@frontmcp/plugin-dashboard 1.8.2 → 1.8.4

package/app/dashboard.app.d.ts

@@ -1,16 +1,30 @@
-import { DynamicPlugin, type ProviderType } from '@frontmcp/sdk';
+import { DynamicPlugin, type FlowCtxOf, type ProviderType } from '@frontmcp/sdk';
 import { type DashboardPluginOptions, type DashboardPluginOptionsInput } from '../dashboard.types';
 /**
  * Internal Dashboard HTTP Plugin.
  *
- * Handles HTTP requests for serving the dashboard HTML.
- * The SSE transport and MCP protocol are handled by FrontMCP's built-in transport layer.
+ * Serves the dashboard HTML, and gates the dashboard's MCP endpoint. The SSE transport
+ * and MCP protocol are handled by FrontMCP's built-in transport layer.
  */
 declare class DashboardHttpPlugin extends DynamicPlugin<DashboardPluginOptions, DashboardPluginOptionsInput> {
     options: DashboardPluginOptions;
     constructor(options?: DashboardPluginOptionsInput);
     /**
-     * Provide the dashboard config and middleware registration via DI.
+     * Gate every request the dashboard's MCP endpoint is about to handle.
+     *
+     * `enabled` and `auth` used to reach only the page middleware, so with the dashboard
+     * turned off, or without its token, `POST /dashboard` still answered `initialize` and
+     * `dashboard:graph` returned the whole server's inventory. This hook runs in the
+     * dashboard scope's `http:request` flow, on Node and on the fetch handler alike, after
+     * the router picked an MCP transport and before any of them runs. The server's own
+     * authentication (the `checkAuthorization` stage) still applies first; the dashboard
+     * token is required on top of it.
+     */
+    gateDashboardMcp(flowCtx: FlowCtxOf<'http:request'>): Promise<void>;
+    /** `this.get`, or `undefined` when the token isn't provided. */
+    private resolve;
+    /**
+     * Provide the dashboard config and page middleware registration via DI.
      */
     static dynamicProviders(options: DashboardPluginOptionsInput): ProviderType[];
 }

package/app/dashboard.app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.app.d.ts","sourceRoot":"","sources":["../../src/app/dashboard.app.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EAOb,KAAK,YAAY,EAGlB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAmE5B;;;;;GAKG;AACH,cAIM,mBAAoB,SAAQ,aAAa,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAClG,OAAO,EAAE,sBAAsB,CAAC;gBAEpB,OAAO,GAAE,2BAAgC;IAQrD;;OAEG;WACa,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,YAAY,EAAE;CA+BvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAmCa,YAAY;CAAG;AAG5B,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"dashboard.app.d.ts","sourceRoot":"","sources":["../../src/app/dashboard.app.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EAOb,KAAK,SAAS,EAGd,KAAK,YAAY,EAIlB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAsF5B;;;;;GAKG;AACH,cAIM,mBAAoB,SAAQ,aAAa,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAClG,OAAO,EAAE,sBAAsB,CAAC;gBAEpB,OAAO,GAAE,2BAAgC;IAQrD;;;;;;;;;;OAUG;IAEG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzE,gEAAgE;IAChE,OAAO,CAAC,OAAO;IAQf;;OAEG;WACa,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,YAAY,EAAE;CAgCvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAmCa,YAAY;CAAG;AAG5B,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/auth/dashboard-access.d.ts

@@ -0,0 +1,42 @@
+import { PublicMcpError, type ToolContext } from '@frontmcp/sdk';
+import { type DashboardPluginOptions } from '../dashboard.types';
+/** Context methods the gate marker needs (a `FrontMcpContext`). */
+interface ContextStore {
+    set<T>(key: symbol, value: T): void;
+    get<T>(key: symbol): T | undefined;
+}
+/** Record that the HTTP gate checked this request's dashboard token. */
+export declare function markDashboardGatePassed(ctx: ContextStore | undefined): void;
+/** The dashboard is turned off (`enabled: false`, or the production default): its MCP endpoint and tools refuse. */
+export declare class DashboardDisabledError extends PublicMcpError {
+    readonly mcpErrorCode: -32003;
+    constructor();
+}
+/** `auth` is on and the caller has not shown the dashboard token. */
+export declare class DashboardUnauthorizedError extends PublicMcpError {
+    readonly mcpErrorCode: -32001;
+    constructor();
+}
+/**
+ * Refuse a dashboard tool call that the dashboard's own options don't allow.
+ *
+ * The HTTP gate (a hook on the dashboard scope's `http:request` flow) already refuses such
+ * requests; this check makes the tools refuse them wherever they are served from (a
+ * direct or stdio server, another app they were added to), so `enabled` and `auth` hold
+ * for every transport, not only for the web page.
+ *
+ * @param options - the dashboard's effective options
+ * @param ctx - the request's context: the gate's mark, and its `x-frontmcp-*` headers
+ */
+export declare function assertDashboardAccess(options: DashboardPluginOptions, ctx: (ContextStore & {
+    metadata?: {
+        customHeaders?: Readonly<Record<string, string>>;
+    };
+}) | undefined): void;
+/**
+ * {@link assertDashboardAccess} for one of the dashboard's tools: the options come from the
+ * dashboard's config provider (the ones its HTTP gate uses), else the published options.
+ */
+export declare function assertDashboardToolAccess(tool: ToolContext): void;
+export {};
+//# sourceMappingURL=dashboard-access.d.ts.map

package/auth/dashboard-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-access.d.ts","sourceRoot":"","sources":["../../src/auth/dashboard-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAIlF,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AASrF,mEAAmE;AACnE,UAAU,YAAY;IACpB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CACpC;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,CAE3E;AAED,oHAAoH;AACpH,qBAAa,sBAAuB,SAAQ,cAAc;IACxD,QAAQ,CAAC,YAAY,SAA6B;;CAKnD;AAED,qEAAqE;AACrE,qBAAa,0BAA2B,SAAQ,cAAc;IAC5D,QAAQ,CAAC,YAAY,SAAgC;;CAUtD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,EAC/B,GAAG,EAAE,CAAC,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAA;CAAE,CAAC,GAAG,SAAS,GACpG,IAAI,CAaN;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAGjE"}

