@iris-eval/mcp-server 0.4.4 → 0.4.5

package/dist/preferences.d.ts

@@ -1,108 +1,58 @@
 import { z } from 'zod';
 declare const MomentFiltersSchema: z.ZodObject<{
     agentName: z.ZodOptional<z.ZodString>;
-    verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-    significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-}, "strict", z.ZodTypeAny, {
-    verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-    agentName?: string | undefined;
-    significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-}, {
-    verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-    agentName?: string | undefined;
-    significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-}>;
-export declare const PreferencesSchema: z.ZodObject<{
-    autoLaunch: z.ZodDefault<z.ZodBoolean>;
-    firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
-    momentFilters: z.ZodDefault<z.ZodObject<{
-        agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+    verdict: z.ZodOptional<z.ZodEnum<{
+        pass: "pass";
+        fail: "fail";
+        partial: "partial";
+        unevaluated: "unevaluated";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
-    sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
-    notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    autoLaunch: z.ZodDefault<z.ZodBoolean>;
-    firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
-    momentFilters: z.ZodDefault<z.ZodObject<{
-        agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+    significanceKind: z.ZodOptional<z.ZodEnum<{
+        "safety-violation": "safety-violation";
+        "cost-spike": "cost-spike";
+        "first-failure": "first-failure";
+        "novel-pattern": "novel-pattern";
+        "rule-collision": "rule-collision";
+        "normal-pass": "normal-pass";
+        "normal-fail": "normal-fail";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
-    sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
-    notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+}, z.core.$strict>;
+export declare const PreferencesSchema: z.ZodObject<{
     autoLaunch: z.ZodDefault<z.ZodBoolean>;
     firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
+    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    theme: z.ZodDefault<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+        system: "system";
+    }>>;
     momentFilters: z.ZodDefault<z.ZodObject<{
         agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+        verdict: z.ZodOptional<z.ZodEnum<{
+            pass: "pass";
+            fail: "fail";
+            partial: "partial";
+            unevaluated: "unevaluated";
+        }>>;
+        significanceKind: z.ZodOptional<z.ZodEnum<{
+            "safety-violation": "safety-violation";
+            "cost-spike": "cost-spike";
+            "first-failure": "first-failure";
+            "novel-pattern": "novel-pattern";
+            "rule-collision": "rule-collision";
+            "normal-pass": "normal-pass";
+            "normal-fail": "normal-fail";
+        }>>;
+    }, z.core.$strict>>;
+    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    density: z.ZodDefault<z.ZodEnum<{
+        compact: "compact";
+        comfortable: "comfortable";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
     sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
     notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">>;
+}, z.core.$loose>;
 export type Preferences = z.infer<typeof PreferencesSchema>;
 export type MomentFilters = z.infer<typeof MomentFiltersSchema>;
 export interface PreferenceState {

package/dist/tools/deploy-rule.js

@@ -24,7 +24,7 @@ const CustomRuleDefinitionSchema = z.object({
         'json_schema',
         'cost_threshold',
     ]),
-    config: z.record(z.unknown()),
+    config: z.record(z.string(), z.unknown()),
     weight: z.number().optional(),
 });
 const inputSchema = {
@@ -63,7 +63,7 @@ export function registerDeployRuleTool(server, customRuleStore) {
             '',
             "Don't use to VALIDATE a rule before committing — deploy writes immediately. Use the dashboard's preview endpoint (POST /api/v1/rules/custom/preview) for dry-run validation against sample output. Don't use to EDIT an existing rule — this call only creates; edits require a dedicated flow (coming in v0.5). To update a rule today: delete_rule then deploy_rule with the new definition.",
             '',
-            'Parameters. name is 1-120 chars (Zod-enforced min/max); appears in eval_result rule_results so make it human-readable. description is optional, max 500 chars (used in dashboard tooltips). evalType determines WHEN the rule fires (must match the eval_type your evaluate_output calls use; e.g., a "completeness" rule fires on every evaluate_output where eval_type="completeness" OR eval_type="custom"). severity affects dashboard sort + audit log signal but does NOT affect scoring (scoring uses the rule\'s weight). definition.type and definition.config must match (e.g., regex_match needs config.pattern; cost_threshold needs config.max_usd; min_length needs config.min). sourceMomentId is optional but recommended (preserves workflow-inversion provenance from Make-This-A-Rule composer). Defaults: severity="medium".',
+            'Parameters. name is 1-120 chars (Zod-enforced min/max); appears in eval_result rule_results so make it human-readable. description is optional, max 500 chars (used in dashboard tooltips). evalType determines WHEN the rule fires (must match the eval_type your evaluate_output calls use; e.g., a "completeness" rule fires on every evaluate_output where eval_type="completeness" OR eval_type="custom"). severity affects dashboard sort + audit log signal but does NOT affect scoring (scoring uses the rule\'s weight). definition.type and definition.config must match (e.g., regex_match needs config.pattern; cost_threshold needs config.max_cost; min_length needs config.min_length; max_length needs config.max_length; contains_keywords/excludes_keywords need config.keywords). Invalid configs are now REJECTED at deploy time with the offending field named, instead of deploying and then failing every evaluation. sourceMomentId is optional but recommended (preserves workflow-inversion provenance from Make-This-A-Rule composer). Defaults: severity="medium".',
             '',
             "Error modes. Throws 400 on invalid definition (Zod rejects — e.g., regex that fails safe-regex2 ReDoS check, or length > 1000 chars). Throws 400 on empty `name`. Throws 400 if the eval category mismatches the definition type. Returns 429 when HTTP rate limit exceeded. File-write failures (disk full, read-only fs) propagate as 500; the audit log is best-effort and does not block deploy.",
         ].join('\n'),

