@frontmcp/adapters 1.4.1 → 1.5.0

package/esm/index.mjs

@@ -1178,7 +1178,22 @@ Add one of the following to your adapter configuration:
    * Initialize the OpenAPI tool generator from URL or spec
    * @private
    */
+  /**
+   * Resolve the `$ref` resolution policy with FrontMCP's secure defaults.
+   *
+   * SECURITY (GHSA-65h7-9wrw-629c): external `$ref` resolution is **disabled by
+   * default** — an untrusted spec can otherwise smuggle SSRF via external refs.
+   * Internal-only (`#/...`) refs and inline `spec:` are unaffected. Developers
+   * who genuinely need external refs opt back in by setting
+   * `loadOptions.refResolution` explicitly (and then own its allow/deny lists;
+   * `mcp-from-openapi` ≥ 2.5.0 DNS-resolves and re-validates redirects).
+   * @private
+   */
+  resolveRefResolution() {
+    return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
+  }
   async initializeGenerator() {
+    const refResolution = this.resolveRefResolution();
     if ("url" in this.options) {
       return await OpenAPIToolGenerator.fromURL(this.options.url, {
         baseUrl: this.options.baseUrl,
@@ -1186,15 +1201,18 @@ Add one of the following to your adapter configuration:
         dereference: this.options.loadOptions?.dereference ?? true,
         headers: this.options.loadOptions?.headers,
         timeout: this.options.loadOptions?.timeout,
-        followRedirects: this.options.loadOptions?.followRedirects,
-        refResolution: this.options.loadOptions?.refResolution
+        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+        // internal target would otherwise be fetched. With mcp-from-openapi
+        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+        followRedirects: this.options.loadOptions?.followRedirects ?? false,
+        refResolution
       });
     } else if ("spec" in this.options) {
       return await OpenAPIToolGenerator.fromJSON(this.options.spec, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution: this.options.loadOptions?.refResolution
+        refResolution
       });
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");

package/esm/openapi/index.mjs

@@ -1178,7 +1178,22 @@ Add one of the following to your adapter configuration:
    * Initialize the OpenAPI tool generator from URL or spec
    * @private
    */
+  /**
+   * Resolve the `$ref` resolution policy with FrontMCP's secure defaults.
+   *
+   * SECURITY (GHSA-65h7-9wrw-629c): external `$ref` resolution is **disabled by
+   * default** — an untrusted spec can otherwise smuggle SSRF via external refs.
+   * Internal-only (`#/...`) refs and inline `spec:` are unaffected. Developers
+   * who genuinely need external refs opt back in by setting
+   * `loadOptions.refResolution` explicitly (and then own its allow/deny lists;
+   * `mcp-from-openapi` ≥ 2.5.0 DNS-resolves and re-validates redirects).
+   * @private
+   */
+  resolveRefResolution() {
+    return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
+  }
   async initializeGenerator() {
+    const refResolution = this.resolveRefResolution();
     if ("url" in this.options) {
       return await OpenAPIToolGenerator.fromURL(this.options.url, {
         baseUrl: this.options.baseUrl,
@@ -1186,15 +1201,18 @@ Add one of the following to your adapter configuration:
         dereference: this.options.loadOptions?.dereference ?? true,
         headers: this.options.loadOptions?.headers,
         timeout: this.options.loadOptions?.timeout,
-        followRedirects: this.options.loadOptions?.followRedirects,
-        refResolution: this.options.loadOptions?.refResolution
+        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+        // internal target would otherwise be fetched. With mcp-from-openapi
+        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+        followRedirects: this.options.loadOptions?.followRedirects ?? false,
+        refResolution
       });
     } else if ("spec" in this.options) {
       return await OpenAPIToolGenerator.fromJSON(this.options.spec, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution: this.options.loadOptions?.refResolution
+        refResolution
       });
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.4.1",
-    "@frontmcp/di": "1.4.1",
-    "@frontmcp/sdk": "1.4.1",
-    "@frontmcp/utils": "1.4.1",
+    "@frontmcp/auth": "1.5.0",
+    "@frontmcp/di": "1.5.0",
+    "@frontmcp/sdk": "1.5.0",
+    "@frontmcp/utils": "1.5.0",
     "js-yaml": "^4.1.0",
-    "mcp-from-openapi": "2.3.0",
+    "mcp-from-openapi": "2.5.0",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.4.1"
+    "@frontmcp/lazy-zod": "1.5.0"
   }
 }

