@imenam/mcp-http-gateway 2.0.2 → 2.0.4

package/auth.js

@@ -1,35 +1,43 @@
-import { createRemoteJWKSet, jwtVerify } from 'jose';
-
-const OAUTH_ENABLED = process.env.MCP_OAUTH_ENABLED === 'true';
-
-let JWKS;
-if (OAUTH_ENABLED) {
-  JWKS = createRemoteJWKSet(new URL(process.env.OAUTH_JWKS_URI));
-}
-
-export function createMcpTokenVerifier() {
-  if (!OAUTH_ENABLED) return null;
-  return {
-    async verifyAccessToken(token) {
-      const { payload } = await jwtVerify(token, JWKS, {
-        issuer: process.env.OAUTH_ISSUER,
-        audience: process.env.MCP_PUBLIC_URL,
-      });
-      return {
-        token,
-        clientId: payload.client_id ?? payload.sub,
-        scopes: typeof payload.scope === 'string' ? payload.scope.split(' ') : [],
-        expiresAt: payload.exp,
-      };
-    },
-  };
-}
-
-export function getProtectedResourceMetadata() {
-  return {
-    resource: process.env.MCP_PUBLIC_URL,
-    authorization_servers: [process.env.OAUTH_ISSUER],
-    scopes_supported: ['mcp:tools'],
-    bearer_methods_supported: ['header'],
-  };
-}
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+
+const OAUTH_ENABLED = process.env.MCP_OAUTH_ENABLED === 'true';
+
+let JWKS;
+if (OAUTH_ENABLED) {
+  JWKS = createRemoteJWKSet(new URL(process.env.OAUTH_JWKS_URI));
+}
+
+export function createMcpTokenVerifier() {
+  if (!OAUTH_ENABLED) return null;
+  return {
+    async verifyAccessToken(token) {
+      let payload;
+      try {
+        const issuer = process.env.OAUTH_ISSUER?.replace(/\/*$/, '/');
+        ({ payload } = await jwtVerify(token, JWKS, {
+          issuer,
+          audience: process.env.MCP_PUBLIC_URL,
+        }));
+      } catch (err) {
+        console.error('[auth] jwtVerify FAILED:', err.code ?? err.constructor.name, err.message);
+        throw err;
+      }
+      return {
+        token,
+        clientId: payload.client_id ?? payload.sub,
+        sub: payload.sub,
+        scopes: typeof payload.scope === 'string' ? payload.scope.split(' ') : [],
+        expiresAt: payload.exp,
+      };
+    },
+  };
+}
+
+export function getProtectedResourceMetadata() {
+  return {
+    resource: process.env.MCP_PUBLIC_URL,
+    authorization_servers: [process.env.OAUTH_ISSUER],
+    scopes_supported: ['mcp:tools'],
+    bearer_methods_supported: ['header'],
+  };
+}

