@frontmcp/adapters 1.5.4 → 1.5.6

package/esm/index.mjs

@@ -10,10 +10,11 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-import { OpenAPIToolGenerator } from "mcp-from-openapi";
+import { normalizeSsrfOptions as normalizeSsrfOptions2, OpenAPIToolGenerator } from "mcp-from-openapi";
 import { Adapter, DynamicAdapter } from "@frontmcp/sdk";
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
+import { normalizeSsrfOptions, safeFetch } from "mcp-from-openapi";
 import { sha256Hex } from "@frontmcp/utils";
 
 // libs/adapters/src/openapi/openapi.errors.ts
@@ -39,6 +40,8 @@ var OpenApiSpecPoller = class {
   retry;
   unhealthyThreshold;
   headers;
+  ssrf;
+  followRedirects;
   callbacks;
   intervalTimer = null;
   lastHash = null;
@@ -56,6 +59,8 @@ var OpenApiSpecPoller = class {
     this.retry = { ...DEFAULT_RETRY, ...options.retry };
     this.unhealthyThreshold = options.unhealthyThreshold ?? 3;
     this.headers = options.headers ?? {};
+    this.ssrf = options.ssrf ?? normalizeSsrfOptions(void 0);
+    this.followRedirects = options.followRedirects ?? false;
     this.callbacks = callbacks;
   }
   /**
@@ -143,35 +148,31 @@ var OpenApiSpecPoller = class {
         headers["If-Modified-Since"] = this.lastModified;
       }
     }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), this.fetchTimeoutMs);
-    try {
-      const response = await fetch(this.url, {
-        headers,
-        signal: controller.signal
-      });
-      if (response.status === 304) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      if (!response.ok) {
-        throw new OpenAPIFetchError(this.url, response.status, response.statusText);
-      }
-      const etag = response.headers.get("etag");
-      const lastModified = response.headers.get("last-modified");
-      if (etag) this.lastEtag = etag;
-      if (lastModified) this.lastModified = lastModified;
-      const body = await response.text();
-      const hash = sha256Hex(body);
-      if (this.lastHash && this.lastHash === hash) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      this.lastHash = hash;
-      this.callbacks.onChanged?.(body, hash);
-    } finally {
-      clearTimeout(timeout);
-    }
+    const response = await safeFetch(this.url, {
+      headers,
+      timeoutMs: this.fetchTimeoutMs,
+      followRedirects: this.followRedirects,
+      ssrf: this.ssrf
+    });
+    if (response.status === 304) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    if (!response.ok) {
+      throw new OpenAPIFetchError(this.url, response.status, response.statusText);
+    }
+    const etag = response.headers.get("etag");
+    const lastModified = response.headers.get("last-modified");
+    if (etag) this.lastEtag = etag;
+    if (lastModified) this.lastModified = lastModified;
+    const body = await response.text();
+    const hash = sha256Hex(body);
+    if (this.lastHash && this.lastHash === hash) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    this.lastHash = hash;
+    this.callbacks.onChanged?.(body, hash);
   }
   /**
    * Dispose the poller and release resources.
@@ -1741,7 +1742,12 @@ ${this.formatSchemaAsSummary(schema)}`;
     if (this.poller) return;
     const polling = this.options.polling;
     if (!polling?.enabled || !("url" in this.options)) return;
-    this.poller = new OpenApiSpecPoller(this.options.url, polling, {
+    const pollingOptions = {
+      ...polling,
+      ssrf: normalizeSsrfOptions2(this.resolveRefResolution()),
+      followRedirects: this.options.loadOptions?.followRedirects ?? false
+    };
+    this.poller = new OpenApiSpecPoller(this.options.url, pollingOptions, {
       onChanged: (_spec, _hash) => {
         this.rebuildChain = this.rebuildChain.then(async () => {
           const previousGenerator = this.generator;

package/esm/openapi/index.mjs

@@ -10,10 +10,11 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-import { OpenAPIToolGenerator } from "mcp-from-openapi";
+import { normalizeSsrfOptions as normalizeSsrfOptions2, OpenAPIToolGenerator } from "mcp-from-openapi";
 import { Adapter, DynamicAdapter } from "@frontmcp/sdk";
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
+import { normalizeSsrfOptions, safeFetch } from "mcp-from-openapi";
 import { sha256Hex } from "@frontmcp/utils";
 