package/esm/skills/index.mjs

@@ -73,6 +73,9 @@ var operationDescriptorSchema = z.object({
   mapper: z.array(parameterMapperSchema).max(256),
   authBindingRef: z.string().min(1).max(128),
   requiredAuthorities: authoritiesPolicySchema.optional(),
+  // Explicit opt-in that a policy-less op is intentionally public — consulted
+  // only when the deployment runs the executor with `unprotectedOps: 'deny'`.
+  public: z.boolean().optional(),
   maxResponseBytes: z.number().int().positive().max(64 * 1024 * 1024).optional(),
   timeoutMs: z.number().int().positive().max(6e5).optional(),
   summary: z.string().max(512).optional(),
@@ -153,6 +156,7 @@ var OverlayParseError = class extends Error {
     this.errors = errors;
     this.name = "OverlayParseError";
   }
+  errors;
 };
 function parseRaw(input) {
   switch (input.kind) {
@@ -210,7 +214,7 @@ function parseOverlay(input) {
 }
 
 // libs/adapters/src/skills/bundle/bundle-diff.ts
-var opEqual = (a, b) => a.operationId === b.operationId && a.serviceId === b.serviceId && a.httpMethod === b.httpMethod && a.pathTemplate === b.pathTemplate && a.authBindingRef === b.authBindingRef && JSON.stringify(a.mapper ?? null) === JSON.stringify(b.mapper ?? null) && JSON.stringify(a.inputSchema) === JSON.stringify(b.inputSchema) && JSON.stringify(a.outputSchema) === JSON.stringify(b.outputSchema) && JSON.stringify(a.requiredAuthorities ?? null) === JSON.stringify(b.requiredAuthorities ?? null) && a.maxResponseBytes === b.maxResponseBytes && a.timeoutMs === b.timeoutMs;
+var opEqual = (a, b) => a.operationId === b.operationId && a.serviceId === b.serviceId && a.httpMethod === b.httpMethod && a.pathTemplate === b.pathTemplate && a.authBindingRef === b.authBindingRef && JSON.stringify(a.mapper ?? null) === JSON.stringify(b.mapper ?? null) && JSON.stringify(a.inputSchema) === JSON.stringify(b.inputSchema) && JSON.stringify(a.outputSchema) === JSON.stringify(b.outputSchema) && JSON.stringify(a.requiredAuthorities ?? null) === JSON.stringify(b.requiredAuthorities ?? null) && (a.public ?? false) === (b.public ?? false) && a.maxResponseBytes === b.maxResponseBytes && a.timeoutMs === b.timeoutMs;
 var skillEqual = (a, b) => a.id === b.id && a.name === b.name && a.description === b.description && a.instructions === b.instructions && JSON.stringify(a.tags ?? []) === JSON.stringify(b.tags ?? []) && JSON.stringify(a.operationIds) === JSON.stringify(b.operationIds) && JSON.stringify(a.requiredAuthorities ?? null) === JSON.stringify(b.requiredAuthorities ?? null);
 function diffBundles(oldBundle, newBundle) {
   const oldSkills = new Map((oldBundle?.skills ?? []).map((s) => [s.id, s]));
@@ -451,6 +455,7 @@ var BundlePinnedError = class extends Error {
     this.pinnedVersion = pinnedVersion;
     this.name = "BundlePinnedError";
   }
+  pinnedVersion;
 };
 
