@frontmcp/skills 1.7.0 → 1.7.1

package/catalog/frontmcp-config/examples/configure-http/cors-restricted-origins.md

@@ -5,7 +5,7 @@ level: basic
 description: 'Configure CORS to allow only specific frontend origins with credentials.'
 tags: [config, browser, http, cors, restricted, origins]
 features:
-  - 'Restricting CORS to explicit origins instead of the permissive default'
+  - 'Naming the origins a browser may read from — omitting `cors` sends no headers at all'
   - 'Enabling `credentials: true` with specific origins (required -- browsers reject `*` with credentials)'
   - 'Setting `maxAge` to reduce preflight request overhead'
   - 'Reading port from an environment variable with a fallback'
@@ -41,7 +41,7 @@ class Server {}
 
 ## What This Demonstrates
 
-- Restricting CORS to explicit origins instead of the permissive default
+- Naming the origins a browser may read from — omitting `cors` sends no headers at all
 - Enabling `credentials: true` with specific origins (required -- browsers reject `*` with credentials)
 - Setting `maxAge` to reduce preflight request overhead
 - Reading port from an environment variable with a fallback

package/catalog/frontmcp-config/references/configure-http.md

@@ -33,7 +33,9 @@ Configure the HTTP server — port, CORS policy, unix sockets, entry path prefix
 - Only need rate limiting or IP filtering without changing HTTP binding -- use `configure-throttle`
 - Need to configure TLS/HTTPS termination -- handle at the reverse proxy or load balancer level, not in FrontMCP
 
-> **Decision:** Use this skill when you need to customize how the HTTP listener binds (port, socket, prefix) or how it handles CORS; skip if the default port 3000 with permissive CORS is sufficient.
+> **Decision:** Use this skill when you need to customize how the HTTP listener binds (port, socket, prefix, network interface) or how it handles CORS; skip if the defaults are sufficient — port 3000, bound to loopback, sending no CORS headers.
+
+> **Changed in v1.7.0.** The server now binds `127.0.0.1` (was `0.0.0.0`) and omitting `cors` now sends no CORS headers (was `{ origin: true }`). Reaching the server from another host or another origin is an explicit opt-in — see [Network Binding](#network-binding) and [CORS Configuration](#cors-configuration).
 
 ## HttpOptionsInput
 
@@ -46,7 +48,7 @@ Configure the HTTP server — port, CORS policy, unix sockets, entry path prefix
     entryPath: '', // default: '' (root)
     socketPath: undefined, // unix socket path (overrides port)
     cors: {
-      // default: permissive (all origins)
+      // default: undefined — no CORS headers at all
       origin: ['https://myapp.com'],
       credentials: true,
       maxAge: 86400,
@@ -87,15 +89,61 @@ http: {
 }
 ```
 
+## Network Binding
+
+The server binds `127.0.0.1` unless told otherwise — a server that says nothing about security is
+local-only. The effective address is resolved in this order, first match wins:
+
+1. `http.security.bindAddress` — `'loopback'`, `'all'`, or a literal address
+2. The `FRONTMCP_BIND_ADDRESS` environment variable — same three forms
+3. Strict mode (`http.security.strict`) — `0.0.0.0` when distributed, `127.0.0.1` otherwise
+4. A distributed build (`FRONTMCP_DEPLOYMENT_MODE=distributed`) — `0.0.0.0`
+5. The default — `127.0.0.1`
+
+```typescript
+http: {
+  security: {
+    bindAddress: 'all',  // 0.0.0.0 — reachable from other hosts
+  },
+}
+```
+
+In a container, prefer the environment variable: a Dockerfile cannot reach into the server's
+TypeScript config, and the env var needs no rebuild.
+
+```dockerfile
+ENV FRONTMCP_BIND_ADDRESS=all
+EXPOSE 3000
+```
+
 ## CORS Configuration
 
-### Permissive (Default)
+### No CORS Headers (Default)
 
-When `cors` is not specified, the server allows all origins without credentials:
+When `cors` is not specified, the server sends **no CORS headers**. A cross-origin request still
+reaches the server and is served normally — the browser simply refuses to let the calling page read
+the response. Non-browser clients are unaffected: CORS is a browser rule, **not server-side access
+control**. If you need to keep callers out, use authentication.
+
+`cors: {}` and `cors: { origin: false }` behave identically to omitting the option — the middleware
+is installed only when `origin` is set to something other than `false`.
+
+```typescript
+// No CORS headers (default behavior)
+http: {
+}
+```
+
+### Allow Any Origin
+
+The pre-v1.7.0 default. Reflects whatever `Origin` the request carries, so any page a user visits
+can read this server's responses — never use it in production.
 
