@langwatch/mcp-server 2.0.0 → 2.2.0

package/src/__tests__/public-http-request-security.integration.test.ts

@@ -1,118 +0,0 @@
-import { createServer, type Server } from "node:http";
-import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-
-import {
-  headersForRedirect,
-  requestPublicJson,
-  resolvePublicDestination,
-} from "../public-http-request.js";
-
-describe("public HTTP request security", () => {
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  /** @scenario Running an HTTP agent rejects unsafe destinations */
-  it.each([
-    "http://127.0.0.1/secrets",
-    "http://2130706433/secrets",
-    "http://169.254.169.254/latest/meta-data/",
-    "http://10.0.0.1/internal",
-    "http://[::1]/secrets",
-    "file:///etc/passwd",
-    "http://user:password@example.com/",
-  ])("rejects unsafe destination %s", async (url) => {
-    await expect(resolvePublicDestination(url)).rejects.toThrow(/globally routable public addresses/);
-  });
-
-  it("fails closed when any resolved address is not public", async () => {
-    await expect(
-      resolvePublicDestination("https://agent.example/run", async () => [
-        { address: "93.184.216.34", family: 4 },
-        { address: "10.0.0.4", family: 4 },
-      ])
-    ).rejects.toThrow(/globally routable public addresses/);
-  });
-
-  it("pins a validated public destination", async () => {
-    await expect(
-      resolvePublicDestination("https://agent.example/run", async () => [{ address: "93.184.216.34", family: 4 }])
-    ).resolves.toMatchObject({
-      address: "93.184.216.34",
-      family: 4,
-    });
-  });
-
-  it("bounds DNS resolution time", async () => {
-    vi.useFakeTimers();
-    const resolution = resolvePublicDestination(
-      "https://agent.example/run",
-      () => new Promise(() => undefined)
-    );
-    const rejection = expect(resolution).rejects.toThrow(
-      /destination could not be resolved/
-    );
-
-    await vi.advanceTimersByTimeAsync(30_000);
-
-    await rejection;
-  });
-
-  /** @scenario HTTP agent redirects are revalidated */
-  it("rejects private redirect targets and strips cross-origin secrets", async () => {
-    await expect(
-      resolvePublicDestination("http://127.0.0.1/redirect-target")
-    ).rejects.toThrow(/globally routable public addresses/);
-
-    expect(
-      headersForRedirect(
-        {
-          Authorization: "Bearer secret",
-          Cookie: "session=secret",
-          "Content-Type": "application/json",
-          "X-Api-Key": "secret",
-          "X-Request-Id": "request-1",
-        },
-        true
-      )
-    ).toEqual({
-      "Content-Type": "application/json",
-      "X-Request-Id": "request-1",
-    });
-  });
-
-  describe("real HTTP request", () => {
-    let server: Server;
-    let port: number;
-    let hits = 0;
-
-    beforeAll(async () => {
-      server = createServer((_request, response) => {
-        hits += 1;
-        response.setHeader("Content-Type", "application/json");
-        response.end(JSON.stringify({ secret: true }));
-      });
-      await new Promise<void>((resolve) => {
-        server.listen(0, "127.0.0.1", resolve);
-      });
-      const address = server.address();
-      port = typeof address === "object" && address ? address.port : 0;
-    });
-
-    afterAll(async () => {
-      await new Promise<void>((resolve, reject) => {
-        server.close((error) => (error ? reject(error) : resolve()));
-      });
-    });
-
-    it("blocks loopback before opening a connection", async () => {
-      await expect(
-        requestPublicJson(`http://127.0.0.1:${port}/secrets`, {
-          method: "POST",
-          body: "{}",
-        })
-      ).rejects.toThrow(/globally routable public addresses/);
-      expect(hits).toBe(0);
-    });
-  });
-});

package/src/__tests__/report-issue.integration.test.ts

@@ -1,147 +0,0 @@
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import {
-  afterAll,
-  beforeAll,
-  beforeEach,
-  describe,
-  expect,
-  it,
-} from "vitest";
-import { initConfig } from "../config.js";
-import { createMcpServer } from "../create-mcp-server.js";
-import { handleReportIssue } from "../tools/report-issue.js";
-
-/**
- * Integration tests for the report_issue tool against a REAL local HTTP
- * server. Corresponds to specs/mcp-server/report-issue-tool.feature.