package/mcp-endpoint.js

@@ -1,148 +1,212 @@
-import { randomUUID } from 'node:crypto';
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
-import {
-  ListToolsRequestSchema,
-  CallToolRequestSchema,
-  isInitializeRequest,
-} from '@modelcontextprotocol/sdk/types.js';
-import { createMcpTokenVerifier, getProtectedResourceMetadata } from './auth.js';
-
-const tools = [
-  {
-    name: 'list_mcps',
-    description: 'List all MCPs available on the gateway with their route and description.',
-    inputSchema: { type: 'object', properties: {} },
-  },
-  {
-    name: 'list_tools',
-    description: 'List all tools available for a given MCP route.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        route: { type: 'string', description: 'MCP route as returned by list_mcps (e.g. "/documentor")' },
-      },
-      required: ['route'],
-    },
-  },
-  {
-    name: 'call_tool',
-    description: 'Call a tool on a given MCP route.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        route:     { type: 'string', description: 'MCP route (e.g. "/documentor")' },
-        tool_name: { type: 'string', description: 'Tool name to call' },
-        arguments: { type: 'object', description: 'Arguments to pass to the tool' },
-      },
-      required: ['route', 'tool_name'],
-    },
-  },
-];
-
-function buildMcpServer({ registry }) {
-  const server = new Server(
-    { name: 'mcp-http-gateway-remote', version: '1.0.0' },
-    { capabilities: { tools: {} } }
-  );
-
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
-
-  server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const { name, arguments: args = {} } = request.params;
-
-    try {
-      if (name === 'list_mcps') {
-        const text = registry
-          .map(m => `- ${m.name} (route: ${m.route})${m.description ? ` — ${m.description}` : ''}`)
-          .join('\n');
-        return { content: [{ type: 'text', text }] };
-      }
-
-      if (name === 'list_tools') {
-        const entry = registry.find(m => m.route === args.route);
-        if (!entry) {
-          return { content: [{ type: 'text', text: `No MCP found for route: ${args.route}` }], isError: true };
-        }
-        const text = JSON.stringify(entry.tools, null, 2);
-        return { content: [{ type: 'text', text }] };
-      }
-
-      if (name === 'call_tool') {
-        const entry = registry.find(m => m.route === args.route);
-        if (!entry) {
-          return { content: [{ type: 'text', text: `No MCP found for route: ${args.route}` }], isError: true };
-        }
-        const result = await entry.client.callTool({
-          name: args.tool_name,
-          arguments: args.arguments ?? {},
-        });
-        return result;
-      }
-
-      return { content: [{ type: 'text', text: `Unknown tool: ${name}` }], isError: true };
-    } catch (err) {
-      return { content: [{ type: 'text', text: `Request failed: ${err.message}` }], isError: true };
-    }
-  });
-
-  return server;
-}
-
-export function registerMcpEndpoint(app, { clients, registry }) {
-  app.get('/.well-known/oauth-protected-resource', (req, res) => {
-    res.json(getProtectedResourceMetadata());
-  });
-
-  const verifier = createMcpTokenVerifier();
-  const authMw = verifier
-    ? requireBearerAuth({
-        verifier,
-        requiredScopes: [],
-        resourceMetadataUrl: `${process.env.MCP_PUBLIC_URL?.replace(/\/mcp$/, '')}/.well-known/oauth-protected-resource`,
-      })
-    : (req, res, next) => next();
-
-  const transports = {};
-
-  const handleMcpRequest = async (req, res) => {
-    try {
-      const sessionId = req.headers['mcp-session-id'];
-      let transport = sessionId ? transports[sessionId] : undefined;
-
-      if (!transport && isInitializeRequest(req.body)) {
-        transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
-          onsessioninitialized: (sid) => { transports[sid] = transport; },
-        });
-        transport.onclose = () => {
-          if (transport.sessionId) delete transports[transport.sessionId];
-        };
-        await buildMcpServer({ registry }).connect(transport);
-      } else if (!transport) {
-        return res.status(400).json({
-          jsonrpc: '2.0',
-          error: { code: -32000, message: 'Bad Request: No valid session ID provided' },
-          id: null,
-        });
-      }
-      await transport.handleRequest(req, res, req.body);
-    } catch (err) {
-      console.error('[mcp-endpoint] handleMcpRequest error:', err.message);
-      if (!res.headersSent) {
-        res.status(500).json({
-          jsonrpc: '2.0',
-          error: { code: -32603, message: 'Internal server error' },
-          id: null,
-        });
-      }
-    }
-  };
-
-  app.post('/mcp', authMw, handleMcpRequest);
-  app.get('/mcp', authMw, handleMcpRequest);
-  app.delete('/mcp', authMw, handleMcpRequest);
-
-  console.log('[gateway] MCP remote endpoint registered at /mcp');
-}
+import { randomUUID } from 'node:crypto';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import {
+  ListToolsRequestSchema,
+  CallToolRequestSchema,
+  isInitializeRequest,
+} from '@modelcontextprotocol/sdk/types.js';
+import { getProtectedResourceMetadata } from './auth.js';
+
+const tools = [
+  {
+    name: 'list_mcps',
+    description: 'List all MCPs available on the gateway with their route and description.',
+    inputSchema: { type: 'object', properties: {} },
+  },
+  {
+    name: 'list_tools',
+    description: 'List all tools available for a given MCP route.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        route: { type: 'string', description: 'MCP route as returned by list_mcps (e.g. "/documentor")' },
+      },
+      required: ['route'],
+    },
+  },
+  {
+    name: 'call_tool',
+    description: 'Call a tool on a given MCP route.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        route:     { type: 'string', description: 'MCP route (e.g. "/documentor")' },
+        tool_name: { type: 'string', description: 'Tool name to call' },
+        arguments: { type: 'object', description: 'Arguments to pass to the tool' },
+      },
+      required: ['route', 'tool_name'],
+    },
+  },
+];
+
+function buildMcpServer({ registry }) {
+  const server = new Server(
+    { name: 'mcp-http-gateway-remote', version: '1.0.0' },
+    { capabilities: { tools: {} } }
