@juspay/neurolink 13.8.17 → 13.8.18

package/dist/index.d.ts

@@ -237,7 +237,8 @@ export declare function createBestAIProvider(requestedProvider?: string, modelNa
  * await writeFile('output.txt', 'Hello from MCP!');
  * ```
  */
-export { CircuitBreakerManager, calculateExpiresAt, createMCPServer, createOAuthProviderFromConfig, DEFAULT_HTTP_RETRY_CONFIG, DEFAULT_RATE_LIMIT_CONFIG, executeMCP, FileTokenStorage, getMCPStats, getServerInfo, globalCircuitBreakerManager, globalRateLimiterManager, HTTPRateLimiter, InMemoryTokenStorage, initializeMCPEcosystem, isRetryableHTTPError, isRetryableStatusCode, isTokenExpired, listMCPs, CircuitBreakerOpenError, MCPCircuitBreaker, mcpLogger, NeuroLinkOAuthProvider, RateLimiterManager, validateServerTools, validateTool as validateMCPTool, withHTTPRetry, MCPToolRegistry, ExternalServerManager, MCPClientFactory, ToolRouter, createToolRouter, DEFAULT_ROUTER_CONFIG, ToolCache, createToolCache, DEFAULT_CACHE_CONFIG, ToolResultCache, createToolResultCache, RequestBatcher, ToolCallBatcher, createRequestBatcher, createToolCallBatcher, DEFAULT_BATCH_CONFIG, inferAnnotations, createAnnotatedTool, validateAnnotations, filterToolsByAnnotations, mergeAnnotations, getAnnotationSummary, requiresConfirmation, isSafeToRetry, getToolSafetyLevel, ElicitationManager, globalElicitationManager, EnhancedToolDiscovery, MCPRegistryClient, globalMCPRegistryClient, getWellKnownServer, getAllWellKnownServers, MCPServerBase, MultiServerManager, globalMultiServerManager, AgentExposureManager, exposeAgentAsTool, exposeAgentsAsTools, exposeWorkflowAsTool, exposeWorkflowsAsTools, globalAgentExposureManager, ServerCapabilitiesManager, createTextResource, createJsonResource, createPrompt, neuroLinkToolToMCP, mcpToolToNeuroLink, batchConvertToMCP, batchConvertToNeuroLink, sanitizeToolName, validateToolName, createToolFromFunction, mcpProtocolToolToServerTool, serverToolToMCPProtocol, TOOL_COMPATIBILITY, ToolIntegrationManager, globalToolIntegrationManager, wrapToolWithElicitation, wrapToolsWithElicitation, createElicitationContext, confirmationMiddleware, validationMiddleware, loggingMiddleware, createRetryMiddleware, createTimeoutMiddleware, createToolMiddlewareChain, ElicitationProtocolAdapter, globalElicitationProtocol, isElicitationProtocolMessage, protocolMessageToElicitation, elicitationResponseToProtocol, createElicitationRequest, createElicitationResponse, createElicitationCancel, createTextInputRequest, createSelectRequest, createConfirmationRequest, createFormRequest, } from "./mcp/index.js";
+export { CircuitBreakerManager, calculateExpiresAt, createMCPServer, createOAuthProviderFromConfig, DEFAULT_HTTP_RETRY_CONFIG, DEFAULT_RATE_LIMIT_CONFIG, executeMCP, FileTokenStorage, getMCPStats, getServerInfo, globalCircuitBreakerManager, globalRateLimiterManager, HTTPRateLimiter, InMemoryTokenStorage, initializeMCPEcosystem, isRetryableHTTPError, isRetryableStatusCode, isTokenExpired, listMCPs, CircuitBreakerOpenError, MCPCircuitBreaker, mcpLogger, NeuroLinkOAuthProvider, RateLimiterManager, validateServerTools, validateTool as validateMCPTool, withHTTPRetry, MCPToolRegistry, ExternalServerManager, MCPClientFactory, ToolRouter, createToolRouter, DEFAULT_ROUTER_CONFIG, ToolCache, createToolCache, DEFAULT_CACHE_CONFIG, ToolResultCache, createToolResultCache, RequestBatcher, ToolCallBatcher, createRequestBatcher, createToolCallBatcher, DEFAULT_BATCH_CONFIG, inferAnnotations, createAnnotatedTool, validateAnnotations, filterToolsByAnnotations, mergeAnnotations, getAnnotationSummary, requiresConfirmation, isSafeToRetry, getToolSafetyLevel, ElicitationManager, globalElicitationManager, EnhancedToolDiscovery, MCPRegistryClient, globalMCPRegistryClient