package/auth/dashboard-auth.d.ts

@@ -13,10 +13,55 @@ export interface DashboardAuthRequest {
     headers?: Record<string, string | string[] | undefined> | undefined;
     query?: Record<string, string | string[] | undefined> | undefined;
 }
+/**
+ * Header an MCP client sends the dashboard token in. `Authorization` belongs to the
+ * server's own authentication, so on an authenticated server the dashboard token needs
+ * a channel of its own.
+ */
+export declare const DASHBOARD_TOKEN_HEADER = "x-frontmcp-dashboard-token";
+/**
+ * Cookie the dashboard page gets once its token was checked, so the page's own MCP
+ * client (an `EventSource`, which cannot send headers) reaches the MCP endpoint without
+ * putting the token in a URL.
+ */
+export declare const DASHBOARD_SESSION_COOKIE = "frontmcp_dashboard";
+/**
+ * Which part of the dashboard a request is for.
+ *
+ * - `page`: the HTML page. Accepts `Authorization: Bearer`, `?token=` (the documented
+ *   link) and the session cookie.
+ * - `mcp`: the dashboard's MCP endpoint. Accepts `Authorization: Bearer`, the
+ *   `x-frontmcp-dashboard-token` header and the session cookie, but not `?token=`: a URL
+ *   token lands in access logs, `Referer` headers and browser history.
+ */
+export type DashboardAuthSurface = 'page' | 'mcp';
 export interface DashboardAuthResult {
     authorized: boolean;
     status?: 401;
     message?: string;
 }
-export declare function createDashboardAuthValidator(auth: DashboardAuth | undefined): ((req: DashboardAuthRequest) => DashboardAuthResult) | undefined;
+/**
+ * Constant-time token comparison.
+ *
+ * Both sides are hashed to fixed-length digests first, so neither the comparison
+ * time nor `timingSafeEqual`'s equal-length requirement leaks the token length.
+ * This is the same idiom the DCR client registry uses for client secrets.
+ */
+export declare function tokenMatches(presented: string, expected: string): boolean;
+/**
+ * The session cookie's value: an HMAC of a fixed label keyed by the token, so the cookie
+ * never holds the token itself and cannot be computed without it.
+ */
+export declare function deriveDashboardCookieValue(token: string): string;
+/**
+ * Create the dashboard's HTTP auth check for one surface (see {@link DashboardAuthSurface}).
+ *
+ * Returns `undefined` when authentication is not enabled, so the caller can skip
+ * the check entirely rather than branch on a permissive validator.
+ *
+ * `Authorization: Bearer <token>` is accepted on both surfaces; the page also takes
+ * `?token=<token>` (the documented link), the MCP endpoint also takes
+ * `x-frontmcp-dashboard-token`, and both take the cookie the page sets.
+ */
+export declare function createDashboardAuthValidator(auth: DashboardAuth | undefined, surface?: DashboardAuthSurface): ((req: DashboardAuthRequest) => DashboardAuthResult) | undefined;
 //# sourceMappingURL=dashboard-auth.d.ts.map

package/auth/dashboard-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-auth.d.ts","sourceRoot":"","sources":["../../src/auth/dashboard-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyDD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,aAAa,GAAG,SAAS,GAC9B,CAAC,CAAC,GAAG,EAAE,oBAAoB,KAAK,mBAAmB,CAAC,GAAG,SAAS,CAqBlE"}
+{"version":3,"file":"dashboard-auth.d.ts","sourceRoot":"","sources":["../../src/auth/dashboard-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACnE;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,KAAK,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAiBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGzE;AAID;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,OAAO,GAAE,oBAA6B,GACrC,CAAC,CAAC,GAAG,EAAE,oBAAoB,KAAK,mBAAmB,CAAC,GAAG,SAAS,CA8BlE"}

package/esm/index.mjs

@@ -421,11 +421,16 @@ import {
   App,
   DynamicPlugin as DynamicPlugin2,
   FrontMcpConfig,
+  FrontMcpContextStorage,
   FrontMcpServer,
+  HttpHook,
   Plugin as Plugin2,
   ScopeEntry as ScopeEntry2
 } from "@frontmcp/sdk";
 
+// plugins/plugin-dashboard/src/auth/dashboard-access.ts
+import { MCP_ERROR_CODES, PublicMcpError } from "@frontmcp/sdk";
+
 // libs/utils/dist/esm/index.mjs
 import { createRequire as __frontmcpCreateRequire } from "module";
 import { z as z2 } from "@frontmcp/lazy-zod";
@@ -2606,6 +2611,9 @@ function randomBytes(length) {
 function sha256(data) {
   return getCrypto().sha256(data);
 }
+function hmacSha256(key, data) {
+  return getCrypto().hmacSha256(key, data);
+}
 function encryptAesGcm(key, plaintext, iv) {
   if (key.length !== 32) {
     throw new Error(`AES-256-GCM requires a 32-byte key, got ${key.length} bytes`);
@@ -3796,6 +3804,8 @@ init_crypto();
 init_runtime();
 
