@iris-eval/mcp-server 0.4.4 → 0.4.6

package/dist/transport/http.js

@@ -23,7 +23,74 @@ export async function createHttpTransport(mcpServer, config, logger) {
     });
     // Authentication
     app.use(createAuthMiddleware(config));
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => crypto.randomUUID() });
+    /*
+     * DNS-rebinding protection (MCP spec: servers MUST validate Origin on
+     * HTTP transports; when local, SHOULD bind loopback).
+     *
+     * iris bound loopback but validated nothing, and `security.apiKey` is
+     * undefined by default — so `createAuthMiddleware` is a pass-through. A
+     * default `--transport http` server was therefore reachable from any web
+     * page the operator visited: the page resolves an attacker-controlled
+     * hostname to 127.0.0.1, the browser treats it as same-origin, and the
+     * request carries no credentials to be missing. That exposes traces and
+     * eval history and allows rule deployment.
+     *
+     * Origin validation is the fix, and it is safe to switch on by default
+     * because the SDK only rejects when an Origin header is PRESENT (see
+     * validateRequestHeaders). Real MCP clients — Claude Desktop, Cursor, the
+     * CLI — send none, so they are unaffected; browsers always do.
+     *
+     * Host validation is applied only when bound to loopback. Binding
+     * elsewhere is a deliberate network deployment that usually sits behind a
+     * proxy rewriting Host, and an exact-match list would break it — the case
+     * where the operator has already taken ownership of the boundary.
+     */
+    const isLoopbackBind = config.transport.host === '127.0.0.1' ||
+        config.transport.host === 'localhost' ||
+        config.transport.host === '::1';
+    /*
+     * Bind FIRST, then build the allowlists from the port actually bound.
+     * `config.transport.port` is 0 when the caller wants an ephemeral port
+     * (tests and embedders do this), and the OS then picks something else —
+     * so allowlists derived from the configured value would contain
+     * `127.0.0.1:0` and reject every real request with a 403 that looks
+     * exactly like an attack. Routes are registered immediately after, and
+     * the port is not discoverable by any client until this function returns.
+     */
+    const httpServer = await new Promise((resolve) => {
+        const server = app.listen(config.transport.port, config.transport.host, () => resolve(server));
+    });
+    const address = httpServer.address();
+    const port = typeof address === 'object' && address ? address.port : config.transport.port;
+    const loopbackOrigins = [
+        `http://127.0.0.1:${port}`,
+        `http://localhost:${port}`,
+        `http://[::1]:${port}`,
+    ];
+    /*
+     * The SDK matches origins EXACTLY (`allowedOrigins.includes(origin)`),
+     * while iris's own CORS allowlist accepts glob patterns like the shipped
+     * default `http://localhost:*`. A pattern entry can never match here, so
+     * it is dropped rather than passed through to sit in the list looking
+     * effective. The concrete loopback origins added above already express
+     * what `http://localhost:*` means for this server's port.
+     *
+     * Note this rejection is what actually stops the attack. Emitting CORS
+     * headers would not: the browser only withholds the RESPONSE, after the
+     * server has already executed the request — so a rebound page could still
+     * deploy rules or delete traces and simply not read the reply.
+     */
+    const configuredOrigins = (config.security.allowedOrigins ?? []).filter((origin) => !origin.includes('*'));
+    const allowedOrigins = [...new Set([...loopbackOrigins, ...configuredOrigins])];
+    const allowedHosts = isLoopbackBind
+        ? [`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`]
+        : undefined;
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => crypto.randomUUID(),
+        enableDnsRebindingProtection: true,
+        allowedOrigins,
+        ...(allowedHosts ? { allowedHosts } : {}),
+    });
     // Rate limiter for MCP POST/DELETE (not GET — SSE streaming)
     const mcpLimiter = createMcpRateLimiter(config);
     app.post('/mcp', mcpLimiter, async (req, res) => {
@@ -37,8 +104,5 @@ export async function createHttpTransport(mcpServer, config, logger) {
     });
     // Error handler (must be last)
     app.use(createErrorHandler(logger));
-    const httpServer = await new Promise((resolve) => {
-        const server = app.listen(config.transport.port, config.transport.host, () => resolve(server));
-    });
     return { transport, httpServer };
 }

package/dist/types/config.d.ts

@@ -15,6 +15,13 @@ export interface IrisConfig {
     dashboard: {
         enabled: boolean;
         port: number;
+        /**
+         * Bind address. Defaults to loopback: the dashboard is unauthenticated
+         * by default (security.apiKey is undefined) and serves the full trace
+         * history, so binding it to every interface exposes agent inputs and
+         * outputs to the local network. Set explicitly to share it.
+         */
+        host: string;
     };
     eval: {
         defaultThreshold: number;

package/dist/utils/iris-home.d.ts

@@ -0,0 +1 @@
+export declare function irisHome(): string;

