@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/auth/oauth.js

@@ -0,0 +1,326 @@
+/**
+ * OAuth 2.1 transport against a third-party MCP server: dynamic client
+ * registration (RFC 7591), code exchange, refresh.
+ *
+ * ─── Why VibeDefend authenticates as itself ─────────────────────────────────
+ *
+ * A third-party server's token belongs to whoever obtained it; there is
+ * nothing to borrow from another client's keychain, and the plan forbids
+ * looking. To read a catalogue behind an auth gate, VibeDefend runs its own
+ * OAuth 2.1 flow, like any other MCP client.
+ *
+ * ─── Public client, therefore PKCE ──────────────────────────────────────────
+ *
+ * This runs on a developer's machine, where no secret is protectable, so
+ * VibeDefend registers as a PUBLIC client (`token_endpoint_auth_method:
+ * none`, see `registerMcpClient`) and PKCE S256 is what secures the exchange.
+ * `discovery.ts` already refuses an authorization server that does not
+ * advertise S256 — never `plain`, which would make the protection useless for
+ * a client with no secret. The verifier/challenge pair itself is computed by
+ * `src/auth/pkce.ts`, already generic and already used by `vibedefend login`.
+ * This file only does OAuth TRANSPORT.
+ *
+ * ─── Partitioning ───────────────────────────────────────────────────────────
+ *
+ * A token obtained for Linear has no business at Notion — nor at the
+ * neighbour's on a shared MCP platform (Smithery, Composio, Zapier,
+ * Pipedream all publish N independent servers on a single host, told apart by
+ * PATH alone). The store (`store.ts`) is therefore keyed by the server's
+ * CANONICAL URL (`mcpAuthKey`), scheme and path included, never by host.
+ */
+const DEFAULT_TIMEOUT_MS = 15_000;
+const DEFAULT_PORTS = {
+    'http:': '80',
+    'https:': '443',
+};
+// ─── Canonical server identity ──────────────────────────────────────────────
+/**
+ * Canonical identity of an MCP server: `scheme//host[:port]path`.
+ *
+ * This is the SAME projection as the backend's (`normalizeMcpUrl`,
+ * analysis-reporting-service/src/modules/mcp-match/mcp-url.util.ts): case
+ * normalised, trailing FQDN dot removed, default port omitted, trailing
+ * slash removed from the path, query and fragment dropped. Both sides have to
+ * name a server with the same string, or a verdict rendered over there no
+ * longer describes what we are asking about here.
+ *
+ * `null` for anything that is not http(s) — there is no MCP server identity
+ * to derive from it — or for an unparseable entry.
+ */
+export function canonicalMcpUrl(url) {
+    if (!url || !url.trim())
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url.trim());
+    }
+    catch {
+        return null;
+    }
+    const scheme = parsed.protocol.toLowerCase();
+    if (scheme !== 'http:' && scheme !== 'https:')
+        return null;
+    const host = parsed.hostname.toLowerCase().replace(/\.$/, '');
+    const port = parsed.port && parsed.port !== DEFAULT_PORTS[scheme] ? `:${parsed.port}` : '';
+    const path = parsed.pathname === '/' ? '' : parsed.pathname.replace(/\/$/, '');
+    return `${scheme}//${host}${port}${path}`;
+}
+/**
+ * Storage key for an MCP credential, indexed by the server's CANONICAL URL.
+ *
+ * Not by host. Shared MCP platforms publish N independent servers on one
+ * host, told apart by PATH alone: a per-host key would merge their
+ * credentials, and a `.mcp.json` in a cloned repository declaring
+ * `https://<host>/@evil/tool/mcp` would be enough to send the legitimate
+ * neighbour's token out as `Authorization: Bearer`, with no user interaction
+ * at all. The scheme matters too: without it, `http://<host>/mcp` would
+ * replay a token obtained over https in the clear.
+ *
+ * The prefix keeps these entries from colliding with the CybeDefend ones in
+ * the same keychain (`Codex MCP Credentials`, see `src/auth/auth-store.ts`).
