@iris-eval/mcp-server 0.4.3-rc.0 → 0.4.5

package/dist/eval/rules/custom.js

@@ -1,7 +1,30 @@
 import isSafeRegex from 'safe-regex2';
+import { readNumericConfig, describeKeys } from './config-keys.js';
 const MAX_PATTERN_LENGTH = 1000;
+// A rule whose CONFIG is invalid has not evaluated the output — it could not
+// run at all. Returning `passed:false, score:0` for that case conflates "your
+// agent produced bad output" with "this rule is broken", and because the
+// engine weights every non-skipped result, one misconfigured rule silently
+// deflates every eval score for as long as it stays deployed (and gives no
+// hint which of the two happened). Mark it skipped: the engine already
+// excludes skipped rules from the weighted average and surfaces skipReason,
+// the same contract `expected_coverage` uses when no expected output exists.
+//
+// Deploy-time validation in custom-rule-store.ts now rejects these configs
+// outright; this path remains the safety net for rules already persisted in
+// a user's ~/.iris/custom-rules.json from before that validation existed.
+function configError(definition, message) {
+    return {
+        ruleName: definition.name,
+        passed: false,
+        score: 0,
+        message,
+        skipped: true,
+        skipReason: message,
+    };
+}
 function safeRegexResult(definition, message) {
-    return { ruleName: definition.name, passed: false, score: 0, message };
+    return configError(definition, message);
 }
 function compileRegex(definition) {
     let patternStr = definition.config.pattern;
@@ -19,15 +42,21 @@ function compileRegex(definition) {
     if (patternStr.length > MAX_PATTERN_LENGTH) {
         return safeRegexResult(definition, `Regex pattern too long (${patternStr.length} > ${MAX_PATTERN_LENGTH})`);
     }
-    if (!isSafeRegex(patternStr)) {
-        return safeRegexResult(definition, 'Regex pattern rejected: potentially unsafe (catastrophic backtracking)');
-    }
+    // Syntax BEFORE safety: safe-regex2 returns false for anything it cannot
+    // parse, so checking it first reports a plainly broken pattern like `(` as
+    // "catastrophic backtracking" — sending the author hunting a performance
+    // problem they do not have instead of the typo they do.
+    let compiled;
     try {
-        return new RegExp(patternStr, flags);
+        compiled = new RegExp(patternStr, flags);
     }
     catch (e) {
         return safeRegexResult(definition, `Invalid regex syntax: ${e instanceof Error ? e.message : 'unknown error'}`);
     }
+    if (!isSafeRegex(patternStr)) {
+        return safeRegexResult(definition, 'Regex pattern rejected: potentially unsafe (catastrophic backtracking)');
+    }
+    return compiled;
 }
 export function createCustomRule(definition) {
     return {
@@ -52,17 +81,17 @@ export function createCustomRule(definition) {
                     return { ruleName: definition.name, passed, score: passed ? 1 : 0, message: passed ? 'Forbidden pattern not found' : 'Forbidden pattern found in output' };
                 }
                 case 'min_length': {
-                    const min = (definition.config.min_length ?? definition.config.length);
+                    const min = readNumericConfig(definition.config, 'min_length');
                     if (min == null || min <= 0) {
-                        return { ruleName: definition.name, passed: false, score: 0, message: 'min_length rule requires config.min_length (positive number)' };
+                        return configError(definition, `min_length rule requires ${describeKeys('min_length')} (positive number)`);
                     }
                     const passed = context.output.length >= min;
                     return { ruleName: definition.name, passed, score: passed ? 1 : context.output.length / min, message: passed ? `Length (${context.output.length}) meets minimum (${min})` : `Length (${context.output.length}) below minimum (${min})` };
                 }
                 case 'max_length': {
-                    const max = (definition.config.max_length ?? definition.config.length);
+                    const max = readNumericConfig(definition.config, 'max_length');
                     if (max == null || max <= 0) {
-                        return { ruleName: definition.name, passed: false, score: 0, message: 'max_length rule requires config.max_length (positive number)' };
+                        return configError(definition, `max_length rule requires ${describeKeys('max_length')} (positive number)`);
                     }
                     const passed = context.output.length <= max;
                     return { ruleName: definition.name, passed, score: passed ? 1 : max / context.output.length, message: passed ? `Length (${context.output.length}) within maximum (${max})` : `Length (${context.output.length}) exceeds maximum (${max})` };
@@ -70,7 +99,7 @@ export function createCustomRule(definition) {
                 case 'contains_keywords': {
                     const keywords = definition.config.keywords;
                     if (!keywords || !Array.isArray(keywords) || keywords.length === 0) {
-                        return { ruleName: definition.name, passed: false, score: 0, message: 'contains_keywords rule requires config.keywords (non-empty string array)' };
+                        return configError(definition, 'contains_keywords rule requires config.keywords (non-empty string array)');
                     }
                     const lower = context.output.toLowerCase();
                     const found = keywords.filter((k) => lower.includes(k.toLowerCase()));
@@ -81,7 +110,7 @@ export function createCustomRule(definition) {
                 case 'excludes_keywords': {
                     const keywords = definition.config.keywords;
                     if (!keywords || !Array.isArray(keywords) || keywords.length === 0) {
-                        return { ruleName: definition.name, passed: false, score: 0, message: 'excludes_keywords rule requires config.keywords (non-empty string array)' };
+                        return configError(definition, 'excludes_keywords rule requires config.keywords (non-empty string array)');
                     }
                     const lower = context.output.toLowerCase();
                     const found = keywords.filter((k) => lower.includes(k.toLowerCase()));
@@ -98,16 +127,16 @@ export function createCustomRule(definition) {
                     }
                 }
                 case 'cost_threshold': {
-                    const max = definition.config.max_cost;
+                    const max = readNumericConfig(definition.config, 'cost_threshold');
                     if (max == null || max < 0) {
-                        return { ruleName: definition.name, passed: false, score: 0, message: 'cost_threshold rule requires config.max_cost (non-negative number)' };
+                        return configError(definition, `cost_threshold rule requires ${describeKeys('cost_threshold')} (non-negative number)`);
                     }
                     const cost = context.costUsd ?? 0;
                     const passed = cost <= max;
                     return { ruleName: definition.name, passed, score: passed ? 1 : 0, message: passed ? `Cost ($${cost}) within threshold ($${max})` : `Cost ($${cost}) exceeds threshold ($${max})` };
                 }
                 default:
-                    return { ruleName: definition.name, passed: false, score: 0, message: `Unknown rule type: ${definition.type}` };
+                    return configError(definition, `Unknown rule type: ${definition.type}`);
             }
         },
     };

