@langwatch/mcp-server 0.10.0 → 1.0.0

package/dist/chunk-CE6QMZOP.js

@@ -0,0 +1,432 @@
+import {
+  makeRequest
+} from "./chunk-5UWY24RP.js";
+
+// src/public-http-request.ts
+import { lookup as dnsLookup } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { isIP } from "net";
+
+// ../langwatch/packages/ssrf/src/index.ts
+function ipv4ToBytes(input) {
+  const parts = input.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = new Uint8Array(4);
+  for (let i = 0; i < 4; i++) {
+    if (!/^\d{1,3}$/.test(parts[i])) return null;
+    const n = Number(parts[i]);
+    if (n > 255) return null;
+    bytes[i] = n;
+  }
+  return bytes;
+}
+function ipv6ToBytes(input) {
+  let s = input;
+  const zone = s.indexOf("%");
+  if (zone !== -1) s = s.slice(0, zone);
+  if (s.includes(".")) {
+    const lastColon = s.lastIndexOf(":");
+    if (lastColon === -1) return null;
+    const v4 = ipv4ToBytes(s.slice(lastColon + 1));
+    if (!v4) return null;
+    const hi = (v4[0] << 8 | v4[1]).toString(16);
+    const lo = (v4[2] << 8 | v4[3]).toString(16);
+    s = `${s.slice(0, lastColon + 1)}${hi}:${lo}`;
+  }
+  const halves = s.split("::");
+  if (halves.length > 2) return null;
+  const parseGroups = (part) => {
+    if (part === "") return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-fA-F]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const head = parseGroups(halves[0]);
+  if (head === null) return null;
+  let groups;
+  if (halves.length === 2) {
+    const tail = parseGroups(halves[1]);
+    if (tail === null) return null;
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0) return null;
+    groups = [...head, ...new Array(missing).fill(0), ...tail];
+  } else {
+    groups = head;
+  }
+  if (groups.length !== 8) return null;
+  const bytes = new Uint8Array(16);
+  for (let i = 0; i < 8; i++) {
+    bytes[i * 2] = groups[i] >> 8 & 255;
+    bytes[i * 2 + 1] = groups[i] & 255;
+  }
+  return bytes;
+}
+function ipToBytes(ip) {
+  return ip.includes(":") ? ipv6ToBytes(ip) : ipv4ToBytes(ip);
+}
+function unmap(bytes) {
+  if (bytes.length !== 16) return bytes;
+  for (let i = 0; i < 10; i++) {
+    if (bytes[i] !== 0) return bytes;
+  }
+  if (bytes[10] === 255 && bytes[11] === 255) return bytes.slice(12, 16);
+  return bytes;
+}
+function parsePrefix({ cidr, rfc }) {
+  const slash = cidr.lastIndexOf("/");
+  const bytes = ipToBytes(cidr.slice(0, slash));
+  if (!bytes) throw new Error(`@langwatch/ssrf: bad prefix ${cidr}`);
+  return { bytes, bits: Number(cidr.slice(slash + 1)), rfc };
+}
+function prefixContains({
+  prefix,
+  addr
+}) {
+  if (prefix.bytes.length !== addr.length) return false;
+  let bits = prefix.bits;
+  let i = 0;
+  while (bits >= 8) {
+    if (prefix.bytes[i] !== addr[i]) return false;
+    i++;
+    bits -= 8;
+  }
+  if (bits > 0) {
+    const mask = 255 << 8 - bits & 255;
+    if ((prefix.bytes[i] & mask) !== (addr[i] & mask)) return false;
+  }
+  return true;
+}
+var METADATA_ADDRESSES = [
+  "169.254.169.254",
+  // AWS/GCP/Azure/Oracle IMDS
+  "169.254.170.2",
+  // AWS ECS/Fargate task metadata
+  "168.63.129.16",
+  // Azure WireServer / host DNS
+  "fd00:ec2::254"
+  // AWS EC2 IMDS over IPv6
+].map((ip) => {
+  const bytes = unmap(ipToBytes(ip));
+  return bytes;
+});
+var SPECIAL_PREFIXES = [
+  // IPv4
+  parsePrefix({ cidr: "0.0.0.0/8", rfc: "RFC1122 this network / unspecified" }),
+  parsePrefix({ cidr: "10.0.0.0/8", rfc: "RFC1918 private" }),
+  parsePrefix({
+    cidr: "100.64.0.0/10",
+    rfc: "RFC6598 CGNAT / shared address space"
+  }),
+  parsePrefix({ cidr: "127.0.0.0/8", rfc: "RFC1122 loopback" }),
+  parsePrefix({ cidr: "169.254.0.0/16", rfc: "RFC3927 link-local" }),
+  parsePrefix({ cidr: "172.16.0.0/12", rfc: "RFC1918 private" }),
+  parsePrefix({
+    cidr: "192.0.0.0/24",
+    rfc: "RFC6890 IETF protocol assignments"
+  }),
+  parsePrefix({
+    cidr: "192.0.2.0/24",
+    rfc: "RFC5737 TEST-NET-1 documentation"
+  }),
+  parsePrefix({
+    cidr: "192.88.99.0/24",
+    rfc: "RFC7526 6to4 relay anycast, deprecated"
+  }),
+  parsePrefix({ cidr: "192.168.0.0/16", rfc: "RFC1918 private" }),
+  parsePrefix({ cidr: "198.18.0.0/15", rfc: "RFC2544 benchmarking" }),
+  parsePrefix({
+    cidr: "198.51.100.0/24",
+    rfc: "RFC5737 TEST-NET-2 documentation"
+  }),
+  parsePrefix({
+    cidr: "203.0.113.0/24",
+    rfc: "RFC5737 TEST-NET-3 documentation"
+  }),
+  parsePrefix({ cidr: "224.0.0.0/4", rfc: "RFC5771 multicast" }),
+  parsePrefix({
+    cidr: "240.0.0.0/4",