 // plugins/plugin-dashboard/src/auth/dashboard-auth.ts
+var DASHBOARD_TOKEN_HEADER = "x-frontmcp-dashboard-token";
+var DASHBOARD_SESSION_COOKIE = "frontmcp_dashboard";
 var AUTHORIZED = { authorized: true };
 function readHeader(headers, name) {
   if (!headers) return void 0;
@@ -3811,6 +3821,19 @@ function tokenMatches(presented, expected) {
   if (presented.length === 0 || expected.length === 0) return false;
   return timingSafeEqual(sha256(presented), sha256(expected));
 }
+var encoder = new TextEncoder();
+function deriveDashboardCookieValue(token) {
+  return base64urlEncode(hmacSha256(encoder.encode(token), encoder.encode("frontmcp-dashboard-session:v1")));
+}
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator === -1) continue;
+    if (part.slice(0, separator).trim() === name) return part.slice(separator + 1).trim();
+  }
+  return void 0;
+}
 function readBearerToken(header) {
   if (!header) return void 0;
   const separator = header.indexOf(" ");
@@ -3819,36 +3842,81 @@ function readBearerToken(header) {
   const token = header.slice(separator + 1).trim();
   return token.length > 0 ? token : void 0;
 }
-function createDashboardAuthValidator(auth) {
+function createDashboardAuthValidator(auth, surface = "page") {
   if (!auth?.enabled) return void 0;
   const expected = auth.token;
+  const expectedCookie = expected ? deriveDashboardCookieValue(expected) : void 0;
   return (req) => {
-    if (!expected) {
+    if (!expected || !expectedCookie) {
       return { authorized: false, status: 401, message: "Dashboard authentication is misconfigured" };
     }
     const bearer = readBearerToken(readHeader(req.headers, "authorization"));
     if (bearer && tokenMatches(bearer, expected)) return AUTHORIZED;
-    const queryToken = readQuery(req.query, "token");
-    if (queryToken && tokenMatches(queryToken, expected)) return AUTHORIZED;
+    if (surface === "mcp") {
+      const headerToken = readHeader(req.headers, DASHBOARD_TOKEN_HEADER);
+      if (headerToken && tokenMatches(headerToken, expected)) return AUTHORIZED;
+    } else {
+      const queryToken = readQuery(req.query, "token");
+      if (queryToken && tokenMatches(queryToken, expected)) return AUTHORIZED;
+    }
+    const cookie = readCookie(readHeader(req.headers, "cookie"), DASHBOARD_SESSION_COOKIE);
+    if (cookie && tokenMatches(cookie, expectedCookie)) return AUTHORIZED;
     return { authorized: false, status: 401, message: "Unauthorized" };
   };
 }
 
+// plugins/plugin-dashboard/src/auth/dashboard-access.ts
+var GATE_PASSED = /* @__PURE__ */ Symbol("frontmcp:dashboard:gate-passed");
+function markDashboardGatePassed(ctx) {
+  ctx?.set(GATE_PASSED, true);
+}
+var DashboardDisabledError = class extends PublicMcpError {
+  mcpErrorCode = MCP_ERROR_CODES.FORBIDDEN;
+  constructor() {
+    super("The FrontMCP dashboard is disabled.", "DASHBOARD_DISABLED", 404);
+  }
+};
+var DashboardUnauthorizedError = class extends PublicMcpError {
+  mcpErrorCode = MCP_ERROR_CODES.UNAUTHORIZED;
+  constructor() {
+    super(
+      `The dashboard token is required. Send it in the ${DASHBOARD_TOKEN_HEADER} header.`,
+      "DASHBOARD_UNAUTHORIZED",
+      401,
+      'Bearer realm="frontmcp-dashboard"'
+    );
+  }
+};
+function assertDashboardAccess(options, ctx) {
+  if (!isDashboardEnabled(options)) {
+    throw new DashboardDisabledError();
+  }
+  if (!options.auth?.enabled) return;
+  if (ctx?.get(GATE_PASSED) === true) return;
+  const expected = options.auth.token;
+  const presented = ctx?.metadata?.customHeaders?.[DASHBOARD_TOKEN_HEADER];
+  if (expected && presented && tokenMatches(presented, expected)) return;
+  throw new DashboardUnauthorizedError();
+}
+function assertDashboardToolAccess(tool) {
+  const configured = tool.tryGet(DashboardConfigToken);
+  assertDashboardAccess(configured ?? resolveDashboardOptions(), tool.tryGetContext());
+}
+
 // plugins/plugin-dashboard/src/html/html.generator.ts
 function escapeForJs(str) {
   return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/</g, "\\x3c").replace(/>/g, "\\x3e").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
 }
-function generateDashboardHtml(options) {
-  const cdn = options.cdn;
-  const basePath = options.basePath;
-  if (cdn.entrypoint) {
-    return generateExternalEntrypointHtml(options);
+function generateDashboardHtml(options, mcpPath = options.basePath) {
+  if (options.cdn.entrypoint) {
+    return generateExternalEntrypointHtml(options, mcpPath);
   }
-  return generateInlineDashboardHtml(options);
+  return generateInlineDashboardHtml(options, mcpPath);
 }
-function generateExternalEntrypointHtml(options) {
+function generateExternalEntrypointHtml(options, mcpPath) {
   const { cdn } = options;
   const safeBasePath = escapeForJs(options.basePath);
+  const safeMcpPath = escapeForJs(mcpPath);
   const safeReact = escapeForJs(cdn.react);
   const safeReactDom = escapeForJs(cdn.reactDom);
   const safeReactDomClient = escapeForJs(cdn.reactDomClient);
@@ -3888,7 +3956,8 @@ function generateExternalEntrypointHtml(options) {
     // Dashboard configuration
     window.__FRONTMCP_DASHBOARD__ = {
       basePath: '${safeBasePath}',
-      sseUrl: '${safeBasePath}/sse',
+      mcpPath: '${safeMcpPath}',
+      sseUrl: '${safeMcpPath}/sse',
     };
 
     // Load external dashboard UI
@@ -3904,10 +3973,11 @@ function generateExternalEntrypointHtml(options) {
 </body>
 </html>`;
 }
-function generateInlineDashboardHtml(options) {
+function generateInlineDashboardHtml(options, mcpPath) {
   const { cdn } = options;
   const safeBasePath = escapeForJs(options.basePath);
-  const sseUrl = `${safeBasePath}/sse`;
+  const safeMcpPath = escapeForJs(mcpPath);
+  const sseUrl = `${safeMcpPath}/sse`;
   const safeReact = escapeForJs(cdn.react);
   const safeReactDom = escapeForJs(cdn.reactDom);
   const safeReactDomClient = escapeForJs(cdn.reactDomClient);
@@ -4105,6 +4175,7 @@ function generateInlineDashboardHtml(options) {
     // Configuration
     const config = {
       basePath: '${safeBasePath}',
+      mcpPath: '${safeMcpPath}',
       sseUrl: '${sseUrl}',
     };
 
