@langwatch/mcp-server 0.10.1 → 2.0.0

package/dist/{update-suite-JJTNOTXN.js → update-suite-SNO3GS7T.js}

@@ -1,8 +1,9 @@
 import {
   updateSuite
-} from "./chunk-UKRCZJJC.js";
-import "./chunk-CAY57CKF.js";
-import "./chunk-KOO5733S.js";
+} from "./chunk-YZLYHLLI.js";
+import "./chunk-A2LEVYQ5.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/update-suite.ts
 async function handleUpdateSuite(params) {
@@ -36,4 +37,4 @@ async function handleUpdateSuite(params) {
 export {
   handleUpdateSuite
 };
-//# sourceMappingURL=update-suite-JJTNOTXN.js.map
+//# sourceMappingURL=update-suite-SNO3GS7T.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@langwatch/mcp-server",
-  "version": "0.10.1",
+  "version": "2.0.0",
   "description": "An MCP server for Langwatch.",
   "type": "module",
   "main": "./dist/index.js",
@@ -36,36 +36,38 @@
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.44",
-    "@anthropic-ai/claude-code": "^2.1.119",
+    "@anthropic-ai/claude-code": "2.1.202",
     "@eslint/js": "^10.0.1",
     "@langwatch/scenario": "^0.4.6",
-    "@types/debug": "^4.1.12",
-    "@types/eslint__js": "^8.42.3",
+    "@opentelemetry/context-async-hooks": "^2.1.0",
+    "@opentelemetry/sdk-node": "^0.219.0",
+    "@types/debug": "^4.1.13",
     "@types/express": "^5.0.6",
     "@types/node": "^25.6.0",
     "@types/yargs": "^17.0.33",
-    "@typescript/native-preview": "7.0.0-dev.20250911.1",
+    "@typescript/native-preview": "7.0.0-dev.20260705.1",
     "ai": "^6.0.161",
+    "chalk": "^5.6.2",
+    "date-fns": "^4.1.0",
     "dotenv": "^17.2.2",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.1",
     "eslint": "^10.2.1",
+    "express": "^5.2.1",
+    "node-pty": "^1.0.0",
     "tsup": "^8.1.0",
     "tsx": "^4.20.5",
     "typescript": "^5.0.0",
-    "typescript-eslint": "^8.55.0"
+    "typescript-eslint": "^8.55.0",
+    "vitest": "^4.1.8",
+    "yargs": "^18.0.0",
+    "zod-validation-error": "^5.0.0",
+    "@langwatch/redaction": "0.0.1",
+    "@langwatch/ssrf": "0.0.1",
+    "@langwatch/handled-error": "0.1.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    "@opentelemetry/context-async-hooks": "^2.1.0",
-    "@opentelemetry/sdk-node": "^0.217.0",
-    "chalk": "^5.6.2",
-    "date-fns": "^4.1.0",
-    "express": "^5.2.1",
-    "node-pty": "^1.0.0",
-    "vitest": "^3.2.4",
-    "yargs": "^17.7.2",
-    "zod": "^4.3.6",
-    "zod-validation-error": "^5.0.0"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.3.6"
   },
   "bin": {
     "langwatch-mcp-server": "./dist/index.js"

package/pyproject.toml

@@ -7,7 +7,7 @@ requires-python = ">=3.11"
 dependencies = [
     "ipykernel>=6.30.1",
     "langwatch",
-    "litellm>=1.77.0",
+    "litellm>=1.84.0",
     "mcp[cli]>=1.13.1",
     "pandas>=2.3.2",
     "tenacity>=9.1.2",
@@ -16,5 +16,13 @@ dependencies = [
 [tool.uv]
 exclude-newer = "7 days"
 
+# Transitive-dependency security pins. Keep these even when the importing
+# package isn't a direct dependency, so a future re-resolution can't silently
+# pull a vulnerable version back in.
+constraint-dependencies = [
+    "python-dotenv>=1.2.2",  # security: python-dotenv advisory (#934)
+    "python-liquid>=2.2.1",  # security: python-liquid advisory (#1528)
+]
+
 [tool.uv.sources]
-langwatch = { path = "../python-sdk", editable = true }
+langwatch = { path = "../../sdks/python", editable = true }

package/src/__tests__/all-tools.integration.test.ts

@@ -1,6 +1,10 @@
 import { createServer, type Server } from "http";
 import { afterAll, beforeAll, describe, expect, it, vi, beforeEach } from "vitest";
 import { initConfig } from "../config.js";
+import {
+  fetchDocumentation,
+  resolveDocumentationUrl,
+} from "../documentation-fetch.js";
 