+    rfc: "RFC1112 reserved incl. 255.255.255.255 broadcast"
+  }),
+  // IPv6
+  parsePrefix({ cidr: "::/128", rfc: "RFC4291 unspecified" }),
+  parsePrefix({ cidr: "::1/128", rfc: "RFC4291 loopback" }),
+  parsePrefix({ cidr: "64:ff9b::/96", rfc: "RFC6052 well-known NAT64" }),
+  parsePrefix({ cidr: "64:ff9b:1::/48", rfc: "RFC8215 local-use NAT64" }),
+  parsePrefix({ cidr: "100::/64", rfc: "RFC6666 discard-only" }),
+  parsePrefix({ cidr: "2001::/32", rfc: "RFC4380 Teredo" }),
+  parsePrefix({ cidr: "2001:db8::/32", rfc: "RFC3849 documentation" }),
+  parsePrefix({ cidr: "2002::/16", rfc: "RFC3056 6to4" }),
+  parsePrefix({ cidr: "3fff::/20", rfc: "RFC9637 documentation" }),
+  parsePrefix({ cidr: "fc00::/7", rfc: "RFC4193 unique-local" }),
+  parsePrefix({ cidr: "fe80::/10", rfc: "RFC4291 link-local unicast" }),
+  parsePrefix({ cidr: "ff00::/8", rfc: "RFC4291 multicast" })
+];
+function bytesEqual({ a, b }) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function classify(ip) {
+  const raw = ipToBytes(ip);
+  if (!raw) return "special";
+  const addr = unmap(raw);
+  if (METADATA_ADDRESSES.some((m) => bytesEqual({ a: m, b: addr })))
+    return "metadata";
+  for (const prefix of SPECIAL_PREFIXES) {
+    if (prefixContains({ prefix, addr })) return "special";
+  }
+  return "global";
+}
+
+// src/public-http-request.ts
+var MAX_REDIRECTS = 5;
+var MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+var REQUEST_TIMEOUT_MS = 3e4;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var SENSITIVE_REDIRECT_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "cookie",
+  "cookie2",
+  "proxy-authorization",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-access-token"
+]);
+function unsafeDestinationError() {
+  return new Error("HTTP agent destinations must resolve only to globally routable public addresses");
+}
+function hostnameWithoutBrackets(hostname) {
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function assertPublicAddress(address) {
+  if (classify(address) !== "global") {
+    throw unsafeDestinationError();
+  }
+}
+async function withTimeout(promise, timeoutMs) {
+  let timeout;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((_resolve, reject) => {
+        timeout = setTimeout(() => reject(new Error("request timed out")), timeoutMs);
+        timeout.unref();
+      })
+    ]);
+  } finally {
+    if (timeout) {
+      clearTimeout(timeout);
+    }
+  }
+}
+function headersForRedirect(headers, crossOrigin) {
+  if (!headers || !crossOrigin) {
+    return headers;
+  }
+  const safeHeaders = Object.fromEntries(
+    Object.entries(headers).filter(([name]) => !SENSITIVE_REDIRECT_HEADERS.has(name.toLowerCase()))
+  );
+  return Object.keys(safeHeaders).length > 0 ? safeHeaders : void 0;
+}
+async function resolvePublicDestination(input, resolver = dnsLookup) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    throw new Error("HTTP agent URL is invalid");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:" || url.username !== "" || url.password !== "") {
+    throw unsafeDestinationError();
+  }
+  const hostname = hostnameWithoutBrackets(url.hostname);
+  const literalFamily = isIP(hostname);
+  if (literalFamily !== 0) {
+    assertPublicAddress(hostname);
+    return { address: hostname, family: literalFamily, url };
+  }
+  let addresses;
+  try {
+    addresses = await withTimeout(
+      resolver(hostname, { all: true, verbatim: true }),
+      REQUEST_TIMEOUT_MS
+    );
+  } catch {
+    throw new Error("HTTP agent destination could not be resolved");
+  }
+  if (addresses.length === 0) {
+    throw new Error("HTTP agent destination could not be resolved");
+  }
+  for (const { address } of addresses) {
+    assertPublicAddress(address);
+  }
+  const selected = addresses.find(({ family }) => family === 4) ?? addresses[0];
+  return {
+    address: selected.address,
+    family: selected.family,
+    url
+  };
+}
+function requestBody(destination, options) {
+  return new Promise((resolve, reject) => {
+    const hostname = hostnameWithoutBrackets(destination.url.hostname);
+    const requestOptions = {
+      protocol: destination.url.protocol,
+      hostname,
+      port: destination.url.port || void 0,
+      path: `${destination.url.pathname}${destination.url.search}`,
+      method: options.method ?? "GET",
+      headers: options.headers,
+      family: destination.family,
+      signal: options.signal,
+      lookup: (_hostname, _options, callback) => {
+        callback(null, destination.address, destination.family);