@@ -4302,7 +4373,7 @@ function generateInlineDashboardHtml(options) {
       const [edges, setEdges, onEdgesChange] = useEdgesState([]);
 
       useEffect(() => {
-        const client = new McpClient(config.sseUrl, config.basePath);
+        const client = new McpClient(config.sseUrl, config.mcpPath);
 
         async function init() {
           try {
@@ -4693,6 +4764,7 @@ var graphToolInputSchema = {
 };
 var GraphTool = class extends ToolContext {
   async execute(input) {
+    assertDashboardToolAccess(this);
     const graphProvider = this.get(GraphDataProvider);
     if (input.refresh) {
       graphProvider.invalidateCache();
@@ -4762,6 +4834,7 @@ var listResourcesOutputSchema = z5.object({
 });
 var ListResourcesTool = class extends ToolContext2 {
   async execute(input) {
+    assertDashboardToolAccess(this);
     const parentScope = this.tryGet(ParentScopeToken);
     const targetScope = parentScope || this.scope;
     const results = [];
@@ -4841,6 +4914,7 @@ var listToolsOutputSchema = z6.object({
 });
 var ListToolsTool = class extends ToolContext3 {
   async execute(input) {
+    assertDashboardToolAccess(this);
     const parentScope = this.tryGet(ParentScopeToken);
     const targetScope = parentScope || this.scope;
     let allTools = [];
@@ -4884,9 +4958,23 @@ ListToolsTool = __decorateClass([
 
 // plugins/plugin-dashboard/src/app/dashboard.app.ts
 var DashboardMiddlewareToken = /* @__PURE__ */ Symbol("dashboard:middleware");
-function createDashboardMiddleware(options) {
-  const html = generateDashboardHtml(options);
-  const authorize = createDashboardAuthValidator(options.auth);
+function sessionCookies(options, paths, secure) {
+  const token = options.auth.token;
+  if (!options.auth.enabled || !token) return [];
+  const value = deriveDashboardCookieValue(token);
+  return paths.map(
+    (path) => `${DASHBOARD_SESSION_COOKIE}=${value}; Path=${path}; HttpOnly; SameSite=Strict${secure ? "; Secure" : ""}`
+  );
+}
+function isHttps(req) {
+  const socket = req.socket;
+  const forwarded = req.headers?.["x-forwarded-proto"];
+  return socket?.encrypted === true || typeof forwarded === "string" && forwarded.split(",")[0]?.trim() === "https";
+}
+function createDashboardMiddleware(options, mcpPath) {
+  const html = generateDashboardHtml(options, mcpPath);
+  const authorize = createDashboardAuthValidator(options.auth, "page");
+  const cookiePaths = [.../* @__PURE__ */ new Set([mcpPath, options.basePath])];
   return async (req, res, next) => {
     if (!isDashboardEnabled(options)) {
       return next();
@@ -4894,7 +4982,10 @@ function createDashboardMiddleware(options) {
     const urlPath = req.path || req.url || "/";
     const method = (req.method || "GET").toUpperCase();
     const isPageRequest = method === "GET" && (urlPath === "/" || urlPath === "");
-    if (isPageRequest && authorize) {
+    if (!isPageRequest) {
+      return next();
+    }
+    if (authorize) {
       const result = authorize({
         headers: req.headers,
         query: req.query
@@ -4904,15 +4995,11 @@ function createDashboardMiddleware(options) {
         return;
       }
     }
-    if (isPageRequest) {
-      res.setHeader?.(
-        "Content-Type",
-        "text/html"
-      );
-      res.status(200).send(html);
-      return;
-    }
-    return next();
+    const writer = res;
+    writer.setHeader?.("Content-Type", "text/html");
+    const cookies = sessionCookies(options, cookiePaths, isHttps(req));
+    if (cookies.length > 0) writer.setHeader?.("Set-Cookie", cookies);
+    res.status(200).send(html);
   };
 }
 var DashboardHttpPlugin = class extends DynamicPlugin2 {
@@ -4924,8 +5011,33 @@ var DashboardHttpPlugin = class extends DynamicPlugin2 {
       ...options
     });
   }
+  async gateDashboardMcp(flowCtx) {
+    const options = this.resolve(DashboardConfigToken) ?? resolveDashboardOptions();
+    if (!isDashboardEnabled(options)) {
+      throw new DashboardDisabledError();
+    }
+    const authorize = createDashboardAuthValidator(options.auth, "mcp");
+    if (!authorize) return;
+    const request = flowCtx.rawInput.request;
+    const result = authorize({
+      headers: request.headers,
+      query: request.query
+    });
+    if (!result.authorized) {
+      throw new DashboardUnauthorizedError();
+    }
+    markDashboardGatePassed(this.resolve(FrontMcpContextStorage)?.getStore());
+  }
+  /** `this.get`, or `undefined` when the token isn't provided. */
+  resolve(token) {
+    try {
+      return this.get(token);
+    } catch {
+      return void 0;
+    }
+  }
   /**
-   * Provide the dashboard config and middleware registration via DI.
+   * Provide the dashboard config and page middleware registration via DI.
    */
   static dynamicProviders(options) {
     return [
@@ -4939,17 +5051,20 @@ var DashboardHttpPlugin = class extends DynamicPlugin2 {
       {
         name: "dashboard:middleware",
         provide: DashboardMiddlewareToken,
-        inject: () => [FrontMcpServer],
-        useFactory: (server) => {
+        inject: () => [FrontMcpServer, ScopeEntry2],
+        useFactory: (server, scope) => {
           const effectiveOptions = resolveDashboardOptions(options);
-          const middleware = createDashboardMiddleware(effectiveOptions);
-          server.registerMiddleware(effectiveOptions.basePath, middleware);
-          return { registered: true };
+          const mcpPath = scope.fullPath;
+          server.registerMiddleware(effectiveOptions.basePath, createDashboardMiddleware(effectiveOptions, mcpPath));
+          return { registered: true, mcpPath };
         }
       }
     ];
   }
 };
+__decorateClass([
+  HttpHook.Will("handleMcp2026", { priority: 1e3 })
+], DashboardHttpPlugin.prototype, "gateDashboardMcp", 1);
 DashboardHttpPlugin = __decorateClass([
   Plugin2({
     name: "dashboard:http",