+ */
+export function mcpAuthKey(serverUrl) {
+    return `mcp-oauth|${canonicalMcpUrl(serverUrl) ?? serverUrl.trim().toLowerCase()}`;
+}
+/**
+ * Raised when a SECRET-BEARING request — the code exchange, the refresh, or
+ * the dynamic registration itself — is answered with a REDIRECT (3xx) instead
+ * of a direct response.
+ *
+ * Without this name, such a status fell into the same `null` (or
+ * `{ok:false, reason:'unavailable'}` for `refreshMcpToken`) as an ordinary
+ * 500: indistinguishable from a plain server failure. A third-party MCP
+ * server that answers a request CARRYING a secret (`code`+`code_verifier`,
+ * `refresh_token`+`client_secret`, or the `redirect_uris` of the
+ * registration) with a redirect is not having an incident: it is TRYING to
+ * have that body replayed somewhere else. `redirect: 'manual'` keeps this
+ * file from following the redirect, but the body has already been sent ONCE
+ * to the address we asked, and the 3xx itself is the signal — not a failure
+ * to file with the others.
+ *
+ * `registerMcpClient` and `exchangeMcpCode` have NO return channel for a
+ * reason (`T | null`, by construction — see their docs): throwing is the only
+ * way to name this case without redrawing their whole contract for one
+ * branch. `refreshMcpToken`, which does have one, uses `'suspicious_redirect'`
+ * instead.
+ */
+export class McpSuspiciousRedirectError extends Error {
+    status;
+    constructor(status, context) {
+        super(`MCP server responded to a secret-bearing ${context} request with a redirect (HTTP ${status}) ` +
+            'instead of completing it — treated as an attempted exfiltration, not an ordinary network failure');
+        this.status = status;
+        this.name = 'McpSuspiciousRedirectError';
+    }
+}
+/** An HTTP redirect status (3xx) — the signal this module is built around. */
+function isRedirectStatus(status) {
+    return status >= 300 && status < 400;
+}
+// ─── Dynamic client registration (RFC 7591) ─────────────────────────────────
+/**
+ * Registers a public client, or returns `null`.
+ *
+ * Necessary: VibeDefend is pre-registered with no MCP server vendor, and
+ * asking the user to create an OAuth application by hand on every server
+ * would be unusable.
+ */
+export async function registerMcpClient(registrationEndpoint, redirectUri, deps = {}) {
+    const f = deps.fetchImpl ?? globalThis.fetch;
+    let res;
+    try {
+        res = await f(registrationEndpoint, {
+            method: 'POST',
+            // A 307/308 would replay this request — BODY INCLUDED — against an
+            // origin we did not choose to talk to. The discovery requests carry no
+            // secret, but `redirect_uris` deserves the same guard.
+            redirect: 'manual',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                client_name: 'VibeDefend',
+                redirect_uris: [redirectUri],
+                grant_types: ['authorization_code', 'refresh_token'],
+                response_types: ['code'],
+                // Public client: no secret is protectable on a developer machine, see
+                // the module header.
+                token_endpoint_auth_method: 'none',
+                application_type: 'native',
+            }),
+            signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return null; // an ORDINARY network failure, see McpSuspiciousRedirectError
+    }
+    if (isRedirectStatus(res.status)) {
+        throw new McpSuspiciousRedirectError(res.status, 'dynamic client registration');
+    }
+    if (!res.ok)
+        return null;
+    try {
+        const body = (await res.json());
+        const clientId = typeof body.client_id === 'string' ? body.client_id : null;
+        if (!clientId)
+            return null;
+        return {
+            clientId,
+            clientSecret: typeof body.client_secret === 'string' ? body.client_secret : null,
+        };
+    }
+    catch {
+        return null; // unreadable body, not an attempted redirect
+    }
+}
+/**
+ * Exchanges the authorization code and the PKCE `code_verifier` for a token,
+ * or returns `null`.
+ *
+ * `null` on EVERY failure (network, non-ok status, body with no
+ * `access_token`) — never interpolated text in the output. Unlike
+ * `refreshMcpToken`, no distinction of cause is needed here: an authorization
+ * code is not "refreshed", a failed exchange simply sends the user back to
+ * the start of the flow. That absence of a text channel structurally closes
+ * any risk of a secret leaking into the output.