 ```typescript
-// All origins allowed (default behavior)
 http: {
+  cors: {
+    origin: true,
+  },
 }
 ```
 
@@ -139,11 +187,11 @@ http: {
 
 ### CORS Fields
 
-| Field         | Type                                        | Default      | Description                        |
-| ------------- | ------------------------------------------- | ------------ | ---------------------------------- |
-| `origin`      | `boolean \| string \| string[] \| function` | `true` (all) | Allowed origins                    |
-| `credentials` | `boolean`                                   | `false`      | Allow cookies/auth headers         |
-| `maxAge`      | `number`                                    | —            | Preflight cache duration (seconds) |
+| Field         | Type                                        | Default | Description                                                                        |
+| ------------- | ------------------------------------------- | ------- | ---------------------------------------------------------------------------------- |
+| `origin`      | `boolean \| string \| string[] \| function` | none    | Allowed origins. No default — omitting it (or `false`) installs no CORS middleware |
+| `credentials` | `boolean`                                   | `false` | Allow cookies/auth headers                                                         |
+| `maxAge`      | `number`                                    | —       | Preflight cache duration (seconds)                                                 |
 
 ## Request Body Limits
 
@@ -345,13 +393,13 @@ curl --unix-socket /tmp/my-mcp-server.sock http://localhost/
 
 ## Common Patterns
 
-| Pattern               | Correct                                                      | Incorrect                                    | Why                                                                                                               |
-| --------------------- | ------------------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
-| Port from environment | `port: Number(process.env.PORT) \|\| 3000`                   | `port: process.env.PORT`                     | The `port` field expects a number; passing a string causes a silent bind failure                                  |
-| CORS with credentials | `cors: { origin: ['https://myapp.com'], credentials: true }` | `cors: { origin: true, credentials: true }`  | Browsers reject `Access-Control-Allow-Origin: *` when credentials are enabled; you must list explicit origins     |
-| Unix socket mode      | `socketPath: '/tmp/my-mcp.sock'` with no `port` field        | Setting both `socketPath` and `port`         | When `socketPath` is set, `port` is silently ignored which can cause confusion during debugging                   |
-| Entry path prefix     | `entryPath: '/api/mcp'` (no trailing slash)                  | `entryPath: '/api/mcp/'` with trailing slash | Trailing slashes cause double-slash issues in route matching (e.g., `/api/mcp//sse`)                              |
-| Disabling CORS        | `cors: false`                                                | Omitting the `cors` field entirely           | Omitting `cors` applies permissive defaults (all origins allowed); set `false` explicitly to send no CORS headers |
+| Pattern               | Correct                                                      | Incorrect                                    | Why                                                                                                                            |
+| --------------------- | ------------------------------------------------------------ | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| Port from environment | `port: Number(process.env.PORT) \|\| 3000`                   | `port: process.env.PORT`                     | The `port` field expects a number; passing a string causes a silent bind failure                                               |
+| CORS with credentials | `cors: { origin: ['https://myapp.com'], credentials: true }` | `cors: { origin: true, credentials: true }`  | Browsers reject `Access-Control-Allow-Origin: *` when credentials are enabled; you must list explicit origins                  |
+| Unix socket mode      | `socketPath: '/tmp/my-mcp.sock'` with no `port` field        | Setting both `socketPath` and `port`         | When `socketPath` is set, `port` is silently ignored which can cause confusion during debugging                                |
+| Entry path prefix     | `entryPath: '/api/mcp'` (no trailing slash)                  | `entryPath: '/api/mcp/'` with trailing slash | Trailing slashes cause double-slash issues in route matching (e.g., `/api/mcp//sse`)                                           |