 // libs/adapters/src/openapi/openapi.errors.ts
@@ -39,6 +40,8 @@ var OpenApiSpecPoller = class {
   retry;
   unhealthyThreshold;
   headers;
+  ssrf;
+  followRedirects;
   callbacks;
   intervalTimer = null;
   lastHash = null;
@@ -56,6 +59,8 @@ var OpenApiSpecPoller = class {
     this.retry = { ...DEFAULT_RETRY, ...options.retry };
     this.unhealthyThreshold = options.unhealthyThreshold ?? 3;
     this.headers = options.headers ?? {};
+    this.ssrf = options.ssrf ?? normalizeSsrfOptions(void 0);
+    this.followRedirects = options.followRedirects ?? false;
     this.callbacks = callbacks;
   }
   /**
@@ -143,35 +148,31 @@ var OpenApiSpecPoller = class {
         headers["If-Modified-Since"] = this.lastModified;
       }
     }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), this.fetchTimeoutMs);
-    try {
-      const response = await fetch(this.url, {
-        headers,
-        signal: controller.signal
-      });
-      if (response.status === 304) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      if (!response.ok) {
-        throw new OpenAPIFetchError(this.url, response.status, response.statusText);
-      }
-      const etag = response.headers.get("etag");
-      const lastModified = response.headers.get("last-modified");
-      if (etag) this.lastEtag = etag;
-      if (lastModified) this.lastModified = lastModified;
-      const body = await response.text();
-      const hash = sha256Hex(body);
-      if (this.lastHash && this.lastHash === hash) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      this.lastHash = hash;
-      this.callbacks.onChanged?.(body, hash);
-    } finally {
-      clearTimeout(timeout);
-    }
+    const response = await safeFetch(this.url, {
+      headers,
+      timeoutMs: this.fetchTimeoutMs,
+      followRedirects: this.followRedirects,
+      ssrf: this.ssrf
+    });
+    if (response.status === 304) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    if (!response.ok) {
+      throw new OpenAPIFetchError(this.url, response.status, response.statusText);
+    }
+    const etag = response.headers.get("etag");
+    const lastModified = response.headers.get("last-modified");
+    if (etag) this.lastEtag = etag;
+    if (lastModified) this.lastModified = lastModified;
+    const body = await response.text();
+    const hash = sha256Hex(body);
+    if (this.lastHash && this.lastHash === hash) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    this.lastHash = hash;
+    this.callbacks.onChanged?.(body, hash);
   }
   /**
    * Dispose the poller and release resources.
@@ -1741,7 +1742,12 @@ ${this.formatSchemaAsSummary(schema)}`;
     if (this.poller) return;
     const polling = this.options.polling;
     if (!polling?.enabled || !("url" in this.options)) return;
-    this.poller = new OpenApiSpecPoller(this.options.url, polling, {
+    const pollingOptions = {
+      ...polling,
+      ssrf: normalizeSsrfOptions2(this.resolveRefResolution()),
+      followRedirects: this.options.loadOptions?.followRedirects ?? false
+    };
+    this.poller = new OpenApiSpecPoller(this.options.url, pollingOptions, {
       onChanged: (_spec, _hash) => {
         this.rebuildChain = this.rebuildChain.then(async () => {
           const previousGenerator = this.generator;

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.5.4",
-    "@frontmcp/di": "1.5.4",
-    "@frontmcp/sdk": "1.5.4",
-    "@frontmcp/utils": "1.5.4",
+    "@frontmcp/auth": "1.5.6",
+    "@frontmcp/di": "1.5.6",
+    "@frontmcp/sdk": "1.5.6",
+    "@frontmcp/utils": "1.5.6",
     "js-yaml": "^4.1.0",
-    "mcp-from-openapi": "2.5.0",
+    "mcp-from-openapi": "2.5.1",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.5.4"
+    "@frontmcp/lazy-zod": "1.5.6"
   }
 }

package/index.js

@@ -45,10 +45,11 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-var import_mcp_from_openapi2 = require("mcp-from-openapi");
+var import_mcp_from_openapi3 = require("mcp-from-openapi");
 var import_sdk4 = require("@frontmcp/sdk");
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
+var import_mcp_from_openapi = require("mcp-from-openapi");
 var import_utils = require("@frontmcp/utils");
 