+ */
+export async function exchangeMcpCode(params) {
+    const f = params.fetchImpl ?? globalThis.fetch;
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: params.code,
+        code_verifier: params.codeVerifier,
+        client_id: params.clientId,
+        redirect_uri: params.redirectUri,
+        // Without `resource`, a token obtained here would be replayable against
+        // another resource of the same authorization server.
+        resource: params.resource,
+    });
+    if (params.clientSecret)
+        body.set('client_secret', params.clientSecret);
+    let res;
+    try {
+        res = await f(params.tokenEndpoint, {
+            method: 'POST',
+            // `code` + `code_verifier` (and `client_secret`, if any) travel in THIS
+            // body. A 307/308 would replay it, body included, against an origin we
+            // did not choose to talk to — `undici` strips `Authorization` across
+            // origins, NOT the body.
+            redirect: 'manual',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body,
+            signal: AbortSignal.timeout(params.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return null; // an ORDINARY network failure, see McpSuspiciousRedirectError
+    }
+    if (isRedirectStatus(res.status)) {
+        throw new McpSuspiciousRedirectError(res.status, 'code exchange');
+    }
+    if (!res.ok)
+        return null;
+    try {
+        const json = (await res.json());
+        const accessToken = typeof json.access_token === 'string' ? json.access_token : null;
+        if (!accessToken)
+            return null;
+        const expiresIn = typeof json.expires_in === 'number' ? json.expires_in : null;
+        return {
+            accessToken,
+            refreshToken: typeof json.refresh_token === 'string' ? json.refresh_token : null,
+            // An absolute deadline: a relative duration becomes wrong the moment it
+            // is read back later, persisted and reloaded in the next session.
+            expiresAt: expiresIn ? Date.now() + expiresIn * 1000 : null,
+        };
+    }
+    catch {
+        return null; // unreadable body, not an attempted redirect
+    }
+}
+/**
+ * RFC 6749 §5.2: an authorization server refusing a dead `refresh_token`
+ * answers with the `invalid_grant` error code in the JSON body — the only
+ * signal we trust to erase local credentials.
+ *
+ * Unlike `token-exchange.ts` (Logto, a server WE control, where "400 or 401"
+ * is a good enough heuristic), a third-party MCP server is outside our
+ * control: a generic 400/401 can mean a CLIENT problem (a stale `client_id`
+ * after a server reset, say) just as easily as a dead refresh token. Erasing
+ * on an HTTP status alone would condemn the user to re-consent for a failure
+ * that is not theirs, so we require the EXPLICIT OAuth error code.
+ */
+async function classifyRefreshError(res) {
+    try {
+        const json = (await res.json());
+        if (json.error === 'invalid_grant')
+            return 'invalid_grant';
+    }
+    catch {
+        // Unreadable body: not enough information to accuse this refresh token.
+    }
+    return 'unavailable';
+}
+/**
+ * Renews an expired token.
+ *
+ * Without this path an authorization does not survive its first expiry —
+ * measured on 2026-08-12 on a Linear token that expired after a few hours
+ * while its refresh token sat stored and unused.
+ */
+export async function refreshMcpToken(params) {
+    const f = params.fetchImpl ?? globalThis.fetch;
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: params.refreshToken,
+        client_id: params.clientId,
+        resource: params.resource,
+    });
+    if (params.clientSecret)
+        body.set('client_secret', params.clientSecret);
+    let res;
+    try {
+        res = await f(params.tokenEndpoint, {
+            method: 'POST',
+            // `refresh_token` + `client_secret` travel in THIS body — the same
+            // cross-origin replay risk as `exchangeMcpCode`.
+            redirect: 'manual',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body,
+            signal: AbortSignal.timeout(params.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return { ok: false, reason: 'unavailable' };
+    }
+    // Named BEFORE the generic `!res.ok` below: otherwise `classifyRefreshError`
+    // would treat it like any other non-ok status (unreadable body →
+    // `'unavailable'`, indistinguishable from a plain 500).