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-dashboard",
-  "version": "1.8.2",
+  "version": "1.8.4",
   "description": "Dashboard plugin for FrontMCP - visual monitoring and introspection of MCP servers",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -47,12 +47,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.2"
+    "@frontmcp/sdk": "1.8.4"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.2"
+    "@frontmcp/lazy-zod": "1.8.4"
   }
 }

package/html/html.generator.d.ts

@@ -11,9 +11,12 @@ import type { DashboardPluginOptions } from '../dashboard.types';
  *
  * The configured `auth.token` is deliberately NOT embedded here, and not put in
  * the SSE query string: a URL token lands in access logs, `Referer` headers and
- * browser history, and the page's own MCP POSTs never carried it anyway
- * (GHSA-rgxj-434m-vxh3). The token gates the page; the dashboard's MCP scope
- * uses the server's normal authentication.
+ * browser history (GHSA-rgxj-434m-vxh3). When `auth` is on, the page's MCP
+ * client authenticates with the HttpOnly cookie the server sets with the page.
+ *
+ * @param mcpPath - where the dashboard's MCP endpoint is served (its scope's
+ *   route, `/dashboard` unless the server has an `entryPath`), which `basePath`
+ *   does not move. Defaults to `basePath`.
  */
-export declare function generateDashboardHtml(options: DashboardPluginOptions): string;
+export declare function generateDashboardHtml(options: DashboardPluginOptions, mcpPath?: string): string;
 //# sourceMappingURL=html.generator.d.ts.map

package/html/html.generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html.generator.d.ts","sourceRoot":"","sources":["../../src/html/html.generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAiBjE;;;;;;GAMG;AACH;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAW7E"}
+{"version":3,"file":"html.generator.d.ts","sourceRoot":"","sources":["../../src/html/html.generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAiBjE;;;;;;GAMG;AACH;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,GAAE,MAAyB,GAAG,MAAM,CAQjH"}

package/index.js

@@ -437,7 +437,10 @@ DashboardPlugin = __decorateClass([
 ], DashboardPlugin);
 
 // plugins/plugin-dashboard/src/app/dashboard.app.ts
-var import_sdk6 = require("@frontmcp/sdk");
+var import_sdk7 = require("@frontmcp/sdk");
+
+// plugins/plugin-dashboard/src/auth/dashboard-access.ts
+var import_sdk2 = require("@frontmcp/sdk");
 
 // libs/utils/dist/esm/index.mjs
 var import_module = require("module");
@@ -2620,6 +2623,9 @@ function randomBytes(length) {
 function sha256(data) {
   return getCrypto().sha256(data);
 }
+function hmacSha256(key, data) {
+  return getCrypto().hmacSha256(key, data);
+}
 function encryptAesGcm(key, plaintext, iv) {
   if (key.length !== 32) {
     throw new Error(`AES-256-GCM requires a 32-byte key, got ${key.length} bytes`);
@@ -3810,6 +3816,8 @@ init_crypto();
 init_runtime();
 
 // plugins/plugin-dashboard/src/auth/dashboard-auth.ts
+var DASHBOARD_TOKEN_HEADER = "x-frontmcp-dashboard-token";
+var DASHBOARD_SESSION_COOKIE = "frontmcp_dashboard";
 var AUTHORIZED = { authorized: true };
 function readHeader(headers, name) {
   if (!headers) return void 0;
@@ -3825,6 +3833,19 @@ function tokenMatches(presented, expected) {
   if (presented.length === 0 || expected.length === 0) return false;
   return timingSafeEqual(sha256(presented), sha256(expected));
 }
+var encoder = new TextEncoder();
+function deriveDashboardCookieValue(token) {
+  return base64urlEncode(hmacSha256(encoder.encode(token), encoder.encode("frontmcp-dashboard-session:v1")));
+}
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator === -1) continue;
+    if (part.slice(0, separator).trim() === name) return part.slice(separator + 1).trim();
+  }
+  return void 0;
+}
 function readBearerToken(header) {
   if (!header) return void 0;
   const separator = header.indexOf(" ");
@@ -3833,36 +3854,81 @@ function readBearerToken(header) {
   const token = header.slice(separator + 1).trim();
   return token.length > 0 ? token : void 0;
 }
-function createDashboardAuthValidator(auth) {
+function createDashboardAuthValidator(auth, surface = "page") {
   if (!auth?.enabled) return void 0;
   const expected = auth.token;
+  const expectedCookie = expected ? deriveDashboardCookieValue(expected) : void 0;
   return (req) => {
-    if (!expected) {
+    if (!expected || !expectedCookie) {
       return { authorized: false, status: 401, message: "Dashboard authentication is misconfigured" };
     }
     const bearer = readBearerToken(readHeader(req.headers, "authorization"));
     if (bearer && tokenMatches(bearer, expected)) return AUTHORIZED;
-    const queryToken = readQuery(req.query, "token");
-    if (queryToken && tokenMatches(queryToken, expected)) return AUTHORIZED;
+    if (surface === "mcp") {
+      const headerToken = readHeader(req.headers, DASHBOARD_TOKEN_HEADER);
+      if (headerToken && tokenMatches(headerToken, expected)) return AUTHORIZED;
+    } else {
+      const queryToken = readQuery(req.query, "token");
+      if (queryToken && tokenMatches(queryToken, expected)) return AUTHORIZED;
+    }
+    const cookie = readCookie(readHeader(req.headers, "cookie"), DASHBOARD_SESSION_COOKIE);
+    if (cookie && tokenMatches(cookie, expectedCookie)) return AUTHORIZED;
     return { authorized: false, status: 401, message: "Unauthorized" };
   };
 }
 