- */
-describe("report_issue", () => {
-  let server: Server;
-  let endpoint: string;
-  let received: { headers: Record<string, unknown>; body: any }[];
-
-  beforeAll(async () => {
-    server = createServer((req, res) => {
-      let data = "";
-      req.on("data", (chunk: Buffer) => (data += chunk.toString()));
-      req.on("end", () => {
-        received.push({ headers: { ...req.headers }, body: JSON.parse(data) });
-        res.writeHead(201, { "content-type": "application/json" });
-        res.end(JSON.stringify({ id: "report-mcp-1" }));
-      });
-    });
-    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
-    endpoint = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
-  });
-
-  afterAll(async () => {
-    await new Promise((resolve) => server.close(resolve));
-  });
-
-  beforeEach(() => {
-    received = [];
-    initConfig({ endpoint, apiKey: undefined });
-  });
-
-  describe("given the registered tool set", () => {
-    /** @scenario "The report tool is listed with an agent-facing description" */
-    it("lists report_issue with the agent-facing consent description", () => {
-      const server = createMcpServer();
-      const tools = (
-        server as unknown as {
-          _registeredTools: Record<string, { description?: string }>;
-        }
-      )._registeredTools;
-      expect(Object.keys(tools)).toContain("report_issue");
-      const description = tools.report_issue?.description ?? "";
-      expect(description).toMatch(/whenever you struggled/i);
-      expect(description).toMatch(/ask the user for permission first/i);
-    });
-  });
-
-  describe("given the user did not approve sending", () => {
-    /** @scenario "Calls without user approval are rejected with instructions" */
-    it("refuses with instructions to ask the user first", async () => {
-      await expect(
-        handleReportIssue({
-          user_approved: false,
-          title: "broken tool",
-          summary: "search_traces 500s",
-        }),
-      ).rejects.toThrow(/ask the user/i);
-      expect(received).toHaveLength(0);
-    });
-  });
-
-  describe("given nothing to report", () => {
-    it("asks for a summary or session content", async () => {
-      await expect(
-        handleReportIssue({ user_approved: true, title: "empty" }),
-      ).rejects.toThrow(/Nothing to report/);
-    });
-  });
-
-  describe("when the user approved a summary report", () => {
-    /** @scenario "Reporting an issue through MCP reaches the LangWatch backend" */
-    it("delivers it marked as coming from MCP and returns a thank-you", async () => {
-      const text = await handleReportIssue({
-        user_approved: true,
-        title: "evaluator setup confusing",
-        summary: "the evaluator wizard 404s on step 2",
-        agent: "claude-code",
-      });
-
-      expect(received).toHaveLength(1);
-      expect(received[0]?.body.source).toBe("mcp");
-      expect(received[0]?.body.kind).toBe("summary");
-      expect(received[0]?.body.title).toBe("evaluator setup confusing");
-      expect(text).toContain("report-mcp-1");
-      expect(text.toLowerCase()).toContain("thank you");
-    });
-  });
-
-  describe("when the title itself includes a secret", () => {
-    it("redacts it before sending", async () => {
-      await handleReportIssue({
-        user_approved: true,
-        title: "X-Api-Key sk-proj-abcdefghijklmnopqrstuvwxyz123456 rejected",
-        summary: "the key was rejected",
-      });
-      expect(received[0]?.body.title).toBe("X-Api-Key [SECRET] rejected");
-    });
-  });
-
-  describe("when session content includes secrets", () => {
-    /** @scenario "Session content passed through MCP is redacted before sending" */
-    it("redacts them locally before sending", async () => {
-      await handleReportIssue({
-        user_approved: true,
-        title: "agent stuck",
-        session_content: JSON.stringify({
-          role: "user",
-          content: "my key sk-proj-abcdefghijklmnopqrstuvwxyz123456 failed",
-        }),
-      });
-
-      const wire = JSON.stringify(received[0]?.body);
-      expect(wire).not.toContain("sk-proj-abcdefghijklmnopqrstuvwxyz123456");
-      expect(received[0]?.body.sessionData).toContain("[SECRET]");
-      expect(received[0]?.body.kind).toBe("full_session");
-    });
-  });
-
-  describe("when an API key is configured", () => {
-    it("attaches it so the report links to the project", async () => {
-      initConfig({ endpoint, apiKey: "sk-lw-mcp-key-abcdef1234567890" });
-      await handleReportIssue({
-        user_approved: true,
-        title: "linked",
-        summary: "linked report",
-      });