 // libs/adapters/src/skills/dependency/skill-dag.ts
@@ -460,6 +465,7 @@ var SkillDependencyCycleError = class extends Error {
     this.cycle = cycle;
     this.name = "SkillDependencyCycleError";
   }
+  cycle;
 };
 var SkillDependencyMissingError = class extends Error {
   constructor(skillId, missingId) {
@@ -468,6 +474,8 @@ var SkillDependencyMissingError = class extends Error {
     this.missingId = missingId;
     this.name = "SkillDependencyMissingError";
   }
+  skillId;
+  missingId;
 };
 var SkillDependencyInvariantError = class extends Error {
   constructor(message) {
@@ -630,7 +638,22 @@ var saasSourceSchema = z2.object({
   /** Expected issuer (`iss`) claim. */
   expectedIssuer: z2.string().min(1)
 });
-var bundleSourceSchema = z2.discriminatedUnion("type", [staticSourceSchema, npmSourceSchema, saasSourceSchema]);
+var inlineSourceSchema = z2.object({
+  type: z2.literal("inline"),
+  /**
+   * The skilled-OpenAPI bundle object, embedded directly (no filesystem, no
+   * network). The right source for V8-isolate runtimes (Cloudflare Workers),
+   * where `static` (fs) and `npm` can't run and `saas` needs an endpoint. The
+   * object is validated by the overlay parser, same as file/remote bundles.
+   */
+  content: z2.unknown()
+});
+var bundleSourceSchema = z2.discriminatedUnion("type", [
+  staticSourceSchema,
+  npmSourceSchema,
+  saasSourceSchema,
+  inlineSourceSchema
+]);
 var signatureKeySchema = z2.object({
   /** Stable key id (matches `kid` claim in the bundle JWT). */
   keyId: z2.string().min(1),
@@ -640,13 +663,50 @@ var signatureKeySchema = z2.object({
   publicKeyPem: z2.string().min(1)
 });
 
