@bryan-thompson/inspector-assessment-server 1.17.1 → 1.18.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/index.js +27 -0
- package/package.json +2 -1
package/build/index.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
import cors from "cors";
|
|
3
|
+
import rateLimit from "express-rate-limit";
|
|
3
4
|
import { parseArgs } from "node:util";
|
|
4
5
|
import { parse as shellParseArgs } from "shell-quote";
|
|
5
6
|
import nodeFetch, { Headers as NodeHeaders } from "node-fetch";
|
|
@@ -134,6 +135,32 @@ const updateHeadersInPlace = (currentHeaders, newHeaders) => {
|
|
|
134
135
|
};
|
|
135
136
|
const app = express();
|
|
136
137
|
app.use(cors());
|
|
138
|
+
// [SECURITY-ENHANCEMENT] - triepod-ai fork: Rate limiting to prevent DoS attacks
|
|
139
|
+
const limiter = rateLimit({
|
|
140
|
+
windowMs: 15 * 60 * 1000, // 15 minutes
|
|
141
|
+
max: 100, // Limit each IP to 100 requests per windowMs
|
|
142
|
+
message: {
|
|
143
|
+
error: "Too many requests",
|
|
144
|
+
message: "Please try again later",
|
|
145
|
+
},
|
|
146
|
+
standardHeaders: true,
|
|
147
|
+
legacyHeaders: false,
|
|
148
|
+
});
|
|
149
|
+
// Apply rate limiting to all MCP endpoints
|
|
150
|
+
app.use("/mcp", limiter);
|
|
151
|
+
app.use("/sse", limiter);
|
|
152
|
+
app.use("/stdio", limiter);
|
|
153
|
+
app.use("/message", limiter);
|
|
154
|
+
// [SECURITY-ENHANCEMENT] - triepod-ai fork: Global body size limits to prevent memory exhaustion
|
|
155
|
+
app.use(express.json({ limit: "10mb" }));
|
|
156
|
+
app.use(express.urlencoded({ limit: "10mb", extended: true }));
|
|
157
|
+
// [SECURITY-ENHANCEMENT] - triepod-ai fork: Content Security Policy headers
|
|
158
|
+
app.use((req, res, next) => {
|
|
159
|
+
res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'");
|
|
160
|
+
res.setHeader("X-Content-Type-Options", "nosniff");
|
|
161
|
+
res.setHeader("X-Frame-Options", "DENY");
|
|
162
|
+
next();
|
|
163
|
+
});
|
|
137
164
|
app.use((req, res, next) => {
|
|
138
165
|
res.header("Access-Control-Expose-Headers", "mcp-session-id");
|
|
139
166
|
next();
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@bryan-thompson/inspector-assessment-server",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.18.0",
|
|
4
4
|
"description": "Server-side application for the Enhanced MCP Inspector with assessment capabilities",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "Bryan Thompson <bryan@triepod.ai>",
|
|
@@ -41,6 +41,7 @@
|
|
|
41
41
|
"@modelcontextprotocol/sdk": "^1.24.3",
|
|
42
42
|
"cors": "^2.8.5",
|
|
43
43
|
"express": "^5.1.0",
|
|
44
|
+
"express-rate-limit": "^8.2.1",
|
|
44
45
|
"shell-quote": "^1.8.3",
|
|
45
46
|
"spawn-rx": "^5.1.2",
|
|
46
47
|
"ws": "^8.18.0",
|