+      }
+    };
+    const transport = destination.url.protocol === "https:" ? httpsRequest : httpRequest;
+    const request = transport(requestOptions, (response) => {
+      const chunks = [];
+      let receivedBytes = 0;
+      response.once("aborted", () => {
+        reject(new Error("HTTP agent response was interrupted"));
+      });
+      response.once("error", reject);
+      const contentLength = Number(response.headers["content-length"]);
+      if (Number.isFinite(contentLength) && contentLength > MAX_RESPONSE_BYTES) {
+        response.destroy(new Error("HTTP agent response is too large"));
+        return;
+      }
+      response.on("data", (chunk) => {
+        receivedBytes += chunk.length;
+        if (receivedBytes > MAX_RESPONSE_BYTES) {
+          response.destroy(new Error("HTTP agent response is too large"));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.once("end", () => {
+        resolve({
+          body: Buffer.concat(chunks).toString("utf8"),
+          location: response.headers.location,
+          statusCode: response.statusCode ?? 0
+        });
+      });
+    });
+    request.once("error", reject);
+    request.setTimeout(REQUEST_TIMEOUT_MS, () => {
+      request.destroy(new Error("HTTP agent request timed out"));
+    });
+    if (options.body !== void 0) {
+      request.write(options.body);
+    }
+    request.end();
+  });
+}
+async function requestPublicJson(input, options = {}, redirectCount = 0) {
+  const destination = await resolvePublicDestination(input);
+  const response = await requestBody(destination, options);
+  if (REDIRECT_STATUSES.has(response.statusCode) && response.location) {
+    if (redirectCount >= MAX_REDIRECTS) {
+      throw new Error(`HTTP agent returned too many redirects`);
+    }
+    const redirectUrl = new URL(response.location, destination.url);
+    const redirectHeaders = headersForRedirect(
+      options.headers,
+      redirectUrl.origin !== destination.url.origin
+    );
+    const preserveBody = response.statusCode === 307 || response.statusCode === 308;
+    return requestPublicJson(
+      redirectUrl.toString(),
+      preserveBody ? { ...options, headers: redirectHeaders } : {
+        ...options,
+        body: void 0,
+        headers: redirectHeaders,
+        method: "GET"
+      },
+      redirectCount + 1
+    );
+  }
+  if (response.statusCode < 200 || response.statusCode >= 300) {
+    throw new Error(`HTTP agent returned an unsuccessful status: ${response.statusCode}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(response.body);
+  } catch {
+    throw new Error("HTTP agent returned invalid JSON");
+  }
+  return parsed;
+}
+
+// src/langwatch-api-agents.ts
+async function listAgents(params) {
+  const query = new URLSearchParams();
+  if (params?.page) query.set("page", String(params.page));
+  if (params?.limit) query.set("limit", String(params.limit));
+  const qs = query.toString() ? `?${query}` : "";
+  return makeRequest("GET", `/api/agents${qs}`);
+}
+async function getAgent(id) {
+  return makeRequest(
+    "GET",
+    `/api/agents/${encodeURIComponent(id)}`
+  );
+}
+async function createAgent(data) {
+  return makeRequest("POST", "/api/agents", data);
+}
+async function updateAgent(params) {
+  const { id, ...data } = params;
+  return makeRequest(
+    "PATCH",
+    `/api/agents/${encodeURIComponent(id)}`,
+    data
+  );
+}
+async function runAgent(id, input) {
+  const agent = await getAgent(id);
+  const config = agent.config ?? {};
+  if (agent.type === "http") {
+    const url = config.url;
+    if (!url) {
+      throw new Error("HTTP agent has no URL configured");
+    }
+    const result2 = await requestPublicJson(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(input ?? {})
+    });
+    return { agentType: "http", result: result2 };
+  }
+  const workflowId = config.workflowId;
+  if (!workflowId) {
+    throw new Error(
+      `Agent "${agent.name}" (type: ${agent.type}) cannot be executed directly. Only HTTP agents and workflow-linked agents can be run.`
+    );
+  }
+  const { runWorkflow } = await import("./langwatch-api-workflows-5HRZ7HR4.js");
+  const result = await runWorkflow(workflowId, input);
+  return { agentType: agent.type, result };
+}
+async function deleteAgent(id) {
+  return makeRequest(
+    "DELETE",
+    `/api/agents/${encodeURIComponent(id)}`
+  );
+}
+
+export {
+  listAgents,
+  getAgent,
+  createAgent,
+  updateAgent,
+  runAgent,
+  deleteAgent
+};
+//# sourceMappingURL=chunk-CE6QMZOP.js.map

