@langwatch/mcp-server 0.10.1 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@langwatch/mcp-server",
-  "version": "0.10.1",
+  "version": "1.0.0",
   "description": "An MCP server for Langwatch.",
   "type": "module",
   "main": "./dist/index.js",
@@ -36,36 +36,38 @@
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.44",
-    "@anthropic-ai/claude-code": "^2.1.119",
+    "@anthropic-ai/claude-code": "2.1.202",
     "@eslint/js": "^10.0.1",
     "@langwatch/scenario": "^0.4.6",
-    "@types/debug": "^4.1.12",
-    "@types/eslint__js": "^8.42.3",
+    "@opentelemetry/context-async-hooks": "^2.1.0",
+    "@opentelemetry/sdk-node": "^0.219.0",
+    "@types/debug": "^4.1.13",
     "@types/express": "^5.0.6",
     "@types/node": "^25.6.0",
     "@types/yargs": "^17.0.33",
-    "@typescript/native-preview": "7.0.0-dev.20250911.1",
+    "@typescript/native-preview": "7.0.0-dev.20260705.1",
     "ai": "^6.0.161",
+    "chalk": "^5.6.2",
+    "date-fns": "^4.1.0",
     "dotenv": "^17.2.2",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.1",
     "eslint": "^10.2.1",
+    "express": "^5.2.1",
+    "node-pty": "^1.0.0",
     "tsup": "^8.1.0",
     "tsx": "^4.20.5",
     "typescript": "^5.0.0",
-    "typescript-eslint": "^8.55.0"
+    "typescript-eslint": "^8.55.0",
+    "vitest": "^4.1.8",
+    "yargs": "^18.0.0",
+    "zod-validation-error": "^5.0.0",
+    "@langwatch/handled-error": "0.1.0",
+    "@langwatch/redaction": "0.0.1",
+    "@langwatch/ssrf": "0.0.1"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    "@opentelemetry/context-async-hooks": "^2.1.0",
-    "@opentelemetry/sdk-node": "^0.217.0",
-    "chalk": "^5.6.2",
-    "date-fns": "^4.1.0",
-    "express": "^5.2.1",
-    "node-pty": "^1.0.0",
-    "vitest": "^3.2.4",
-    "yargs": "^17.7.2",
-    "zod": "^4.3.6",
-    "zod-validation-error": "^5.0.0"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.3.6"
   },
   "bin": {
     "langwatch-mcp-server": "./dist/index.js"

package/pnpm-workspace.yaml

@@ -1,17 +1,34 @@
+# Standalone workspace: mcp-server is installed on its own in CI, the
+# release workflow, and its Dockerfile. Shared source-only contract packages
+# are bundled by tsup for publish.
+packages:
+  - .
+  - ../packages/handled-error
+  - ../langwatch/packages/redaction
+  - ../langwatch/packages/ssrf
+
 minimumReleaseAge: 10080
 
 overrides:
-  # Security: protobufjs code execution + prototype-pollution + DoS
+  # Security: protobufjs code execution + prototype-pollution + DoS + Any-expansion DoS + property shadowing
   # (GHSA-xq3m-2v4x-88gg, GHSA-66ff-xgx4-vchm, GHSA-75px-5xx7-5xc7,
-  # GHSA-jvwf-75h9-cwgg, GHSA-685m-2w69-288q)
-  "protobufjs": ">=7.5.6 <8.0.0 || >=8.0.2"
+  # GHSA-jvwf-75h9-cwgg, GHSA-685m-2w69-288q, GHSA-wcpc-wj8m-hjx6, GHSA-f38q-mgvj-vph7)
+  "protobufjs": ">=7.5.6 <8.0.0 || >=8.6.0"
   # Security: langsmith untrusted manifest deserialization (GHSA-3644-q5cj-c5c7).
   # langsmith is only a transitive of the @langwatch/scenario devDependency
   # (via langchain / @langchain/core); pinned to a known-safe version.
   "langsmith": "0.6.0"
+  # Security: esbuild Deno binary integrity RCE + dev-server file read (GHSA-gv7w-rqvm-qjhr / GHSA-g7r4-m6w7-qqqr)
+  "esbuild@<0.28.1": ">=0.28.1"
+  # Security: vite dev-server file read / middleware path bypass
+  "vite@>=7.0.0 <7.3.5": ">=7.3.5 <8"
+  # Security: hono request smuggling / path confusion
+  "hono@<4.12.25": ">=4.12.25"
   # Security: fast-uri path traversal + host confusion
   "fast-uri@<3.1.2": "3.1.2"
   liquidjs: ">=10.26.0"
+  # Security: uuid missing buffer bounds check in v3/v5/v6 (GHSA-w5hq-g745-h8pq)
+  "uuid@<11.1.1": ">=11.1.1 <12"
 