package/dist/tools/evaluate-output.js

@@ -6,7 +6,7 @@ const CustomRuleSchema = z.object({
         'regex_match', 'regex_no_match', 'min_length', 'max_length',
         'contains_keywords', 'excludes_keywords', 'json_schema', 'cost_threshold',
     ]),
-    config: z.record(z.unknown()),
+    config: z.record(z.string(), z.unknown()),
     weight: z.number().optional(),
 });
 const inputSchema = {

package/dist/tools/log-trace.js

@@ -18,11 +18,11 @@ const SpanSchema = z.object({
     status_message: z.string().optional(),
     start_time: z.string(),
     end_time: z.string().optional(),
-    attributes: z.record(z.unknown()).optional(),
+    attributes: z.record(z.string(), z.unknown()).optional(),
     events: z.array(z.object({
         name: z.string(),
         timestamp: z.string(),
-        attributes: z.record(z.unknown()).optional(),
+        attributes: z.record(z.string(), z.unknown()).optional(),
     })).optional(),
 });
 const TokenUsageSchema = z.object({
@@ -39,7 +39,7 @@ const inputSchema = {
     latency_ms: z.number().optional().describe('Total execution time in milliseconds (end-to-end agent latency)'),
     token_usage: TokenUsageSchema.optional().describe('Token usage breakdown (prompt/completion/total — used for cost analysis)'),
     cost_usd: z.number().optional().describe('Total cost in USD — overrides per-span aggregation when provided (treated as authoritative)'),
-    metadata: z.record(z.unknown()).optional().describe('Opaque key-value tags (e.g. {requestId, userId, env}) — queryable in dashboard, not via get_traces filters'),
+    metadata: z.record(z.string(), z.unknown()).optional().describe('Opaque key-value tags (e.g. {requestId, userId, env}) — queryable in dashboard, not via get_traces filters'),
     spans: z.array(SpanSchema).optional().describe('Detailed execution spans (hierarchical span tree with timings, attributes, events)'),
     timestamp: z.string().optional().describe('Trace timestamp (ISO 8601); defaults to now() when omitted'),
 };