 // --- Canned responses for every API endpoint ---
 
@@ -14,6 +18,14 @@ const CANNED_TRACES_SEARCH = {
       output: { value: "I am fine, thank you!" },
       timestamps: { started_at: 1700000000000 },
       metadata: { user_id: "user-42", thread_id: "thread-1" },
+      evaluations: [
+        {
+          evaluator_id: "eval-1",
+          name: "Faithfulness",
+          score: 0.95,
+          passed: true,
+        },
+      ],
     },
   ],
   pagination: { totalHits: 1 },
@@ -616,7 +628,6 @@ function createMockServer(): Server {
 describe("All MCP tools integration", () => {
   let server: Server;
   let port: number;
-  let originalFetch: typeof globalThis.fetch;
 
   beforeAll(async () => {
     server = createMockServer();
@@ -631,94 +642,41 @@ describe("All MCP tools integration", () => {
         resolve();
       });
     });
-    originalFetch = globalThis.fetch;
   });
 
   afterAll(async () => {
     await new Promise<void>((resolve) => server.close(() => resolve()));
-    globalThis.fetch = originalFetch;
   });
 
   // =====================
   // 1. fetch_langwatch_docs
   // =====================
   describe("fetch_langwatch_docs", () => {
-    describe("when fetching the docs index", () => {
-      it("returns content from the langwatch docs URL", async () => {
-        // Intercept fetch to avoid hitting the real network
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () =>
-            Promise.resolve(
-              "# LangWatch Docs\nWelcome to LangWatch documentation.",
-            ),
-        });
-        globalThis.fetch = mockFetch;
-
-        // The tool is inlined in index.ts; call the same logic directly
-        const url = "https://langwatch.ai/docs/llms.txt";
-        const response = await fetch(url);
-        const text = await response.text();
-
-        expect(text).toContain("LangWatch");
-        expect(mockFetch).toHaveBeenCalledWith(url);
-
-        globalThis.fetch = originalFetch;
-      });
-    });
-
-    describe("when fetching a specific doc page", () => {
-      it("appends .md extension when missing", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () => Promise.resolve("# Integration Guide"),
-        });
-        globalThis.fetch = mockFetch;
-
-        let urlToFetch = "https://langwatch.ai/docs/integration";
-        if (
-          !urlToFetch.endsWith(".md") &&
-          !urlToFetch.endsWith(".txt")
-        ) {
-          urlToFetch += ".md";
-        }
-
-        const response = await fetch(urlToFetch);
-        const text = await response.text();
-
-        expect(text).toContain("Integration Guide");
-        expect(mockFetch).toHaveBeenCalledWith(
-          "https://langwatch.ai/docs/integration.md",
-        );
-
-        globalThis.fetch = originalFetch;
-      });
+    it("resolves the trusted docs index", () => {
+      expect(resolveDocumentationUrl("langwatch").toString()).toBe(
+        "https://langwatch.ai/docs/llms.txt",
+      );
     });
 
-    describe("when a relative path is provided", () => {
-      it("prepends the docs base URL", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () => Promise.resolve("# Getting Started"),
-        });
-        globalThis.fetch = mockFetch;
-
-        let urlToFetch: string | undefined = "/getting-started";
-        if (urlToFetch && !urlToFetch.endsWith(".md") && !urlToFetch.endsWith(".txt")) {
-          urlToFetch += ".md";
-        }
-        if (!urlToFetch!.startsWith("http")) {
-          if (!urlToFetch!.startsWith("/")) {
-            urlToFetch = "/" + urlToFetch;
-          }
-          urlToFetch = "https://langwatch.ai/docs" + urlToFetch;
-        }
-
-        await fetch(urlToFetch);
+    it("fetches trusted docs without following redirects", async () => {
+      const mockFetch = vi.fn().mockResolvedValue(
+        new Response("# Integration Guide"),
+      );
 
-        expect(mockFetch).toHaveBeenCalledWith(
-          "https://langwatch.ai/docs/getting-started.md",
-        );
+      const text = await fetchDocumentation(
+        "langwatch",
+        "integration",
+        mockFetch,
+      );
 
-        globalThis.fetch = originalFetch;
-      });
+      expect(text).toContain("Integration Guide");
+      expect(mockFetch).toHaveBeenCalledWith(
+        new URL("https://langwatch.ai/docs/integration.md"),
+        {
+          redirect: "error",
+          signal: expect.any(AbortSignal),
+        },
+      );
     });
   });
 
