@frontmcp/plugin-skilled-openapi 1.8.0 → 1.8.1

package/esm/index.mjs

@@ -734,6 +734,7 @@ import {
   buildRequest,
   parseResponse
 } from "@frontmcp/adapters/openapi";
+import { isRedirectResponse } from "@frontmcp/utils";
 
 // plugins/plugin-skilled-openapi/src/executor/host-concurrency.ts
 var gates = /* @__PURE__ */ new Map();
@@ -767,68 +768,28 @@ async function withHostConcurrency(host, limit, fn) {
 }
 
 // plugins/plugin-skilled-openapi/src/executor/ssrf-guard.ts
-var PRIVATE_IPV4_BLOCKS = [
-  // RFC 1918
-  { net: ipv4ToInt("10.0.0.0"), mask: 4278190080 },
-  { net: ipv4ToInt("172.16.0.0"), mask: 4293918720 },
-  { net: ipv4ToInt("192.168.0.0"), mask: 4294901760 },
-  // Loopback
-  { net: ipv4ToInt("127.0.0.0"), mask: 4278190080 },
-  // Carrier-grade NAT (RFC 6598) — routable-looking but private; a common
-  // SSRF blind spot (SECURITY-REVIEW B4).
-  { net: ipv4ToInt("100.64.0.0"), mask: 4290772992 }
-];
-var ALWAYS_FORBIDDEN_IPV4_BLOCKS = [
-  // Link-local incl. AWS/GCP/Azure metadata 169.254.169.254
-  { net: ipv4ToInt("169.254.0.0"), mask: 4294901760 },
-  // "this host on this network" / unspecified
-  { net: ipv4ToInt("0.0.0.0"), mask: 4278190080 }
-];
-function ipv4ToInt(ip) {
-  const parts = ip.split(".").map((n) => parseInt(n, 10));
-  if (parts.length !== 4 || parts.some((p) => Number.isNaN(p))) return 0;
-  const [a, b, c, d] = parts;
-  return a * 16777216 + (b << 16 >>> 0) + (c << 8 >>> 0) + d >>> 0;
-}
-function isValidIPv4(ip) {
-  if (!/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(ip)) return false;
-  return ip.split(".").every((p) => {
-    const n = Number(p);
-    return n >= 0 && n <= 255;
-  });
-}
-function matchesBlock(ip, blocks) {
-  const v = ipv4ToInt(ip);
-  return blocks.some((b) => (v & b.mask) >>> 0 === b.net);
-}
-function isPrivateIPv4(ip) {
-  if (!isValidIPv4(ip)) return false;
-  return matchesBlock(ip, PRIVATE_IPV4_BLOCKS) || matchesBlock(ip, ALWAYS_FORBIDDEN_IPV4_BLOCKS);
-}
-function isAlwaysForbiddenIPv4(ip) {
-  if (!isValidIPv4(ip)) return false;
-  return matchesBlock(ip, ALWAYS_FORBIDDEN_IPV4_BLOCKS);
-}
-function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  if (lower.startsWith("fe80:") || lower.startsWith("fe80::")) return true;
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    return isPrivateIPv4(v4);
-  }
-  return false;
-}
-function isAlwaysForbiddenIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower.startsWith("fe80:") || lower.startsWith("fe80::")) return true;
-  if (lower === "fd00:ec2::254") return true;
-  if (lower === "::") return true;
-  if (lower.startsWith("::ffff:")) {
-    return isAlwaysForbiddenIPv4(lower.slice("::ffff:".length));
-  }
-  return false;
+import { classifyIpAddress, parseIpv4 } from "@frontmcp/utils";
+var ALWAYS_FORBIDDEN_RANGES = /* @__PURE__ */ new Set([
+  "link-local",
+  "cloud-metadata",
+  "unspecified",
+  "this-network",
+  "local-use-nat64"
+]);
+function findAddressViolation(address, outbound) {
+  const classification = classifyIpAddress(address);
+  if (!classification) {
+    return { description: `malformed IP address ${address}`, alwaysForbidden: true };
+  }
+  if (classification.range === "public") return void 0;
+  const alwaysForbidden = ALWAYS_FORBIDDEN_RANGES.has(classification.range);
+  if (!alwaysForbidden && outbound.allowPrivateNetworks) return void 0;
+  const category = alwaysForbidden ? "metadata/link-local" : "private/loopback";
+  const embedded = classification.embeddedIpv4 ? `embeds ${classification.embeddedIpv4}, ` : "";
+  return {
+    description: `${category} IPv${classification.family} ${address} (${embedded}in ${classification.cidr})`,
+    alwaysForbidden
+  };
 }
 var FORBIDDEN_METADATA_HOSTS = /* @__PURE__ */ new Set([
   "metadata.google.internal",
@@ -839,11 +800,8 @@ var FORBIDDEN_METADATA_HOSTS = /* @__PURE__ */ new Set([
   "metadata.goog"
 ]);
 function classifyHostLiteral(hostname) {