 // libs/adapters/src/openapi/openapi.errors.ts
@@ -74,6 +75,8 @@ var OpenApiSpecPoller = class {
   retry;
   unhealthyThreshold;
   headers;
+  ssrf;
+  followRedirects;
   callbacks;
   intervalTimer = null;
   lastHash = null;
@@ -91,6 +94,8 @@ var OpenApiSpecPoller = class {
     this.retry = { ...DEFAULT_RETRY, ...options.retry };
     this.unhealthyThreshold = options.unhealthyThreshold ?? 3;
     this.headers = options.headers ?? {};
+    this.ssrf = options.ssrf ?? (0, import_mcp_from_openapi.normalizeSsrfOptions)(void 0);
+    this.followRedirects = options.followRedirects ?? false;
     this.callbacks = callbacks;
   }
   /**
@@ -178,35 +183,31 @@ var OpenApiSpecPoller = class {
         headers["If-Modified-Since"] = this.lastModified;
       }
     }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), this.fetchTimeoutMs);
-    try {
-      const response = await fetch(this.url, {
-        headers,
-        signal: controller.signal
-      });
-      if (response.status === 304) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      if (!response.ok) {
-        throw new OpenAPIFetchError(this.url, response.status, response.statusText);
-      }
-      const etag = response.headers.get("etag");
-      const lastModified = response.headers.get("last-modified");
-      if (etag) this.lastEtag = etag;
-      if (lastModified) this.lastModified = lastModified;
-      const body = await response.text();
-      const hash = (0, import_utils.sha256Hex)(body);
-      if (this.lastHash && this.lastHash === hash) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      this.lastHash = hash;
-      this.callbacks.onChanged?.(body, hash);
-    } finally {
-      clearTimeout(timeout);
-    }
+    const response = await (0, import_mcp_from_openapi.safeFetch)(this.url, {
+      headers,
+      timeoutMs: this.fetchTimeoutMs,
+      followRedirects: this.followRedirects,
+      ssrf: this.ssrf
+    });
+    if (response.status === 304) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    if (!response.ok) {
+      throw new OpenAPIFetchError(this.url, response.status, response.statusText);
+    }
+    const etag = response.headers.get("etag");
+    const lastModified = response.headers.get("last-modified");
+    if (etag) this.lastEtag = etag;
+    if (lastModified) this.lastModified = lastModified;
+    const body = await response.text();
+    const hash = (0, import_utils.sha256Hex)(body);
+    if (this.lastHash && this.lastHash === hash) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    this.lastHash = hash;
+    this.callbacks.onChanged?.(body, hash);
   }
   /**
    * Dispose the poller and release resources.
@@ -217,13 +218,13 @@ var OpenApiSpecPoller = class {
 };
 