@@ -726,53 +684,16 @@ describe("All MCP tools integration", () => {
   // 2. fetch_scenario_docs
   // =====================
   describe("fetch_scenario_docs", () => {
-    describe("when fetching the scenario docs index", () => {
-      it("returns content from the scenario docs URL", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () =>
-            Promise.resolve(
-              "# Scenario Testing\nLearn how to test agents.",
-            ),
-        });
-        globalThis.fetch = mockFetch;
-
-        const url = "https://langwatch.ai/scenario/llms.txt";
-        const response = await fetch(url);
-        const text = await response.text();
-
-        expect(text).toContain("Scenario Testing");
-        expect(mockFetch).toHaveBeenCalledWith(url);
-
-        globalThis.fetch = originalFetch;
-      });
+    it("resolves the trusted Scenario docs index", () => {
+      expect(resolveDocumentationUrl("scenario").toString()).toBe(
+        "https://langwatch.ai/scenario/llms.txt",
+      );
     });
 
-    describe("when fetching a specific scenario doc page", () => {
-      it("appends .md extension and prepends base URL for relative paths", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-          text: () => Promise.resolve("# Setup Guide"),
-        });
-        globalThis.fetch = mockFetch;
-
-        let urlToFetch: string | undefined = "setup";
-        if (urlToFetch && !urlToFetch.endsWith(".md") && !urlToFetch.endsWith(".txt")) {
-          urlToFetch += ".md";
-        }
-        if (!urlToFetch!.startsWith("http")) {
-          if (!urlToFetch!.startsWith("/")) {
-            urlToFetch = "/" + urlToFetch;
-          }
-          urlToFetch = "https://langwatch.ai/scenario" + urlToFetch;
-        }
-
-        await fetch(urlToFetch);
-
-        expect(mockFetch).toHaveBeenCalledWith(
-          "https://langwatch.ai/scenario/setup.md",
-        );
-
-        globalThis.fetch = originalFetch;
-      });
+    it("normalizes a relative Scenario docs path", () => {
+      expect(resolveDocumentationUrl("scenario", "setup").toString()).toBe(
+        "https://langwatch.ai/scenario/setup.md",
+      );
     });
   });
 
@@ -976,6 +897,21 @@ describe("All MCP tools integration", () => {
         });
       });
     });
+
+    describe("given a trace has evaluation results", () => {
+      /** @scenario Agent searches traces and sees evaluation results without a follow-up call */
+      it("includes evaluation status in the digest without a follow-up call", async () => {
+        const { handleSearchTraces } = await import(
+          "../tools/search-traces.js"
+        );
+        const result = await handleSearchTraces({
+          startDate: "24h",
+          endDate: "now",
+        });
+
+        expect(result).toContain("- **Faithfulness**: PASSED (score: 0.95)");
+      });
+    });
   });
 
   // =====================

package/src/__tests__/config.unit.test.ts

@@ -58,6 +58,39 @@ describe("config", () => {
     });
   });
 
+  describe("when the endpoint carries a trailing slash", () => {
+    it("strips it from a CLI endpoint", () => {
+      initConfig({ endpoint: "https://cli.example.com/" });
+      expect(getConfig().endpoint).toBe("https://cli.example.com");
+    });
+
+    it("trims whitespace around a CLI endpoint", () => {
+      initConfig({ endpoint: "  https://cli.example.com///  " });
+      expect(getConfig().endpoint).toBe("https://cli.example.com");
+    });
+
+    it("strips repeated slashes from the env var", () => {
+      process.env.LANGWATCH_ENDPOINT = "http://localhost:5560///";
+      initConfig({});
+      expect(getConfig().endpoint).toBe("http://localhost:5560");
+    });
+
+    it("keeps the built request path free of a double slash", () => {
+      initConfig({ endpoint: "https://app.langwatch.ai/" });
+      expect(`${getConfig().endpoint}/api/bug-reports`).toBe(
+        "https://app.langwatch.ai/api/bug-reports",
+      );
+    });
+  });
+
+  describe("when the endpoint is blank", () => {
+    it("falls back to the default rather than an empty base url", () => {
+      process.env.LANGWATCH_ENDPOINT = "   ";
+      initConfig({});
+      expect(getConfig().endpoint).toBe("https://app.langwatch.ai");
+    });
+  });
+
   describe("when no args or env vars are provided", () => {
     it("defaults endpoint to https://app.langwatch.ai", () => {
       initConfig({});

package/src/__tests__/docker.integration.test.ts

@@ -4,7 +4,16 @@ import { execSync } from "child_process";
 const IMAGE_NAME = "langwatch-mcp-server-test";
 const CONTAINER_NAME = "langwatch-mcp-server-test-container";
 const HOST_PORT = 13099; // unlikely to conflict
-const BEARER_TOKEN = "test-docker-api-key";
+
+/**
+ * HTTP mode verifies the bearer against the LangWatch API before creating a
+ * session, so the authenticated paths need a key the API actually accepts.
+ * Without one, this file still covers startup, CORS, and rejection.
+ */
+const BEARER_TOKEN = process.env.LANGWATCH_API_KEY;
+
+/** A syntactically fine token that the LangWatch API does not know. */
+const BOGUS_TOKEN = "totally-not-a-real-key";
 
