@assistant-ui/react-mcp 0.1.20 → 0.1.22

package/src/utils/serverUrl.test.ts

@@ -2,9 +2,39 @@ import { describe, expect, it } from "vitest";
 import {
   hasPersistedCredentials,
   isAuthStateForServerUrl,
+  isSecureNetworkUrl,
   normalizeMcpServerUrl,
 } from "./serverUrl";
 
+describe("isSecureNetworkUrl", () => {
+  it.each([
+    "https://mcp.example.com/mcp",
+    "http://localhost:3000/mcp",
+    "http://localhost.:3000/mcp",
+    "http://dev.localhost:3000/mcp",
+    "http://dev.localhost.:3000/mcp",
+    "http://127.0.0.1:3000/mcp",
+    "http://127.1.2.3/mcp",
+    "http://[::1]:3000/mcp",
+    "http://[::ffff:127.0.0.1]:3000/mcp",
+    "http://[::ffff:127.1.2.3]/mcp",
+  ])("accepts %s", (url) => {
+    expect(isSecureNetworkUrl(url)).toBe(true);
+  });
+
+  it.each([
+    "http://mcp.example.com/mcp",
+    "http://192.168.1.20:3000/mcp",
+    "http://localhost.example.com/mcp",
+    "http://[::ffff:10.0.0.1]/mcp",
+    "http://[::2]/mcp",
+    "ws://localhost:3000/mcp",
+    "not a url",
+  ])("rejects %s", (url) => {
+    expect(isSecureNetworkUrl(url)).toBe(false);
+  });
+});
+
 describe("normalizeMcpServerUrl", () => {
   it("normalizes host case and the default port", () => {
     expect(normalizeMcpServerUrl("https://MCP.Example.com:443/mcp")).toBe(

package/src/utils/serverUrl.ts

@@ -3,6 +3,32 @@ import type { MCPPersistedAuthState } from "../auth/types";
 export const normalizeMcpServerUrl = (serverUrl: string): string =>
   new URL(serverUrl).toString();
 
+const IPV4_LOOPBACK = /^127(?:\.\d{1,3}){3}$/;
+const IPV4_MAPPED_LOOPBACK = /^\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\]$/;
+
+const isLoopbackHostname = (hostname: string): boolean => {
+  const host = hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+  return (
+    host === "localhost" ||
+    host.endsWith(".localhost") ||
+    IPV4_LOOPBACK.test(host) ||
+    host === "[::1]" ||
+    IPV4_MAPPED_LOOPBACK.test(host)
+  );
+};
+
+export const isSecureNetworkUrl = (serverUrl: string): boolean => {
+  try {
+    const url = new URL(serverUrl);
+    return (
+      url.protocol === "https:" ||
+      (url.protocol === "http:" && isLoopbackHostname(url.hostname))
+    );
+  } catch {
+    return false;
+  }
+};
+
 export const isAuthStateForServerUrl = (
   state: MCPPersistedAuthState | null,
   serverUrl: string,