+    if (isRedirectStatus(res.status)) {
+        return { ok: false, reason: 'suspicious_redirect' };
+    }
+    if (!res.ok) {
+        return { ok: false, reason: await classifyRefreshError(res) };
+    }
+    let json;
+    try {
+        json = (await res.json());
+    }
+    catch {
+        return { ok: false, reason: 'unavailable' };
+    }
+    const accessToken = typeof json.access_token === 'string' ? json.access_token : null;
+    if (!accessToken)
+        return { ok: false, reason: 'unavailable' };
+    const expiresIn = typeof json.expires_in === 'number' ? json.expires_in : null;
+    return {
+        ok: true,
+        tokens: {
+            accessToken,
+            // A server that returns no new refresh token keeps the old one valid
+            // (RFC 6749 does not mandate rotation); losing it would break the NEXT
+            // renewal. A server that does issue a new one must be followed.
+            refreshToken: typeof json.refresh_token === 'string' ? json.refresh_token : params.refreshToken,
+            expiresAt: expiresIn ? Date.now() + expiresIn * 1000 : null,
+        },
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/mcp/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/mcp/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAsBH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,aAAa,GAA2B;IAC5C,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,KAAK;CAChB,CAAC;AAEF,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE/E,OAAO,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,aAAa,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAExC;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CACH,4CAA4C,OAAO,kCAAkC,MAAM,IAAI;YAC7F,kGAAkG,CACrG,CAAC;QANO,WAAM,GAAN,MAAM,CAAQ;QAOvB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,oBAA4B,EAC5B,WAAmB,EACnB,OAAkB,EAAE;IAEpB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAE7C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,oBAAoB,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,mEAAmE;YACnE,uEAAuE;YACvE,uDAAuD;YACvD,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,YAAY;gBACzB,aAAa,EAAE,CAAC,WAAW,CAAC;gBAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,sEAAsE;gBACtE,qBAAqB;gBACrB,0BAA0B,EAAE,MAAM;gBAClC,gBAAgB,EAAE,QAAQ;aAC3B,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACnD,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,8DAA8D;IAC7E,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACjF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC5D,CAAC;AACH,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAA6B;IACjE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,wEAAwE;QACxE,qDAAqD;QACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAExE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yBAAyB;YACzB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACrD,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,8DAA8D;IAC7E,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/E,OAAO;YACL,WAAW;YACX,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YAChF,wEAAwE;YACxE,kEAAkE;YAClE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;SAC5D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC5D,CAAC;AACH,CAAC;AAkCD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAa;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe;YAAE,OAAO,eAAe,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAA6B;IACjE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAExE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,mEAAmE;YACnE,iDAAiD;YACjD,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACrD,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED,6EAA6E;IAC7E,iEAAiE;IACjE,wDAAwD;IACxD,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE9D,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,WAAW;YACX,qEAAqE;YACrE,uEAAuE;YACvE,gEAAgE;YAChE,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;YAC/F,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;SAC5D;KACF,CAAC;AACJ,CAAC"}

package/dist/mcp/auth/probe.js

@@ -0,0 +1,128 @@
+/**
+ * Does this HTTP MCP server actually want a token?
+ *
+ * The plan is explicit: before starting an OAuth flow, try without one. A
+ * server that answers is left alone — no browser, no dynamic registration, no
+ * credential to keep safe for something that never needed it. Plenty of
+ * internal MCP servers sit behind a VPN and authenticate nobody.
+ *
+ * The probe is the real handshake, not a HEAD request: a server commonly lets
+ * `initialize` through and refuses `tools/list`, so stopping at the first
+ * exchange would file it as open when it is not.
+ */
+import { canonicalMcpUrl } from './oauth.js';
+const DEFAULT_TIMEOUT_MS = 15_000;
+const PROTOCOL_VERSION = '2025-06-18';
+/**
+ * Runs `initialize`, `notifications/initialized` and `tools/list` against an
+ * HTTP MCP server and reports what happened. Never throws.
