient
       unevaluatedProperties unevaluatedItems
     ].freeze
 
+    # Wall-clock budget for ALL pattern matching in a single validate call.
+    # Schemas come from the remote server, so an expensive expression must not
+    # be able to monopolize the calling thread.
+    #
+    # The budget is for the whole operation, not per match: a per-match limit
+    # multiplies, since the server also controls how many strings it sends
+    # (N array items under one pathological items.pattern costs N x limit).
+    PATTERN_MATCH_TIMEOUT = 1.0
+
+    # Floor for an individual match's timeout, so a nearly-exhausted budget
+    # still makes progress rather than failing every remaining pattern.
+    MIN_PATTERN_MATCH_TIMEOUT = 0.01
+
     # Keywords whose value is a single subschema to walk.
     SUBSCHEMA_KEYWORDS = %w[
       items contains additionalProperties propertyNames not if then else
@@ -85,17 +98,20 @@ module MCPClient
     # @param schema [Hash] the JSON schema
     # @param path [String] JSON-pointer-style location used in error messages
     # @return [Array<String>] human-readable validation errors (empty if valid)
-    def self.validate(data, schema, path: '#')
+    def self.validate(data, schema, path: '#', deadline: nil)
       return [] unless schema.is_a?(Hash)
 
+      # One deadline covers the entire (recursive) validation.
+      deadline ||= Process.clock_gettime(Process::CLOCK_MONOTONIC) + PATTERN_MATCH_TIMEOUT
+
       schema = schema.transform_keys(&:to_s)
       errors = []
       errors.concat(validate_type(data, schema['type'], path)) if schema.key?('type')
       errors.concat(validate_enum(data, schema, path))
       case data
-      when Hash then errors.concat(validate_object(data, schema, path))
-      when Array then errors.concat(validate_array(data, schema, path))
-      when String then errors.concat(validate_string(data, schema, path))
+      when Hash then errors.concat(validate_object(data, schema, path, deadline))
+      when Array then errors.concat(validate_array(data, schema, path, deadline))
+      when String then errors.concat(validate_string(data, schema, path, deadline))
       when Numeric then errors.concat(validate_number(data, schema, path))
       end
       errors
@@ -179,7 +195,7 @@ module MCPClient
     # @param schema [Hash] string-keyed schema
     # @param path [String] location for error messages
     # @return [Array<String>] validation errors
-    def self.validate_object(data, schema, path)
+    def self.validate_object(data, schema, path, deadline = nil)
       errors = []
       Array(schema['required']).each do |raw_name|
         name = raw_name.to_s
@@ -199,7 +215,7 @@ module MCPClient
               end
         next if key.nil?
 
-        errors.concat(validate(data[key], prop_schema, path: "#{path}/#{name}"))
+        errors.concat(validate(data[key], prop_schema, path: "#{path}/#{name}", deadline: deadline))
       end
       errors
     end
@@ -209,7 +225,7 @@ module MCPClient
     # @param schema [Hash] string-keyed schema
     # @param path [String] location for error messages
     # @return [Array<String>] validation errors
-    def self.validate_array(data, schema, path)
+    def self.validate_array(data, schema, path, deadline = nil)
       errors = []
       min_items = schema['minItems']
       max_items = schema['maxItems']
@@ -221,7 +237,9 @@ module MCPClient
       end
       items = schema['items']
       if items.is_a?(Hash)
-        data.each_with_index { |item, idx| errors.concat(validate(item, items, path: "#{path}/#{idx}")) }
+        data.each_with_index do |item, idx|
+          errors.concat(validate(item, items, path: "#{path}/#{idx}", deadline: deadline))
+        end
       end
       errors
     end
@@ -231,7 +249,7 @@ module MCPClient
     # @param schema [Hash] string-keyed schema
     # @param path [String] location for error messages
     # @return [Array<String>] validation errors
-    def self.validate_string(data, schema, path)
+    def self.validate_string(data, schema, path, deadline = nil)
       errors = []
       min_length = schema['minLength']
       max_length = schema['maxLength']
@@ -241,25 +259,51 @@ module MCPClient
       if max_length.is_a?(Numeric) && data.length > max_length
         errors << "#{path}: string is longer than maxLength #{max_length}"
       end
-      errors.concat(validate_pattern(data, schema['pattern'], path))
+      errors.concat(validate_pattern(data, schema['pattern'], path, deadline))
       errors
     end
 