+| Allowing cross-origin | `cors: { origin: ['https://myapp.com'] }`                    | Omitting the `cors` field entirely           | Omitting `cors` (like `cors: false`) sends no CORS headers at all; a browser on another origin needs an explicit `origin` list |
 
 ## Verification Checklist
 
@@ -362,8 +410,14 @@ curl --unix-socket /tmp/my-mcp-server.sock http://localhost/
 - [ ] If `socketPath` is set, `port` is removed or commented out to avoid confusion
 - [ ] `entryPath` does not have a trailing slash
 
+### Network Binding
+
+- [ ] If the server must be reachable from another host, `security.bindAddress` or `FRONTMCP_BIND_ADDRESS` is set — the default is loopback-only
+- [ ] Containers set `FRONTMCP_BIND_ADDRESS=all` so the published port reaches the process
+
 ### CORS
 
+- [ ] `cors` is set only if a browser on another origin needs access — omitting it sends no headers
 - [ ] If `credentials: true`, `origin` lists explicit allowed origins (not `true` or `*`)
 - [ ] `maxAge` is set to a reasonable value for production (e.g., `86400` for 24 hours)
 - [ ] Dynamic origin function handles `undefined` origin (non-browser requests)
@@ -390,7 +444,7 @@ curl --unix-socket /tmp/my-mcp-server.sock http://localhost/
 | CORS errors in the browser console                    | Origin not included in the `cors.origin` list or `credentials: true` with wildcard origin                            | Add the frontend origin to the `origin` array and ensure credentials and origin settings are compatible  |
 | Unix socket file not created                          | Missing write permissions on the target directory or stale socket file from a previous run                           | Check directory permissions and remove the stale `.sock` file before restarting                          |
 | Routes return 404 after setting `entryPath`           | Client is still requesting the root path without the prefix                                                          | Update client base URL to include the entry path (e.g., `http://localhost:3000/api/mcp`)                 |
-| Server binds but external clients cannot connect      | Server bound to `localhost` or `127.0.0.1` inside a container                                                        | Set `host: '0.0.0.0'` or use Docker port mapping to expose the container port                            |
+| Server binds but external clients cannot connect      | The default bind address is `127.0.0.1`, which a published container port cannot reach                               | Set `FRONTMCP_BIND_ADDRESS=all` in the container (or `http.security.bindAddress: 'all'` in the config)   |
 | `413 Payload Too Large` with JSON-RPC envelope        | Request body exceeded `bodyLimit` (default `'4mb'`)                                                                  | Raise `http.bodyLimit` to fit the payload, or move large blobs to a separate upload endpoint             |
 | Server throws at startup mentioning a "reserved" path | A custom `http.routes` path collides with the MCP entry path, `/oauth/*`, `/.well-known/*`, `/health`, or `/metrics` | Rename the custom route to a non-reserved path                                                           |
 | Custom route returns JSON when HTML/bytes expected    | The Express adapter defaults responses to `application/json`                                                         | Set `res.setHeader('Content-Type', ...)` (or `res.type(...)`) in the handler before sending the body     |

package/catalog/frontmcp-deployment/examples/build-for-sdk/create-flat-config.md

@@ -42,6 +42,10 @@ async function main() {
           case 'multiply':
             return { result: input.a * input.b };
           case 'divide':
+            // `z.number()` accepts 0, so guard the divisor: 1/0 is Infinity, which JSON
+            // serialises as null, and 0/0 is NaN, which the output schema rejects with an
+            // opaque error. Fail with a message the caller can act on instead.
+            if (input.b === 0) throw new Error('Cannot divide by zero');
             return { result: input.a / input.b };
         }
       }),

package/catalog/frontmcp-deployment/examples/deploy-to-node/docker-compose-with-redis.md

@@ -70,6 +70,8 @@ RUN npx frontmcp build --target node
 FROM node:24-alpine AS production
 WORKDIR /app
 ENV NODE_ENV=production
+# The server binds 127.0.0.1 by default, which a published container port cannot reach.
+ENV FRONTMCP_BIND_ADDRESS=all
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/package.json ./
 COPY --from=builder /app/yarn.lock ./

package/catalog/frontmcp-deployment/examples/deploy-to-node/pm2-with-nginx.md

@@ -54,7 +54,8 @@ server {
 # .env
 PORT=3000
 NODE_ENV=production
-HOST=0.0.0.0
+# No FRONTMCP_BIND_ADDRESS here on purpose: the server binds 127.0.0.1 by default,
+# which is exactly right when NGINX on the same host is the only thing talking to it.
 REDIS_URL=redis://localhost:6379
 LOG_LEVEL=info
 ```