package/dist/eval/rules/relevance.d.ts

@@ -1,5 +1,6 @@
 import type { EvalRule } from '../../types/eval.js';
 export declare const keywordOverlap: EvalRule;
+export declare const HALLUCINATION_MARKERS: string[];
 export declare const noHallucinationMarkers: EvalRule;
 export declare const topicConsistency: EvalRule;
 export declare const relevanceRules: EvalRule[];

package/dist/eval/rules/relevance.js

@@ -28,7 +28,9 @@ export const keywordOverlap = {
         };
     },
 };
-const HALLUCINATION_MARKERS = [
+// Exported so the claims drift test can assert .claims.json counts against
+// the runtime truth (tests/claims-eval-rules-counts.test.ts).
+export const HALLUCINATION_MARKERS = [
     'as an ai',
     'as a language model',
     'i cannot',

package/dist/eval/rules/safety.d.ts

@@ -1,6 +1,11 @@
 import type { EvalRule } from '../../types/eval.js';
+export declare const PII_PATTERNS: Array<{
+    name: string;
+    pattern: RegExp;
+}>;
 export declare const noPii: EvalRule;
 export declare const noBlocklistWords: EvalRule;
+export declare const INJECTION_PATTERNS: RegExp[];
 export declare const noInjectionPatterns: EvalRule;
 export declare const noStubOutput: EvalRule;
 export declare const safetyRules: EvalRule[];

package/dist/eval/rules/safety.js

@@ -5,7 +5,9 @@
  * patterns evaluate. Word-boundary anchors avoid matching inside larger
  * strings where appropriate.
  */
-const PII_PATTERNS = [
+// Exported so the claims drift test can assert .claims.json counts against
+// the runtime truth (tests/claims-eval-rules-counts.test.ts).
+export const PII_PATTERNS = [
     // Original v0.3.0 patterns
     { name: 'SSN', pattern: /\b\d{3}-\d{2}-\d{4}\b/ },
     { name: 'Credit Card', pattern: /\b(?:\d{4}[-\s]?){3}\d{4}\b/ },
@@ -79,7 +81,7 @@ export const noBlocklistWords = {
  * leaks, or role-override acknowledgments). Input-side detection is the
  * agent host's job; output-side is Iris's.
  */
-const INJECTION_PATTERNS = [
+export const INJECTION_PATTERNS = [
     // Original v0.3.0 patterns
     /ignore (?:all )?(?:previous|above|prior) (?:instructions|prompts)/i,
     /you are now (?:a |in )/i,