+// libs/adapters/src/skills/sources/inline.source.ts
+var InlineSource = class {
+  constructor(options, logger) {
+    this.options = options;
+    this.logger = logger;
+  }
+  options;
+  logger;
+  id = "inline:bundle";
+  listeners = /* @__PURE__ */ new Set();
+  async start() {
+    const bundle = this.parse();
+    for (const fn of this.listeners) {
+      try {
+        fn(bundle);
+      } catch (e) {
+        this.logger.warn(`[inline-source] listener threw: ${e.message}`);
+      }
+    }
+  }
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  async stop() {
+    this.listeners.clear();
+  }
+  parse() {
+    return parseOverlay({ kind: "object", content: this.options.content });
+  }
+};
+
 // libs/adapters/src/skills/sources/npm.source.ts
+var npmDynamicImport;
 var NpmSource = class {
   constructor(options, logger) {
     this.options = options;
     this.logger = logger;
     this.id = `npm:${this.options.packageName}${this.options.exportName ? `#${this.options.exportName}` : ""}`;
   }
+  options;
+  logger;
   id;
   listeners = /* @__PURE__ */ new Set();
   cached;
@@ -686,9 +746,16 @@ var NpmSource = class {
     }
     return parseOverlay({ kind: "object", content: exported });
   }
-  // Indirected so tests can stub.
+  // Indirected so tests can stub. The dynamic `import()` is wrapped in a
+  // lazily-built `new Function` so static bundlers (esbuild / `wrangler dev` /
+  // miniflare) don't try to resolve the runtime-computed package specifier at
+  // build time — installing an npm bundle is a Node-only path that never runs
+  // on a V8 isolate, but `createBundleSource` keeps NpmSource statically
+  // reachable in the worker bundle. The Function is only built when this runs
+  // (Node), so a Worker that merely bundles it never evaluates it.
   dynamicImport(specifier) {
-    return import(specifier);
+    npmDynamicImport ??= new Function("s", "return import(s)");
+    return npmDynamicImport(specifier);
   }
   notify(bundle) {
     for (const fn of this.listeners) {
@@ -706,35 +773,49 @@ import { dirname, ensureDir, pathResolve, readFile, writeFile } from "@frontmcp/
 var DEFAULT_CACHE_DIR = ".frontmcp/skilled-openapi";
 var DEFAULT_PULL_TIMEOUT_MS = 3e4;
 var SaasPullSource = class {
-  constructor(options, cacheDir, logger) {
+  constructor(options, cacheDir, logger, deps = {}) {
     this.options = options;
     this.cacheDir = cacheDir;
     this.logger = logger;
+    this.deps = deps;
     this.id = `saas:${this.options.endpoint}`;
   }
+  options;
+  cacheDir;
+  logger;
+  deps;
   id;
   listeners = /* @__PURE__ */ new Set();
   pollHandle;
   inFlight = false;
   stopped = false;
   async start() {
+    if (this.stopped || this.inFlight) {
+      this.schedulePoll();
+      return;
+    }
+    this.inFlight = true;
     let bundle;
     try {
-      bundle = await this.fetchOnce();
-      await this.persistCache(bundle);
-    } catch (e) {
-      this.logger.warn(
-        `[saas-source] initial pull failed (${e.message}); attempting cached bundle fallback`
-      );
-      bundle = await this.loadCache();
-      if (!bundle) {
-        throw new Error(
-          `[saas-source] initial pull failed and no cached bundle is available at ${this.cachePath()}: ${e.message}`
+      try {
+        bundle = await this.fetchOnce();
+        await this.persistCache(bundle);
+      } catch (e) {
+        this.logger.warn(
+          `[saas-source] initial pull failed (${e.message}); attempting cached bundle fallback`
         );
+        bundle = await this.loadCache();
+        if (!bundle) {
+          throw new Error(
+            `[saas-source] initial pull failed and no cached bundle is available at ${this.cachePath()}: ${e.message}`
+          );
+        }
+        this.logger.warn(`[saas-source] using cached bundle "${bundle.bundleId}@${bundle.version}"`);
       }
-      this.logger.warn(`[saas-source] using cached bundle "${bundle.bundleId}@${bundle.version}"`);
+      this.notify(bundle);
+    } finally {
+      this.inFlight = false;
     }
-    this.notify(bundle);
     this.schedulePoll();
   }
   onChange(listener) {
@@ -752,12 +833,32 @@ var SaasPullSource = class {
     this.listeners.clear();
   }
   schedulePoll() {
-    if (this.stopped) return;
+    if (this.stopped || this.deps.disablePolling) return;
+    if (this.pollHandle) clearTimeout(this.pollHandle);
     this.pollHandle = setTimeout(() => {
       void this.pollOnce();
     }, this.options.pollIntervalMs);
     this.pollHandle.unref?.();
   }
+  /**
+   * Manually pull a fresh bundle, persist it, and notify listeners. Drive this
+   * from a Cron Trigger / Durable Object alarm on runtimes without background
+   * timers (where `disablePolling` is set). Single-flight: returns `undefined`
+   * if a pull is already in flight; throws if the pull itself fails (the caller
+   * — e.g. a scheduled handler — decides how to surface it).
+   */
+  async refresh() {
+    if (this.stopped || this.inFlight) return void 0;
+    this.inFlight = true;
+    try {
+      const bundle = await this.fetchOnce();
+      await this.persistCache(bundle);
+      this.notify(bundle);
+      return bundle;
+    } finally {
+      this.inFlight = false;
+    }
+  }
   async pollOnce() {
     if (this.stopped) return;
     if (this.inFlight) {
@@ -808,6 +909,10 @@ var SaasPullSource = class {
   }
   async persistCache(bundle) {
     try {
+      if (this.deps.cache) {
+        await this.deps.cache.write(bundle);
+        return;
+      }
       const filePath = this.cachePath();
       await ensureDir(dirname(filePath));
       await writeFile(filePath, JSON.stringify(bundle));
@@ -817,6 +922,11 @@ var SaasPullSource = class {
   }
   async loadCache() {
     try {
+      if (this.deps.cache) {
+        const cached = await this.deps.cache.read();
+        if (cached === void 0 || cached === null) return void 0;
+        return parseOverlay({ kind: "object", content: cached });
+      }
       const filePath = this.cachePath();
       const raw = await readFile(filePath, "utf8");
       return parseOverlay({ kind: "json", content: raw });
@@ -843,6 +953,8 @@ var StaticSource = class {
     this.logger = logger;
     this.id = `static:${this.options.path}`;
   }
+  options;
+  logger;
   id;
   listeners = /* @__PURE__ */ new Set();
   watcher;
@@ -927,17 +1039,74 @@ var StaticSource = class {
 };
 