 /** Standard headers required by the MCP Streamable HTTP protocol */
 const MCP_POST_HEADERS = {
@@ -20,7 +29,7 @@ describe("Docker container", () => {
       // Build from repo root (mcp-server needs langevals/ for build)
       const repoRoot = process.cwd().replace(/\/mcp-server.*$/, "");
       execSync(
-        `docker build -t ${IMAGE_NAME} -f mcp-server/Dockerfile .`,
+        `docker build -t ${IMAGE_NAME} -f mcp/typescript/Dockerfile .`,
         {
           cwd: repoRoot,
           stdio: "pipe",
@@ -85,11 +94,86 @@ describe("Docker container", () => {
     expect(body.status).toBe("ok");
   });
 
-  it("CORS headers are present", async () => {
+  it("does not answer with a wildcard CORS origin", async () => {
     if (!containerRunning) return;
 
     const res = await fetch(`http://localhost:${HOST_PORT}/health`);
-    expect(res.headers.get("access-control-allow-origin")).toBe("*");
+    expect(res.headers.get("access-control-allow-origin")).not.toBe("*");
+  });
+
+  it("reflects an allowed origin and rejects an unlisted one", async () => {
+    if (!containerRunning) return;
+
+    const allowed = await fetch(`http://localhost:${HOST_PORT}/health`, {
+      headers: { Origin: "http://localhost:5173" },
+    });
+    expect(allowed.status).toBe(200);
+    expect(allowed.headers.get("access-control-allow-origin")).toBe(
+      "http://localhost:5173"
+    );
+
+    const rejected = await fetch(`http://localhost:${HOST_PORT}/health`, {
+      headers: { Origin: "https://attacker.example" },
+    });
+    expect(rejected.status).toBe(403);
+  });
+
+  it("rejects a bearer the LangWatch API does not recognise", async () => {
+    if (!containerRunning) return;
+
+    const res = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
+      method: "POST",
+      headers: {
+        ...MCP_POST_HEADERS,
+        Authorization: `Bearer ${BOGUS_TOKEN}`,
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-03-26",
+          capabilities: {},
+          clientInfo: { name: "docker-test", version: "1.0.0" },
+        },
+      }),
+    });
+
+    expect(res.status).toBe(401);
+    expect(res.headers.get("mcp-session-id")).toBeNull();
+  });
+
+  it("rejects a session id presented without a bearer token", async () => {
+    if (!containerRunning || !BEARER_TOKEN) return;
+
+    const initRes = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
+      method: "POST",
+      headers: {
+        ...MCP_POST_HEADERS,
+        Authorization: `Bearer ${BEARER_TOKEN}`,
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-03-26",
+          capabilities: {},
+          clientInfo: { name: "docker-test", version: "1.0.0" },
+        },
+      }),
+    });
+    const sessionId = initRes.headers.get("mcp-session-id");
+    expect(sessionId).toBeTruthy();
+    await initRes.text();
+
+    const res = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
+      method: "POST",
+      headers: { ...MCP_POST_HEADERS, "mcp-session-id": sessionId! },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
+    });
+
+    expect(res.status).toBe(401);
   });
 
   it("returns 401 on initialize without Bearer token", async () => {
@@ -116,7 +200,7 @@ describe("Docker container", () => {
   });
 
   it("MCP initialize works with Bearer token", async () => {
-    if (!containerRunning) return;
+    if (!containerRunning || !BEARER_TOKEN) return;
 
     const res = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
       method: "POST",
@@ -146,7 +230,7 @@ describe("Docker container", () => {
   });
 
   it("lists tools after initialization with Bearer token", async () => {
-    if (!containerRunning) return;
+    if (!containerRunning || !BEARER_TOKEN) return;
 
     // Initialize a session
     const initRes = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
@@ -205,7 +289,7 @@ describe("Docker container", () => {
   });
 
   it("legacy SSE endpoint responds with Bearer token", async () => {
-    if (!containerRunning) return;
+    if (!containerRunning || !BEARER_TOKEN) return;
 
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 5000);