 onlyBuiltDependencies:
   - node-pty

package/pyproject.toml

@@ -7,7 +7,7 @@ requires-python = ">=3.11"
 dependencies = [
     "ipykernel>=6.30.1",
     "langwatch",
-    "litellm>=1.77.0",
+    "litellm>=1.84.0",
     "mcp[cli]>=1.13.1",
     "pandas>=2.3.2",
     "tenacity>=9.1.2",
@@ -16,5 +16,13 @@ dependencies = [
 [tool.uv]
 exclude-newer = "7 days"
 
+# Transitive-dependency security pins. Keep these even when the importing
+# package isn't a direct dependency, so a future re-resolution can't silently
+# pull a vulnerable version back in.
+constraint-dependencies = [
+    "python-dotenv>=1.2.2",  # security: python-dotenv advisory (#934)
+    "python-liquid>=2.2.1",  # security: python-liquid advisory (#1528)
+]
+
 [tool.uv.sources]
 langwatch = { path = "../python-sdk", editable = true }

package/src/__tests__/all-tools.integration.test.ts

@@ -1,6 +1,10 @@
 import { createServer, type Server } from "http";
 import { afterAll, beforeAll, describe, expect, it, vi, beforeEach } from "vitest";
 import { initConfig } from "../config.js";
+import {
+  fetchDocumentation,
+  resolveDocumentationUrl,
+} from "../documentation-fetch.js";
 
 // --- Canned responses for every API endpoint ---
 
@@ -14,6 +18,14 @@ const CANNED_TRACES_SEARCH = {
       output: { value: "I am fine, thank you!" },
       timestamps: { started_at: 1700000000000 },
       metadata: { user_id: "user-42", thread_id: "thread-1" },
+      evaluations: [
+        {
+          evaluator_id: "eval-1",
+          name: "Faithfulness",
+          score: 0.95,
+          passed: true,
+        },
+      ],
     },
   ],
   pagination: { totalHits: 1 },
@@ -616,7 +628,6 @@ function createMockServer(): Server {
 describe("All MCP tools integration", () => {
   let server: Server;
   let port: number;
-  let originalFetch: typeof globalThis.fetch;
 
   beforeAll(async () => {
     server = createMockServer();
@@ -631,94 +642,41 @@ describe("All MCP tools integration", () => {
         resolve();
       });
     });
-    originalFetch = globalThis.fetch;
   });
 
   afterAll(async () => {
     await new Promise<void>((resolve) => server.close(() => resolve()));
-    globalThis.fetch = originalFetch;
   });
 
   // =====================
   // 1. fetch_langwatch_docs
   // =====================
   describe("fetch_langwatch_docs", () => {
-    describe("when fetching the docs index", () => {
-      it("returns content from the langwatch docs URL", async () => {
-        // Intercept fetch to avoid hitting the real network
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () =>
-            Promise.resolve(
-              "# LangWatch Docs\nWelcome to LangWatch documentation.",
-            ),
-        });
-        globalThis.fetch = mockFetch;
-
-        // The tool is inlined in index.ts; call the same logic directly
-        const url = "https://langwatch.ai/docs/llms.txt";
-        const response = await fetch(url);
-        const text = await response.text();
-
-        expect(text).toContain("LangWatch");
-        expect(mockFetch).toHaveBeenCalledWith(url);
-
-        globalThis.fetch = originalFetch;
-      });
-    });
-
-    describe("when fetching a specific doc page", () => {
-      it("appends .md extension when missing", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () => Promise.resolve("# Integration Guide"),
-        });
-        globalThis.fetch = mockFetch;
-
-        let urlToFetch = "https://langwatch.ai/docs/integration";
-        if (
-          !urlToFetch.endsWith(".md") &&
-          !urlToFetch.endsWith(".txt")
-        ) {
-          urlToFetch += ".md";
-        }
-
-        const response = await fetch(urlToFetch);
-        const text = await response.text();
-
-        expect(text).toContain("Integration Guide");
-        expect(mockFetch).toHaveBeenCalledWith(
-          "https://langwatch.ai/docs/integration.md",
-        );
-
-        globalThis.fetch = originalFetch;
-      });
+    it("resolves the trusted docs index", () => {
+      expect(resolveDocumentationUrl("langwatch").toString()).toBe(
+        "https://langwatch.ai/docs/llms.txt",
+      );
     });
 