+  );
+
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
+
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args = {} } = request.params;
+
+    try {
+      if (name === 'list_mcps') {
+        const text = registry
+          .map(m => `- ${m.name} (route: ${m.route})${m.description ? ` — ${m.description}` : ''}`)
+          .join('\n');
+        return { content: [{ type: 'text', text }] };
+      }
+
+      if (name === 'list_tools') {
+        const entry = registry.find(m => m.route === args.route);
+        if (!entry) {
+          return { content: [{ type: 'text', text: `No MCP found for route: ${args.route}` }], isError: true };
+        }
+        const text = JSON.stringify(entry.tools, null, 2);
+        return { content: [{ type: 'text', text }] };
+      }
+
+      if (name === 'call_tool') {
+        const entry = registry.find(m => m.route === args.route);
+        if (!entry) {
+          return { content: [{ type: 'text', text: `No MCP found for route: ${args.route}` }], isError: true };
+        }
+        const result = await entry.client.callTool({
+          name: args.tool_name,
+          arguments: args.arguments ?? {},
+        });
+        return result;
+      }
+
+      return { content: [{ type: 'text', text: `Unknown tool: ${name}` }], isError: true };
+    } catch (err) {
+      return { content: [{ type: 'text', text: `Request failed: ${err.message}` }], isError: true };
+    }
+  });
+
+  return server;
+}
+
+function buildDnsRebindingConfig() {
+  const port = process.env.GATEWAY_PORT ?? '3500';
+  const extraHosts = process.env.GATEWAY_ALLOWED_HOSTS
+    ? process.env.GATEWAY_ALLOWED_HOSTS.split(',').map(s => s.trim()).filter(Boolean)
+    : [];
+  const publicHost = process.env.MCP_PUBLIC_URL
+    ? (() => { try { return new URL(process.env.MCP_PUBLIC_URL).host; } catch { return null; } })()
+    : null;
+  const allowedHosts = [
+    `localhost:${port}`,
+    ...(publicHost ? [publicHost] : []),
+    ...extraHosts,
+  ];
+
+  const extraOrigins = process.env.GATEWAY_ALLOWED_ORIGINS
+    ? process.env.GATEWAY_ALLOWED_ORIGINS.split(',').map(s => s.trim()).filter(Boolean)
+    : [];
+  const allowedOrigins = ['https://claude.ai', ...extraOrigins];
+
+  return { allowedHosts, allowedOrigins };
+}
+
+export function registerMcpEndpoint(app, { clients, registry }) {
+  app.get('/.well-known/oauth-protected-resource', (req, res) => {
+    res.json(getProtectedResourceMetadata());
+  });
+
+  const { allowedHosts, allowedOrigins } = buildDnsRebindingConfig();
+  console.log('[gateway] DNS rebinding protection — allowedHosts:', allowedHosts);
+  console.log('[gateway] DNS rebinding protection — allowedOrigins:', allowedOrigins);
+
+  const SESSION_TTL_MS = parseInt(process.env.SESSION_TTL_MINUTES ?? '30', 10) * 60_000;
+  const SESSION_MAX = parseInt(process.env.SESSION_MAX_COUNT ?? '100', 10);
+  console.log(`[gateway] Session limits — TTL: ${SESSION_TTL_MS / 60_000} min, max: ${SESSION_MAX}`);
+
+  const transports = {};
+
+  const cleanupExpiredSessions = () => {
+    const now = Date.now();
+    for (const [sid, entry] of Object.entries(transports)) {
+      if (now - entry.lastActivity > SESSION_TTL_MS) {
+        console.log(`[mcp-endpoint] Session ${sid} expired (TTL), closing.`);
+        entry.transport.close?.();
+        delete transports[sid];
+      }
+    }
+  };
+
+  const cleanupTimer = setInterval(cleanupExpiredSessions, 60_000);
+  cleanupTimer.unref();
+
+  const handleMcpRequest = async (req, res) => {
+    try {
+      const sessionId = req.headers['mcp-session-id'];
+      const entry = sessionId ? transports[sessionId] : undefined;
+
+      let transport;
+
+      if (!entry && isInitializeRequest(req.body)) {
+        const activeCount = Object.keys(transports).length;
+        if (activeCount >= SESSION_MAX) {
+          console.warn(`[mcp-endpoint] Session cap reached (${activeCount}/${SESSION_MAX}), rejecting initialize.`);
+          return res.status(429).json({
+            jsonrpc: '2.0',
+            error: { code: -32000, message: 'Too Many Requests: session limit reached' },
+            id: null,
+          });
+        }
+
+        const ownerSub = req.auth?.sub ?? null;
+        transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: () => randomUUID(),
+          enableDnsRebindingProtection: true,
+          allowedHosts,
+          allowedOrigins,
+          onsessioninitialized: (sid) => {
+            transports[sid] = { transport, ownerSub, lastActivity: Date.now() };
+          },
+        });
+        transport.onclose = () => {
+          if (transport.sessionId) delete transports[transport.sessionId];
+        };
+        await buildMcpServer({ registry }).connect(transport);
+      } else if (!entry) {
+        return res.status(400).json({
+          jsonrpc: '2.0',
+          error: { code: -32000, message: 'Bad Request: No valid session ID provided' },
+          id: null,
+        });
+      } else {
+        if (entry.ownerSub !== null && req.auth?.sub !== entry.ownerSub) {
+          console.warn(`[mcp-endpoint] Session hijacking attempt: session owned by "${entry.ownerSub}", request by "${req.auth?.sub}"`);
+          return res.status(403).json({
+            jsonrpc: '2.0',
+            error: { code: -32000, message: 'Forbidden: session belongs to another client' },
+            id: null,
+          });
+        }
+        entry.lastActivity = Date.now();
+        transport = entry.transport;
+      }
+
+      await transport.handleRequest(req, res, req.body);
+    } catch (err) {
+      console.error('[mcp-endpoint] handleMcpRequest error:', err);
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: '2.0',
+          error: { code: -32603, message: 'Internal server error' },
+          id: null,
+        });
+      }
+    }
+  };
+
+  app.post('/mcp', handleMcpRequest);
+  app.get('/mcp', handleMcpRequest);
+  app.delete('/mcp', handleMcpRequest);
+
+  console.log('[gateway] MCP remote endpoint registered at /mcp');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imenam/mcp-http-gateway",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "type": "module",
   "description": "HTTP gateway that exposes MCP servers as REST routes — bridge between MCP and any HTTP-capable agent",
   "main": "server.js",

