@frontmcp/adapters 1.7.1 → 1.8.0

package/esm/index.mjs

@@ -893,8 +893,35 @@ function createOpenApiTool(openapiTool, options, logger) {
         method: openapiTool.metadata.method.toUpperCase(),
         headers,
         body: serializedBody,
-        signal: controller.signal
+        signal: controller.signal,
+        // SECURITY (GHSA-qh67-4345-cw2q): never auto-follow redirects. `fetch` defaults to
+        // `redirect: 'follow'`, which re-sends the request to a destination the UPSTREAM
+        // chose, not the operator. Only `baseUrl` is validated, and only for its scheme, so
+        // a 3xx is an unvalidated hop — to a cloud metadata address or an RFC1918 host.
+        // undici also strips only `Authorization` and `Cookie` across origins and forwards
+        // custom headers, which is exactly how this adapter injects API keys, so following
+        // hands the backend credential to the redirect target. `manual` makes the 3xx
+        // visible here so it can be refused instead of chased.
+        redirect: "manual"
       });
+      if (response.status >= 300 && response.status < 400) {
+        logger.warn(`[${openapiTool.name}] upstream returned a redirect; not followed`, {
+          status: response.status
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                status: response.status,
+                error: `Upstream returned a redirect (${response.status}); not followed to protect injected credentials.`
+              })
+            }
+          ],
+          isError: true,
+          _meta: { status: response.status, errorCode: "OPENAPI_REDIRECT_NOT_FOLLOWED" }
+        };
+      }
       const apiResponse = await parseResponse(response, { maxResponseSize: options.maxResponseSize });
       let transformedData = apiResponse.data;
       if (postToolTransform) {

package/esm/openapi/index.mjs

@@ -893,8 +893,35 @@ function createOpenApiTool(openapiTool, options, logger) {
         method: openapiTool.metadata.method.toUpperCase(),
         headers,
         body: serializedBody,
-        signal: controller.signal
+        signal: controller.signal,
+        // SECURITY (GHSA-qh67-4345-cw2q): never auto-follow redirects. `fetch` defaults to
+        // `redirect: 'follow'`, which re-sends the request to a destination the UPSTREAM
+        // chose, not the operator. Only `baseUrl` is validated, and only for its scheme, so
+        // a 3xx is an unvalidated hop — to a cloud metadata address or an RFC1918 host.
+        // undici also strips only `Authorization` and `Cookie` across origins and forwards
+        // custom headers, which is exactly how this adapter injects API keys, so following
+        // hands the backend credential to the redirect target. `manual` makes the 3xx
+        // visible here so it can be refused instead of chased.
+        redirect: "manual"
       });
+      if (response.status >= 300 && response.status < 400) {
+        logger.warn(`[${openapiTool.name}] upstream returned a redirect; not followed`, {
+          status: response.status
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                status: response.status,
+                error: `Upstream returned a redirect (${response.status}); not followed to protect injected credentials.`
+              })
+            }
+          ],
+          isError: true,
+          _meta: { status: response.status, errorCode: "OPENAPI_REDIRECT_NOT_FOLLOWED" }
+        };
+      }
       const apiResponse = await parseResponse(response, { maxResponseSize: options.maxResponseSize });
       let transformedData = apiResponse.data;
       if (postToolTransform) {

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.7.1",
-    "@frontmcp/di": "1.7.1",
-    "@frontmcp/sdk": "1.7.1",
-    "@frontmcp/utils": "1.7.1",
+    "@frontmcp/auth": "1.8.0",
+    "@frontmcp/di": "1.8.0",
+    "@frontmcp/sdk": "1.8.0",
+    "@frontmcp/utils": "1.8.0",
     "js-yaml": "^4.1.0",
     "mcp-from-openapi": "2.5.1",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.1"
+    "@frontmcp/lazy-zod": "1.8.0"
   }
 }