-    describe("when a relative path is provided", () => {
-      it("prepends the docs base URL", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () => Promise.resolve("# Getting Started"),
-        });
-        globalThis.fetch = mockFetch;
-
-        let urlToFetch: string | undefined = "/getting-started";
-        if (urlToFetch && !urlToFetch.endsWith(".md") && !urlToFetch.endsWith(".txt")) {
-          urlToFetch += ".md";
-        }
-        if (!urlToFetch!.startsWith("http")) {
-          if (!urlToFetch!.startsWith("/")) {
-            urlToFetch = "/" + urlToFetch;
-          }
-          urlToFetch = "https://langwatch.ai/docs" + urlToFetch;
-        }
-
-        await fetch(urlToFetch);
+    it("fetches trusted docs without following redirects", async () => {
+      const mockFetch = vi.fn().mockResolvedValue(
+        new Response("# Integration Guide"),
+      );
 
-        expect(mockFetch).toHaveBeenCalledWith(
-          "https://langwatch.ai/docs/getting-started.md",
-        );
+      const text = await fetchDocumentation(
+        "langwatch",
+        "integration",
+        mockFetch,
+      );
 
-        globalThis.fetch = originalFetch;
-      });
+      expect(text).toContain("Integration Guide");
+      expect(mockFetch).toHaveBeenCalledWith(
+        new URL("https://langwatch.ai/docs/integration.md"),
+        {
+          redirect: "error",
+          signal: expect.any(AbortSignal),
+        },
+      );
     });
   });
 
@@ -726,53 +684,16 @@ describe("All MCP tools integration", () => {
   // 2. fetch_scenario_docs
   // =====================
   describe("fetch_scenario_docs", () => {
-    describe("when fetching the scenario docs index", () => {
-      it("returns content from the scenario docs URL", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () =>
-            Promise.resolve(
-              "# Scenario Testing\nLearn how to test agents.",
-            ),
-        });
-        globalThis.fetch = mockFetch;
-
-        const url = "https://langwatch.ai/scenario/llms.txt";
-        const response = await fetch(url);
-        const text = await response.text();
-
-        expect(text).toContain("Scenario Testing");
-        expect(mockFetch).toHaveBeenCalledWith(url);
-
-        globalThis.fetch = originalFetch;
-      });
+    it("resolves the trusted Scenario docs index", () => {
+      expect(resolveDocumentationUrl("scenario").toString()).toBe(
+        "https://langwatch.ai/scenario/llms.txt",
+      );
     });
 
-    describe("when fetching a specific scenario doc page", () => {
-      it("appends .md extension and prepends base URL for relative paths", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () => Promise.resolve("# Setup Guide"),
-        });
-        globalThis.fetch = mockFetch;
-
-        let urlToFetch: string | undefined = "setup";
-        if (urlToFetch && !urlToFetch.endsWith(".md") && !urlToFetch.endsWith(".txt")) {
-          urlToFetch += ".md";
-        }
-        if (!urlToFetch!.startsWith("http")) {
-          if (!urlToFetch!.startsWith("/")) {
-            urlToFetch = "/" + urlToFetch;
-          }
-          urlToFetch = "https://langwatch.ai/scenario" + urlToFetch;
-        }
-
-        await fetch(urlToFetch);
-
-        expect(mockFetch).toHaveBeenCalledWith(
-          "https://langwatch.ai/scenario/setup.md",
-        );
-
-        globalThis.fetch = originalFetch;
-      });
+    it("normalizes a relative Scenario docs path", () => {
+      expect(resolveDocumentationUrl("scenario", "setup").toString()).toBe(
+        "https://langwatch.ai/scenario/setup.md",
+      );
     });
   });
 