+// plugins/plugin-dashboard/src/auth/dashboard-access.ts
+var GATE_PASSED = /* @__PURE__ */ Symbol("frontmcp:dashboard:gate-passed");
+function markDashboardGatePassed(ctx) {
+  ctx?.set(GATE_PASSED, true);
+}
+var DashboardDisabledError = class extends import_sdk2.PublicMcpError {
+  mcpErrorCode = import_sdk2.MCP_ERROR_CODES.FORBIDDEN;
+  constructor() {
+    super("The FrontMCP dashboard is disabled.", "DASHBOARD_DISABLED", 404);
+  }
+};
+var DashboardUnauthorizedError = class extends import_sdk2.PublicMcpError {
+  mcpErrorCode = import_sdk2.MCP_ERROR_CODES.UNAUTHORIZED;
+  constructor() {
+    super(
+      `The dashboard token is required. Send it in the ${DASHBOARD_TOKEN_HEADER} header.`,
+      "DASHBOARD_UNAUTHORIZED",
+      401,
+      'Bearer realm="frontmcp-dashboard"'
+    );
+  }
+};
+function assertDashboardAccess(options, ctx) {
+  if (!isDashboardEnabled(options)) {
+    throw new DashboardDisabledError();
+  }
+  if (!options.auth?.enabled) return;
+  if (ctx?.get(GATE_PASSED) === true) return;
+  const expected = options.auth.token;
+  const presented = ctx?.metadata?.customHeaders?.[DASHBOARD_TOKEN_HEADER];
+  if (expected && presented && tokenMatches(presented, expected)) return;
+  throw new DashboardUnauthorizedError();
+}
+function assertDashboardToolAccess(tool) {
+  const configured = tool.tryGet(DashboardConfigToken);
+  assertDashboardAccess(configured ?? resolveDashboardOptions(), tool.tryGetContext());
+}
+
 // plugins/plugin-dashboard/src/html/html.generator.ts
 function escapeForJs(str) {
   return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/</g, "\\x3c").replace(/>/g, "\\x3e").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
 }
-function generateDashboardHtml(options) {
-  const cdn = options.cdn;
-  const basePath = options.basePath;
-  if (cdn.entrypoint) {
-    return generateExternalEntrypointHtml(options);
+function generateDashboardHtml(options, mcpPath = options.basePath) {
+  if (options.cdn.entrypoint) {
+    return generateExternalEntrypointHtml(options, mcpPath);
   }
-  return generateInlineDashboardHtml(options);
+  return generateInlineDashboardHtml(options, mcpPath);
 }
-function generateExternalEntrypointHtml(options) {
+function generateExternalEntrypointHtml(options, mcpPath) {
   const { cdn } = options;
   const safeBasePath = escapeForJs(options.basePath);
+  const safeMcpPath = escapeForJs(mcpPath);
   const safeReact = escapeForJs(cdn.react);
   const safeReactDom = escapeForJs(cdn.reactDom);
   const safeReactDomClient = escapeForJs(cdn.reactDomClient);
@@ -3902,7 +3968,8 @@ function generateExternalEntrypointHtml(options) {
     // Dashboard configuration
     window.__FRONTMCP_DASHBOARD__ = {
       basePath: '${safeBasePath}',
-      sseUrl: '${safeBasePath}/sse',
+      mcpPath: '${safeMcpPath}',
+      sseUrl: '${safeMcpPath}/sse',
     };
 
     // Load external dashboard UI
@@ -3918,10 +3985,11 @@ function generateExternalEntrypointHtml(options) {
 </body>
 </html>`;
 }
-function generateInlineDashboardHtml(options) {
+function generateInlineDashboardHtml(options, mcpPath) {
   const { cdn } = options;
   const safeBasePath = escapeForJs(options.basePath);
-  const sseUrl = `${safeBasePath}/sse`;
+  const safeMcpPath = escapeForJs(mcpPath);
+  const sseUrl = `${safeMcpPath}/sse`;
   const safeReact = escapeForJs(cdn.react);
   const safeReactDom = escapeForJs(cdn.reactDom);
   const safeReactDomClient = escapeForJs(cdn.reactDomClient);
@@ -4119,6 +4187,7 @@ function generateInlineDashboardHtml(options) {
     // Configuration
     const config = {
       basePath: '${safeBasePath}',
+      mcpPath: '${safeMcpPath}',
       sseUrl: '${sseUrl}',
     };
 
@@ -4316,7 +4385,7 @@ function generateInlineDashboardHtml(options) {
       const [edges, setEdges, onEdgesChange] = useEdgesState([]);
 
       useEffect(() => {
-        const client = new McpClient(config.sseUrl, config.basePath);
+        const client = new McpClient(config.sseUrl, config.mcpPath);
 
         async function init() {
           try {
@@ -4433,7 +4502,7 @@ function generateInlineDashboardHtml(options) {
 }
 
 // plugins/plugin-dashboard/src/providers/graph-data.provider.ts
-var import_sdk2 = require("@frontmcp/sdk");
+var import_sdk3 = require("@frontmcp/sdk");
 var GraphDataProvider = class {
   constructor(scope, serverName, serverVersion) {
     this.scope = scope;
@@ -4693,20 +4762,21 @@ var GraphDataProvider = class {
   }
 };
 GraphDataProvider = __decorateClass([
-  (0, import_sdk2.Provider)({
+  (0, import_sdk3.Provider)({
     name: "graph-data-provider"
   })
 ], GraphDataProvider);
 
 // plugins/plugin-dashboard/src/tools/graph.tool.ts
 var import_lazy_zod5 = require("@frontmcp/lazy-zod");
-var import_sdk3 = require("@frontmcp/sdk");
+var import_sdk4 = require("@frontmcp/sdk");
 var graphToolInputSchema = {
   includeSchemas: import_lazy_zod5.z.boolean().optional().default(false).describe("Include full input/output schemas in the response"),
   refresh: import_lazy_zod5.z.boolean().optional().default(false).describe("Force refresh the graph data (bypass cache)")
 };
-var GraphTool = class extends import_sdk3.ToolContext {
+var GraphTool = class extends import_sdk4.ToolContext {
   async execute(input) {
+    assertDashboardToolAccess(this);
     const graphProvider = this.get(GraphDataProvider);
     if (input.refresh) {
       graphProvider.invalidateCache();
@@ -4729,7 +4799,7 @@ var GraphTool = class extends import_sdk3.ToolContext {
   }
 };
 GraphTool = __decorateClass([
-  (0, import_sdk3.Tool)({
+  (0, import_sdk4.Tool)({
     name: "dashboard:graph",
     description: "Get the server graph showing all registered tools, resources, prompts, apps, and their relationships. Returns nodes and edges that can be visualized.",
     inputSchema: graphToolInputSchema,
@@ -4741,7 +4811,7 @@ GraphTool = __decorateClass([
 