-  let h = hostname;
-  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
-  if (isValidIPv4(h)) return { kind: "v4", ip: h };
-  if (h.includes(":")) return { kind: "v6", ip: h };
-  return { kind: "name", ip: h };
+  const address = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  return { isIpLiteral: parseIpv4(address) !== void 0 || address.includes(":"), address };
 }
 async function checkOutboundUrl(target, allowedHosts, outbound) {
   let url;
@@ -863,50 +821,27 @@ async function checkOutboundUrl(target, allowedHosts, outbound) {
     return { ok: false, reason: `hostname "${hostname}" is not in the bundle's declared services` };
   }
   const literal = classifyHostLiteral(hostname);
-  if (literal.kind === "v4") {
-    if (isAlwaysForbiddenIPv4(literal.ip)) {
-      return { ok: false, reason: `metadata/link-local IPv4 ${literal.ip} is always blocked` };
-    }
-    if (!outbound.allowPrivateNetworks && isPrivateIPv4(literal.ip)) {
-      return { ok: false, reason: `private/loopback IPv4 ${literal.ip} is blocked` };
-    }
-    return { ok: true };
-  }
-  if (literal.kind === "v6") {
-    if (isAlwaysForbiddenIPv6(literal.ip)) {
-      return { ok: false, reason: `metadata/link-local IPv6 ${literal.ip} is always blocked` };
-    }
-    if (!outbound.allowPrivateNetworks && isPrivateIPv6(literal.ip)) {
-      return { ok: false, reason: `private IPv6 ${literal.ip} is blocked` };
+  if (literal.isIpLiteral) {
+    const violation = findAddressViolation(literal.address, outbound);
+    if (violation) {
+      return { ok: false, reason: `${violation.description} is ${violation.alwaysForbidden ? "always " : ""}blocked` };
     }
     return { ok: true };
   }
   let addresses;
   try {
     const { promises: dns } = await import("node:dns");
-    addresses = await dns.lookup(literal.ip, { all: true });
+    addresses = await dns.lookup(literal.address, { all: true });
   } catch (e) {
     if (!outbound.allowPrivateNetworks) {
       return { ok: false, reason: `DNS resolution failed for "${hostname}": ${e.message}` };
     }
     return { ok: true };
   }
-  for (const a of addresses) {
-    if (a.family === 4) {
-      if (isAlwaysForbiddenIPv4(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to metadata/link-local IPv4 ${a.address}` };
-      }
-      if (!outbound.allowPrivateNetworks && isPrivateIPv4(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to private/loopback IPv4 ${a.address}` };
-      }
-    }
-    if (a.family === 6) {
-      if (isAlwaysForbiddenIPv6(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to metadata/link-local IPv6 ${a.address}` };
-      }
-      if (!outbound.allowPrivateNetworks && isPrivateIPv6(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to private IPv6 ${a.address}` };
-      }
+  for (const { address } of addresses) {
+    const violation = findAddressViolation(address, outbound);
+    if (violation) {
+      return { ok: false, reason: `host "${hostname}" resolved to ${violation.description}` };
     }
   }
   return { ok: true };
@@ -1061,7 +996,7 @@ async function executeOperation(args) {
         // here so we can refuse it instead of following blindly.
         redirect: "manual"
       });
-      if (response.status >= 300 && response.status < 400) {
+      if (isRedirectResponse(response)) {
         return failure(
           response.status,
           `upstream returned a redirect (${response.status}); not followed to protect injected credentials`
@@ -1699,7 +1634,9 @@ var SkilledOpenApiPlugin = class extends DynamicPlugin {
     } catch {
     }
     const scope = this.get(ScopeEntry3);
-    const catalog = buildSkillsCatalogSummary(scope.skills);
+    const catalog = buildSkillsCatalogSummary(scope.skills, {
+      mcpResources: scope.metadata?.skillsConfig?.mcpResources
+    });
     const description = catalog ? `${searchSkillDescription}
 