@@ -976,6 +897,21 @@ describe("All MCP tools integration", () => {
         });
       });
     });
+
+    describe("given a trace has evaluation results", () => {
+      /** @scenario Agent searches traces and sees evaluation results without a follow-up call */
+      it("includes evaluation status in the digest without a follow-up call", async () => {
+        const { handleSearchTraces } = await import(
+          "../tools/search-traces.js"
+        );
+        const result = await handleSearchTraces({
+          startDate: "24h",
+          endDate: "now",
+        });
+
+        expect(result).toContain("- **Faithfulness**: PASSED (score: 0.95)");
+      });
+    });
   });
 
   // =====================

package/src/__tests__/documentation-fetch-security.integration.test.ts

@@ -0,0 +1,176 @@
+import { createServer, type Server } from "node:http";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+import { initConfig } from "../config.js";
+import { fetchDocumentation, resolveDocumentationUrl } from "../documentation-fetch.js";
+
+const MCP_HEADERS = {
+  Accept: "application/json, text/event-stream",
+  Authorization: "Bearer security-regression-test",
+  "Content-Type": "application/json",
+};
+
+describe("MCP documentation fetch security", () => {
+  describe("URL validation", () => {
+    /** @scenario A documentation tool accepts its own trusted HTTPS pages */
+    it.each([
+      ["langwatch" as const, undefined, "https://langwatch.ai/docs/llms.txt"],
+      ["scenario" as const, undefined, "https://langwatch.ai/scenario/llms.txt"],
+      ["langwatch" as const, "observability/tracing", "https://langwatch.ai/docs/observability/tracing.md"],
+      ["scenario" as const, "/scenario/guides/quickstart", "https://langwatch.ai/scenario/guides/quickstart.md"],
+      [
+        "langwatch" as const,
+        "https://langwatch.ai/docs/llms.txt?format=raw",
+        "https://langwatch.ai/docs/llms.txt?format=raw",
+      ],
+    ])("resolves trusted %s documentation URL %s", (kind, input, expected) => {
+      expect(resolveDocumentationUrl(kind, input).toString()).toBe(expected);
+    });
+
+    /** @scenario A documentation tool rejects non-HTTPS and untrusted hosts */
+    /** @scenario A documentation tool rejects a trusted host outside its namespace */
+    it.each([
+      ["langwatch" as const, "http://169.254.169.254/latest/meta-data/"],
+      ["langwatch" as const, "https://langwatch.ai.attacker.example/docs/x"],
+      ["langwatch" as const, "https://langwatch.ai@127.0.0.1/docs/x"],
+      ["langwatch" as const, "https://langwatch.ai:444/docs/x"],
+      ["langwatch" as const, "file:///etc/passwd"],
+      ["langwatch" as const, "https://langwatch.ai/scenario/llms.txt"],
+      ["langwatch" as const, "https://langwatch.ai/docs-evil/page.md"],
+      ["scenario" as const, "https://langwatch.ai/docs/llms.txt"],
+      ["scenario" as const, "https://langwatch.ai/scenario-evil/page.md"],
+      ["langwatch" as const, "https://langwatch.ai/docs/../scenario/llms.txt"],
+    ])("rejects untrusted %s documentation URL %s", (kind, input) => {
+      expect(() => resolveDocumentationUrl(kind, input)).toThrow(/trusted LangWatch documentation URL/);
+    });
+  });
+
+  /** @scenario Documentation fetches do not follow redirects */
+  it("disables redirects and bounds trusted documentation fetches", async () => {
+    let receivedRedirectMode: RequestRedirect | undefined;
+    let receivedSignal: AbortSignal | null | undefined;
+    const fetchForTest: typeof fetch = async (_input, init) => {
+      receivedRedirectMode = init?.redirect;
+      receivedSignal = init?.signal;
+      return new Response("# documentation");
+    };
+
+    const text = await fetchDocumentation("langwatch", "https://langwatch.ai/docs/llms.txt", fetchForTest);
+
+    expect(text).toBe("# documentation");
+    expect(receivedRedirectMode).toBe("error");