     # Validate a string against a regular-expression pattern.
     # Invalid patterns are not enforced.
+    #
+    # The pattern comes from the tool's outputSchema, i.e. from the remote
+    # server, so matching runs against the validation-wide deadline: neither a
+    # single expensive expression nor many cheap-looking ones can pin the
+    # calling thread. A match that exceeds the budget is reported as a
+    # validation error rather than silently accepted — the value was never
+    # shown to satisfy the schema.
     # @param data [String] the string
     # @param pattern [Object] the pattern keyword value
     # @param path [String] location for error messages
+    # @param deadline [Float, nil] monotonic deadline for the whole validation
     # @return [Array<String>] validation errors
-    def self.validate_pattern(data, pattern, path)
+    def self.validate_pattern(data, pattern, path, deadline = nil)
       return [] unless pattern.is_a?(String)
-      return [] if data.match?(Regexp.new(pattern))
+
+      remaining = pattern_budget_remaining(deadline)
+      return ["#{path}: pattern matching budget exhausted before #{pattern.inspect}"] if remaining.zero?
+
+      return [] if data.match?(Regexp.new(pattern, timeout: remaining))
 
       ["#{path}: string does not match pattern #{pattern.inspect}"]
+    rescue Regexp::TimeoutError
+      ["#{path}: pattern #{pattern.inspect} exceeded the #{PATTERN_MATCH_TIMEOUT}s matching budget"]
     rescue RegexpError
       []
     end
 
+    # Time left in the validation-wide pattern budget.
+    # @param deadline [Float, nil] monotonic deadline, or nil for a lone match
+    # @return [Float] seconds available for the next match; 0.0 when exhausted
+    def self.pattern_budget_remaining(deadline)
+      return PATTERN_MATCH_TIMEOUT unless deadline
+
+      remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      return 0.0 if remaining <= 0
+
+      [remaining, MIN_PATTERN_MATCH_TIMEOUT].max
+    end
+
     # Validate a number against inclusive/exclusive bounds.
     # @param data [Numeric] the number
     # @param schema [Hash] string-keyed schema

data/lib/mcp_client/server_factory.rb

@@ -99,7 +99,10 @@ module MCPClient
         name: config[:name],
         logger: logger,
         oauth_provider: config[:oauth_provider],
-        faraday_config: config[:faraday_config]
+        faraday_config: config[:faraday_config],
+        max_decompressed_body_bytes:
+          config[:max_decompressed_body_bytes] ||
+            MCPClient::ServerStreamableHTTP::JsonRpcTransport::MAX_DECOMPRESSED_BODY_BYTES
       )
     end
 

data/lib/mcp_client/server_http/json_rpc_transport.rb

@@ -21,7 +21,7 @@ module MCPClient
         data = JSON.parse(body)
         process_jsonrpc_response(data)
       rescue JSON::ParserError => e
-        raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{e.message}"
+        raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{describe_parse_error(e)}"
       end
     end
   end

data/lib/mcp_client/server_sse/json_rpc_transport.rb

@@ -2,10 +2,13 @@
 
 require_relative '../json_rpc_common'
 
+require_relative 'origin_policy'
+
 module MCPClient
   class ServerSSE
     # JSON-RPC request/notification plumbing for SSE transport
     module JsonRpcTransport
+      include OriginPolicy
       include JsonRpcCommon
 
       # Generic JSON-RPC request: send method with params and return result
@@ -19,7 +22,7 @@ module MCPClient
       def rpc_request(method, params = {}, timeout: nil)
         ensure_initialized
 
-        with_retry do
+        with_retry(method) do
           request_id = @mutex.synchronize { @request_id += 1 }
           request = build_jsonrpc_request(method, params, request_id)
           begin
@@ -119,8 +122,12 @@ module MCPClient
       # @raise [MCPClient::Errors::TransportError] if response isn't valid JSON
       # @raise [MCPClient::Errors::ToolCallError] for other errors during request execution
       def send_jsonrpc_request(request, timeout: nil)
-        @logger.debug("Sending JSON-RPC request: #{request.to_json}")
+        @logger.debug("Sending JSON-RPC request: #{describe_jsonrpc_message(request)}")
         record_activity
+        # Register the id BEFORE posting: the SSE stream may deliver the
+        # response before the POST returns, and only responses to registered
+        # (outstanding) requests are accepted into @sse_results.
+        register_pending_request(request['id'])
 
