@fitzzero/quickdraw-core 5.1.1 → 5.1.2

package/dist/server/mcp/index.d.ts

@@ -1,14 +1,15 @@
-import { A as AnyService, d as Caller } from '../../caller-CXTFswBO.js';
+import { A as AnyService, d as Caller } from '../../caller-BT-Mv4bD.js';
 import { IncomingHttpHeaders, IncomingMessage } from 'node:http';
-import { ap as MethodName, d as StandardSchemaV1, c as InferOutput } from '../../infer-Teo1xpsd.js';
+import { ap as MethodName, d as StandardSchemaV1, c as InferOutput } from '../../infer-BmoZsL9a.js';
 import { Q as QuickdrawError, a as ErrorCode } from '../../errors-S-bxEIBC.js';
-import { P as PrincipalOfServices, C as ContractOfServices, D as Dispatcher, H as HttpRouter } from '../../http-Djj2Inuu.js';
-import { a as McpContext, b as McpContextOf, M as MaybePromise } from '../../types-Cu0vmx7c.js';
-import { L as Logger } from '../../logger-BY28acW-.js';
-import { A as AuthenticateResult } from '../../auth-BhWqdyb-.js';
+import { P as PrincipalOfServices, C as ContractOfServices, D as Dispatcher, H as HttpRouter } from '../../http-DotQ5bj8.js';
+import { a as McpContext, b as McpContextOf, M as MaybePromise } from '../../types-CYliTP65.js';
+import { L as Logger } from '../../logger-Yz93KzdV.js';
+import { A as AuthenticateResult } from '../../auth-DXiSJZaf.js';
 import { Readable, Writable } from 'node:stream';
-import '../../envelope-Cp3YcVxC.js';
-import '../../metrics-BdBu5o8G.js';
+import { A as AllowedOrigin } from '../../origins-kvpxnVcW.js';
+import '../../envelope-DzWyIXjj.js';
+import '../../metrics-DW80Exve.js';
 import 'socket.io';
 
 /** The JSON Schema of a tool's arguments. MCP requires an object schema. */
@@ -55,7 +56,12 @@ interface McpStdioRequest {
     /** The session's id. Every call of the server carries the same one. */
     readonly sessionId: string;
 }
-/** What one request to the MCP HTTP routes stands for. Each request is a session of its own. */
+/**
+ * What one request to the MCP HTTP routes stands for. Each request is a
+ * session of its own, and its queries share its caller's concurrency lane:
+ * its bearer token's, its user's without a token, or its address's when
+ * anonymous.
+ */
 interface McpHttpRequest {
     readonly transport: "http";
     readonly sessionId: string;
@@ -176,6 +182,14 @@ interface McpCustomTool<S extends readonly AnyService[] = readonly AnyService[],
      * `"public"` lets anonymous callers in, with `principal: null`.
      */
     readonly access?: McpToolAccess;
+    /**
+     * The kinds of principal (`principal.kind`) that may call the tool, within
+     * the ones the app's `initQuickdraw({ kinds })` admits, which it admits by
+     * default: a caller of another kind gets `FORBIDDEN` before the arguments
+     * are read or the handler runs. A `"public"` tool takes none of its own (a
+     * caller of a refused kind could call it signed out).
+     */
+    readonly kinds?: readonly NonNullable<PrincipalOfServices<S>["kind"]>[];
     /**
      * The tool's arguments. A Standard Schema that can describe itself as JSON
      * Schema (Zod 4.2 or later) validates them before the handler runs; a JSON
@@ -219,7 +233,13 @@ interface McpRegistryOptions<S extends readonly AnyService[], Tools extends read
      * anonymous caller, who may call `"public"` methods and `"public"` custom
      * tools only. A stdio server usually reads a token from its environment;
      * an HTTP request carries one as a bearer token. Throwing fails the call
-     * with `UNAUTHENTICATED`. Without it every call is anonymous.