 // libs/adapters/src/openapi/openapi.security.ts
-var import_mcp_from_openapi = require("mcp-from-openapi");
+var import_mcp_from_openapi2 = require("mcp-from-openapi");
 async function createSecurityContextFromAuth(tool2, ctx, options) {
   if (options.securityResolver) {
     return await options.securityResolver(tool2, ctx);
   }
   if (options.authProviderMapper) {
-    const context = (0, import_mcp_from_openapi.createSecurityContext)({});
+    const context = (0, import_mcp_from_openapi2.createSecurityContext)({});
     const securitySchemes = /* @__PURE__ */ new Set();
     for (const mapper of tool2.mapper) {
       if (mapper.security?.scheme) {
@@ -287,9 +288,9 @@ async function createSecurityContextFromAuth(tool2, ctx, options) {
     return context;
   }
   if (options.staticAuth) {
-    return (0, import_mcp_from_openapi.createSecurityContext)(options.staticAuth);
+    return (0, import_mcp_from_openapi2.createSecurityContext)(options.staticAuth);
   }
-  return (0, import_mcp_from_openapi.createSecurityContext)({
+  return (0, import_mcp_from_openapi2.createSecurityContext)({
     jwt: ctx.authInfo?.token
   });
 }
@@ -372,7 +373,7 @@ function validateSecurityConfiguration(tools, options) {
   return result;
 }
 async function resolveToolSecurity(tool2, ctx, options) {
-  const securityResolver = new import_mcp_from_openapi.SecurityResolver();
+  const securityResolver = new import_mcp_from_openapi2.SecurityResolver();
   const securityContext = await createSecurityContextFromAuth(tool2, ctx, options);
   const hasAuth = securityContext.jwt || securityContext.apiKey || securityContext.basic || securityContext.oauth2Token || securityContext.apiKeys && Object.keys(securityContext.apiKeys).length > 0 || securityContext.customHeaders && Object.keys(securityContext.customHeaders).length > 0;
   const requiresSecurity = tool2.mapper.some((m) => m.security && m.required === true);
@@ -1230,7 +1231,7 @@ Add one of the following to your adapter configuration:
   async initializeGenerator() {
     const refResolution = this.resolveRefResolution();
     if ("url" in this.options) {
-      return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromURL(this.options.url, {
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromURL(this.options.url, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
@@ -1243,7 +1244,7 @@ Add one of the following to your adapter configuration:
         refResolution
       });
     } else if ("spec" in this.options) {
-      return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromJSON(this.options.spec, {
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromJSON(this.options.spec, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
@@ -1776,7 +1777,12 @@ ${this.formatSchemaAsSummary(schema)}`;
     if (this.poller) return;
     const polling = this.options.polling;
     if (!polling?.enabled || !("url" in this.options)) return;
-    this.poller = new OpenApiSpecPoller(this.options.url, polling, {
+    const pollingOptions = {
+      ...polling,
+      ssrf: (0, import_mcp_from_openapi3.normalizeSsrfOptions)(this.resolveRefResolution()),
+      followRedirects: this.options.loadOptions?.followRedirects ?? false
+    };
+    this.poller = new OpenApiSpecPoller(this.options.url, pollingOptions, {
       onChanged: (_spec, _hash) => {
         this.rebuildChain = this.rebuildChain.then(async () => {
           const previousGenerator = this.generator;

package/openapi/index.js

@@ -45,10 +45,11 @@ __export(openapi_exports, {
 module.exports = __toCommonJS(openapi_exports);
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-var import_mcp_from_openapi2 = require("mcp-from-openapi");
+var import_mcp_from_openapi3 = require("mcp-from-openapi");
 var import_sdk4 = require("@frontmcp/sdk");
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
+var import_mcp_from_openapi = require("mcp-from-openapi");
 var import_utils = require("@frontmcp/utils");
 