         begin
           response = post_json_rpc_request(request)
@@ -133,12 +140,33 @@ module MCPClient
         rescue MCPClient::Errors::ConnectionError, MCPClient::Errors::TransportError, MCPClient::Errors::ServerError
           raise
         rescue JSON::ParserError => e
-          raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{e.message}"
+          raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{describe_parse_error(e)}"
         rescue Errno::ECONNREFUSED => e
           raise MCPClient::Errors::ConnectionError, "Server connection lost: #{e.message}"
         rescue StandardError => e
           method_name = request['method']
           raise MCPClient::Errors::ToolCallError, "Error executing request '#{method_name}': #{e.message}"
+        ensure
+          unregister_pending_request(request['id'])
+        end
+      end
+
+      # Mark a request id as awaiting its response.
+      # @param request_id [Integer, String] id of the outgoing request
+      # @return [void]
+      def register_pending_request(request_id)
+        @mutex.synchronize { @pending_request_ids.add(request_id) }
+      end
+
+      # Stop accepting responses for a request id (completed, failed or timed
+      # out) and drop any result that was never consumed — a late or duplicate
+      # response must not accumulate in @sse_results.
+      # @param request_id [Integer, String] id of the finished request
+      # @return [void]
+      def unregister_pending_request(request_id)
+        @mutex.synchronize do
+          @pending_request_ids.delete(request_id)
+          @sse_results.delete(request_id)
         end
       end
 
@@ -178,7 +206,7 @@ module MCPClient
       def create_json_rpc_connection(base_url)
         Faraday.new(url: base_url) do |f|
           f.request :retry, max: @max_retries, interval: @retry_backoff, backoff_factor: 2
-          f.response :follow_redirects, limit: 3
+          f.response :follow_redirects, limit: 3, callback: method(:reject_cross_origin_redirect!)
           f.options.open_timeout = @read_timeout
           f.options.timeout = @read_timeout
           f.adapter Faraday.default_adapter
@@ -207,7 +235,7 @@ module MCPClient
         end
 
         msg = "Received JSON-RPC response: #{response.status}"
-        msg += " #{response.body}" if response.respond_to?(:body)
+        msg += " (#{describe_body_size(response.body)})" if response.respond_to?(:body)
         @logger.debug(msg)
         response
       end
@@ -306,7 +334,7 @@ module MCPClient
         data = JSON.parse(response.body)
         process_jsonrpc_response(data)
       rescue JSON::ParserError => e
-        raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{e.message}"
+        raise MCPClient::Errors::TransportError, "Invalid JSON response from server: #{describe_parse_error(e)}"
       end
     end
   end

data/lib/mcp_client/server_sse/origin_policy.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+module MCPClient
+  class ServerSSE
+    # Origin pinning for the legacy HTTP+SSE transport.
+    #
+    # Everything this transport sends carries the caller's configured headers
+    # (Authorization, API keys, cookies), and callback responses carry
+    # roots/sampling/elicitation data, so no request may leave the origin the
+    # caller connected to — neither by a server-chosen endpoint URI nor by a
+    # redirect.
+    module OriginPolicy
+      # @param base [URI::Generic] the SSE connection URL
+      # @param other [URI::Generic] the URL to compare
+      # @return [Boolean] whether both share scheme, host and port
+      def same_origin?(base, other)
+        base.scheme == other.scheme &&
+          base.host&.downcase == other.host&.downcase &&
+          base.port == other.port
+      end
+
+      # @param uri [URI::Generic]
+      # @return [String] scheme://host:port of the URI
+      def origin_of(uri)
+        "#{uri.scheme}://#{uri.host}:#{uri.port}"
+      end
+
+      # Refuse to follow a redirect that leaves the SSE connection's origin.
+      #
+      # Pinning the endpoint event's origin is not sufficient on its own: a
+      # same-origin endpoint can answer a POST with a 307/308 to another
+      # origin, and faraday-follow_redirects replays the request there. It
+      # strips only the literal Authorization header, so configured API-key
+      # and other custom headers — plus the JSON-RPC body — would still reach
+      # the foreign origin.
+      #
+      # Raises ConnectionError rather than TransportError because the server
+      # has already received the original request; with_retry must not re-send
+      # it.
+      # @param _old_env [Faraday::Env] the redirecting response environment
+      # @param new_env [Faraday::Env] environment of the request about to be replayed
+      # @return [void]
+      # @raise [MCPClient::Errors::ConnectionError] if the redirect changes origin
+      def reject_cross_origin_redirect!(_old_env, new_env)
+        base = URI.parse(@base_url)
+        target = new_env.url
+        return if same_origin?(base, target)
+
+        message = "Refusing cross-origin redirect from #{origin_of(base)} to #{origin_of(target)}"
+        @logger.error(message)
+        raise MCPClient::Errors::ConnectionError, message
+      end
+    end
+  end
+end