+     * with `UNAUTHENTICATED`: throw `QuickdrawError("UNAUTHENTICATED")` (or
+     * `FORBIDDEN`) to refuse a token, which is logged at debug, and never put
+     * the token in a message; anything else thrown is logged as an error.
+     * Without it every call is anonymous. An HTTP request's queries share the
+     * lane of its bearer token: a hook that authenticates by anything else (a
+     * cookie, an API key header) must refuse a request whose bearer token it
+     * does not verify, or a caller makes a lane per made-up token.
      */
     readonly principal?: (request: McpRequest) => MaybePromise<AuthenticateResult<PrincipalOfServices<S>>>;
     /**
@@ -237,10 +257,15 @@ interface McpRegistryOptions<S extends readonly AnyService[], Tools extends read
      * before the method runs when the caller is anonymous (`UNAUTHENTICATED`),
      * or when the binder returns `undefined` or `null` or the caller sent the
      * argument with another value (`FORBIDDEN`); a binder that throws fails it
-     * with `INTERNAL`, or with the code of a `QuickdrawError`. Custom tools are
-     * never bound. Binding is not access control: the same principal reaches
-     * the method over a socket or HTTP with nothing bound, so the method's
-     * access must still confine it.
+     * with `INTERNAL`, or with the code of a `QuickdrawError`. A call of any
+     * other method's tool that sends a bound argument is refused (`FORBIDDEN`).
+     * An input that is a `$ref` to an object counts as that object, and a
+     * bound key anywhere else in an input (in a union's or an intersection's
+     * branch, or an input that is no object) fails when the registry is built.
+     * Only top-level arguments are bound. Custom tools are never bound.
+     * Binding is not access control: the same principal reaches the method
+     * over a socket or HTTP with nothing bound, so the method's access must
+     * still confine it.
      */
     readonly bind?: Readonly<Record<string, McpBinder<S>>>;
     /** The app's own tools, listed after the generated ones. */
@@ -282,9 +307,14 @@ interface McpRegistry {
  * `customTools`, served by `dispatcher`. Throws at once when a method's
  * input schema cannot describe itself as JSON Schema (use Zod 4.2 or later
  * for it, or `exclude` the method), when two tools share a name, when the
- * dispatcher does not serve one of the services, or when an argument of
- * `bind` is in no tool's object input or is in an input that is not an
- * object.
+ * dispatcher does not serve one of the services, when an argument of
+ * `bind` is in no tool's object input or may be anywhere in an input where
+ * it cannot be filled (an input that is not an object schema, or a branch
+ * of a union or an intersection, behind a `$ref` too), or when custom tools
+ * are served beside the services of apps that admit no kind in common.
+ * Every call runs in its caller's concurrency lane: a stdio session, or on
+ * HTTP its bearer token, its user without a token, or its address when
+ * anonymous.
  *
  * @example
  * const registry = createMcpRegistry({
@@ -381,6 +411,22 @@ interface McpHttpRouterOptions {
     readonly maxBodyBytes?: number;
     /** Default: the console. */
     readonly logger?: Logger;
+    /**
+     * The web pages that may call the routes, by origin: exact origins
+     * (`"https://app.example.com"`) or patterns anchored with `^` and `$`, as
+     * `socketAuth` takes them. A request whose `Origin` is not listed gets 403;
+     * a request without one (an MCP client, a script) is not a page's and
+     * passes. Default: none, so no page may call them.
+     */
+    readonly allowedOrigins?: readonly AllowedOrigin[];
+    /**
+     * The `Host` names the routes answer for (`"localhost"`, `"127.0.0.1"`,
+     * `"mcp.example.com:8443"`; an entry without a port matches any port): a
+     * request for another gets 403. Set it for a server on a developer's
+     * machine or a LAN, where a page could reach it through DNS rebinding.
+     * Default: any host.