package/dist/index.js

@@ -85,7 +85,9 @@ Environment variables (CLI flags take precedence):
   IRIS_DASHBOARD                       true to enable web dashboard
   IRIS_DASHBOARD_PORT                  Dashboard port (1-65535, default: 6920)
   IRIS_API_KEY                         API key for HTTP authentication
-  IRIS_ALLOWED_ORIGINS                 Comma-separated CORS origin allowlist
+  IRIS_ALLOWED_ORIGINS                 Comma-separated origin allowlist. Dashboard: CORS headers (supports globs, e.g. http://localhost:*).
+                                       HTTP transport: exact-match Origin allowlist for DNS-rebinding protection (globs ignored;
+                                       this server's own loopback origins are always allowed).
   IRIS_NO_AUTO_LAUNCH                  Set to 1 to disable first-run dashboard auto-launch
   IRIS_ANTHROPIC_API_KEY               Required by evaluate_with_llm_judge + verify_citations (provider=anthropic)
   IRIS_OPENAI_API_KEY                  Required by evaluate_with_llm_judge + verify_citations (provider=openai)

package/dist/middleware/error-handler.js

@@ -9,7 +9,25 @@ export function createErrorHandler(logger) {
             return;
         }
         const status = err.status ?? err.statusCode ?? 500;
-        const message = status >= 500 ? 'Internal server error' : (err.message ?? 'Unknown error');
+        /*
+         * Never echo a Node system error to the client. Their messages embed
+         * absolute paths — an ENOENT from res.sendFile returned
+         *   "ENOENT: no such file or directory, stat 'C:\...\dist\dashboard\index.html'"
+         * with a 404, disclosing the install path and OS user to anyone who
+         * could reach the dashboard (CWE-209). 5xx was already masked; the leak
+         * was in the 4xx branch, where echoing err.message is otherwise useful
+         * (body-parser's "request entity too large", Zod messages, etc.).
+         *
+         * Identify system errors by the shape Node gives them — a string `code`
+         * plus `syscall` — rather than by matching path-ish text, which would
+         * miss cases and mangle legitimate messages.
+         */
+        const isSystemError = typeof err?.code === 'string' && typeof err?.syscall === 'string';
+        const message = status >= 500 || isSystemError
+            ? status >= 500
+                ? 'Internal server error'
+                : 'Not found'
+            : (err.message ?? 'Unknown error');
         logger.error(`Request error: ${err.message}`, { status, stack: err.stack });
         res.status(status).json({
             error: message,

package/dist/otel/mapper.js

@@ -9,6 +9,7 @@
 //
 // We intentionally do not depend on @opentelemetry/* — the exporter
 // serializes these plain objects, and the payload shape is the OTLP spec.
+import { PKG_VERSION } from '../config/defaults.js';
 // OTel SpanKind enum values (from opentelemetry-proto/trace/v1/trace.proto).
 const KIND_MAP = {
     INTERNAL: 1,
@@ -145,7 +146,7 @@ export function buildExportPayload(traces, serviceName) {
             { key: 'service.name', value: { stringValue: serviceName } },
             { key: 'telemetry.sdk.name', value: { stringValue: 'iris-mcp' } },
             { key: 'telemetry.sdk.language', value: { stringValue: 'nodejs' } },
-            { key: 'telemetry.sdk.version', value: { stringValue: '0.4.0' } },
+            { key: 'telemetry.sdk.version', value: { stringValue: PKG_VERSION } },
         ],
     };
     const spans = [];