, getWellKnownServer, getAllWellKnownServers, MCPServerBase, MultiServerManager, globalMultiServerManager, AgentExposureManager, exposeAgentAsTool, exposeAgentsAsTools, exposeWorkflowAsTool, exposeWorkflowsAsTools, globalAgentExposureManager, ServerCapabilitiesManager, createTextResource, createJsonResource, createPrompt, neuroLinkToolToMCP, mcpToolToNeuroLink, batchConvertToMCP, batchConvertToNeuroLink, sanitizeToolName, validateToolName, createToolFromFunction, mcpProtocolToolToServerTool, serverToolToMCPProtocol, TOOL_COMPATIBILITY, ToolIntegrationManager, globalToolIntegrationManager, wrapToolWithElicitation, wrapToolsWithElicitation, createElicitationContext, confirmationMiddleware, validationMiddleware, loggingMiddleware, createRetryMiddleware, createTimeoutMiddleware, createToolMiddlewareChain, ElicitationProtocolAdapter, globalElicitationProtocol, isElicitationProtocolMessage, protocolMessageToElicitation, elicitationResponseToProtocol, createElicitationRequest, createElicitationResponse, createElicitationCancel, createTextInputRequest, createSelectRequest, createConfirmationRequest, createFormRequest, assertMcpTransportUrlAllowed, classifyMcpTransportAddress, resolveProjectMcpConfigPath, setProjectMcpConfigTrustHook, getProjectMcpConfigTrustHook, summarizeProjectMcpConfig, formatProjectMcpConfigSummary, getProjectMcpConfigTrustStatus, recordTrustedProjectMcpConfig, readProjectMcpConfigTrustStore, hashProjectMcpConfig, getTrustedMcpConfigStorePath, PROJECT_MCP_CONFIG_FILENAME, TRUST_MCP_CONFIG_ENV, TRUST_MCP_CONFIG_FLAG, TRUSTED_MCP_CONFIGS_FILENAME, } from "./mcp/index.js";
+export { loadDotenv, loadProcessDotenv } from "./utils/dotenvBootstrap.js";
 export { computeToolSignature, dedupeTools } from "./core/toolDedup.js";
 export { logger } from "./utils/logger.js";
 export { getPoolStats } from "./utils/redis.js";

package/dist/index.js

@@ -396,7 +396,12 @@ neuroLinkToolToMCP, mcpToolToNeuroLink, batchConvertToMCP, batchConvertToNeuroLi
 // MCP Enhancements - Tool Integration
 ToolIntegrationManager, globalToolIntegrationManager, wrapToolWithElicitation, wrapToolsWithElicitation, createElicitationContext, confirmationMiddleware, validationMiddleware, loggingMiddleware, createRetryMiddleware, createTimeoutMiddleware, createToolMiddlewareChain, 
 // MCP Enhancements - Elicitation Protocol
-ElicitationProtocolAdapter, globalElicitationProtocol, isElicitationProtocolMessage, protocolMessageToElicitation, elicitationResponseToProtocol, createElicitationRequest, createElicitationResponse, createElicitationCancel, createTextInputRequest, createSelectRequest, createConfirmationRequest, createFormRequest, } from "./mcp/index.js";
+ElicitationProtocolAdapter, globalElicitationProtocol, isElicitationProtocolMessage, protocolMessageToElicitation, elicitationResponseToProtocol, createElicitationRequest, createElicitationResponse, createElicitationCancel, createTextInputRequest, createSelectRequest, createConfirmationRequest, createFormRequest, 
+// Project MCP config trust + transport URL policy (2026-10 security audit)
+assertMcpTransportUrlAllowed, classifyMcpTransportAddress, resolveProjectMcpConfigPath, setProjectMcpConfigTrustHook, getProjectMcpConfigTrustHook, summarizeProjectMcpConfig, formatProjectMcpConfigSummary, getProjectMcpConfigTrustStatus, recordTrustedProjectMcpConfig, readProjectMcpConfigTrustStore, hashProjectMcpConfig, getTrustedMcpConfigStorePath, PROJECT_MCP_CONFIG_FILENAME, TRUST_MCP_CONFIG_ENV, TRUST_MCP_CONFIG_FLAG, TRUSTED_MCP_CONFIGS_FILENAME, } from "./mcp/index.js";
+// Explicit `.env` loading for SDK hosts. Importing the SDK no longer reads
+// `<cwd>/.env` (2026-10 security hardening); call `loadDotenv()` to opt in.