 ---

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-skilled-openapi",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "FrontMCP plugin: serve a customer's OpenAPI spec as skill bundles (signed, OpenAPI-Overlay-based) with hidden per-operation tools mediated by three meta-tools (search_skill / load_skill / run_workflow — the last runs an enclave-sandboxed AgentScript that orchestrates the loaded skills' operations).",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -48,14 +48,15 @@
     }
   },
   "dependencies": {
-    "@frontmcp/adapters": "1.8.0",
-    "@frontmcp/auth": "1.8.0",
-    "@frontmcp/sdk": "1.8.0"
+    "@frontmcp/adapters": "1.8.1",
+    "@frontmcp/auth": "1.8.1",
+    "@frontmcp/sdk": "1.8.1",
+    "@frontmcp/utils": "1.8.1"
   },
   "peerDependencies": {
     "@enclave-vm/ast": "*",
     "@enclave-vm/core": "*",
-    "@frontmcp/lazy-zod": "1.8.0"
+    "@frontmcp/lazy-zod": "1.8.1"
   },
   "peerDependenciesMeta": {
     "@enclave-vm/ast": {

package/executor/openapi-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-runtime.d.ts","sourceRoot":"","sources":["../../src/executor/openapi-runtime.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AA2HD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,eAAe,CAAC,CA8H3B"}
+{"version":3,"file":"openapi-runtime.d.ts","sourceRoot":"","sources":["../../src/executor/openapi-runtime.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AA2HD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,eAAe,CAAC,CA+H3B"}

package/executor/ssrf-guard.d.ts

@@ -7,7 +7,7 @@ export declare function isPrivateIPv4(ip: string): boolean;
 /** Metadata / link-local IPv4 — blocked even when `allowPrivateNetworks` is on. */
 export declare function isAlwaysForbiddenIPv4(ip: string): boolean;
 export declare function isPrivateIPv6(ip: string): boolean;
-/** Metadata / link-local IPv6 — blocked even when `allowPrivateNetworks` is on. */
+/** Metadata / link-local IPv6 (including IPv4-carrying forms) — blocked even when `allowPrivateNetworks` is on. */
 export declare function isAlwaysForbiddenIPv6(ip: string): boolean;
 /**
  * Validate an outbound URL against the allowlist + scheme rules + IP blocklist.

package/executor/ssrf-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../../src/executor/ssrf-guard.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkDD,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOjD;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAWjD;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAazD;AAyBD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EACjC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,eAAe,CAAC,CAkF1B"}
+{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../../src/executor/ssrf-guard.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAwBD,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAIjD;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGzD;AAyCD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EACjC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,eAAe,CAAC,CA2D1B"}

package/index.js

@@ -737,6 +737,7 @@ var import_sdk2 = require("@frontmcp/sdk");
 