 // plugins/plugin-dashboard/src/tools/list-resources.tool.ts
 var import_lazy_zod6 = require("@frontmcp/lazy-zod");
-var import_sdk4 = require("@frontmcp/sdk");
+var import_sdk5 = require("@frontmcp/sdk");
 
 // plugins/plugin-dashboard/src/shared/safe-regex.ts
 function safeRegex(pattern) {
@@ -4774,8 +4844,9 @@ var listResourcesOutputSchema = import_lazy_zod6.z.object({
   ),
   count: import_lazy_zod6.z.number()
 });
-var ListResourcesTool = class extends import_sdk4.ToolContext {
+var ListResourcesTool = class extends import_sdk5.ToolContext {
   async execute(input) {
+    assertDashboardToolAccess(this);
     const parentScope = this.tryGet(ParentScopeToken);
     const targetScope = parentScope || this.scope;
     const results = [];
@@ -4821,7 +4892,7 @@ var ListResourcesTool = class extends import_sdk4.ToolContext {
   }
 };
 ListResourcesTool = __decorateClass([
-  (0, import_sdk4.Tool)({
+  (0, import_sdk5.Tool)({
     name: "dashboard:list-resources",
     description: "List all resources and resource templates registered in the monitored FrontMCP server.",
     inputSchema: listResourcesInputSchema,
@@ -4834,7 +4905,7 @@ ListResourcesTool = __decorateClass([
 
 // plugins/plugin-dashboard/src/tools/list-tools.tool.ts
 var import_lazy_zod7 = require("@frontmcp/lazy-zod");
-var import_sdk5 = require("@frontmcp/sdk");
+var import_sdk6 = require("@frontmcp/sdk");
 var listToolsInputSchema = {
   filter: import_lazy_zod7.z.string().optional().describe("Filter tools by name pattern (regex supported)"),
   includePlugins: import_lazy_zod7.z.boolean().default(true).describe("Include tools from plugins"),
@@ -4853,8 +4924,9 @@ var listToolsOutputSchema = import_lazy_zod7.z.object({
   ),
   count: import_lazy_zod7.z.number()
 });
-var ListToolsTool = class extends import_sdk5.ToolContext {
+var ListToolsTool = class extends import_sdk6.ToolContext {
   async execute(input) {
+    assertDashboardToolAccess(this);
     const parentScope = this.tryGet(ParentScopeToken);
     const targetScope = parentScope || this.scope;
     let allTools = [];
@@ -4885,7 +4957,7 @@ var ListToolsTool = class extends import_sdk5.ToolContext {
   }
 };
 ListToolsTool = __decorateClass([
-  (0, import_sdk5.Tool)({
+  (0, import_sdk6.Tool)({
     name: "dashboard:list-tools",
     description: "List all tools registered in the monitored FrontMCP server. Returns tool names, descriptions, and optionally schemas.",
     inputSchema: listToolsInputSchema,
@@ -4898,9 +4970,23 @@ ListToolsTool = __decorateClass([
 