 // libs/adapters/src/skills/sources/index.ts
-function createBundleSource(source, cacheDir, logger) {
+function createBundleSource(source, cacheDir, logger, deps) {
   switch (source.type) {
     case "static":
       return new StaticSource(source, logger);
     case "npm":
       return new NpmSource(source, logger);
     case "saas":
-      return new SaasPullSource(source, cacheDir, logger);
+      return new SaasPullSource(source, cacheDir, logger, deps);
+    case "inline":
+      return new InlineSource(source, logger);
   }
 }
 
+// libs/adapters/src/skills/openapi/compile-skilled-bundle.ts
+import { OpenAPIToolGenerator } from "mcp-from-openapi";
+async function compileSkilledBundleFromOpenApi(openapi, skills, options) {
+  const serviceId = options.serviceId ?? "api";
+  const baseUrl = options.baseUrl ?? openapi.servers?.[0]?.url;
+  if (!baseUrl) {
+    throw new Error("compileSkilledBundleFromOpenApi: no baseUrl \u2014 pass options.baseUrl or declare servers[] in the OpenAPI doc.");
+  }
+  const generator = await OpenAPIToolGenerator.fromJSON(openapi);
+  const tools = await generator.generateTools();
+  const byOperationId = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    const opId = tool.metadata.operationId;
+    if (opId) byOperationId.set(opId, tool);
+  }
+  const referenced = /* @__PURE__ */ new Set();
+  for (const skill of skills) for (const opId of skill.operationIds) referenced.add(opId);
+  const operations = {};
+  for (const opId of referenced) {
+    const tool = byOperationId.get(opId);
+    if (!tool) {
+      throw new Error(`compileSkilledBundleFromOpenApi: operationId "${opId}" is referenced by a skill but not defined in the OpenAPI document.`);
+    }
+    operations[opId] = {
+      operationId: opId,
+      serviceId,
+      httpMethod: tool.metadata.method.toUpperCase(),
+      pathTemplate: tool.metadata.path,
+      summary: tool.metadata.operationSummary ?? tool.description,
+      inputSchema: tool.inputSchema,
+      outputSchema: tool.outputSchema ?? { type: "object" },
+      mapper: tool.mapper,
+      authBindingRef: "default"
+    };
+  }
+  return {
+    schemaVersion: 1,
+    bundleId: options.bundleId,
+    version: options.version,
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    sourceDigest: options.sourceDigest ?? "0".repeat(64),
+    services: [{ id: serviceId, baseUrl }],
+    authBindings: { default: options.authBinding ?? { kind: "none" } },
+    skills: skills.map((s) => ({
+      id: s.id,
+      name: s.name,
+      description: s.description,
+      instructions: s.instructions,
+      tags: s.tags ?? [],
+      operationIds: s.operationIds
+    })),
+    operations
+  };
+}
+
 // libs/adapters/src/skills/sources/filesystem-skills.source.ts
 import {
   basename,
@@ -962,6 +1131,7 @@ var FilesystemSkillsSource = class {
     this.options = { ...DEFAULT_OPTIONS, ...options };
     this.id = `filesystem-skills:${this.options.skillsDir}`;
   }
+  logger;
   id;
   options;
   listeners = /* @__PURE__ */ new Set();
@@ -1360,6 +1530,8 @@ var BundlePushJwtVerifier = class {
       jwksUri: options.jwksUri
     };
   }
+  options;
+  logger;
   providerRef;
   jwks;
   /**
@@ -1762,6 +1934,8 @@ var StorageAdapterAuditStore = class {
     this.adapter = adapter;
     this.options = options;
   }
+  adapter;
+  options;
   get sequenceKey() {
     return this.options.sequenceKey ?? SKILL_AUDIT_KEYS.sequence;
   }
@@ -1838,6 +2012,10 @@ var SkillAuditWriter = class {
     this.subjectHashSecret = options.subjectHashSecret ?? this.deriveDefaultSubjectSecret();
     this.maxQueueDepth = options.maxQueueDepth ?? SKILL_AUDIT_QUEUE_MAX;
   }
+  store;
+  signer;
+  logger;
+  metrics;
   /**
    * Single-flight queue: every append() chains onto this promise so the
    * read-tail-then-append-with-prevHash sequence stays atomic per process.
@@ -2452,6 +2630,63 @@ function crossValidateManifest(manifest) {
   return errors.length === 0 ? { ok: true } : { ok: false, errors };
 }
 