-      expect(received[0]?.headers.authorization).toBe(
-        "Bearer sk-lw-mcp-key-abcdef1234567890",
-      );
-    });
-  });
-});

package/src/__tests__/scenario-tools.integration.test.ts

@@ -1,286 +0,0 @@
-import { createServer, type Server } from "http";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { initConfig } from "../config.js";
-
-// --- Canned responses for scenario API endpoints ---
-
-const CANNED_SCENARIOS_LIST = [
-  {
-    id: "scen_abc123",
-    name: "Login Flow Happy Path",
-    situation: "User attempts to log in with valid credentials",
-    criteria: ["Responds with a welcome message", "Includes user name in greeting"],
-    labels: ["auth", "happy-path"],
-  },
-  {
-    id: "scen_def456",
-    name: "Password Reset",
-    situation: "User requests a password reset link",
-    criteria: ["Sends reset email"],
-    labels: ["auth"],
-  },
-];
-
-const CANNED_SCENARIO_DETAIL = {
-  id: "scen_abc123",
-  name: "Login Flow Happy Path",
-  situation: "User attempts to log in with valid credentials",
-  criteria: ["Responds with a welcome message", "Includes user name in greeting"],
-  labels: ["auth", "happy-path"],
-};
-
-const CANNED_SCENARIO_CREATED = {
-  id: "scen_new789",
-  name: "Login Flow Happy Path",
-  situation: "User attempts to log in with valid creds",
-  criteria: ["Responds with a welcome message", "Includes user name in greeting"],
-  labels: ["auth", "happy-path"],
-};
-
-const CANNED_SCENARIO_UPDATED = {
-  id: "scen_abc123",
-  name: "Login Flow - Valid Credentials",
-  situation: "User logs in with correct email and pass",
-  criteria: [
-    "Responds with welcome message",
-    "Sets session cookie",
-    "Redirects to dashboard",
-  ],
-  labels: ["auth", "happy-path"],
-};
-
-const CANNED_SCENARIO_ARCHIVED = {
-  id: "scen_abc123",
-  archived: true,
-};
-
-// --- Mock HTTP Server ---
-
-function createMockServer(): Server {
-  return createServer((req, res) => {
-    const authToken = req.headers["x-auth-token"];
-    if (authToken !== "test-integration-key") {
-      res.writeHead(401, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ message: "Invalid auth token." }));
-      return;
-    }
-
-    let body = "";
-    req.on("data", (chunk: string) => (body += chunk));
-    req.on("end", () => {
-      const url = req.url ?? "";
-      res.setHeader("Content-Type", "application/json");
-
-      // GET /api/scenarios - list all scenarios
-      if (url === "/api/scenarios" && req.method === "GET") {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_SCENARIOS_LIST));
-      }
-      // GET /api/scenarios/:id - get scenario detail
-      else if (
-        url.match(/^\/api\/scenarios\/scen_abc123(\?|$)/) &&
-        req.method === "GET"
-      ) {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_SCENARIO_DETAIL));
-      }
-      // GET /api/scenarios/:id - not found
-      else if (
-        url.match(/^\/api\/scenarios\/scen_nonexistent(\?|$)/) &&
-        req.method === "GET"
-      ) {
-        res.writeHead(404);
-        res.end(JSON.stringify({ message: "Scenario not found" }));
-      }
-      // POST /api/scenarios - create scenario
-      else if (url === "/api/scenarios" && req.method === "POST") {
-        const parsed = JSON.parse(body);
-        if (!parsed.name) {
-          res.writeHead(400);
-          res.end(JSON.stringify({ message: "Validation error: name is required" }));
-        } else {
-          res.writeHead(201);
-          res.end(JSON.stringify(CANNED_SCENARIO_CREATED));
-        }
-      }
-      // PUT /api/scenarios/:id - update scenario
-      else if (
-        url.match(/^\/api\/scenarios\/scen_abc123$/) &&
-        req.method === "PUT"
-      ) {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_SCENARIO_UPDATED));
-      }
-      // PUT /api/scenarios/:id - not found
-      else if (
-        url.match(/^\/api\/scenarios\/scen_nonexistent$/) &&
-        req.method === "PUT"
-      ) {
-        res.writeHead(404);
-        res.end(JSON.stringify({ message: "Scenario not found" }));
-      }
-      // DELETE /api/scenarios/:id - archive scenario
-      else if (
-        url.match(/^\/api\/scenarios\/scen_abc123$/) &&
-        req.method === "DELETE"
-      ) {
-        res.writeHead(200);
-        res.end(JSON.stringify(CANNED_SCENARIO_ARCHIVED));
-      }
-      else {
-        res.writeHead(404);
-        res.end(
-          JSON.stringify({ message: `Not found: ${req.method} ${url}` })
-        );
-      }
-    });
-  });
-}
-
-// --- Integration Tests ---
-// These verify that MCP tool handlers correctly communicate with the REST API
-// (auth, HTTP methods, status codes, error propagation).