+     */
+    readonly allowedHosts?: readonly string[];
 }
 /** What `invoke` answers: 4.1's `{ success, data }`, or a failure's message, code and data. */
 type McpHttpReply = {

package/dist/server/mcp/index.js

@@ -3,20 +3,32 @@ import {
 } from "../../chunk-XNLWBZIG.js";
 import {
   NEVER_ABORTED,
+  checkKind,
+  inputKeys,
   lazyMembers,
+  narrowKinds,
   parseInput,
+  pointerToken,
+  referenced,
+  runtimeOf,
   toQuickdrawError
-} from "../../chunk-2PWMUVC7.js";
+} from "../../chunk-MBH6IDSM.js";
 import {
   describeError
-} from "../../chunk-DD4SKCNO.js";
+} from "../../chunk-LCC7HNFP.js";
 import {
+  originAllowlist
+} from "../../chunk-NO4M6PO5.js";
+import {
+  isForbiddenCredential,
   isJsonRequest,
+  isRefusal,
   readJsonInput,
   toPrincipal,
   unreadable
-} from "../../chunk-REX5YPHX.js";
-import "../../chunk-H23KEFBA.js";
+} from "../../chunk-RJ5I2VO3.js";
+import "../../chunk-DUBU3BB3.js";
+import "../../chunk-AK23XSWD.js";
 import {
   hasJsonSchema,
   isStandardSchema
@@ -24,7 +36,7 @@ import {
 import "../../chunk-Z2LZ7IZ7.js";
 import {
   consoleLogger
-} from "../../chunk-YSWH776Y.js";
+} from "../../chunk-DKE6QO26.js";
 import {
   INTERNAL_MESSAGE,
   QuickdrawError,
@@ -72,20 +84,72 @@ function toolInputOf(label, schema, fail, instead = `leave ${label} out with exc
       `the input schema of ${label} cannot be written as JSON Schema (${json.message}): change that schema, or ${instead}`
     );
   }
-  if (json.type === "object") {
-    return { schema: json, mode: "object" };
+  const described = referenced(json, json);
+  if (described?.type === "object") {
+    return { schema: inlined(json, described), mode: "object" };
   }
-  const { $schema: dialect, ...input } = json;
+  const { $schema: dialect, definitions, $defs, ...input } = json;
   return {
     schema: {
       ...dialect === void 0 ? {} : { $schema: dialect },
       type: "object",
-      properties: { input },
-      ...acceptsUndefined(schema) ? {} : { required: ["input"] }
+      properties: { input: rerooted(input) },
+      ...acceptsUndefined(schema) ? {} : { required: ["input"] },
+      ...definitions === void 0 ? {} : { definitions: rerooted(definitions) },
+      ...$defs === void 0 ? {} : { $defs: rerooted($defs) }
     },
     mode: "wrapped"
   };
 }
+var WRAPPED_INPUT = "#/properties/input";
+function rerooted(value) {
+  if (Array.isArray(value)) {
+    return value.map(rerooted);
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => {
+      const intoRoot = key === "$ref" && typeof item === "string" && (item === "#" || item.startsWith("#/") && !/^#\/(?:definitions|\$defs)\//u.test(item));
+      return [key, intoRoot ? `${WRAPPED_INPUT}${item.slice(1)}` : rerooted(item)];
+    })
+  );
+}
+function refersTo(value, ref) {
+  if (Array.isArray(value)) {
+    return value.some((item) => refersTo(item, ref));
+  }
+  if (!isRecord(value)) {
+    return false;
+  }
+  return value.$ref === ref || Object.values(value).some((item) => refersTo(item, ref));
+}
+function inlined(json, target) {
+  if (target === json) {
+    return json;
+  }
+  const ref = String(json.$ref);
+  const { $schema: dialect } = json;
+  const schema = {
+    ...dialect === void 0 ? {} : { $schema: dialect },
+    ...target
+  };
+  for (const keyword of ["definitions", "$defs"]) {
+    const defs = json[keyword];
+    if (!isRecord(defs)) {
+      continue;
+    }
+    const others = Object.fromEntries(
+      Object.entries(defs).filter(([name]) => `#/${keyword}/${pointerToken(name)}` !== ref)
+    );
+    const kept = refersTo({ ...schema, [keyword]: others }, ref) ? defs : others;