package/dist/preferences.d.ts

@@ -1,108 +1,58 @@
 import { z } from 'zod';
 declare const MomentFiltersSchema: z.ZodObject<{
     agentName: z.ZodOptional<z.ZodString>;
-    verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-    significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-}, "strict", z.ZodTypeAny, {
-    verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-    agentName?: string | undefined;
-    significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-}, {
-    verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-    agentName?: string | undefined;
-    significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-}>;
-export declare const PreferencesSchema: z.ZodObject<{
-    autoLaunch: z.ZodDefault<z.ZodBoolean>;
-    firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
-    momentFilters: z.ZodDefault<z.ZodObject<{
-        agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+    verdict: z.ZodOptional<z.ZodEnum<{
+        pass: "pass";
+        fail: "fail";
+        partial: "partial";
+        unevaluated: "unevaluated";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
-    sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
-    notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    autoLaunch: z.ZodDefault<z.ZodBoolean>;
-    firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
-    momentFilters: z.ZodDefault<z.ZodObject<{
-        agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+    significanceKind: z.ZodOptional<z.ZodEnum<{
+        "safety-violation": "safety-violation";
+        "cost-spike": "cost-spike";
+        "first-failure": "first-failure";
+        "novel-pattern": "novel-pattern";
+        "rule-collision": "rule-collision";
+        "normal-pass": "normal-pass";
+        "normal-fail": "normal-fail";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
-    sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
-    notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+}, z.core.$strict>;
+export declare const PreferencesSchema: z.ZodObject<{
     autoLaunch: z.ZodDefault<z.ZodBoolean>;
     firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
+    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    theme: z.ZodDefault<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+        system: "system";
+    }>>;
     momentFilters: z.ZodDefault<z.ZodObject<{
         agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+        verdict: z.ZodOptional<z.ZodEnum<{
+            pass: "pass";
+            fail: "fail";
+            partial: "partial";
+            unevaluated: "unevaluated";
+        }>>;
+        significanceKind: z.ZodOptional<z.ZodEnum<{
+            "safety-violation": "safety-violation";
+            "cost-spike": "cost-spike";
+            "first-failure": "first-failure";
+            "novel-pattern": "novel-pattern";
+            "rule-collision": "rule-collision";
+            "normal-pass": "normal-pass";
+            "normal-fail": "normal-fail";
+        }>>;
+    }, z.core.$strict>>;
+    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    density: z.ZodDefault<z.ZodEnum<{
+        compact: "compact";
+        comfortable: "comfortable";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
     sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
     notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">>;
+}, z.core.$loose>;
 export type Preferences = z.infer<typeof PreferencesSchema>;
 export type MomentFilters = z.infer<typeof MomentFiltersSchema>;
 export interface PreferenceState {

package/dist/tools/deploy-rule.js

@@ -24,7 +24,7 @@ const CustomRuleDefinitionSchema = z.object({
         'json_schema',
         'cost_threshold',
     ]),
-    config: z.record(z.unknown()),
+    config: z.record(z.string(), z.unknown()),
     weight: z.number().optional(),
 });
 const inputSchema = {
@@ -63,7 +63,7 @@ export function registerDeployRuleTool(server, customRuleStore) {
             '',
             "Don't use to VALIDATE a rule before committing — deploy writes immediately. Use the dashboard's preview endpoint (POST /api/v1/rules/custom/preview) for dry-run validation against sample output. Don't use to EDIT an existing rule — this call only creates; edits require a dedicated flow (coming in v0.5). To update a rule today: delete_rule then deploy_rule with the new definition.",
             '',
-            'Parameters. name is 1-120 chars (Zod-enforced min/max); appears in eval_result rule_results so make it human-readable. description is optional, max 500 chars (used in dashboard tooltips). evalType determines WHEN the rule fires (must match the eval_type your evaluate_output calls use; e.g., a "completeness" rule fires on every evaluate_output where eval_type="completeness" OR eval_type="custom"). severity affects dashboard sort + audit log signal but does NOT affect scoring (scoring uses the rule\'s weight). definition.type and definition.config must match (e.g., regex_match needs config.pattern; cost_threshold needs config.max_usd; min_length needs config.min). sourceMomentId is optional but recommended (preserves workflow-inversion provenance from Make-This-A-Rule composer). Defaults: severity="medium".',
+            'Parameters. name is 1-120 chars (Zod-enforced min/max); appears in eval_result rule_results so make it human-readable. description is optional, max 500 chars (used in dashboard tooltips). evalType determines WHEN the rule fires (must match the eval_type your evaluate_output calls use; e.g., a "completeness" rule fires on every evaluate_output where eval_type="completeness" OR eval_type="custom"). severity affects dashboard sort + audit log signal but does NOT affect scoring (scoring uses the rule\'s weight). definition.type and definition.config must match (e.g., regex_match needs config.pattern; cost_threshold needs config.max_cost; min_length needs config.min_length; max_length needs config.max_length; contains_keywords/excludes_keywords need config.keywords). Invalid configs are now REJECTED at deploy time with the offending field named, instead of deploying and then failing every evaluation. sourceMomentId is optional but recommended (preserves workflow-inversion provenance from Make-This-A-Rule composer). Defaults: severity="medium".',
             '',
             "Error modes. Throws 400 on invalid definition (Zod rejects — e.g., regex that fails safe-regex2 ReDoS check, or length > 1000 chars). Throws 400 on empty `name`. Throws 400 if the eval category mismatches the definition type. Returns 429 when HTTP rate limit exceeded. File-write failures (disk full, read-only fs) propagate as 500; the audit log is best-effort and does not block deploy.",
         ].join('\n'),