package/server.js

@@ -14,6 +14,9 @@ import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { initDb, getOrComputeToolEmbedding, getAllToolEmbeddings } from './embeddings/db.js';
 import { getEmbedding, cosineSimilarity } from './embeddings/vectorizer.js';
 import { registerMcpEndpoint } from './mcp-endpoint.js';
+import { createMcpTokenVerifier } from './auth.js';
+import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
+import { rateLimit } from 'express-rate-limit';
 
 // Normalise les différents formats de config rencontrés dans la nature :
 // - `command` string + `args` array  (format Cursor)
@@ -26,13 +29,33 @@ function normalizeCfg(cfg) {
   return { ...cfg, command, args, env };
 }
 
+// Variables système minimales transmises aux MCPs enfants.
+// On exclut délibérément toutes les variables propres au gateway
+// (OPENAI_API_KEY, OAUTH_*, GATEWAY_*, MCP_*, etc.).
+const CHILD_ENV_WHITELIST = new Set([
+  'PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL',
+  'LANG', 'LC_ALL', 'LC_CTYPE',
+  'TEMP', 'TMP', 'TMPDIR',
+  'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',
+  'SYSTEMROOT', 'SYSTEMDRIVE', 'WINDIR',
+  'COMSPEC', 'PATHEXT', 'USERNAME',
+  'PROGRAMFILES', 'NODE_PATH',
+]);
+
+function buildChildEnv(cfgEnv = {}) {
+  const safeEnv = Object.fromEntries(
+    Object.entries(process.env).filter(([k]) => CHILD_ENV_WHITELIST.has(k))
+  );
+  return { ...safeEnv, ...cfgEnv };
+}
+
 // --- MCP client ---
 
 async function connectMcp(name, cfg) {
   const transport = new StdioClientTransport({
     command: cfg.command,
     args: cfg.args ?? [],
-    env: { ...process.env, ...(cfg.env ?? {}) },
+    env: buildChildEnv(cfg.env),
   });
   const client = new Client({ name: 'mcp-gateway', version: '1.0.0' }, { capabilities: {} });
   await client.connect(transport);
@@ -69,8 +92,11 @@ function registerMcpRoutes(app, route, client, name) {
 
 // --- Bootstrap ---
 
+const LOCALHOST_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);
+
 async function main() {
   const GATEWAY_PORT = parseInt(process.env.GATEWAY_PORT ?? '3500', 10);
+  const GATEWAY_HOST = process.env.GATEWAY_HOST ?? '127.0.0.1';
 
   // GATEWAY_CONFIG_DIR overrides the directory in which mcp-servers.json is looked up
   // (defaults to ./config relative to cwd).
@@ -84,6 +110,65 @@ async function main() {
   const app = express();
   app.use(express.json({ type: '*/*' }));
 