+    if (Object.keys(kept).length > 0) {
+      schema[keyword] = kept;
+    }
+  }
+  return schema;
+}
 function inputOf(mode, args) {
   if (mode === "object") {
     return args ?? {};
@@ -139,35 +203,19 @@ function describeMethod(service, method, kind, text) {
 function propertiesOf(schema) {
   return isRecord(schema) && isRecord(schema.properties) ? Object.keys(schema.properties) : [];
 }
-function branchProperties(schema, found = /* @__PURE__ */ new Set()) {
-  if (!isRecord(schema)) {
-    return found;
-  }
-  for (const keyword of ["anyOf", "oneOf", "allOf"]) {
-    const branches = schema[keyword];
-    for (const branch of Array.isArray(branches) ? branches : []) {
-      for (const key of propertiesOf(branch)) {
-        found.add(key);
-      }
-      branchProperties(branch, found);
-    }
-  }
-  return found;
-}
-function boundArguments(label, input, bind, fail) {
-  if (input.mode === "object") {
-    const properties = propertiesOf(input.schema);
-    return bind.filter((key) => properties.includes(key));
+function boundArguments(label, input, schema, bind, fail) {
+  if (bind.length === 0) {
+    return [];
   }
-  const wrapped = input.schema.properties?.input;
-  const unbindable = branchProperties(wrapped, new Set(propertiesOf(wrapped)));
-  const misplaced = bind.find((key) => unbindable.has(key));
+  const bindable = input.mode === "object" ? propertiesOf(input.schema) : [];
+  const keys = inputKeys(schema) ?? [];
+  const misplaced = bind.find((key) => keys.includes(key) && !bindable.includes(key));
   if (misplaced !== void 0) {
     fail(
-      `bind.${misplaced} names a property of the input of ${label}, which is not an object: bind fills properties of object inputs only; leave ${label} out with exclude, or make its input an object`
+      `bind.${misplaced} names a property of the input of ${label}, which is not an object: bind fills properties of object inputs only (an object schema, or one with .meta({ id }); not a union, an intersection, or a schema made from an object, as .optional() or .refine() make); leave ${label} out with exclude, or make its input an object`
     );
   }
-  return [];
+  return bind.filter((key) => bindable.includes(key));
 }
 function withoutArguments(schema, bound) {
   const kept = (key) => !bound.includes(key);
@@ -194,7 +242,7 @@ function planMethodTools(services, options, fail, bind = []) {
       }
       const label = `${service.name}.${method}`;
       const input = toolInputOf(label, def.input, fail);
-      const bound = boundArguments(label, input, bind, fail);
+      const bound = boundArguments(label, input, def.input, bind, fail);
       const tool = {
         name: toolName(service.name, method),
         description: describeMethod(service.name, method, def.kind, def.describe),
@@ -228,6 +276,46 @@ function describeTools(services, options = {}) {
   return planned.map((entry2) => entry2.tool);
 }
 
+// src/server/mcp/lanes.ts
+import { createHash } from "crypto";
+import { isIPv6 } from "net";
+function groupsOf(address) {
+  const written = new URL(`http://[${address}]/`).hostname.slice(1, -1);
+  const [head = "", tail = ""] = written.split("::");
+  const parse2 = (part) => part === "" ? [] : part.split(":").map((group) => Number.parseInt(group, 16));
+  const before = parse2(head);
+  const after = parse2(tail);
+  return [...before, ...new Array(8 - before.length - after.length).fill(0), ...after];
+}
+function addressLane(ip) {
+  const address = ip.split("%", 1)[0] ?? ip;
+  if (!isIPv6(address)) {
+    return ip;
+  }
+  const [a = 0, b = 0, c = 0, d = 0, e = 0, f = 0, g = 0, h = 0] = groupsOf(address);
