@langwatch/mcp-server 1.0.0 → 2.0.0

package/src/index.ts

@@ -24,6 +24,17 @@ const argv = await yargs(hideBin(process.argv))
     description: "HTTP server port (only used with --http)",
     default: 3000,
   })
+  .option("host", {
+    type: "string",
+    description:
+      "HTTP listen address (only used with --http). Defaults to loopback; pass 0.0.0.0 to accept connections from other machines",
+  })
+  .option("allowedOrigin", {
+    type: "array",
+    string: true,
+    description:
+      "Browser origin allowed to call the HTTP server, repeatable. Loopback origins are always allowed",
+  })
   .help()
   .parseAsync();
 
@@ -34,11 +45,47 @@ initConfig({
 
 if (argv.http) {
   const { startHttpServer } = await import("./http-server.js");
-  const { port } = await startHttpServer({ port: argv.port });
-  console.log(`LangWatch MCP server listening on http://0.0.0.0:${port}/mcp`);
+  const { isLoopbackHost, parseAllowedOrigins } = await import(
+    "./http-security.js"
+  );
+
+  const allowedOrigins =
+    argv.allowedOrigin && argv.allowedOrigin.length > 0
+      ? parseAllowedOrigins(argv.allowedOrigin.join(","))
+      : undefined;
+
+  const { port, host } = await startHttpServer({
+    port: argv.port,
+    host: argv.host,
+    allowedOrigins,
+  });
+
+  // An IPv6 literal has to be bracketed inside a URL, and must not be
+  // double-bracketed when the operator already wrote it that way.
+  const displayHost =
+    host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  console.log(
+    `LangWatch MCP server listening on http://${displayHost}:${port}/mcp`
+  );
   console.log(
     "Clients must provide their API key via Authorization: Bearer <key> header"
   );
+  if (!isLoopbackHost(host)) {
+    console.warn(
+      `Warning: bound to ${host}, so the server is reachable from other machines. ` +
+        "Make sure it sits behind a trusted network boundary and that --allowedOrigin " +
+        "lists only origins you control."
+    );
+  }
+  if (process.env.LANGWATCH_MCP_TRUST_PROXY === "true") {
+    console.warn(
+      "Warning: LANGWATCH_MCP_TRUST_PROXY=true, so the rate limit on failed " +
+        "authentication uses the client address from X-Forwarded-For. Keep this " +
+        "on only when a trusted proxy terminates in front of the port and " +
+        "overwrites that header. Otherwise a client can supply any address there " +
+        "and the limit stops counting."
+    );
+  }
 } else {
   const transport = new StdioServerTransport();
   const server = createMcpServer();

package/src/tools/discover-evaluator-schema.ts

@@ -1,5 +1,5 @@
-import { AVAILABLE_EVALUATORS } from "../../../langevals/ts-integration/evaluators.generated.js";
-import type { EvaluatorDefinition, EvaluatorTypes } from "../../../langevals/ts-integration/evaluators.generated.js";
+import { AVAILABLE_EVALUATORS } from "../../../../services/langevals/ts-integration/evaluators.generated.js";
+import type { EvaluatorDefinition, EvaluatorTypes } from "../../../../services/langevals/ts-integration/evaluators.generated.js";
 
 /**
  * Formats evaluator schema information for the discover_schema tool.

package/tsconfig.json

@@ -13,8 +13,8 @@
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true,
     "moduleResolution": "bundler",
-    "rootDir": "..",
-    // The evaluator catalog we import (langevals/ts-integration/evaluators.generated.ts)
+    "rootDir": "../..",
+    // The evaluator catalog we import (services/langevals/ts-integration/evaluators.generated.ts)
     // is Zod-first and imports `zod`, but lives outside this package's
     // node_modules tree, so plain resolution cannot find it. Point `zod` at this
     // package's own copy (a declared dependency) so the type-checker resolves it.

package/uv.lock

@@ -967,7 +967,7 @@ wheels = [
 [[package]]
 name = "langwatch"
 version = "0.26.0"
-source = { editable = "../python-sdk" }
+source = { editable = "../../sdks/python" }
 dependencies = [
     { name = "attrs" },
     { name = "coolname" },
@@ -1210,7 +1210,7 @@ dependencies = [
 [package.metadata]
 requires-dist = [
     { name = "ipykernel", specifier = ">=6.30.1" },
-    { name = "langwatch", editable = "../python-sdk" },
+    { name = "langwatch", editable = "../../sdks/python" },
     { name = "litellm", specifier = ">=1.84.0" },
     { name = "mcp", extras = ["cli"], specifier = ">=1.13.1" },
     { name = "pandas", specifier = ">=2.3.2" },

package/dist/langwatch-api-workflows-5HRZ7HR4.js

@@ -1,16 +0,0 @@
-import {
-  deleteWorkflow,
-  getWorkflow,
-  listWorkflows,
-  runWorkflow
-} from "./chunk-T7WJVS2N.js";
-import "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
-export {
-  deleteWorkflow,
-  getWorkflow,
-  listWorkflows,
-  runWorkflow
-};
-//# sourceMappingURL=langwatch-api-workflows-5HRZ7HR4.js.map

package/pnpm-workspace.yaml

@@ -1,34 +0,0 @@
-# Standalone workspace: mcp-server is installed on its own in CI, the
-# release workflow, and its Dockerfile. Shared source-only contract packages
-# are bundled by tsup for publish.
-packages:
-  - .
-  - ../packages/handled-error
-  - ../langwatch/packages/redaction
-  - ../langwatch/packages/ssrf
-
-minimumReleaseAge: 10080
-
-overrides:
-  # Security: protobufjs code execution + prototype-pollution + DoS + Any-expansion DoS + property shadowing
-  # (GHSA-xq3m-2v4x-88gg, GHSA-66ff-xgx4-vchm, GHSA-75px-5xx7-5xc7,
-  # GHSA-jvwf-75h9-cwgg, GHSA-685m-2w69-288q, GHSA-wcpc-wj8m-hjx6, GHSA-f38q-mgvj-vph7)
-  "protobufjs": ">=7.5.6 <8.0.0 || >=8.6.0"
-  # Security: langsmith untrusted manifest deserialization (GHSA-3644-q5cj-c5c7).
-  # langsmith is only a transitive of the @langwatch/scenario devDependency
-  # (via langchain / @langchain/core); pinned to a known-safe version.
-  "langsmith": "0.6.0"
-  # Security: esbuild Deno binary integrity RCE + dev-server file read (GHSA-gv7w-rqvm-qjhr / GHSA-g7r4-m6w7-qqqr)
-  "esbuild@<0.28.1": ">=0.28.1"
-  # Security: vite dev-server file read / middleware path bypass
-  "vite@>=7.0.0 <7.3.5": ">=7.3.5 <8"
-  # Security: hono request smuggling / path confusion
-  "hono@<4.12.25": ">=4.12.25"
-  # Security: fast-uri path traversal + host confusion
-  "fast-uri@<3.1.2": "3.1.2"
-  liquidjs: ">=10.26.0"
-  # Security: uuid missing buffer bounds check in v3/v5/v6 (GHSA-w5hq-g745-h8pq)
-  "uuid@<11.1.1": ">=11.1.1 <12"
-
-onlyBuiltDependencies:
-  - node-pty