package/dist/utils/iris-home.js

@@ -0,0 +1,21 @@
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/*
+ * Single resolver for the iris home directory (default: ~/.iris).
+ *
+ * Every per-user file iris touches lives under this directory — the
+ * SQLite DB default, config.json, custom-rules.json, audit.log,
+ * preferences.json. Before this helper each module joined
+ * homedir() + '.iris' itself, which meant there was no way to point a
+ * spawned server at a scratch directory: the E2E suite isolated the DB
+ * via IRIS_DB_PATH but still wiped the real audit.log, deployed test
+ * rules into the real custom-rules.json, and overwrote the real
+ * preferences.json on every run.
+ *
+ * IRIS_HOME redirects all of them at once. Read at call time — not
+ * module load — so a test harness that sets the env var before
+ * spawning (or between in-process calls) always wins.
+ */
+export function irisHome() {
+    return process.env.IRIS_HOME ?? join(homedir(), '.iris');
+}

package/dist/utils/write-atomic.d.ts

@@ -0,0 +1 @@
+export declare function writeAtomic(targetPath: string, contents: string): void;

package/dist/utils/write-atomic.js

@@ -0,0 +1,64 @@
+import { mkdirSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { randomBytes } from 'node:crypto';
+/*
+ * Atomic file write: write a temp file, then rename it over the target.
+ *
+ * This lives in one place because it was duplicated verbatim in
+ * preferences.ts and custom-rule-store.ts, and both copies carried the same
+ * two Windows bugs.
+ *
+ * 1. The temp path was `${targetPath}.tmp.${process.pid}` — keyed on the
+ *    PROCESS, not the call. Two concurrent writes to the same target inside
+ *    one process (which is exactly what a vitest file does) therefore raced
+ *    on a single temp path: one call renamed it away while the other was
+ *    still writing, and the loser got
+ *      EPERM: operation not permitted, rename '...preferences.json.tmp.38468'
+ *    Observed twice in one session, on different suites. A random suffix
+ *    makes each call's temp file its own.
+ *
+ * 2. Even with unique names, Windows can briefly deny a rename while a
+ *    virus scanner or indexer holds the file. POSIX rename() has no such
+ *    behaviour, so this never reproduces on CI. A few short retries turn a
+ *    transient lock into a small delay instead of a lost write.
+ *
+ * The retry is deliberately narrow: only the error codes Windows raises for
+ * transient sharing violations. Anything else (ENOSPC, EROFS, a bad path)
+ * still throws immediately rather than being retried into a slow failure.
+ */
+const TRANSIENT_RENAME_ERRORS = new Set(['EPERM', 'EACCES', 'EBUSY']);
+const MAX_ATTEMPTS = 5;
+function sleepSync(ms) {
+    // Synchronous by necessity — writeAtomic is sync, and making it async
+    // would ripple through every caller for a Windows-only edge case.
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+export function writeAtomic(targetPath, contents) {
+    mkdirSync(dirname(targetPath), { recursive: true });
+    const tmp = `${targetPath}.tmp.${process.pid}.${randomBytes(6).toString('hex')}`;
+    writeFileSync(tmp, contents, 'utf-8');
+    let lastError;
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+        try {
+            renameSync(tmp, targetPath);
+            return;
+        }
+        catch (err) {
+            lastError = err;
+            const code = err?.code;
+            if (!code || !TRANSIENT_RENAME_ERRORS.has(code))
+                break;
+            sleepSync(10 * (attempt + 1));
+        }
+    }
+    // Don't leave the temp file behind on a genuine failure — a stray
+    // `preferences.json.tmp.1234.ab12cd` next to the real file is confusing
+    // and never cleaned up otherwise.
+    try {
+        unlinkSync(tmp);
+    }
+    catch {
+        // Best effort; the original error is the one worth reporting.
+    }
+    throw lastError;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iris-eval/mcp-server",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "The agent eval standard for MCP. Score every agent output for quality, safety, and cost.",
   "mcpName": "io.github.iris-eval/mcp-server",
   "type": "module",
@@ -76,27 +76,32 @@
     "node": ">=20.0.0"
   },
   "overrides": {
-    "fast-uri": "^3.1.2"
+    "brace-expansion": "^5.0.7",
+    "fast-uri": "^3.1.5",
+    "ip-address": "^10.4.0",
+    "postcss": "^8.5.25",
+    "@hono/node-server": "^2.1.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "better-sqlite3": "^12.8.0",
     "express": "^5.1.0",
     "express-rate-limit": "^8.3.2",
     "helmet": "^8.1.0",
     "pino": "^10.3.1",
     "safe-regex2": "^5.1.0",
-    "zod": "^3.25.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@playwright/test": "^1.59.1",
     "@types/better-sqlite3": "^7.6.0",
     "@types/express": "^5.0.0",
-    "@types/node": "^25.5.2",
+    "@types/node": "^26.1.1",
     "@typescript-eslint/eslint-plugin": "^8.58.0",
     "@typescript-eslint/parser": "^8.58.0",
     "@vitest/coverage-v8": "^4.1.1",
     "eslint": "^10.2.0",
+    "fast-check": "^4.8.0",
     "prettier": "^3.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.7.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/iris-eval/mcp-server",
     "source": "github"
   },
-  "version": "0.4.4",
+  "version": "0.4.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@iris-eval/mcp-server",
-      "version": "0.4.4",
+      "version": "0.4.6",
       "transport": {
         "type": "stdio"
       },