+  if (a === 0 && b === 0 && c === 0 && d === 0 && e === 0 && f === 65535) {
+    return [g >> 8, g & 255, h >> 8, h & 255].join(".");
+  }
+  return `${[a, b, c, d & 65280].map((group) => group.toString(16)).join(":")}::/56`;
+}
+function addressOf(request) {
+  const { ip } = request.req;
+  return typeof ip === "string" && ip !== "" ? ip : request.req.socket?.remoteAddress ?? "unknown";
+}
+function laneOf(request, principal) {
+  if (request.transport === "stdio") {
+    return `mcp:${request.sessionId}`;
+  }
+  if (principal === null) {
+    return `mcp:http:address:${addressLane(addressOf(request))}`;
+  }
+  if (request.token === null) {
+    return `mcp:http:user:${principal.userId}`;
+  }
+  const hash = createHash("sha256").update(request.token).digest("base64url").slice(0, 22);
+  return `mcp:http:token:${hash}`;
+}
+
 // src/server/mcp/session.ts
 var CATEGORY = "quickdraw.mcp";
 async function principalOf(settings, request) {
@@ -237,7 +325,8 @@ async function principalOf(settings, request) {
   try {
     return toPrincipal(await settings.principal(request));
   } catch (error) {
-    settings.logger.error("MCP authentication failed", {
+    const refused = isRefusal(error) || isForbiddenCredential(error);
+    settings.logger[refused ? "debug" : "error"]("MCP authentication failed", {
       category: CATEGORY,
       transport: request.transport,
       error: describeError(error)
@@ -261,7 +350,7 @@ async function contextOf(settings, request, principal) {
 async function openSession(settings, request) {
   const principal = await principalOf(settings, request);
   const mcp = await contextOf(settings, request, principal);
-  return { principal, mcp, connectionId: `mcp:${request.sessionId}` };
+  return { principal, mcp, connectionId: laneOf(request, principal) };
 }
 function failure(settings, error, tool) {
   const converted = toQuickdrawError(error);
@@ -342,7 +431,26 @@ function accessOf(owner, access, fail) {
   }
   return access;
 }
-function checkCustomTool(value, index, fail) {
+function appKindsOf(services) {
+  let kinds;
+  for (const service of services) {
+    const own = runtimeOf(service)?.kinds;
+    if (own !== void 0) {
+      kinds = kinds === void 0 ? own : kinds.filter((kind) => own.includes(kind));
+    }
+  }
+  return kinds;
+}
+function kindsOf(owner, value, access, appKinds, fail) {
+  if (value.kinds !== void 0 && access === "public") {
+    fail(
+      `${owner}: a "public" tool takes no kinds of its own, since a caller of a refused kind could call it signed out; give it access "authenticated"`
+    );
+  }
+  const above = appKinds === void 0 ? void 0 : { kinds: appKinds, by: "initQuickdraw" };
+  return narrowKinds(value.kinds, above, (message) => fail(`${owner}: ${message}`));
+}
+function checkCustomTool(value, index, appKinds, fail) {
   if (!isRecord2(value)) {
     fail(`customTools[${index}] must be { name, description, inputSchema, handler }`);
   }
@@ -361,6 +469,7 @@ function checkCustomTool(value, index, fail) {
     fail(`${owner}: annotations must be an object of hints`);
   }
   const access = accessOf(owner, value.access, fail);
+  const kinds = kindsOf(owner, value, access, appKinds, fail);
   const input = argumentsOf(owner, inputSchema, fail);
   const tool = {
     name,
@@ -371,19 +480,26 @@ function checkCustomTool(value, index, fail) {
   return {
     tool: Object.freeze(tool),
     access,
+    kinds,
     mode: input.mode,
     schema: isStandardSchema(inputSchema) ? inputSchema : void 0,
     handler
   };
 }
-function checkCustomTools(value, fail) {
+function checkCustomTools(value, fail, services = []) {