 // libs/adapters/src/openapi/openapi.errors.ts
@@ -74,6 +75,8 @@ var OpenApiSpecPoller = class {
   retry;
   unhealthyThreshold;
   headers;
+  ssrf;
+  followRedirects;
   callbacks;
   intervalTimer = null;
   lastHash = null;
@@ -91,6 +94,8 @@ var OpenApiSpecPoller = class {
     this.retry = { ...DEFAULT_RETRY, ...options.retry };
     this.unhealthyThreshold = options.unhealthyThreshold ?? 3;
     this.headers = options.headers ?? {};
+    this.ssrf = options.ssrf ?? (0, import_mcp_from_openapi.normalizeSsrfOptions)(void 0);
+    this.followRedirects = options.followRedirects ?? false;
     this.callbacks = callbacks;
   }
   /**
@@ -178,35 +183,31 @@ var OpenApiSpecPoller = class {
         headers["If-Modified-Since"] = this.lastModified;
       }
     }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), this.fetchTimeoutMs);
-    try {
-      const response = await fetch(this.url, {
-        headers,
-        signal: controller.signal
-      });
-      if (response.status === 304) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      if (!response.ok) {
-        throw new OpenAPIFetchError(this.url, response.status, response.statusText);
-      }
-      const etag = response.headers.get("etag");
-      const lastModified = response.headers.get("last-modified");
-      if (etag) this.lastEtag = etag;
-      if (lastModified) this.lastModified = lastModified;
-      const body = await response.text();
-      const hash = (0, import_utils.sha256Hex)(body);
-      if (this.lastHash && this.lastHash === hash) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      this.lastHash = hash;
-      this.callbacks.onChanged?.(body, hash);
-    } finally {
-      clearTimeout(timeout);
-    }
+    const response = await (0, import_mcp_from_openapi.safeFetch)(this.url, {
+      headers,
+      timeoutMs: this.fetchTimeoutMs,
+      followRedirects: this.followRedirects,
+      ssrf: this.ssrf
+    });
+    if (response.status === 304) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    if (!response.ok) {
+      throw new OpenAPIFetchError(this.url, response.status, response.statusText);
+    }
+    const etag = response.headers.get("etag");
+    const lastModified = response.headers.get("last-modified");
+    if (etag) this.lastEtag = etag;
+    if (lastModified) this.lastModified = lastModified;
+    const body = await response.text();
+    const hash = (0, import_utils.sha256Hex)(body);
+    if (this.lastHash && this.lastHash === hash) {
+      this.callbacks.onUnchanged?.();
+      return;
+    }
+    this.lastHash = hash;
+    this.callbacks.onChanged?.(body, hash);
   }
   /**
    * Dispose the poller and release resources.
@@ -217,13 +218,13 @@ var OpenApiSpecPoller = class {
 };
 
 // libs/adapters/src/openapi/openapi.security.ts
-var import_mcp_from_openapi = require("mcp-from-openapi");
+var import_mcp_from_openapi2 = require("mcp-from-openapi");
 async function createSecurityContextFromAuth(tool2, ctx, options) {
   if (options.securityResolver) {
     return await options.securityResolver(tool2, ctx);
   }
   if (options.authProviderMapper) {
-    const context = (0, import_mcp_from_openapi.createSecurityContext)({});
+    const context = (0, import_mcp_from_openapi2.createSecurityContext)({});
     const securitySchemes = /* @__PURE__ */ new Set();
     for (const mapper of tool2.mapper) {
       if (mapper.security?.scheme) {
@@ -287,9 +288,9 @@ async function createSecurityContextFromAuth(tool2, ctx, options) {
     return context;
   }
   if (options.staticAuth) {
-    return (0, import_mcp_from_openapi.createSecurityContext)(options.staticAuth);
+    return (0, import_mcp_from_openapi2.createSecurityContext)(options.staticAuth);
   }
-  return (0, import_mcp_from_openapi.createSecurityContext)({
+  return (0, import_mcp_from_openapi2.createSecurityContext)({
     jwt: ctx.authInfo?.token
   });
 }
@@ -372,7 +373,7 @@ function validateSecurityConfiguration(tools, options) {
   return result;
 }
 async function resolveToolSecurity(tool2, ctx, options) {
-  const securityResolver = new import_mcp_from_openapi.SecurityResolver();
+  const securityResolver = new import_mcp_from_openapi2.SecurityResolver();
   const securityContext = await createSecurityContextFromAuth(tool2, ctx, options);
   const hasAuth = securityContext.jwt || securityContext.apiKey || securityContext.basic || securityContext.oauth2Token || securityContext.apiKeys && Object.keys(securityContext.apiKeys).length > 0 || securityContext.customHeaders && Object.keys(securityContext.customHeaders).length > 0;
   const requiresSecurity = tool2.mapper.some((m) => m.security && m.required === true);
@@ -1230,7 +1231,7 @@ Add one of the following to your adapter configuration:
   async initializeGenerator() {
     const refResolution = this.resolveRefResolution();
     if ("url" in this.options) {
-      return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromURL(this.options.url, {
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromURL(this.options.url, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
@@ -1243,7 +1244,7 @@ Add one of the following to your adapter configuration:
         refResolution
       });
     } else if ("spec" in this.options) {
-      return await import_mcp_from_openapi2.OpenAPIToolGenerator.fromJSON(this.options.spec, {
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromJSON(this.options.spec, {
         baseUrl: this.options.baseUrl,
         validate: this.options.loadOptions?.validate ?? true,
         dereference: this.options.loadOptions?.dereference ?? true,
@@ -1776,7 +1777,12 @@ ${this.formatSchemaAsSummary(schema)}`;
     if (this.poller) return;
     const polling = this.options.polling;
     if (!polling?.enabled || !("url" in this.options)) return;
-    this.poller = new OpenApiSpecPoller(this.options.url, polling, {
+    const pollingOptions = {
+      ...polling,
+      ssrf: (0, import_mcp_from_openapi3.normalizeSsrfOptions)(this.resolveRefResolution()),
+      followRedirects: this.options.loadOptions?.followRedirects ?? false
+    };
+    this.poller = new OpenApiSpecPoller(this.options.url, pollingOptions, {
       onChanged: (_spec, _hash) => {
         this.rebuildChain = this.rebuildChain.then(async () => {
           const previousGenerator = this.generator;