+ */
+export async function probeMcpHttp(serverUrl, deps = {}) {
+    const f = deps.fetchImpl ?? globalThis.fetch;
+    const timeout = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const clientInfo = deps.clientInfo ?? { name: 'vibedefend', version: '0.0.0' };
+    let sessionId;
+    const post = async (body) => {
+        const headers = {
+            ...(deps.headers ?? {}),
+            'content-type': 'application/json',
+            accept: 'application/json, text/event-stream',
+        };
+        if (deps.token)
+            headers.authorization = `Bearer ${deps.token}`;
+        if (sessionId)
+            headers['mcp-session-id'] = sessionId;
+        return f(serverUrl, {
+            method: 'POST',
+            // Same reasoning as everywhere else a request may carry a credential:
+            // a 3xx would replay it against an origin we did not choose.
+            redirect: 'manual',
+            headers,
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(timeout),
+        });
+    };
+    const refusal = (res, at) => ({
+        verdict: 'refused',
+        refusedAt: at,
+        challenge: { status: res.status, wwwAuthenticate: res.headers.get('www-authenticate') },
+    });
+    try {
+        const initialize = await post({
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: { protocolVersion: PROTOCOL_VERSION, capabilities: {}, clientInfo },
+        });
+        if (initialize.status === 401 || initialize.status === 403) {
+            return refusal(initialize, 'initialize');
+        }
+        if (!initialize.ok)
+            return { verdict: 'unusable' };
+        sessionId = initialize.headers.get('mcp-session-id') ?? undefined;
+        const initializeBody = await readMessage(initialize);
+        if (!initializeBody)
+            return { verdict: 'unusable' };
+        // A server that never sees `notifications/initialized` is entitled to
+        // refuse everything afterwards, which would read as an auth refusal.
+        await post({ jsonrpc: '2.0', method: 'notifications/initialized' }).catch(() => undefined);
+        const list = await post({ jsonrpc: '2.0', id: 2, method: 'tools/list' });
+        if (list.status === 401 || list.status === 403)
+            return refusal(list, 'tools/list');
+        if (!list.ok)
+            return { verdict: 'unusable' };
+        const listBody = await readMessage(list);
+        if (!listBody)
+            return { verdict: 'unusable' };
+        // A JSON-RPC error is an answer, not a refusal: a server with no tools
+        // capability returns -32601 and is perfectly open.
+        const result = listBody.result;
+        const tools = Array.isArray(result?.tools) ? result.tools : [];
+        return { verdict: 'open', toolCount: tools.length, tools };
+    }
+    catch {
+        return { verdict: 'unreachable' };
+    }
+}
+/**
+ * Reads one JSON-RPC message out of a response, whether it came as JSON or as
+ * a one-shot SSE stream. The probe only needs the first one.
+ */
+async function readMessage(res) {
+    const contentType = (res.headers.get('content-type') ?? '').toLowerCase();
+    let text;
+    try {
+        text = await res.text();
+    }
+    catch {
+        return null;
+    }
+    if (contentType.includes('text/event-stream')) {
+        for (const line of text.split(/\r?\n/)) {
+            if (!line.startsWith('data:'))
+                continue;
+            try {
+                return JSON.parse(line.slice(5).trim());
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The identity a probe result is filed under. Always the canonical URL, never
+ * the string as typed: `?api_key=` in a hosted server's URL is a credential
+ * and has no business in a storage key.
+ */
+export function probeKey(serverUrl) {
+    return canonicalMcpUrl(serverUrl) ?? serverUrl;
+}
+//# sourceMappingURL=probe.js.map

package/dist/mcp/auth/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../src/mcp/auth/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAiC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,OAAkB,EAAE;IAEpB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAE/E,IAAI,SAA6B,CAAC;IAElC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAa,EAAqB,EAAE;QACtD,MAAM,OAAO,GAA2B;YACtC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACvB,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,SAAS;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACrD,OAAO,CAAC,CAAC,SAAS,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,sEAAsE;YACtE,6DAA6D;YAC7D,QAAQ,EAAE,QAAQ;YAClB,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAa,EAAE,EAA+B,EAAkB,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE;KACxF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE;SAC5E,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACnD,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAEpD,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE3F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAE9C,uEAAuE;QACvE,mDAAmD;QACnD,MAAM,MAAM,GAAI,QAA+C,CAAC,MAAM,CAAC;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,GAAa;IACtC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB;IACxC,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;AACjD,CAAC"}