   if (value === void 0) {
     return [];
   }
   if (!Array.isArray(value)) {
     fail("customTools must be an array of { name, description, inputSchema, handler }");
   }
-  return value.map((tool, index) => checkCustomTool(tool, index, fail));
+  const appKinds = appKindsOf(services);
+  if (appKinds?.length === 0 && value.length > 0) {
+    fail(
+      "customTools: the served services' apps admit no kind in common (initQuickdraw({ kinds })), so no principal could call a custom tool: serve custom tools beside the services of one app, or of apps that admit a kind in common"
+    );
+  }
+  return value.map((tool, index) => checkCustomTool(tool, index, appKinds, fail));
 }
 async function runCustomTool(settings, custom, args, session, options) {
   const { name } = custom.tool;
@@ -392,6 +508,7 @@ async function runCustomTool(settings, custom, args, session, options) {
     if (custom.access === "authenticated" && session.principal === null) {
       throw new QuickdrawError("UNAUTHENTICATED", "Authentication required");
     }
+    checkKind(custom.kinds, session.principal, `The tool "${name}"`);
     const input = inputOf(custom.mode, args);
     const parsed = custom.schema === void 0 ? input : await parseInput(custom.schema, input, `the tool "${name}"`);
     const data = await custom.handler({
@@ -475,7 +592,7 @@ function resolveRegistry(options) {
   const binders = checkBinders(options.bind, fail);
   const methodTools = planMethodTools(options.services, options, fail, [...binders.keys()]);
   checkBound(binders, methodTools, fail);
-  const customTools = checkCustomTools(options.customTools, fail);
+  const customTools = checkCustomTools(options.customTools, fail, options.services);
   const entries = [
     ...methodTools.map((tool) => ({ kind: "method", ...tool })),
     ...customTools.map((tool) => ({ kind: "custom", ...tool }))
@@ -545,6 +662,16 @@ async function bindInput(settings, tool, input, session, request) {
   return { ...given, ...Object.fromEntries(filled) };
 }
 async function dispatchMethod(settings, tool, input, session, options) {
+  const stray = settings.binders.size === 0 || !isRecord3(input) || Array.isArray(input) ? void 0 : [...settings.binders.keys()].find(
+    (key) => !tool.bound.includes(key) && Object.hasOwn(input, key)
+  );
+  if (stray !== void 0) {
+    const error = new QuickdrawError(
+      "FORBIDDEN",
+      `"${stray}" is bound to the caller; ${tool.service}.${tool.method} does not take it from the agent`
+    );
+    return settle(settings, options, failure(settings, error, tool.tool.name));
+  }
   let bound = input;
   if (tool.bound.length > 0) {
     try {
@@ -894,8 +1021,81 @@ async function bootstrapMcpServer(serverModule) {
   }
 }
 
-// src/server/mcp/http.ts
+// src/server/mcp/httpRequest.ts
 import { randomUUID as randomUUID2 } from "crypto";
+function requestOf(req) {
+  const header = req.headers.authorization;
+  const token = typeof header === "string" && header.startsWith("Bearer ") ? header.slice(7) : "";
+  return {
+    transport: "http",
+    sessionId: randomUUID2(),
+    token: token.trim() === "" ? null : token.trim(),
+    headers: req.headers,
+    req
+  };
+}
+function hostOf(value) {
+  if (/\s/u.test(value)) {
+    return void 0;
+  }
+  const host = !value.startsWith("[") && value.split(":").length > 2 ? `[${value}]` : value;
+  let url;
+  try {
+    url = new URL(`http://${host}`);
+  } catch {
+    return void 0;
+  }
+  const extra = url.username + url.password + url.search + url.hash;
+  if (url.hostname === "" || extra !== "" || url.pathname !== "/") {
+    return void 0;