+export { loadDotenv, loadProcessDotenv } from "./utils/dotenvBootstrap.js";
 // Tool signature deduplication utilities (opt-in, fail-open)
 export { computeToolSignature, dedupeTools } from "./core/toolDedup.js";
 export { logger } from "./utils/logger.js";

package/dist/mcp/auth/tokenStorage.d.ts

@@ -34,6 +34,13 @@ export declare class FileTokenStorage implements TokenStorage {
     private loaded;
     constructor(filePath: string);
     private loadTokens;
+    /**
+     * Persist the token map. These are bearer credentials, so the directory is
+     * created `0700` and the file lands `0600`: written to a uniquely named
+     * temporary file opened with `wx` (a pre-planted file or symlink at that
+     * name fails instead of being followed), then renamed into place so a
+     * reader never sees a torn file.
+     */
     private saveToFile;
     getTokens(serverId: string): Promise<OAuthTokens | null>;
     saveTokens(serverId: string, tokens: OAuthTokens): Promise<void>;

package/dist/mcp/auth/tokenStorage.js

@@ -71,16 +71,35 @@ export class FileTokenStorage {
             this.loaded = true;
         }
     }
+    /**
+     * Persist the token map. These are bearer credentials, so the directory is
+     * created `0700` and the file lands `0600`: written to a uniquely named
+     * temporary file opened with `wx` (a pre-planted file or symlink at that
+     * name fails instead of being followed), then renamed into place so a
+     * reader never sees a torn file.
+     */
     async saveToFile() {
         try {
             const fs = await import("fs/promises");
             const path = await import("path");
-            // Ensure directory exists
+            const { randomBytes } = await import("crypto");
             const dir = path.dirname(this.filePath);
-            await fs.mkdir(dir, { recursive: true });
-            // Write tokens to file
+            await fs.mkdir(dir, { recursive: true, mode: 0o700 });
             const data = Object.fromEntries(this.tokens.entries());
-            await fs.writeFile(this.filePath, JSON.stringify(data, null, 2), "utf-8");
+            const tmp = `${this.filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+            try {
+                await fs.writeFile(tmp, JSON.stringify(data, null, 2), {
+                    encoding: "utf-8",
+                    mode: 0o600,
+                    flag: "wx",
+                });
+                await fs.rename(tmp, this.filePath);
+                await fs.chmod(this.filePath, 0o600);
+            }
+            catch (writeError) {
+                await fs.rm(tmp, { force: true });
+                throw writeError;
+            }
         }
         catch (error) {
             logger.error(`[FileTokenStorage] Error saving tokens: ${error instanceof Error ? error.message : String(error)}`);

package/dist/mcp/externalServerManager.d.ts

@@ -52,9 +52,19 @@ export declare class ExternalServerManager extends EventEmitter {
      */
     getServerName(serverId: string): string;
     /**
-     * Load MCP server configurations from .mcp-config.json file with parallel loading support
-     * Automatically registers servers found in the configuration
-     * @param configPath Optional path to config file (defaults to .mcp-config.json in cwd)
+     * Load MCP server configurations from a `.mcp-config.json`-shaped file and
+     * register every server it names.
+     *
+     * Calling this is an explicit decision to run that file's servers. With no
+     * `configPath` it reads `.mcp-config.json` from the working directory, so
+     * a host must only omit the path when it controls that directory; the SDK
+     * itself never calls this without a path it resolved through
+     * `resolveProjectMcpConfigPath` (see `projectConfigTrust.ts`).