 // plugins/plugin-skilled-openapi/src/executor/openapi-runtime.ts
 var import_openapi = require("@frontmcp/adapters/openapi");
+var import_utils2 = require("@frontmcp/utils");
 
 // plugins/plugin-skilled-openapi/src/executor/host-concurrency.ts
 var gates = /* @__PURE__ */ new Map();
@@ -770,68 +771,28 @@ async function withHostConcurrency(host, limit, fn) {
 }
 
 // plugins/plugin-skilled-openapi/src/executor/ssrf-guard.ts
-var PRIVATE_IPV4_BLOCKS = [
-  // RFC 1918
-  { net: ipv4ToInt("10.0.0.0"), mask: 4278190080 },
-  { net: ipv4ToInt("172.16.0.0"), mask: 4293918720 },
-  { net: ipv4ToInt("192.168.0.0"), mask: 4294901760 },
-  // Loopback
-  { net: ipv4ToInt("127.0.0.0"), mask: 4278190080 },
-  // Carrier-grade NAT (RFC 6598) — routable-looking but private; a common
-  // SSRF blind spot (SECURITY-REVIEW B4).
-  { net: ipv4ToInt("100.64.0.0"), mask: 4290772992 }
-];
-var ALWAYS_FORBIDDEN_IPV4_BLOCKS = [
-  // Link-local incl. AWS/GCP/Azure metadata 169.254.169.254
-  { net: ipv4ToInt("169.254.0.0"), mask: 4294901760 },
-  // "this host on this network" / unspecified
-  { net: ipv4ToInt("0.0.0.0"), mask: 4278190080 }
-];
-function ipv4ToInt(ip) {
-  const parts = ip.split(".").map((n) => parseInt(n, 10));
-  if (parts.length !== 4 || parts.some((p) => Number.isNaN(p))) return 0;
-  const [a, b, c, d] = parts;
-  return a * 16777216 + (b << 16 >>> 0) + (c << 8 >>> 0) + d >>> 0;
-}
-function isValidIPv4(ip) {
-  if (!/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(ip)) return false;
-  return ip.split(".").every((p) => {
-    const n = Number(p);
-    return n >= 0 && n <= 255;
-  });
-}
-function matchesBlock(ip, blocks) {
-  const v = ipv4ToInt(ip);
-  return blocks.some((b) => (v & b.mask) >>> 0 === b.net);
-}
-function isPrivateIPv4(ip) {
-  if (!isValidIPv4(ip)) return false;
-  return matchesBlock(ip, PRIVATE_IPV4_BLOCKS) || matchesBlock(ip, ALWAYS_FORBIDDEN_IPV4_BLOCKS);
-}
-function isAlwaysForbiddenIPv4(ip) {
-  if (!isValidIPv4(ip)) return false;
-  return matchesBlock(ip, ALWAYS_FORBIDDEN_IPV4_BLOCKS);
-}
-function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  if (lower.startsWith("fe80:") || lower.startsWith("fe80::")) return true;
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    return isPrivateIPv4(v4);
-  }
-  return false;
-}
-function isAlwaysForbiddenIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower.startsWith("fe80:") || lower.startsWith("fe80::")) return true;
-  if (lower === "fd00:ec2::254") return true;
-  if (lower === "::") return true;
-  if (lower.startsWith("::ffff:")) {
-    return isAlwaysForbiddenIPv4(lower.slice("::ffff:".length));
-  }
-  return false;
+var import_utils = require("@frontmcp/utils");
+var ALWAYS_FORBIDDEN_RANGES = /* @__PURE__ */ new Set([
+  "link-local",
+  "cloud-metadata",
+  "unspecified",
+  "this-network",
+  "local-use-nat64"
+]);
+function findAddressViolation(address, outbound) {
+  const classification = (0, import_utils.classifyIpAddress)(address);
+  if (!classification) {
+    return { description: `malformed IP address ${address}`, alwaysForbidden: true };
+  }
+  if (classification.range === "public") return void 0;
+  const alwaysForbidden = ALWAYS_FORBIDDEN_RANGES.has(classification.range);
+  if (!alwaysForbidden && outbound.allowPrivateNetworks) return void 0;
+  const category = alwaysForbidden ? "metadata/link-local" : "private/loopback";
+  const embedded = classification.embeddedIpv4 ? `embeds ${classification.embeddedIpv4}, ` : "";
+  return {
+    description: `${category} IPv${classification.family} ${address} (${embedded}in ${classification.cidr})`,
+    alwaysForbidden
+  };
 }
 var FORBIDDEN_METADATA_HOSTS = /* @__PURE__ */ new Set([
   "metadata.google.internal",
@@ -842,11 +803,8 @@ var FORBIDDEN_METADATA_HOSTS = /* @__PURE__ */ new Set([
   "metadata.goog"
 ]);
 function classifyHostLiteral(hostname) {
-  let h = hostname;
-  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
-  if (isValidIPv4(h)) return { kind: "v4", ip: h };
-  if (h.includes(":")) return { kind: "v6", ip: h };
-  return { kind: "name", ip: h };
+  const address = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  return { isIpLiteral: (0, import_utils.parseIpv4)(address) !== void 0 || address.includes(":"), address };
 }
 async function checkOutboundUrl(target, allowedHosts, outbound) {
   let url;
@@ -866,50 +824,27 @@ async function checkOutboundUrl(target, allowedHosts, outbound) {