package/catalog/frontmcp-deployment/examples/deploy-to-node-dockerfile/basic-multistage-dockerfile.md

@@ -31,6 +31,8 @@ RUN yarn frontmcp build --target node
 FROM node:24-alpine AS production
 WORKDIR /app
 ENV NODE_ENV=production
+# The server binds 127.0.0.1 by default, which a published container port cannot reach.
+ENV FRONTMCP_BIND_ADDRESS=all
 ENV PORT=3000
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/package.json ./

package/catalog/frontmcp-deployment/examples/deploy-to-node-dockerfile/secure-nonroot-dockerfile.md

@@ -50,6 +50,8 @@ USER frontmcp
 
 # Environment defaults
 ENV NODE_ENV=production
+# The server binds 127.0.0.1 by default, which a published container port cannot reach.
+ENV FRONTMCP_BIND_ADDRESS=all
 ENV PORT=3000
 
 EXPOSE 3000

package/catalog/frontmcp-deployment/references/build-for-sdk.md

@@ -69,15 +69,34 @@ const server = await create({
     tool({
       name: 'calculate',
       description: 'Perform calculation',
-      inputSchema: { expression: z.string() },
+      inputSchema: {
+        a: z.number(),
+        b: z.number(),
+        operation: z.enum(['add', 'subtract', 'multiply', 'divide']),
+      },
       outputSchema: { result: z.number() },
-    })((input) => ({ result: eval(input.expression) })),
+    })((input) => {
+      switch (input.operation) {
+        case 'add':
+          return { result: input.a + input.b };
+        case 'subtract':
+          return { result: input.a - input.b };
+        case 'multiply':
+          return { result: input.a * input.b };
+        case 'divide':
+          // `z.number()` accepts 0, so guard the divisor: 1/0 is Infinity, which JSON
+          // serialises as null, and 0/0 is NaN, which the output schema rejects with an
+          // opaque error. Fail with a message the caller can act on instead.
+          if (input.b === 0) throw new Error('Cannot divide by zero');
+          return { result: input.a / input.b };
+      }
+    }),
   ],
   cacheKey: 'my-service', // Reuse same instance on repeated calls
 });
 
 // Call tools directly
-const result = await server.callTool('calculate', { expression: '2 + 2' });
+const result = await server.callTool('calculate', { a: 2, b: 2, operation: 'add' });
 
 // List available tools
 const { tools } = await server.listTools();
@@ -86,6 +105,13 @@ const { tools } = await server.listTools();
 await server.dispose();
 ```
 
+> **Never `eval()` tool input.** A tool's arguments come from the MCP caller, or from an LLM acting
+> on caller-controlled prompts — they are untrusted by definition. `eval` on that value runs with the
+> embedding process's full authority: environment credentials, the filesystem, the network, and
+> `process.getBuiltinModule('child_process')`. Output-schema validation cannot help, because the side
+> effects happen before the result is validated. Model the operation in the schema, as above, so the
+> set of things the tool can do is fixed at design time.
+
 ### CreateConfig Fields
 
 ```typescript

package/catalog/frontmcp-deployment/references/deploy-to-node-dockerfile.md

@@ -65,6 +65,8 @@ USER frontmcp
 
 # Environment defaults
 ENV NODE_ENV=production
+# The server binds 127.0.0.1 by default, which a published container port cannot reach.
+ENV FRONTMCP_BIND_ADDRESS=all
 ENV PORT=3000
 
 EXPOSE 3000

package/catalog/frontmcp-deployment/references/deploy-to-node.md

@@ -130,7 +130,10 @@ Create a `.env` file or set variables in your deployment environment:
 # Server
 PORT=3000
 NODE_ENV=production
-HOST=0.0.0.0
+# The server binds 127.0.0.1 by default. Set this only when it must be reachable
+# from another host — a container, a VM, direct access. Behind a reverse proxy on
+# the same machine, leave it unset.
+FRONTMCP_BIND_ADDRESS=all
 
 # Redis (required for session storage in production)
 REDIS_URL=redis://localhost:6379
@@ -139,13 +142,13 @@ REDIS_URL=redis://localhost:6379
 LOG_LEVEL=info
 ```
 
-| Variable    | Description                         | Default       |
-| ----------- | ----------------------------------- | ------------- |
-| `PORT`      | HTTP port for the server            | `3000`        |
-| `NODE_ENV`  | Runtime environment                 | `development` |
-| `REDIS_URL` | Redis connection string for storage | (none)        |
-| `HOST`      | Network interface to bind           | `0.0.0.0`     |
-| `LOG_LEVEL` | Logging verbosity                   | `info`        |
+| Variable                | Description                                                        | Default                  |
+| ----------------------- | ------------------------------------------------------------------ | ------------------------ |
+| `PORT`                  | HTTP port for the server                                           | `3000`                   |
+| `NODE_ENV`              | Runtime environment                                                | `development`            |
+| `REDIS_URL`             | Redis connection string for storage                                | (none)                   |
+| `FRONTMCP_BIND_ADDRESS` | Network interface to bind: `all`, `loopback`, or a literal address | `loopback` (`127.0.0.1`) |
+| `LOG_LEVEL`             | Logging verbosity                                                  | `info`                   |
 
 ## Step 5: Health Checks
 

package/catalog/frontmcp-production-readiness/examples/production-node-server/docker-multi-stage.md

@@ -33,6 +33,8 @@ RUN npx frontmcp build
 FROM node:24-slim AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
+# The server binds 127.0.0.1 by default, which a published container port cannot reach.
+ENV FRONTMCP_BIND_ADDRESS=all
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile --production && yarn cache clean
 COPY --from=builder /app/dist ./dist

package/catalog/skills-manifest.json

@@ -781,7 +781,7 @@
               "level": "basic",
               "tags": ["config", "browser", "http", "cors", "restricted", "origins"],
               "features": [
-                "Restricting CORS to explicit origins instead of the permissive default",
+                "Naming the origins a browser may read from — omitting `cors` sends no headers at all",
                 "Enabling `credentials: true` with specific origins (required -- browsers reject `*` with credentials)",
                 "Setting `maxAge` to reduce preflight request overhead",
                 "Reading port from an environment variable with a fallback"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/skills",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Curated skills catalog for FrontMCP projects",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",