+     *
+     * `${NAME}` references in each server's `env` and `args` are expanded from
+     * `process.env`; `headers` and `url` are used as written.
+     *
+     * @param configPath Path to the config file (defaults to .mcp-config.json in cwd)
      * @param options Loading options including parallel support
      * @returns Promise resolving to { serversLoaded, errors }
      */

package/dist/mcp/externalServerManager.js

@@ -66,36 +66,76 @@ const readMCPTransportFetch = (value) => {
     }
     return value;
 };
+const ENV_REFERENCE_PATTERN = /\$\{([^}]*)\}/g;
+const ENV_REFERENCE_PRESENT = /\$\{[^}]*\}/;
 /**
- * Recursively substitute environment variables in strings
- * Replaces ${VAR_NAME} with the value from process.env.VAR_NAME
- * @param value - Value to process (string, object, array, or primitive)
- * @returns Processed value with environment variables substituted
+ * The only shape a `${…}` reference may take. Anything else — lower case,
+ * a leading digit, `${}`, `${a.b}`, `${PATH:-x}` — is left as written, so a
+ * config cannot probe the environment through odd names.
  */
-function substituteEnvVariables(value) {
+const ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+/**
+ * Recursively substitute `${NAME}` references in `value` from `process.env`.
+ *
+ * Applies to a server's `env` and `args` only. `headers` and `url` are sent
+ * to a remote host, so a reference there would ship the variable's value off
+ * the machine; they are passed through unchanged by `warnOnEnvReferences`.
+ *
+ * @param value - string, array, object or primitive
+ * @param field - the config field being processed, for log messages
+ */
+function substituteEnvVariables(value, field) {
     if (typeof value === "string") {
-        // Replace ${VAR_NAME} with process.env.VAR_NAME
-        return value.replace(/\$\{([^}]+)\}/g, (match, varName) => {
-            const envValue = process.env[varName.trim()];
+        return value.replace(ENV_REFERENCE_PATTERN, (match, rawName) => {
+            const varName = rawName.trim();
+            if (!ENV_NAME_PATTERN.test(varName)) {
+                mcpLogger.warn(`[ExternalServerManager] ${field}: "${match}" is not a valid environment variable reference (names must match ^[A-Z][A-Z0-9_]*$); left as written`);
+                return match;
+            }
+            const envValue = process.env[varName];
             if (envValue === undefined) {
-                mcpLogger.warn(`[ExternalServerManager] Environment variable ${varName} is not defined, using empty string`);
+                mcpLogger.warn(`[ExternalServerManager] ${field}: environment variable ${varName} is not defined, using empty string`);
                 return "";
             }
             return envValue;
         });
     }
     if (Array.isArray(value)) {
-        return value.map((item) => substituteEnvVariables(item));
+        return value.map((item) => substituteEnvVariables(item, field));
     }
     if (isNonNullObject(value)) {
         const result = {};
         for (const [key, val] of Object.entries(value)) {
-            result[key] = substituteEnvVariables(val);
+            result[key] = substituteEnvVariables(val, field);
         }
         return result;
     }
     return value;
 }
+/**
+ * Warn about `${NAME}` references in a field that is never expanded. The
+ * value is used exactly as written: a header reading `Bearer ${TOKEN}` is
+ * sent literally, which fails authentication loudly instead of leaking.
+ */
+function warnOnEnvReferences(value, field) {
+    if (typeof value === "string") {
+        if (ENV_REFERENCE_PRESENT.test(value)) {
+            mcpLogger.warn(`[ExternalServerManager] ${field} contains a \${VAR} reference; environment variables are never expanded in ${field} (only in env and args). The value is used as written.`);
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            warnOnEnvReferences(item, field);
+        }
+        return;
+    }
+    if (isNonNullObject(value)) {
+        for (const [key, val] of Object.entries(value)) {
+            warnOnEnvReferences(val, `${field}.${key}`);
+        }
+    }
+}
 /**
  * The two messages the MCP SDK produces when the transport underneath a
  * request is gone: `Protocol._onclose` rejects every pending request with
@@ -249,8 +289,91 @@ function isValidExternalMCPServerConfig(config) {
         (record.retryConfig === undefined || isNonNullObject(record.retryConfig)) &&
         (record.rateLimiting === undefined ||
             isNonNullObject(record.rateLimiting)) &&
+        (record.inheritParentEnv === undefined ||
+            typeof record.inheritParentEnv === "boolean") &&
+        (record.allowPrivateNetwork === undefined ||
+            typeof record.allowPrivateNetwork === "boolean") &&
         (record.metadata === undefined || isNonNullObject(record.metadata)));
 }
+/**
+ * Convert one `mcpServers` entry of a project config into an `MCPServerInfo`.