+  }
+  const written = !host.endsWith("]") && /:\d+$/u.test(host);
+  return { hostname: url.hostname, port: written ? url.port || "80" : void 0 };
+}
+function checkHosts(hosts) {
+  if (hosts === void 0) {
+    return void 0;
+  }
+  const parsed = Array.isArray(hosts) ? hosts.map((host) => typeof host === "string" ? hostOf(host) : void 0) : [];
+  if (parsed.length === 0 || parsed.includes(void 0)) {
+    throw new TypeError(
+      'createMcpHttpRouter: allowedHosts must list host names, such as "localhost" or "mcp.example.com:8443"'
+    );
+  }
+  return Object.freeze(parsed);
+}
+function hostAllowed(hosts, header) {
+  const host = header === void 0 ? void 0 : hostOf(header);
+  if (host === void 0) {
+    return false;
+  }
+  const portMatches = (port) => host.port === void 0 ? port === "80" || port === "443" : port === host.port;
+  return hosts.some(
+    (entry2) => entry2.hostname === host.hostname && (entry2.port === void 0 || portMatches(entry2.port))
+  );
+}
+function requestGate(allowedOrigins, allowedHosts) {
+  const origins = originAllowlist(
+    allowedOrigins ?? [],
+    "createMcpHttpRouter",
+    true
+  );
+  const hosts = checkHosts(allowedHosts);
+  return Object.freeze({
+    refusal(req) {
+      const { origin, host } = req.headers;
+      if (origin !== void 0 && origins.allowed(origin) === null) {
+        return "The MCP routes refuse requests from web pages unless allowedOrigins lists their origin";
+      }
+      if (hosts !== void 0 && !hostAllowed(hosts, host)) {
+        return "The MCP routes do not answer for this host";
+      }
+      return void 0;
+    }
+  });
+}
+
+// src/server/mcp/http.ts
 var DEFAULT_MAX_BODY_BYTES = 1048576;
 var CATEGORY3 = "quickdraw.mcp";
 var NOT_JSON = "Send the call as a JSON body with Content-Type: application/json";
@@ -922,6 +1122,8 @@ function send(res, status, body) {
   res.statusCode = status;
   res.setHeader("content-type", "application/json; charset=utf-8");
   res.setHeader("content-length", bytes);
+  res.setHeader("cache-control", "no-store");
+  res.setHeader("x-content-type-options", "nosniff");
   res.end(body);
   return bytes;
 }
@@ -962,17 +1164,6 @@ function targetOf(body) {
   }
   return void 0;
 }
-function requestOf(req) {
-  const header = req.headers.authorization;
-  const token = typeof header === "string" && header.startsWith("Bearer ") ? header.slice(7) : "";
-  return {
-    transport: "http",
-    sessionId: randomUUID2(),
-    token: token.trim() === "" ? null : token.trim(),
-    headers: req.headers,
-    req
-  };
-}
 async function invoke(settings, req, res) {
   const controller = new AbortController();
   res.once("close", () => {
@@ -1022,7 +1213,8 @@ function resolveSettings(options) {
     registry: options.registry,
     prefix: normalizePath(options.path ?? "/mcp"),
     maxBodyBytes,
-    logger: options.logger ?? consoleLogger
+    logger: options.logger ?? consoleLogger,
+    gate: requestGate(options.allowedOrigins, options.allowedHosts)
   };
 }
 function createMcpHttpRouter(options) {
@@ -1037,6 +1229,16 @@ function createMcpHttpRouter(options) {
       }
       return;
     }
+    const refusal = settings.gate.refusal(req);
+    if (refusal !== void 0) {
+      settings.logger.debug("An MCP HTTP request was refused", {
+        category: CATEGORY3,
+        origin: req.headers.origin,
+        host: req.headers.host
+      });
+      sendResult(settings, res, failure2(new QuickdrawError("FORBIDDEN", refusal)));
+      return;
+    }
     if (route === "tools") {
       send(res, 200, JSON.stringify({ tools: settings.registry.tools }));
       return;