package/openapi/openapi-spec-poller.d.ts

@@ -7,7 +7,7 @@
  *
  * @packageDocumentation
  */
-import type { SpecPollerOptions, SpecPollerCallbacks, SpecPollerStats } from './openapi-spec-poller.types';
+import type { SpecPollerCallbacks, SpecPollerOptions, SpecPollerStats } from './openapi-spec-poller.types';
 /**
  * Polls an OpenAPI spec URL for changes using content-hash and ETag detection.
  * Follows the callback-based emitter pattern (like ToolEmitter).
@@ -20,6 +20,8 @@ export declare class OpenApiSpecPoller {
     private readonly retry;
     private readonly unhealthyThreshold;
     private readonly headers;
+    private readonly ssrf;
+    private readonly followRedirects;
     private readonly callbacks;
     private intervalTimer;
     private lastHash;

package/openapi/openapi-spec-poller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-spec-poller.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi-spec-poller.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EAGhB,MAAM,6BAA6B,CAAC;AAUrC;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAEhD,OAAO,CAAC,aAAa,CAA+C;IACpE,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAiC;gBAEnC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,EAAE,SAAS,GAAE,mBAAwB;IAW7F;;OAEG;IACH,KAAK,IAAI,IAAI;IAWb;;OAEG;IACH,IAAI,IAAI,IAAI;IAOZ;;OAEG;IACH,QAAQ,IAAI,eAAe;IAS3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAWb,cAAc;YAoCd,OAAO;IAqDrB;;OAEG;IACH,OAAO,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"openapi-spec-poller.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi-spec-poller.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAEV,mBAAmB,EACnB,iBAAiB,EAEjB,eAAe,EAChB,MAAM,6BAA6B,CAAC;AAUrC;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAEhD,OAAO,CAAC,aAAa,CAA+C;IACpE,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAiC;gBAEnC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,EAAE,SAAS,GAAE,mBAAwB;IAa7F;;OAEG;IACH,KAAK,IAAI,IAAI;IAWb;;OAEG;IACH,IAAI,IAAI,IAAI;IAOZ;;OAEG;IACH,QAAQ,IAAI,eAAe;IAS3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAWb,cAAc;YAoCd,OAAO;IAiDrB;;OAEG;IACH,OAAO,IAAI,IAAI;CAGhB"}

package/openapi/openapi-spec-poller.types.d.ts

@@ -5,6 +5,7 @@
  *
  * @packageDocumentation
  */
+import type { ResolvedSsrfOptions } from 'mcp-from-openapi';
 /**
  * Change detection strategy.
  */
@@ -42,6 +43,18 @@ export interface SpecPollerOptions {
     unhealthyThreshold?: number;
     /** Additional headers for fetch requests */
     headers?: Record<string, string>;
+    /**
+     * SSRF policy applied to the spec URL on every poll, matching the guard used
+     * for the initial `OPENAPIToolGenerator.fromURL()` load. The adapter injects
+     * this from `loadOptions.refResolution`; standalone callers may set it
+     * directly. Defaults to blocking internal/private addresses.
+     */
+    ssrf?: ResolvedSsrfOptions;
+    /**
+     * Follow (and re-validate) redirect hops when polling. Mirrors the adapter's
+     * spec-load redirect policy. @default false
+     */
+    followRedirects?: boolean;
 }
 /**
  * Callback types for spec poller events.