+// libs/adapters/src/skills/deploy/manifest-to-config.ts
+function specStem(ref) {
+  const noQuery = ref.split("?")[0].split("#")[0];
+  const base = noQuery.split("/").pop() ?? noQuery;
+  const stem = base.replace(/\.(ya?ml|json)$/i, "");
+  const safe = (stem || base).replace(/[^a-zA-Z0-9_.-]/g, "-");
+  return safe || "spec";
+}
+function normalizeSpec(source) {
+  if (typeof source === "string") {
+    const id = specStem(source);
+    return { id, spec: source, bindingName: id };
+  }
+  return {
+    id: source.id,
+    spec: source.spec,
+    baseUrl: source.baseUrl,
+    bindingName: source.bindingName ?? source.id
+  };
+}
+function buildFrontMcpConfigFromManifest(manifest) {
+  const info = {
+    name: manifest.server.info.name,
+    version: manifest.server.info.version,
+    ...manifest.server.info.title !== void 0 ? { title: manifest.server.info.title } : {}
+  };
+  const skills = {
+    source: manifest.skills.source,
+    ...manifest.skills.alwaysLoad ? { alwaysLoad: manifest.skills.alwaysLoad } : {},
+    ...manifest.skills.tags ? { tags: manifest.skills.tags } : {}
+  };
+  let specs = [];
+  let specsDir;
+  if (typeof manifest.specs === "string") {
+    specsDir = manifest.specs;
+  } else {
+    specs = manifest.specs.map(normalizeSpec);
+    const seen = /* @__PURE__ */ new Set();
+    for (const s of specs) {
+      if (seen.has(s.id)) {
+        throw new Error(
+          `manifest specs: duplicate spec id "${s.id}" (derived from the filename stem). Give the colliding spec an explicit { id } in frontmcp.deploy.yaml.`
+        );
+      }
+      seen.add(s.id);
+    }
+  }
+  return {
+    info,
+    ...manifest.server.instructions !== void 0 ? { instructions: manifest.server.instructions } : {},
+    skillsConfig: { enabled: true, injectInstructions: "append" },
+    skills,
+    specs,
+    ...specsDir !== void 0 ? { specsDir } : {}
+  };
+}
+
 // libs/adapters/src/skills/classifier/openapi-classify.ts
 function classifyOperations(specId, ops) {
   if (!specId || specId.length === 0) {
@@ -2770,6 +3005,7 @@ export {
   ClassificationRegistry,
   FilesystemSkillsSource,
   Hs256AuditSigner,
+  InlineSource,
   MemoryAuditStore,
   NpmSource,
   OverlayParseError,
@@ -2789,6 +3025,7 @@ export {
   WebhookReplayGuard,
   applyClassificationOverrides,
   applyEnvironmentOverlay,
+  buildFrontMcpConfigFromManifest,
   buildKnownOps,
   buildResourceChangeNotification,
   bundleDigest,
@@ -2798,6 +3035,7 @@ export {
   canonicalizeRecordForSigning,
   classifyOne,
   classifyOperations,
+  compileSkilledBundleFromOpenApi,
   createBundleSource,
   crossValidate,
   crossValidateManifest,