+ *
+ * Shared by the parallel and sequential loaders so the two cannot drift.
+ * `${NAME}` references are expanded in `env` and `args` only; `headers` and
+ * `url` are passed through as written (see `warnOnEnvReferences`).
+ *
+ * @throws when the entry fails `isValidExternalMCPServerConfig`
+ */
+function toExternalServerInfo(serverId, serverConfig) {
+    if (!isValidExternalMCPServerConfig(serverConfig)) {
+        throw new Error(`Invalid server config for ${serverId}: missing required properties or wrong types`);
+    }
+    if (serverConfig.headers !== undefined) {
+        warnOnEnvReferences(serverConfig.headers, `${serverId}.headers`);
+    }
+    if (serverConfig.url !== undefined) {
+        warnOnEnvReferences(serverConfig.url, `${serverId}.url`);
+    }
+    return {
+        id: serverId,
+        name: serverId,
+        description: typeof serverConfig.description === "string"
+            ? serverConfig.description
+            : `External MCP server: ${serverId}`,
+        transport: typeof serverConfig.transport === "string"
+            ? serverConfig.transport
+            : "stdio",
+        status: "initializing",
+        tools: [],
+        command: typeof serverConfig.command === "string"
+            ? serverConfig.command
+            : undefined,
+        args: Array.isArray(serverConfig.args)
+            ? substituteEnvVariables(serverConfig.args.map((arg) => String(arg)), `${serverId}.args`)
+            : [],
+        env: isNonNullObject(serverConfig.env)
+            ? substituteEnvVariables(serverConfig.env, `${serverId}.env`)
+            : {},
+        inheritParentEnv: typeof serverConfig.inheritParentEnv === "boolean"
+            ? serverConfig.inheritParentEnv
+            : undefined,
+        allowPrivateNetwork: typeof serverConfig.allowPrivateNetwork === "boolean"
+            ? serverConfig.allowPrivateNetwork
+            : undefined,
+        timeout: typeof serverConfig.timeout === "number"
+            ? serverConfig.timeout
+            : undefined,
+        retries: typeof serverConfig.retries === "number"
+            ? serverConfig.retries
+            : undefined,
+        healthCheckInterval: typeof serverConfig.healthCheckInterval === "number"
+            ? serverConfig.healthCheckInterval
+            : undefined,
+        autoRestart: typeof serverConfig.autoRestart === "boolean"
+            ? serverConfig.autoRestart
+            : undefined,
+        cwd: typeof serverConfig.cwd === "string" ? serverConfig.cwd : undefined,
+        url: typeof serverConfig.url === "string" ? serverConfig.url : undefined,
+        // HTTP transport-specific fields — never expanded, see above.
+        headers: isNonNullObject(serverConfig.headers)
+            ? serverConfig.headers
+            : undefined,
+        fetch: readMCPTransportFetch(serverConfig.fetch),
+        httpOptions: isNonNullObject(serverConfig.httpOptions)
+            ? serverConfig.httpOptions
+            : undefined,
+        retryConfig: isNonNullObject(serverConfig.retryConfig)
+            ? serverConfig.retryConfig
+            : undefined,
+        rateLimiting: isNonNullObject(serverConfig.rateLimiting)
+            ? serverConfig.rateLimiting
+            : undefined,
+        blockedTools: Array.isArray(serverConfig.blockedTools)
+            ? serverConfig.blockedTools
+            : undefined,
+        metadata: safeMetadataConversion(serverConfig.metadata),
+    };
+}
 /**
  * ExternalServerManager
  * Core class for managing external MCP servers
@@ -489,9 +612,19 @@ export class ExternalServerManager extends EventEmitter {
         return instance?.config?.name || serverId;
     }
     /**
-     * Load MCP server configurations from .mcp-config.json file with parallel loading support
-     * Automatically registers servers found in the configuration
-     * @param configPath Optional path to config file (defaults to .mcp-config.json in cwd)
+     * Load MCP server configurations from a `.mcp-config.json`-shaped file and
+     * register every server it names.