     return { ok: false, reason: `hostname "${hostname}" is not in the bundle's declared services` };
   }
   const literal = classifyHostLiteral(hostname);
-  if (literal.kind === "v4") {
-    if (isAlwaysForbiddenIPv4(literal.ip)) {
-      return { ok: false, reason: `metadata/link-local IPv4 ${literal.ip} is always blocked` };
-    }
-    if (!outbound.allowPrivateNetworks && isPrivateIPv4(literal.ip)) {
-      return { ok: false, reason: `private/loopback IPv4 ${literal.ip} is blocked` };
-    }
-    return { ok: true };
-  }
-  if (literal.kind === "v6") {
-    if (isAlwaysForbiddenIPv6(literal.ip)) {
-      return { ok: false, reason: `metadata/link-local IPv6 ${literal.ip} is always blocked` };
-    }
-    if (!outbound.allowPrivateNetworks && isPrivateIPv6(literal.ip)) {
-      return { ok: false, reason: `private IPv6 ${literal.ip} is blocked` };
+  if (literal.isIpLiteral) {
+    const violation = findAddressViolation(literal.address, outbound);
+    if (violation) {
+      return { ok: false, reason: `${violation.description} is ${violation.alwaysForbidden ? "always " : ""}blocked` };
     }
     return { ok: true };
   }
   let addresses;
   try {
     const { promises: dns } = await import("node:dns");
-    addresses = await dns.lookup(literal.ip, { all: true });
+    addresses = await dns.lookup(literal.address, { all: true });
   } catch (e) {
     if (!outbound.allowPrivateNetworks) {
       return { ok: false, reason: `DNS resolution failed for "${hostname}": ${e.message}` };
     }
     return { ok: true };
   }
-  for (const a of addresses) {
-    if (a.family === 4) {
-      if (isAlwaysForbiddenIPv4(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to metadata/link-local IPv4 ${a.address}` };
-      }
-      if (!outbound.allowPrivateNetworks && isPrivateIPv4(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to private/loopback IPv4 ${a.address}` };
-      }
-    }
-    if (a.family === 6) {
-      if (isAlwaysForbiddenIPv6(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to metadata/link-local IPv6 ${a.address}` };
-      }
-      if (!outbound.allowPrivateNetworks && isPrivateIPv6(a.address)) {
-        return { ok: false, reason: `host "${hostname}" resolved to private IPv6 ${a.address}` };
-      }
+  for (const { address } of addresses) {
+    const violation = findAddressViolation(address, outbound);
+    if (violation) {
+      return { ok: false, reason: `host "${hostname}" resolved to ${violation.description}` };
     }
   }
   return { ok: true };
@@ -1064,7 +999,7 @@ async function executeOperation(args) {
         // here so we can refuse it instead of following blindly.
         redirect: "manual"
       });
-      if (response.status >= 300 && response.status < 400) {
+      if ((0, import_utils2.isRedirectResponse)(response)) {
         return failure(
           response.status,
           `upstream returned a redirect (${response.status}); not followed to protect injected credentials`
@@ -1702,7 +1637,9 @@ var SkilledOpenApiPlugin = class extends import_sdk5.DynamicPlugin {
     } catch {
     }
     const scope = this.get(import_sdk5.ScopeEntry);
-    const catalog = (0, import_sdk5.buildSkillsCatalogSummary)(scope.skills);
+    const catalog = (0, import_sdk5.buildSkillsCatalogSummary)(scope.skills, {
+      mcpResources: scope.metadata?.skillsConfig?.mcpResources
+    });
     const description = catalog ? `${searchSkillDescription}
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-skilled-openapi",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "FrontMCP plugin: serve a customer's OpenAPI spec as skill bundles (signed, OpenAPI-Overlay-based) with hidden per-operation tools mediated by three meta-tools (search_skill / load_skill / run_workflow — the last runs an enclave-sandboxed AgentScript that orchestrates the loaded skills' operations).",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -48,14 +48,15 @@
     }
   },
   "dependencies": {
-    "@frontmcp/adapters": "1.8.0",
-    "@frontmcp/auth": "1.8.0",
-    "@frontmcp/sdk": "1.8.0"
+    "@frontmcp/adapters": "1.8.1",
+    "@frontmcp/auth": "1.8.1",
+    "@frontmcp/sdk": "1.8.1",
+    "@frontmcp/utils": "1.8.1"
   },
   "peerDependencies": {
     "@enclave-vm/ast": "*",
     "@enclave-vm/core": "*",
-    "@frontmcp/lazy-zod": "1.8.0"
+    "@frontmcp/lazy-zod": "1.8.1"
   },
   "peerDependenciesMeta": {
     "@enclave-vm/ast": {