+  const globalWindowMin = parseInt(process.env.RATE_LIMIT_GLOBAL_WINDOW_MINUTES ?? '15', 10);
+  const globalMax       = parseInt(process.env.RATE_LIMIT_GLOBAL_MAX ?? '300', 10);
+  const searchWindowMin = parseInt(process.env.RATE_LIMIT_SEARCH_WINDOW_MINUTES ?? '1', 10);
+  const searchMax       = parseInt(process.env.RATE_LIMIT_SEARCH_MAX ?? '30', 10);
+
+  app.use(rateLimit({
+    windowMs: globalWindowMin * 60_000,
+    max: globalMax,
+    standardHeaders: 'draft-8',
+    legacyHeaders: false,
+    message: { error: 'Too Many Requests' },
+  }));
+  console.log(`[gateway] Rate limit — global: ${globalMax} req/${globalWindowMin} min/IP`);
+
+  const searchLimiter = rateLimit({
+    windowMs: searchWindowMin * 60_000,
+    max: searchMax,
+    standardHeaders: 'draft-8',
+    legacyHeaders: false,
+    message: { error: 'Too Many Requests' },
+  });
+  console.log(`[gateway] Rate limit — /tools/search: ${searchMax} req/${searchWindowMin} min/IP`);
+
+  const verifier = createMcpTokenVerifier();
+  if (verifier) {
+    const bearerMw = requireBearerAuth({
+      verifier,
+      requiredScopes: ['mcp:tools'],
+      resourceMetadataUrl: `${process.env.MCP_PUBLIC_URL?.replace(/\/mcp$/, '')}/.well-known/oauth-protected-resource`,
+    });
+
+    const allowedSubs = process.env.OAUTH_ALLOWED_SUBS
+      ? new Set(process.env.OAUTH_ALLOWED_SUBS.split(',').map(s => s.trim()).filter(Boolean))
+      : null;
+
+    const subAllowListMw = allowedSubs
+      ? (req, res, next) => {
+          if (!allowedSubs.has(req.auth?.sub)) {
+            return res.status(403).json({ error: 'Forbidden' });
+          }
+          return next();
+        }
+      : null;
+
+    app.use((req, res, next) => {
+      if (req.path.startsWith('/.well-known/')) return next();
+      return bearerMw(req, res, subAllowListMw ? () => subAllowListMw(req, res, next) : next);
+    });
+    console.log('[gateway] OAuth protection enabled — required scope: mcp:tools');
+    if (allowedSubs) console.log(`[gateway] Sub allow-list active (${allowedSubs.size} entr${allowedSubs.size > 1 ? 'ies' : 'y'})`);
+  } else if (!LOCALHOST_HOSTS.has(GATEWAY_HOST)) {
+    console.error('[gateway] FATAL: OAuth is disabled but GATEWAY_HOST is not localhost.');
+    console.error(`[gateway] Refusing to expose an unauthenticated gateway on ${GATEWAY_HOST}:${GATEWAY_PORT}.`);
+    console.error('[gateway] → Set MCP_OAUTH_ENABLED=true, or set GATEWAY_HOST=127.0.0.1.');
+    process.exit(1);
+  } else {
+    console.warn('[gateway] WARNING: OAuth is disabled — gateway is open, bound to localhost only.');
+  }
+
   const dataDir = process.env.GATEWAY_DATA_DIR ?? path.join(process.cwd(), 'data');
   const dbPath = path.join(dataDir, 'embeddings', 'embeddings.db');
   initDb(dbPath);
@@ -115,7 +200,7 @@ async function main() {
     }
   }
 
-  app.get('/tools/search', async (req, res) => {
+  app.get('/tools/search', searchLimiter, async (req, res) => {
     const q = req.query.q?.trim();
     const limit = Math.min(parseInt(req.query.limit ?? '5', 10), 20);
     if (!q) return res.status(400).json({ error: 'Missing query parameter: q' });
@@ -168,8 +253,13 @@ async function main() {
 
   registerMcpEndpoint(app, { clients, registry });
 
-  app.listen(GATEWAY_PORT, () => {
-    console.log(`[gateway] Listening on http://localhost:${GATEWAY_PORT}`);
+  const httpServer = app.listen(GATEWAY_PORT, GATEWAY_HOST, () => {
+    console.log(`[gateway] Listening on http://${GATEWAY_HOST}:${GATEWAY_PORT}`);
+  });
+
+  httpServer.on('error', (err) => {
+    console.error('[gateway] HTTP server error:', err.message);
+    process.exit(1);
   });
 
   const shutdown = async () => {