+     *
+     * Calling this is an explicit decision to run that file's servers. With no
+     * `configPath` it reads `.mcp-config.json` from the working directory, so
+     * a host must only omit the path when it controls that directory; the SDK
+     * itself never calls this without a path it resolved through
+     * `resolveProjectMcpConfigPath` (see `projectConfigTrust.ts`).
+     *
+     * `${NAME}` references in each server's `env` and `args` are expanded from
+     * `process.env`; `headers` and `url` are used as written.
+     *
+     * @param configPath Path to the config file (defaults to .mcp-config.json in cwd)
      * @param options Loading options including parallel support
      * @returns Promise resolving to { serversLoaded, errors }
      */
@@ -525,67 +658,7 @@ export class ExternalServerManager extends EventEmitter {
             // Create promises for all servers to start them concurrently
             const serverPromises = Object.entries(config.mcpServers).map(async ([serverId, serverConfig]) => {
                 try {
-                    // Validate and convert config format to MCPServerInfo
-                    if (!isValidExternalMCPServerConfig(serverConfig)) {
-                        throw new Error(`Invalid server config for ${serverId}: missing required properties or wrong types`);
-                    }
-                    const externalConfig = {
-                        id: serverId,
-                        name: serverId,
-                        description: typeof serverConfig.description === "string"
-                            ? serverConfig.description
-                            : `External MCP server: ${serverId}`,
-                        transport: typeof serverConfig.transport === "string"
-                            ? serverConfig.transport
-                            : "stdio",
-                        status: "initializing",
-                        tools: [],
-                        command: typeof serverConfig.command === "string"
-                            ? serverConfig.command
-                            : undefined,
-                        args: Array.isArray(serverConfig.args)
-                            ? serverConfig.args
-                            : [],
-                        env: isNonNullObject(serverConfig.env)
-                            ? substituteEnvVariables(serverConfig.env)
-                            : {},
-                        timeout: typeof serverConfig.timeout === "number"
-                            ? serverConfig.timeout
-                            : undefined,
-                        retries: typeof serverConfig.retries === "number"
-                            ? serverConfig.retries
-                            : undefined,
-                        healthCheckInterval: typeof serverConfig.healthCheckInterval === "number"
-                            ? serverConfig.healthCheckInterval
-                            : undefined,
-                        autoRestart: typeof serverConfig.autoRestart === "boolean"
-                            ? serverConfig.autoRestart
-                            : undefined,
-                        cwd: typeof serverConfig.cwd === "string"
-                            ? serverConfig.cwd
-                            : undefined,
-                        url: typeof serverConfig.url === "string"
-                            ? serverConfig.url
-                            : undefined,
-                        // HTTP transport-specific fields
-                        headers: isNonNullObject(serverConfig.headers)
-                            ? substituteEnvVariables(serverConfig.headers)
-                            : undefined,
-                        fetch: readMCPTransportFetch(serverConfig.fetch),
-                        httpOptions: isNonNullObject(serverConfig.httpOptions)
-                            ? serverConfig.httpOptions
-                            : undefined,
-                        retryConfig: isNonNullObject(serverConfig.retryConfig)
-                            ? serverConfig.retryConfig
-                            : undefined,
-                        rateLimiting: isNonNullObject(serverConfig.rateLimiting)
-                            ? serverConfig.rateLimiting
-                            : undefined,
-                        blockedTools: Array.isArray(serverConfig.blockedTools)
-                            ? serverConfig.blockedTools
-                            : undefined,
-                        metadata: safeMetadataConversion(serverConfig.metadata),
-                    };