+    expect(receivedSignal).toBeInstanceOf(AbortSignal);
+  });
+
+  it("rejects non-document responses from the trusted origin", async () => {
+    const fetchForTest: typeof fetch = async () =>
+      new Response("<html>unexpected</html>", {
+        headers: { "Content-Type": "text/html" },
+      });
+
+    await expect(fetchDocumentation("langwatch", "https://langwatch.ai/docs/llms.txt", fetchForTest)).rejects.toThrow(
+      /unexpected content type/
+    );
+  });
+
+  describe("HTTP tool transport", () => {
+    let mcpServer: Server;
+    let targetServer: Server;
+    let mcpPort: number;
+    let targetPort: number;
+    let sessionId: string;
+    let targetHits = 0;
+    let rpcId = 10;
+
+    beforeAll(async () => {
+      targetServer = createServer((_request, response) => {
+        targetHits += 1;
+        response.end("internal-only response");
+      });
+      await new Promise<void>((resolve) => {
+        targetServer.listen(0, "127.0.0.1", resolve);
+      });
+      const targetAddress = targetServer.address();
+      targetPort = typeof targetAddress === "object" && targetAddress ? targetAddress.port : 0;
+
+      initConfig({ endpoint: "https://app.langwatch.ai" });
+      const { startHttpServer } = await import("../http-server.js");
+      const started = await startHttpServer({ port: 0 });
+      mcpServer = started.server;
+      mcpPort = started.port;
+
+      const initializeResponse = await fetch(`http://127.0.0.1:${mcpPort}/mcp`, {
+        method: "POST",
+        headers: MCP_HEADERS,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "initialize",
+          params: {
+            protocolVersion: "2025-03-26",
+            capabilities: {},
+            clientInfo: { name: "security-test", version: "1.0.0" },
+          },
+        }),
+      });
+      sessionId = initializeResponse.headers.get("mcp-session-id") ?? "";
+      expect(sessionId).not.toBe("");
+
+      await fetch(`http://127.0.0.1:${mcpPort}/mcp`, {
+        method: "POST",
+        headers: { ...MCP_HEADERS, "mcp-session-id": sessionId },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          method: "notifications/initialized",
+        }),
+      });
+    });
+
+    afterAll(async () => {
+      await Promise.all([
+        new Promise<void>((resolve, reject) => {
+          mcpServer.close((error) => (error ? reject(error) : resolve()));
+        }),
+        new Promise<void>((resolve, reject) => {
+          targetServer.close((error) => (error ? reject(error) : resolve()));
+        }),
+      ]);
+    });
+
+    async function callDocumentationTool(
+      name: "fetch_langwatch_docs" | "fetch_scenario_docs",
+      url: string
+    ): Promise<string> {
+      const response = await fetch(`http://127.0.0.1:${mcpPort}/mcp`, {
+        method: "POST",
+        headers: { ...MCP_HEADERS, "mcp-session-id": sessionId },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: rpcId++,
+          method: "tools/call",
+          params: { name, arguments: { url } },
+        }),
+      });
+
+      expect(response.status).toBe(200);
+      return response.text();
+    }
+
+    it.each(["fetch_langwatch_docs" as const, "fetch_scenario_docs" as const])(
+      "blocks %s from reaching a loopback HTTP server",
+      async (tool) => {
+        const hitsBefore = targetHits;
+        const body = await callDocumentationTool(tool, `http://127.0.0.1:${targetPort}/secrets`);
+
+        expect(body).toContain("trusted LangWatch documentation URL");
+        expect(targetHits).toBe(hitsBefore);
+      }
+    );
+
+    it("blocks cross-namespace fetches through the real MCP handler", async () => {
+      const body = await callDocumentationTool("fetch_langwatch_docs", "https://langwatch.ai/scenario/llms.txt");
+
+      expect(body).toContain("trusted LangWatch documentation URL");
+    });
+  });
+});