package/openapi/openapi-spec-poller.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-spec-poller.types.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi-spec-poller.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,2CAA2C;IAC3C,WAAW,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,2BAA2B;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qCAAqC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"openapi-spec-poller.types.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi-spec-poller.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,2CAA2C;IAC3C,WAAW,CAAC,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,2BAA2B;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qCAAqC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAC;CACpB"}

package/openapi/openapi.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.adapter.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,cAAc,EAAE,KAAK,uBAAuB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAK3G,OAAO,EAIL,KAAK,qBAAqB,EAQ3B,MAAM,iBAAiB,CAAC;AAwBzB,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAc,CAAC,qBAAqB,CAAC;IAC/E,OAAO,CAAC,SAAS,CAAC,CAAuB;IACzC,OAAO,CAAC,MAAM,CAAiB;IACxB,OAAO,EAAE,qBAAqB,CAAC;IACtC,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,eAAe,CAA0D;IACjF,OAAO,CAAC,YAAY,CAAoC;gBAE5C,OAAO,EAAE,qBAAqB;IAc1C;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIjC,KAAK,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAuI/C;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;YAId,mBAAmB;IA4BjC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA0C5B;;;OAGG;IACH,OAAO,CAAC,cAAc;IAMtB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA6D7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAwBhC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAoD5B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA2D7B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAoBpC;;;;OAIG;YACW,wBAAwB;IAiFtC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAgBlC;;;OAGG;IACH,OAAO,CAAC,0CAA0C;IA+BlD;;;OAGG;IACH,OAAO,CAAC,2CAA2C;IAyCnD;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAuB7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,MAAM,IAAI;IAO3E;;;;OAIG;IACH,YAAY,IAAI,IAAI;IAsCpB;;OAEG;IACH,WAAW,IAAI,IAAI;CAOpB"}
+{"version":3,"file":"openapi.adapter.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,cAAc,EAAE,KAAK,uBAAuB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAK3G,OAAO,EAIL,KAAK,qBAAqB,EAQ3B,MAAM,iBAAiB,CAAC;AAwBzB,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAc,CAAC,qBAAqB,CAAC;IAC/E,OAAO,CAAC,SAAS,CAAC,CAAuB;IACzC,OAAO,CAAC,MAAM,CAAiB;IACxB,OAAO,EAAE,qBAAqB,CAAC;IACtC,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,eAAe,CAA0D;IACjF,OAAO,CAAC,YAAY,CAAoC;gBAE5C,OAAO,EAAE,qBAAqB;IAc1C;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIjC,KAAK,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAuI/C;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;YAId,mBAAmB;IA4BjC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA0C5B;;;OAGG;IACH,OAAO,CAAC,cAAc;IAMtB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA6D7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAwBhC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAoD5B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA2D7B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAoBpC;;;;OAIG;YACW,wBAAwB;IAiFtC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAgBlC;;;OAGG;IACH,OAAO,CAAC,0CAA0C;IA+BlD;;;OAGG;IACH,OAAO,CAAC,2CAA2C;IAyCnD;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAuB7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,MAAM,IAAI;IAO3E;;;;OAIG;IACH,YAAY,IAAI,IAAI;IA6CpB;;OAEG;IACH,WAAW,IAAI,IAAI;CAOpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.5.4",
-    "@frontmcp/di": "1.5.4",
-    "@frontmcp/sdk": "1.5.4",
-    "@frontmcp/utils": "1.5.4",
+    "@frontmcp/auth": "1.5.6",
+    "@frontmcp/di": "1.5.6",
+    "@frontmcp/sdk": "1.5.6",
+    "@frontmcp/utils": "1.5.6",
     "js-yaml": "^4.1.0",
-    "mcp-from-openapi": "2.5.0",
+    "mcp-from-openapi": "2.5.1",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.5.4"
+    "@frontmcp/lazy-zod": "1.5.6"
   }
 }