-// Formatting/digest logic is tested in scenario-tools.unit.test.ts.
-
-describe("MCP scenario tools integration", () => {
-  let server: Server;
-  let port: number;
-
-  beforeAll(async () => {
-    server = createMockServer();
-    await new Promise<void>((resolve) => {
-      server.listen(0, () => {
-        const addr = server.address();
-        port = typeof addr === "object" && addr ? addr.port : 0;
-        initConfig({
-          apiKey: "test-integration-key",
-          endpoint: `http://localhost:${port}`,
-        });
-        resolve();
-      });
-    });
-  });
-
-  afterAll(async () => {
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-  });
-
-  describe("platform_list_scenarios", () => {
-    describe("when the API returns scenarios", () => {
-      it("returns a non-empty result", async () => {
-        const { handleListScenarios } = await import(
-          "../tools/list-scenarios.js"
-        );
-        const result = await handleListScenarios({});
-        expect(result.length).toBeGreaterThan(0);
-      });
-    });
-
-    describe("when format is json", () => {
-      it("returns parseable JSON matching the API response", async () => {
-        const { handleListScenarios } = await import(
-          "../tools/list-scenarios.js"
-        );
-        const result = await handleListScenarios({ format: "json" });
-        expect(JSON.parse(result)).toEqual(CANNED_SCENARIOS_LIST);
-      });
-    });
-  });
-
-  describe("platform_get_scenario", () => {
-    describe("when the scenario exists", () => {
-      it("returns a non-empty result", async () => {
-        const { handleGetScenario } = await import(
-          "../tools/get-scenario.js"
-        );
-        const result = await handleGetScenario({ scenarioId: "scen_abc123" });
-        expect(result.length).toBeGreaterThan(0);
-      });
-    });
-
-    describe("when the scenario does not exist", () => {
-      it("propagates the 404 error", async () => {
-        const { handleGetScenario } = await import(
-          "../tools/get-scenario.js"
-        );
-        await expect(
-          handleGetScenario({ scenarioId: "scen_nonexistent" })
-        ).rejects.toThrow("404");
-      });
-    });
-  });
-
-  describe("platform_create_scenario", () => {
-    describe("when valid data is provided", () => {
-      it("returns confirmation with new scenario ID", async () => {
-        const { handleCreateScenario } = await import(
-          "../tools/create-scenario.js"
-        );
-        const result = await handleCreateScenario({
-          name: "Login Flow Happy Path",
-          situation: "User attempts to log in with valid creds",
-          criteria: ["Responds with a welcome message", "Includes user name in greeting"],
-          labels: ["auth", "happy-path"],
-        });
-        expect(result).toContain("scen_new789");
-      });
-    });
-
-    describe("when name is empty", () => {
-      it("propagates the validation error", async () => {
-        const { handleCreateScenario } = await import(
-          "../tools/create-scenario.js"
-        );
-        await expect(
-          handleCreateScenario({
-            name: "",
-            situation: "Some situation",
-          })
-        ).rejects.toThrow();
-      });
-    });
-  });
-
-  describe("platform_update_scenario", () => {
-    describe("when the scenario exists", () => {
-      it("returns a non-empty result", async () => {
-        const { handleUpdateScenario } = await import(
-          "../tools/update-scenario.js"
-        );
-        const result = await handleUpdateScenario({
-          scenarioId: "scen_abc123",
-          name: "Login Flow - Valid Credentials",
-        });
-        expect(result.length).toBeGreaterThan(0);
-      });
-    });
-
-    describe("when the scenario does not exist", () => {
-      it("propagates the 404 error", async () => {
-        const { handleUpdateScenario } = await import(
-          "../tools/update-scenario.js"
-        );
-        await expect(
-          handleUpdateScenario({
-            scenarioId: "scen_nonexistent",
-            name: "Updated Name",
-          })
-        ).rejects.toThrow("404");
-      });
-    });
-  });
-
-  describe("platform_archive_scenario", () => {
-    describe("when the scenario exists", () => {
-      it("returns confirmation that scenario was archived", async () => {
-        const { handleArchiveScenario } = await import(
-          "../tools/archive-scenario.js"
-        );
-        const result = await handleArchiveScenario({
-          scenarioId: "scen_abc123",
-        });
-        expect(result).toContain("archived");
-      });
-    });
-  });
-});