package/dist/tools/evaluate-output.js

@@ -6,7 +6,7 @@ const CustomRuleSchema = z.object({
         'regex_match', 'regex_no_match', 'min_length', 'max_length',
         'contains_keywords', 'excludes_keywords', 'json_schema', 'cost_threshold',
     ]),
-    config: z.record(z.unknown()),
+    config: z.record(z.string(), z.unknown()),
     weight: z.number().optional(),
 });
 const inputSchema = {

package/dist/tools/log-trace.js

@@ -18,11 +18,11 @@ const SpanSchema = z.object({
     status_message: z.string().optional(),
     start_time: z.string(),
     end_time: z.string().optional(),
-    attributes: z.record(z.unknown()).optional(),
+    attributes: z.record(z.string(), z.unknown()).optional(),
     events: z.array(z.object({
         name: z.string(),
         timestamp: z.string(),
-        attributes: z.record(z.unknown()).optional(),
+        attributes: z.record(z.string(), z.unknown()).optional(),
     })).optional(),
 });
 const TokenUsageSchema = z.object({
@@ -39,7 +39,7 @@ const inputSchema = {
     latency_ms: z.number().optional().describe('Total execution time in milliseconds (end-to-end agent latency)'),
     token_usage: TokenUsageSchema.optional().describe('Token usage breakdown (prompt/completion/total — used for cost analysis)'),
     cost_usd: z.number().optional().describe('Total cost in USD — overrides per-span aggregation when provided (treated as authoritative)'),
-    metadata: z.record(z.unknown()).optional().describe('Opaque key-value tags (e.g. {requestId, userId, env}) — queryable in dashboard, not via get_traces filters'),
+    metadata: z.record(z.string(), z.unknown()).optional().describe('Opaque key-value tags (e.g. {requestId, userId, env}) — queryable in dashboard, not via get_traces filters'),
     spans: z.array(SpanSchema).optional().describe('Detailed execution spans (hierarchical span tree with timings, attributes, events)'),
     timestamp: z.string().optional().describe('Trace timestamp (ISO 8601); defaults to now() when omitted'),
 };