package/dist/transport/http.js

@@ -23,7 +23,74 @@ export async function createHttpTransport(mcpServer, config, logger) {
     });
     // Authentication
     app.use(createAuthMiddleware(config));
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => crypto.randomUUID() });
+    /*
+     * DNS-rebinding protection (MCP spec: servers MUST validate Origin on
+     * HTTP transports; when local, SHOULD bind loopback).
+     *
+     * iris bound loopback but validated nothing, and `security.apiKey` is
+     * undefined by default — so `createAuthMiddleware` is a pass-through. A
+     * default `--transport http` server was therefore reachable from any web
+     * page the operator visited: the page resolves an attacker-controlled
+     * hostname to 127.0.0.1, the browser treats it as same-origin, and the
+     * request carries no credentials to be missing. That exposes traces and
+     * eval history and allows rule deployment.
+     *
+     * Origin validation is the fix, and it is safe to switch on by default
+     * because the SDK only rejects when an Origin header is PRESENT (see
+     * validateRequestHeaders). Real MCP clients — Claude Desktop, Cursor, the
+     * CLI — send none, so they are unaffected; browsers always do.
+     *
+     * Host validation is applied only when bound to loopback. Binding
+     * elsewhere is a deliberate network deployment that usually sits behind a
+     * proxy rewriting Host, and an exact-match list would break it — the case
+     * where the operator has already taken ownership of the boundary.
+     */
+    const isLoopbackBind = config.transport.host === '127.0.0.1' ||
+        config.transport.host === 'localhost' ||
+        config.transport.host === '::1';
+    /*
+     * Bind FIRST, then build the allowlists from the port actually bound.
+     * `config.transport.port` is 0 when the caller wants an ephemeral port
+     * (tests and embedders do this), and the OS then picks something else —
+     * so allowlists derived from the configured value would contain
+     * `127.0.0.1:0` and reject every real request with a 403 that looks
+     * exactly like an attack. Routes are registered immediately after, and
+     * the port is not discoverable by any client until this function returns.
+     */
+    const httpServer = await new Promise((resolve) => {
+        const server = app.listen(config.transport.port, config.transport.host, () => resolve(server));
+    });
+    const address = httpServer.address();
+    const port = typeof address === 'object' && address ? address.port : config.transport.port;
+    const loopbackOrigins = [
+        `http://127.0.0.1:${port}`,
+        `http://localhost:${port}`,
+        `http://[::1]:${port}`,
+    ];
+    /*
+     * The SDK matches origins EXACTLY (`allowedOrigins.includes(origin)`),
+     * while iris's own CORS allowlist accepts glob patterns like the shipped
+     * default `http://localhost:*`. A pattern entry can never match here, so
+     * it is dropped rather than passed through to sit in the list looking
+     * effective. The concrete loopback origins added above already express
+     * what `http://localhost:*` means for this server's port.
+     *
+     * Note this rejection is what actually stops the attack. Emitting CORS
+     * headers would not: the browser only withholds the RESPONSE, after the
+     * server has already executed the request — so a rebound page could still
+     * deploy rules or delete traces and simply not read the reply.
+     */
+    const configuredOrigins = (config.security.allowedOrigins ?? []).filter((origin) => !origin.includes('*'));
+    const allowedOrigins = [...new Set([...loopbackOrigins, ...configuredOrigins])];
+    const allowedHosts = isLoopbackBind
+        ? [`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`]
+        : undefined;
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => crypto.randomUUID(),
+        enableDnsRebindingProtection: true,
+        allowedOrigins,
+        ...(allowedHosts ? { allowedHosts } : {}),
+    });
     // Rate limiter for MCP POST/DELETE (not GET — SSE streaming)
     const mcpLimiter = createMcpRateLimiter(config);
     app.post('/mcp', mcpLimiter, async (req, res) => {
@@ -37,8 +104,5 @@ export async function createHttpTransport(mcpServer, config, logger) {
     });
     // Error handler (must be last)
     app.use(createErrorHandler(logger));
-    const httpServer = await new Promise((resolve) => {
-        const server = app.listen(config.transport.port, config.transport.host, () => resolve(server));
-    });
     return { transport, httpServer };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iris-eval/mcp-server",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "The agent eval standard for MCP. Score every agent output for quality, safety, and cost.",
   "mcpName": "io.github.iris-eval/mcp-server",
   "type": "module",
@@ -76,27 +76,32 @@
     "node": ">=20.0.0"
   },
   "overrides": {
-    "fast-uri": "^3.1.2"
+    "brace-expansion": "^5.0.7",
+    "fast-uri": "^3.1.5",
+    "ip-address": "^10.4.0",
+    "postcss": "^8.5.25",
+    "@hono/node-server": "^2.1.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "better-sqlite3": "^12.8.0",
     "express": "^5.1.0",
     "express-rate-limit": "^8.3.2",
     "helmet": "^8.1.0",
     "pino": "^10.3.1",
     "safe-regex2": "^5.1.0",
-    "zod": "^3.25.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@playwright/test": "^1.59.1",
     "@types/better-sqlite3": "^7.6.0",
     "@types/express": "^5.0.0",
-    "@types/node": "^25.5.2",
+    "@types/node": "^26.1.1",
     "@typescript-eslint/eslint-plugin": "^8.58.0",
     "@typescript-eslint/parser": "^8.58.0",
     "@vitest/coverage-v8": "^4.1.1",
     "eslint": "^10.2.0",
+    "fast-check": "^4.8.0",
     "prettier": "^3.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.7.0",

package/server.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/iris-eval/mcp-server",
     "source": "github"
   },
-  "version": "0.4.4",
+  "version": "0.4.5",
   "packages": [
     {
       "registryType": "npm",