 // plugins/plugin-dashboard/src/app/dashboard.app.ts
 var DashboardMiddlewareToken = /* @__PURE__ */ Symbol("dashboard:middleware");
-function createDashboardMiddleware(options) {
-  const html = generateDashboardHtml(options);
-  const authorize = createDashboardAuthValidator(options.auth);
+function sessionCookies(options, paths, secure) {
+  const token = options.auth.token;
+  if (!options.auth.enabled || !token) return [];
+  const value = deriveDashboardCookieValue(token);
+  return paths.map(
+    (path) => `${DASHBOARD_SESSION_COOKIE}=${value}; Path=${path}; HttpOnly; SameSite=Strict${secure ? "; Secure" : ""}`
+  );
+}
+function isHttps(req) {
+  const socket = req.socket;
+  const forwarded = req.headers?.["x-forwarded-proto"];
+  return socket?.encrypted === true || typeof forwarded === "string" && forwarded.split(",")[0]?.trim() === "https";
+}
+function createDashboardMiddleware(options, mcpPath) {
+  const html = generateDashboardHtml(options, mcpPath);
+  const authorize = createDashboardAuthValidator(options.auth, "page");
+  const cookiePaths = [.../* @__PURE__ */ new Set([mcpPath, options.basePath])];
   return async (req, res, next) => {
     if (!isDashboardEnabled(options)) {
       return next();
@@ -4908,7 +4994,10 @@ function createDashboardMiddleware(options) {
     const urlPath = req.path || req.url || "/";
     const method = (req.method || "GET").toUpperCase();
     const isPageRequest = method === "GET" && (urlPath === "/" || urlPath === "");
-    if (isPageRequest && authorize) {
+    if (!isPageRequest) {
+      return next();
+    }
+    if (authorize) {
       const result = authorize({
         headers: req.headers,
         query: req.query
@@ -4918,18 +5007,14 @@ function createDashboardMiddleware(options) {
         return;
       }
     }
-    if (isPageRequest) {
-      res.setHeader?.(
-        "Content-Type",
-        "text/html"
-      );
-      res.status(200).send(html);
-      return;
-    }
-    return next();
+    const writer = res;
+    writer.setHeader?.("Content-Type", "text/html");
+    const cookies = sessionCookies(options, cookiePaths, isHttps(req));
+    if (cookies.length > 0) writer.setHeader?.("Set-Cookie", cookies);
+    res.status(200).send(html);
   };
 }
-var DashboardHttpPlugin = class extends import_sdk6.DynamicPlugin {
+var DashboardHttpPlugin = class extends import_sdk7.DynamicPlugin {
   options;
   constructor(options = {}) {
     super();
@@ -4938,8 +5023,33 @@ var DashboardHttpPlugin = class extends import_sdk6.DynamicPlugin {
       ...options
     });
   }
+  async gateDashboardMcp(flowCtx) {
+    const options = this.resolve(DashboardConfigToken) ?? resolveDashboardOptions();
+    if (!isDashboardEnabled(options)) {
+      throw new DashboardDisabledError();
+    }
+    const authorize = createDashboardAuthValidator(options.auth, "mcp");
+    if (!authorize) return;
+    const request = flowCtx.rawInput.request;
+    const result = authorize({
+      headers: request.headers,
+      query: request.query
+    });
+    if (!result.authorized) {
+      throw new DashboardUnauthorizedError();
+    }
+    markDashboardGatePassed(this.resolve(import_sdk7.FrontMcpContextStorage)?.getStore());
+  }
+  /** `this.get`, or `undefined` when the token isn't provided. */
+  resolve(token) {
+    try {
+      return this.get(token);
+    } catch {
+      return void 0;
+    }
+  }
   /**
-   * Provide the dashboard config and middleware registration via DI.
+   * Provide the dashboard config and page middleware registration via DI.
    */
   static dynamicProviders(options) {
     return [
@@ -4953,19 +5063,22 @@ var DashboardHttpPlugin = class extends import_sdk6.DynamicPlugin {
       {
         name: "dashboard:middleware",
         provide: DashboardMiddlewareToken,
-        inject: () => [import_sdk6.FrontMcpServer],
-        useFactory: (server) => {
+        inject: () => [import_sdk7.FrontMcpServer, import_sdk7.ScopeEntry],
+        useFactory: (server, scope) => {
           const effectiveOptions = resolveDashboardOptions(options);
-          const middleware = createDashboardMiddleware(effectiveOptions);
-          server.registerMiddleware(effectiveOptions.basePath, middleware);
-          return { registered: true };
+          const mcpPath = scope.fullPath;
+          server.registerMiddleware(effectiveOptions.basePath, createDashboardMiddleware(effectiveOptions, mcpPath));
+          return { registered: true, mcpPath };
         }
       }
     ];
   }
 };
+__decorateClass([
+  import_sdk7.HttpHook.Will("handleMcp2026", { priority: 1e3 })
+], DashboardHttpPlugin.prototype, "gateDashboardMcp", 1);
 DashboardHttpPlugin = __decorateClass([
-  (0, import_sdk6.Plugin)({
+  (0, import_sdk7.Plugin)({
     name: "dashboard:http",
     description: "Dashboard HTTP handler for serving UI HTML"
   })
@@ -4973,7 +5086,7 @@ DashboardHttpPlugin = __decorateClass([
 var DashboardApp = class {
 };
 DashboardApp = __decorateClass([
-  (0, import_sdk6.App)({
+  (0, import_sdk7.App)({
     name: "dashboard",
     description: "FrontMCP Dashboard for visualization and monitoring",
     providers: [
@@ -4981,7 +5094,7 @@ DashboardApp = __decorateClass([
       {
         name: "dashboard:parent-scope",
         provide: ParentScopeToken,
-        inject: () => [import_sdk6.ScopeEntry],
+        inject: () => [import_sdk7.ScopeEntry],
         useFactory: (scope) => {
           return scope;
         }
@@ -4990,7 +5103,7 @@ DashboardApp = __decorateClass([
       {
         name: "dashboard:graph-data",
         provide: GraphDataProvider,
-        inject: () => [import_sdk6.ScopeEntry, import_sdk6.FrontMcpConfig],
+        inject: () => [import_sdk7.ScopeEntry, import_sdk7.FrontMcpConfig],
         useFactory: (scope, config) => {
           const serverName = config.info?.name || "FrontMCP Server";
           const serverVersion = config.info?.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-dashboard",
-  "version": "1.8.2",
+  "version": "1.8.4",
   "description": "Dashboard plugin for FrontMCP - visual monitoring and introspection of MCP servers",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -47,12 +47,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.2"
+    "@frontmcp/sdk": "1.8.4"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.2"
+    "@frontmcp/lazy-zod": "1.8.4"
   }
 }

package/tools/graph.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.tool.d.ts","sourceRoot":"","sources":["../../src/tools/graph.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAQ,WAAW,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;CAGhC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;AAE/E;;GAEG;AAUH,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAC1C,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;CA2BzD"}
+{"version":3,"file":"graph.tool.d.ts","sourceRoot":"","sources":["../../src/tools/graph.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAQ,WAAW,EAAE,MAAM,eAAe,CAAC;AAIlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;CAGhC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;AAE/E;;GAEG;AAUH,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAC1C,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;CA6BzD"}

package/tools/list-resources.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-resources.tool.d.ts","sourceRoot":"","sources":["../../src/tools/list-resources.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAQ,WAAW,EAAmB,MAAM,eAAe,CAAC;AAKnE;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAExF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;gCAWpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;GAEG;AAUH,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IAClD,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAwDvE"}
+{"version":3,"file":"list-resources.tool.d.ts","sourceRoot":"","sources":["../../src/tools/list-resources.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAQ,WAAW,EAAmB,MAAM,eAAe,CAAC;AAMnE;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAExF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;gCAWpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;GAEG;AAUH,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IAClD,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA0DvE"}

package/tools/list-tools.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-tools.tool.d.ts","sourceRoot":"","sources":["../../src/tools/list-tools.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAQ,WAAW,EAAmB,MAAM,eAAe,CAAC;AAKnE;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;CAIhC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;gCAYhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAErE;;GAEG;AAWH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IAC9C,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAgD/D"}
+{"version":3,"file":"list-tools.tool.d.ts","sourceRoot":"","sources":["../../src/tools/list-tools.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAQ,WAAW,EAAmB,MAAM,eAAe,CAAC;AAMnE;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;CAIhC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;gCAYhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAErE;;GAEG;AAWH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IAC9C,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;CAkD/D"}