package/index.js

@@ -928,8 +928,35 @@ function createOpenApiTool(openapiTool, options, logger) {
         method: openapiTool.metadata.method.toUpperCase(),
         headers,
         body: serializedBody,
-        signal: controller.signal
+        signal: controller.signal,
+        // SECURITY (GHSA-qh67-4345-cw2q): never auto-follow redirects. `fetch` defaults to
+        // `redirect: 'follow'`, which re-sends the request to a destination the UPSTREAM
+        // chose, not the operator. Only `baseUrl` is validated, and only for its scheme, so
+        // a 3xx is an unvalidated hop — to a cloud metadata address or an RFC1918 host.
+        // undici also strips only `Authorization` and `Cookie` across origins and forwards
+        // custom headers, which is exactly how this adapter injects API keys, so following
+        // hands the backend credential to the redirect target. `manual` makes the 3xx
+        // visible here so it can be refused instead of chased.
+        redirect: "manual"
       });
+      if (response.status >= 300 && response.status < 400) {
+        logger.warn(`[${openapiTool.name}] upstream returned a redirect; not followed`, {
+          status: response.status
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                status: response.status,
+                error: `Upstream returned a redirect (${response.status}); not followed to protect injected credentials.`
+              })
+            }
+          ],
+          isError: true,
+          _meta: { status: response.status, errorCode: "OPENAPI_REDIRECT_NOT_FOLLOWED" }
+        };
+      }
       const apiResponse = await parseResponse(response, { maxResponseSize: options.maxResponseSize });
       let transformedData = apiResponse.data;
       if (postToolTransform) {

package/openapi/index.js

@@ -928,8 +928,35 @@ function createOpenApiTool(openapiTool, options, logger) {
         method: openapiTool.metadata.method.toUpperCase(),
         headers,
         body: serializedBody,
-        signal: controller.signal
+        signal: controller.signal,
+        // SECURITY (GHSA-qh67-4345-cw2q): never auto-follow redirects. `fetch` defaults to
+        // `redirect: 'follow'`, which re-sends the request to a destination the UPSTREAM
+        // chose, not the operator. Only `baseUrl` is validated, and only for its scheme, so
+        // a 3xx is an unvalidated hop — to a cloud metadata address or an RFC1918 host.
+        // undici also strips only `Authorization` and `Cookie` across origins and forwards
+        // custom headers, which is exactly how this adapter injects API keys, so following
+        // hands the backend credential to the redirect target. `manual` makes the 3xx
+        // visible here so it can be refused instead of chased.
+        redirect: "manual"
       });
+      if (response.status >= 300 && response.status < 400) {
+        logger.warn(`[${openapiTool.name}] upstream returned a redirect; not followed`, {
+          status: response.status
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                status: response.status,
+                error: `Upstream returned a redirect (${response.status}); not followed to protect injected credentials.`
+              })
+            }
+          ],
+          isError: true,
+          _meta: { status: response.status, errorCode: "OPENAPI_REDIRECT_NOT_FOLLOWED" }
+        };
+      }
       const apiResponse = await parseResponse(response, { maxResponseSize: options.maxResponseSize });
       let transformedData = apiResponse.data;
       if (postToolTransform) {

package/openapi/openapi.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.tool.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAI1D,OAAO,KAAK,EAIV,qBAAqB,EAEtB,MAAM,iBAAiB,CAAC;AAMzB;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,cA+QpH"}
+{"version":3,"file":"openapi.tool.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAI1D,OAAO,KAAK,EAIV,qBAAqB,EAEtB,MAAM,iBAAiB,CAAC;AAMzB;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,cA6SpH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.7.1",
-    "@frontmcp/di": "1.7.1",
-    "@frontmcp/sdk": "1.7.1",
-    "@frontmcp/utils": "1.7.1",
+    "@frontmcp/auth": "1.8.0",
+    "@frontmcp/di": "1.8.0",
+    "@frontmcp/sdk": "1.8.0",
+    "@frontmcp/utils": "1.8.0",
     "js-yaml": "^4.1.0",
     "mcp-from-openapi": "2.5.1",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.1"
+    "@frontmcp/lazy-zod": "1.8.0"
   }
 }