package/index.js

@@ -1213,7 +1213,22 @@ Add one of the following to your adapter configuration:
    * Initialize the OpenAPI tool generator from URL or spec
    * @private
    */
+  /**
+   * Resolve the `$ref` resolution policy with FrontMCP's secure defaults.
+   *
+   * SECURITY (GHSA-65h7-9wrw-629c): external `$ref` resolution is **disabled by
+   * default** — an untrusted spec can otherwise smuggle SSRF via external refs.
+   * Internal-only (`#/...`) refs and inline `spec:` are unaffected. Developers
+   * who genuinely need external refs opt back in by setting
+   * `loadOptions.refResolution` explicitly (and then own its allow/deny lists;
+   * `mcp-from-openapi` ≥ 2.5.0 DNS-resolves and re-validates redirects).
+   * @private
+   */
+  resolveRefResolution() {
+    return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
+  }
   async initializeGenerator() {
+    const refResolution = this.resolveRefResolution();
     if ("url" in this.options) {
       return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromURL(this.options.url, {
         baseUrl: this.options.baseUrl,
@@ -1221,15 +1236,18 @@ Add one of the following to your adapter configuration:
         dereference: this.options.loadOptions?.dereference ?? true,
         headers: this.options.loadOptions?.headers,
         timeout: this.options.loadOptions?.timeout,
-        followRedirects: this.options.loadOptions?.followRedirects,
-        refResolution: this.options.loadOptions?.refResolution
+        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+        // internal target would otherwise be fetched. With mcp-from-openapi
+        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+        followRedirects: this.options.loadOptions?.followRedirects ?? false,
+        refResolution
       });
     } else if ("spec" in this.options) {
       return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromJSON(this.options.spec, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution: this.options.loadOptions?.refResolution
+        refResolution
       });
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");

package/openapi/index.js

@@ -1213,7 +1213,22 @@ Add one of the following to your adapter configuration:
    * Initialize the OpenAPI tool generator from URL or spec
    * @private
    */
+  /**
+   * Resolve the `$ref` resolution policy with FrontMCP's secure defaults.
+   *
+   * SECURITY (GHSA-65h7-9wrw-629c): external `$ref` resolution is **disabled by
+   * default** — an untrusted spec can otherwise smuggle SSRF via external refs.
+   * Internal-only (`#/...`) refs and inline `spec:` are unaffected. Developers
+   * who genuinely need external refs opt back in by setting
+   * `loadOptions.refResolution` explicitly (and then own its allow/deny lists;
+   * `mcp-from-openapi` ≥ 2.5.0 DNS-resolves and re-validates redirects).
+   * @private
+   */
+  resolveRefResolution() {
+    return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
+  }
   async initializeGenerator() {
+    const refResolution = this.resolveRefResolution();
     if ("url" in this.options) {
       return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromURL(this.options.url, {
         baseUrl: this.options.baseUrl,
@@ -1221,15 +1236,18 @@ Add one of the following to your adapter configuration:
         dereference: this.options.loadOptions?.dereference ?? true,
         headers: this.options.loadOptions?.headers,
         timeout: this.options.loadOptions?.timeout,
-        followRedirects: this.options.loadOptions?.followRedirects,
-        refResolution: this.options.loadOptions?.refResolution
+        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+        // internal target would otherwise be fetched. With mcp-from-openapi
+        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+        followRedirects: this.options.loadOptions?.followRedirects ?? false,
+        refResolution
       });
     } else if ("spec" in this.options) {
       return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromJSON(this.options.spec, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution: this.options.loadOptions?.refResolution
+        refResolution
       });
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");