package/skilled-openapi.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skilled-openapi.plugin.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,gBAAgB,EAIrB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,aAAa,EAKb,KAAK,SAAS,EAEd,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAMvB,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACtC,MAAM,yBAAyB,CAAC;AAmBjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,eAAsD,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE;;;;OAIG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC1C;AAqDD;;;;;;;;;;;;GAYG;AAQH,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,aAAa,CAC7D,2BAA2B,EAC3B,gCAAgC,CACjC;IACC,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,OAAO,EAAE,gCAAgC;IAMrD,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;OAUG;IAEG,gCAAgC,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB7F,OAAO,CAAC,oBAAoB;WAaZ,gBAAgB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY,EAAE;CA0J5F"}
+{"version":3,"file":"skilled-openapi.plugin.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,gBAAgB,EAIrB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,aAAa,EAKb,KAAK,SAAS,EAEd,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAMvB,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACtC,MAAM,yBAAyB,CAAC;AAmBjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,eAAsD,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE;;;;OAIG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC1C;AAqDD;;;;;;;;;;;;GAYG;AAQH,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,aAAa,CAC7D,2BAA2B,EAC3B,gCAAgC,CACjC;IACC,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,OAAO,EAAE,gCAAgC;IAMrD,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;OAUG;IAEG,gCAAgC,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB7F,OAAO,CAAC,oBAAoB;WAaZ,gBAAgB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY,EAAE;CA0J5F"}