+                    const externalConfig = toExternalServerInfo(serverId, serverConfig);
                     const result = await this.addServer(serverId, externalConfig);
                     return { serverId, result };
                 }
@@ -664,67 +737,7 @@ export class ExternalServerManager extends EventEmitter {
             const errors = [];
             for (const [serverId, serverConfig] of Object.entries(config.mcpServers)) {
                 try {
-                    // Validate and convert config format to MCPServerInfo
-                    if (!isValidExternalMCPServerConfig(serverConfig)) {
-                        throw new Error(`Invalid server config for ${serverId}: missing required properties or wrong types`);
-                    }
-                    const externalConfig = {
-                        id: serverId,
-                        name: serverId,
-                        description: typeof serverConfig.description === "string"
-                            ? serverConfig.description
-                            : `External MCP server: ${serverId}`,
-                        transport: typeof serverConfig.transport === "string"
-                            ? serverConfig.transport
-                            : "stdio",
-                        status: "initializing",
-                        tools: [],
-                        command: typeof serverConfig.command === "string"
-                            ? serverConfig.command
-                            : undefined,
-                        args: Array.isArray(serverConfig.args)
-                            ? serverConfig.args
-                            : [],
-                        env: isNonNullObject(serverConfig.env)
-                            ? substituteEnvVariables(serverConfig.env)
-                            : {},
-                        timeout: typeof serverConfig.timeout === "number"
-                            ? serverConfig.timeout
-                            : undefined,
-                        retries: typeof serverConfig.retries === "number"
-                            ? serverConfig.retries
-                            : undefined,
-                        healthCheckInterval: typeof serverConfig.healthCheckInterval === "number"
-                            ? serverConfig.healthCheckInterval
-                            : undefined,
-                        autoRestart: typeof serverConfig.autoRestart === "boolean"
-                            ? serverConfig.autoRestart
-                            : undefined,
-                        cwd: typeof serverConfig.cwd === "string"
-                            ? serverConfig.cwd
-                            : undefined,
-                        url: typeof serverConfig.url === "string"
-                            ? serverConfig.url
-                            : undefined,
-                        // HTTP transport-specific fields
-                        headers: isNonNullObject(serverConfig.headers)
-                            ? substituteEnvVariables(serverConfig.headers)
-                            : undefined,
-                        fetch: readMCPTransportFetch(serverConfig.fetch),
-                        httpOptions: isNonNullObject(serverConfig.httpOptions)
-                            ? serverConfig.httpOptions
-                            : undefined,
-                        retryConfig: isNonNullObject(serverConfig.retryConfig)
-                            ? serverConfig.retryConfig
-                            : undefined,
-                        rateLimiting: isNonNullObject(serverConfig.rateLimiting)
-                            ? serverConfig.rateLimiting
-                            : undefined,
-                        blockedTools: Array.isArray(serverConfig.blockedTools)
-                            ? serverConfig.blockedTools
-                            : undefined,
-                        metadata: safeMetadataConversion(serverConfig.metadata),
-                    };
+                    const externalConfig = toExternalServerInfo(serverId, serverConfig);
                     const result = await this.addServer(serverId, externalConfig);
                     if (result.success) {
                         serversLoaded++;
@@ -843,6 +856,8 @@ export class ExternalServerManager extends EventEmitter {
             autoRestart: config.autoRestart,
             minTools: config.minTools,
             cwd: config.cwd,
+            inheritParentEnv: config.inheritParentEnv,
+            allowPrivateNetwork: config.allowPrivateNetwork,
             url: config.url,