data/lib/mcp_client/server_sse/reconnect_monitor.rb

@@ -1,9 +1,13 @@
 # frozen_string_literal: true
 
+require_relative 'origin_policy'
+
 module MCPClient
   class ServerSSE
     # Extracted module for back-off, ping, and reconnection logic
     module ReconnectMonitor
+      include OriginPolicy
+
       # Start an activity monitor thread to maintain the connection
       # @return [void]
       def start_activity_monitor
@@ -202,7 +206,9 @@ module MCPClient
           f.options.open_timeout = 10
           f.options.timeout = nil
           f.request :retry, max: @max_retries, interval: @retry_backoff, backoff_factor: 2
-          f.response :follow_redirects, limit: 3
+          # Same origin pinning as the RPC connection: the SSE stream carries
+          # the configured credential headers too.
+          f.response :follow_redirects, limit: 3, callback: method(:reject_cross_origin_redirect!)
           f.adapter Faraday.default_adapter
         end
 

data/lib/mcp_client/server_sse/sse_parser.rb

@@ -2,11 +2,14 @@
 
 require 'json'
 require 'uri'
+require_relative 'origin_policy'
 
 module MCPClient
   class ServerSSE
     # === Wire-level SSE parsing & dispatch ===
     module SseParser
+      include OriginPolicy
+
       # Parse and handle a raw SSE event payload.
       # @param event_data [String] the raw event chunk
       def parse_and_handle_sse_event(event_data)
@@ -39,7 +42,7 @@ module MCPClient
         rescue MCPClient::Errors::ConnectionError
           raise
         rescue JSON::ParserError => e
-          @logger.warn("Failed to parse JSON from event data: #{e.message}")
+          @logger.warn("Failed to parse JSON from event data: #{describe_parse_error(e, event[:data])}")
         rescue StandardError => e
           @logger.error("Error processing SSE event: #{e.message}")
         end
@@ -98,6 +101,15 @@ module MCPClient
         # paginated list. Writing each page as it arrives would let a concurrent
         # list_tools observe a partial (page-1-only) cache mid-pagination.
         @mutex.synchronize do
+          # The stream is peer-controlled: only ids some caller is actually
+          # waiting on are stored. Without this check a server could stream
+          # unsolicited responses with fresh ids and grow @sse_results without
+          # bound for the lifetime of the client.
+          unless @pending_request_ids.include?(data['id'])
+            @logger.debug("Discarding unsolicited response id #{data['id'].inspect}")
+            return true
+          end
+
           @sse_results[data['id']] =
             if data['error']
               # JSON-RPC error response: store the error under a Symbol key
@@ -156,20 +168,39 @@ module MCPClient
         end
       end
 
-      # Resolve an endpoint URI reference against the SSE connection URL
+      # Resolve an endpoint URI reference against the SSE connection URL.
+      # The resolved endpoint MUST stay on the SSE connection's origin: the
+      # event payload is server-controlled input, and honoring a cross-origin
+      # target would redirect every JSON-RPC POST — including the configured
+      # Authorization/API-key headers and callback response bodies — to a
+      # server the caller never chose.
       # @param data [String] the endpoint event payload (absolute or relative URI)
       # @return [String] the absolute endpoint URL
       def resolve_endpoint_uri(data)
-        URI.join(@base_url, data).to_s
+        endpoint = URI.join(@base_url, data)
+        base = URI.parse(@base_url)
+        unless same_origin?(base, endpoint)
+          fail_endpoint_handshake!(
+            "Cross-origin endpoint in SSE endpoint event: #{data.inspect} " \
+            "does not match the connection origin #{origin_of(base)}"
+          )
+        end
+        endpoint.to_s
       rescue URI::Error => e
         # The endpoint event is the handshake's core payload; an unresolvable
         # URI must fail the handshake rather than deferring a broken POST
         # target to the first request.
         @logger.error("Failed to resolve endpoint URI #{data.inspect} against #{@base_url}: #{e.message}")
-        message = "Invalid endpoint URI in SSE endpoint event: #{data.inspect} (#{e.message})"
-        # The SSE worker thread swallows this exception with a generic rescue,
-        # so also record the failure cause (mirroring @auth_error) for the
-        # connect caller blocked in wait_for_connection to surface promptly.
+        fail_endpoint_handshake!("Invalid endpoint URI in SSE endpoint event: #{data.inspect} (#{e.message})")
+      end
+
+      # Record the handshake failure cause and raise. The SSE worker thread
+      # swallows this exception with a generic rescue, so also record the
+      # failure (mirroring @auth_error) for the connect caller blocked in
+      # wait_for_connection to surface promptly.
+      # @param message [String] the failure description
+      # @raise [MCPClient::Errors::TransportError] always
+      def fail_endpoint_handshake!(message)
         @mutex.synchronize do
           @connection_error = message
           @connection_established = false