package/dist/transport/http.js

@@ -23,7 +23,74 @@ export async function createHttpTransport(mcpServer, config, logger) {
     });
     // Authentication
     app.use(createAuthMiddleware(config));
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => crypto.randomUUID() });
+    /*
+     * DNS-rebinding protection (MCP spec: servers MUST validate Origin on
+     * HTTP transports; when local, SHOULD bind loopback).
+     *
+     * iris bound loopback but validated nothing, and `security.apiKey` is
+     * undefined by default — so `createAuthMiddleware` is a pass-through. A
+     * default `--transport http` server was therefore reachable from any web
+     * page the operator visited: the page resolves an attacker-controlled
+     * hostname to 127.0.0.1, the browser treats it as same-origin, and the
+     * request carries no credentials to be missing. That exposes traces and
+     * eval history and allows rule deployment.
+     *
+     * Origin validation is the fix, and it is safe to switch on by default
+     * because the SDK only rejects when an Origin header is PRESENT (see
+     * validateRequestHeaders). Real MCP clients — Claude Desktop, Cursor, the
+     * CLI — send none, so they are unaffected; browsers always do.
+     *
+     * Host validation is applied only when bound to loopback. Binding
+     * elsewhere is a deliberate network deployment that usually sits behind a
+     * proxy rewriting Host, and an exact-match list would break it — the case
+     * where the operator has already taken ownership of the boundary.
+     */
+    const isLoopbackBind = config.transport.host === '127.0.0.1' ||
+        config.transport.host === 'localhost' ||
+        config.transport.host === '::1';
+    /*
+     * Bind FIRST, then build the allowlists from the port actually bound.
+     * `config.transport.port` is 0 when the caller wants an ephemeral port
+     * (tests and embedders do this), and the OS then picks something else —
+     * so allowlists derived from the configured value would contain
+     * `127.0.0.1:0` and reject every real request with a 403 that looks
+     * exactly like an attack. Routes are registered immediately after, and
+     * the port is not discoverable by any client until this function returns.
+     */
+    const httpServer = await new Promise((resolve) => {
+        const server = app.listen(config.transport.port, config.transport.host, () => resolve(server));
+    });
+    const address = httpServer.address();
+    const port = typeof address === 'object' && address ? address.port : config.transport.port;
+    const loopbackOrigins = [
+        `http://127.0.0.1:${port}`,
+        `http://localhost:${port}`,
+        `http://[::1]:${port}`,
+    ];
+    /*
+     * The SDK matches origins EXACTLY (`allowedOrigins.includes(origin)`),
+     * while iris's own CORS allowlist accepts glob patterns like the shipped
+     * default `http://localhost:*`. A pattern entry can never match here, so
+     * it is dropped rather than passed through to sit in the list looking
+     * effective. The concrete loopback origins added above already express
+     * what `http://localhost:*` means for this server's port.
+     *
+     * Note this rejection is what actually stops the attack. Emitting CORS
+     * headers would not: the browser only withholds the RESPONSE, after the
+     * server has already executed the request — so a rebound page could still
+     * deploy rules or delete traces and simply not read the reply.
+     */
+    const configuredOrigins = (config.security.allowedOrigins ?? []).filter((origin) => !origin.includes('*'));
+    const allowedOrigins = [...new Set([...loopbackOrigins, ...configuredOrigins])];
+    const allowedHosts = isLoopbackBind
+        ? [`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`]
+        : undefined;
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => crypto.randomUUID(),
+        enableDnsRebindingProtection: true,
+        allowedOrigins,
+        ...(allowedHosts ? { allowedHosts } : {}),
+    });
     // Rate limiter for MCP POST/DELETE (not GET — SSE streaming)
     const mcpLimiter = createMcpRateLimiter(config);
     app.post('/mcp', mcpLimiter, async (req, res) => {
@@ -37,8 +104,5 @@ export async function createHttpTransport(mcpServer, config, logger) {
     });
     // Error handler (must be last)
     app.use(createErrorHandler(logger));
-    const httpServer = await new Promise((resolve) => {
-        const server = app.listen(config.transport.port, config.transport.host, () => resolve(server));
-    });
     return { transport, httpServer };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iris-eval/mcp-server",
-  "version": "0.4.3-rc.0",
+  "version": "0.4.5",
   "description": "The agent eval standard for MCP. Score every agent output for quality, safety, and cost.",
   "mcpName": "io.github.iris-eval/mcp-server",
   "type": "module",
@@ -76,27 +76,32 @@
     "node": ">=20.0.0"
   },
   "overrides": {
-    "fast-uri": "^3.1.2"
+    "brace-expansion": "^5.0.7",
+    "fast-uri": "^3.1.5",
+    "ip-address": "^10.4.0",
+    "postcss": "^8.5.25",
+    "@hono/node-server": "^2.1.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "better-sqlite3": "^12.8.0",
     "express": "^5.1.0",
     "express-rate-limit": "^8.3.2",
     "helmet": "^8.1.0",
     "pino": "^10.3.1",
     "safe-regex2": "^5.1.0",
-    "zod": "^3.25.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@playwright/test": "^1.59.1",
     "@types/better-sqlite3": "^7.6.0",
     "@types/express": "^5.0.0",
-    "@types/node": "^25.5.2",
+    "@types/node": "^26.1.1",
     "@typescript-eslint/eslint-plugin": "^8.58.0",
     "@typescript-eslint/parser": "^8.58.0",
     "@vitest/coverage-v8": "^4.1.1",
     "eslint": "^10.2.0",
+    "fast-check": "^4.8.0",
     "prettier": "^3.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.7.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/iris-eval/mcp-server",
     "source": "github"
   },
-  "version": "0.4.3-rc.0",
+  "version": "0.4.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@iris-eval/mcp-server",
-      "version": "0.4.3-rc.0",
+      "version": "0.4.4",
       "transport": {
         "type": "stdio"
       },