package/dist/{chunk-X2SEURT2.js → chunk-DAIQKS27.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-42ZHHHIJ.js";
+} from "./chunk-5UWY24RP.js";
 
 // src/langwatch-api-model-providers.ts
 async function listModelProviders() {
@@ -19,4 +19,4 @@ export {
   listModelProviders,
   setModelProvider
 };
-//# sourceMappingURL=chunk-X2SEURT2.js.map
+//# sourceMappingURL=chunk-DAIQKS27.js.map

package/dist/{chunk-R7C7OUVG.js → chunk-EU22L52K.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-42ZHHHIJ.js";
+} from "./chunk-5UWY24RP.js";
 
 // src/langwatch-api-evaluators.ts
 function getEvaluatorType(evaluator) {
@@ -41,4 +41,4 @@ export {
   updateEvaluator,
   deleteEvaluator
 };
-//# sourceMappingURL=chunk-R7C7OUVG.js.map
+//# sourceMappingURL=chunk-EU22L52K.js.map

package/dist/{chunk-TROIWSEQ.js → chunk-J45SVWPR.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-42ZHHHIJ.js";
+} from "./chunk-5UWY24RP.js";
 
 // src/langwatch-api-datasets.ts
 async function listDatasets(params) {
@@ -83,4 +83,4 @@ export {
   deleteDatasetRecords,
   listDatasetRecords
 };
-//# sourceMappingURL=chunk-TROIWSEQ.js.map
+//# sourceMappingURL=chunk-J45SVWPR.js.map

package/dist/{chunk-CCM4ZFGF.js → chunk-O3LWVN67.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-42ZHHHIJ.js";
+} from "./chunk-5UWY24RP.js";
 
 // src/langwatch-api-scenarios.ts
 async function listScenarios() {
@@ -37,4 +37,4 @@ export {
   updateScenario,
   archiveScenario
 };
-//# sourceMappingURL=chunk-CCM4ZFGF.js.map
+//# sourceMappingURL=chunk-O3LWVN67.js.map

package/dist/{chunk-BB7EOKHR.js → chunk-RYRB2YVJ.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-42ZHHHIJ.js";
+} from "./chunk-5UWY24RP.js";
 
 // src/langwatch-api-annotations.ts
 async function listAnnotations() {
@@ -39,4 +39,4 @@ export {
   createAnnotation,
   deleteAnnotation
 };
-//# sourceMappingURL=chunk-BB7EOKHR.js.map
+//# sourceMappingURL=chunk-RYRB2YVJ.js.map

package/dist/{chunk-HKY3GW45.js → chunk-T7WJVS2N.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-42ZHHHIJ.js";
+} from "./chunk-5UWY24RP.js";
 
 // src/langwatch-api-workflows.ts
 async function listWorkflows() {
@@ -32,4 +32,4 @@ export {
   runWorkflow,
   deleteWorkflow
 };
-//# sourceMappingURL=chunk-HKY3GW45.js.map
+//# sourceMappingURL=chunk-T7WJVS2N.js.map

package/dist/{chunk-JHOSVOHT.js → chunk-UXXA4D6K.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-42ZHHHIJ.js";
+} from "./chunk-5UWY24RP.js";
 
 // src/langwatch-api-dashboards.ts
 async function listDashboards() {
@@ -36,4 +36,4 @@ export {
   renameDashboard,
   deleteDashboard
 };
-//# sourceMappingURL=chunk-JHOSVOHT.js.map
+//# sourceMappingURL=chunk-UXXA4D6K.js.map