             headers: config.headers,
             fetch: config.fetch,
@@ -892,11 +907,14 @@ export class ExternalServerManager extends EventEmitter {
                 autoRestart: serverInfo.autoRestart,
                 minTools: serverInfo.minTools,
                 cwd: serverInfo.cwd,
+                inheritParentEnv: serverInfo.inheritParentEnv,
+                allowPrivateNetwork: serverInfo.allowPrivateNetwork,
                 url: serverInfo.url,
                 blockedTools: serverInfo.blockedTools,
                 metadata: safeMetadataConversion(serverInfo.metadata),
                 // HTTP transport-specific fields
                 headers: serverInfo.headers,
+                auth: serverInfo.auth,
                 fetch: serverInfo.fetch,
                 httpOptions: serverInfo.httpOptions,
                 retryConfig: serverInfo.retryConfig,

package/dist/mcp/index.d.ts

@@ -20,6 +20,8 @@ export { CircuitBreakerManager, globalCircuitBreakerManager, MCPCircuitBreaker,
 export { MCPToolRegistry } from "./toolRegistry.js";
 export { ExternalServerManager } from "./externalServerManager.js";
 export { MCPClientFactory } from "./mcpClientFactory.js";
+export { PROJECT_MCP_CONFIG_FILENAME, TRUST_MCP_CONFIG_ENV, TRUST_MCP_CONFIG_FLAG, TRUSTED_MCP_CONFIGS_FILENAME, formatProjectMcpConfigSummary, getProjectMcpConfigTrustHook, getProjectMcpConfigTrustStatus, getTrustedMcpConfigStorePath, hashProjectMcpConfig, readProjectMcpConfigTrustStore, recordTrustedProjectMcpConfig, resolveProjectMcpConfigPath, setProjectMcpConfigTrustHook, summarizeProjectMcpConfig, } from "./projectConfigTrust.js";
+export { assertMcpTransportUrlAllowed, classifyMcpTransportAddress, } from "./transportUrlPolicy.js";
 export { AgentExposureManager, exposeAgentAsTool, exposeAgentsAsTools, exposeWorkflowAsTool, exposeWorkflowsAsTools, globalAgentExposureManager, } from "./agentExposure.js";
 export { ElicitationManager, globalElicitationManager, } from "./elicitation/index.js";
 export { createConfirmationRequest, createElicitationCancel, createElicitationRequest, createElicitationResponse, createFormRequest, createSelectRequest, createTextInputRequest, ElicitationProtocolAdapter, elicitationResponseToProtocol, globalElicitationProtocol, isElicitationProtocolMessage, protocolMessageToElicitation, } from "./elicitationProtocol.js";

package/dist/mcp/index.js

@@ -15,6 +15,9 @@ export { CircuitBreakerManager, globalCircuitBreakerManager, MCPCircuitBreaker,
 export { MCPToolRegistry } from "./toolRegistry.js";
 export { ExternalServerManager } from "./externalServerManager.js";
 export { MCPClientFactory } from "./mcpClientFactory.js";
+// Project `.mcp-config.json` trust and transport URL policy
+export { PROJECT_MCP_CONFIG_FILENAME, TRUST_MCP_CONFIG_ENV, TRUST_MCP_CONFIG_FLAG, TRUSTED_MCP_CONFIGS_FILENAME, formatProjectMcpConfigSummary, getProjectMcpConfigTrustHook, getProjectMcpConfigTrustStatus, getTrustedMcpConfigStorePath, hashProjectMcpConfig, readProjectMcpConfigTrustStore, recordTrustedProjectMcpConfig, resolveProjectMcpConfigPath, setProjectMcpConfigTrustHook, summarizeProjectMcpConfig, } from "./projectConfigTrust.js";
+export { assertMcpTransportUrlAllowed, classifyMcpTransportAddress, } from "./transportUrlPolicy.js";
 // ========================================
 // MCP ENHANCEMENTS (Phase 8.39.0)
 // ========================================

package/dist/mcp/mcpClientFactory.d.ts

@@ -32,6 +32,12 @@ export declare const terminateLiveStdioServers: () => void;
  */
 export declare class MCPClientFactory {
     private static readonly NEUROLINK_IMPLEMENTATION;
+    /**
+     * No `sampling` here: advertising it tells a server it may send
+     * `sampling/createMessage` and have this client run an LLM call on its
+     * behalf, and the client has no handler for it. Only what is implemented
+     * is announced.
+     */
     private static readonly DEFAULT_CAPABILITIES;
     /**
      * Create an MCP client for the given server configuration
@@ -53,6 +59,14 @@ export declare class MCPClientFactory {
      * Create transport based on configuration
      */
     private static createTransport;
+    /**
+     * Apply the transport URL policy (`transportUrlPolicy.ts`) before any
+     * network transport is built: TLS unless loopback, and no private,
+     * link-local or metadata destinations unless the server config says
+     * `allowPrivateNetwork: true`. Runs for every network server, whether it
+     * came from a project config or from `addExternalMCPServer`.
+     */
+    private static assertNetworkUrlAllowed;
     /**
      * Create a stdio transport.
      *