@langwatch/mcp-server 2.1.0 → 2.2.0

package/src/http-server.ts

@@ -1,13 +1,14 @@
-import express from "express";
-import type { Request, RequestHandler, Response, NextFunction } from "express";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { randomUUID, createHash } from "node:crypto";
 import type { Server } from "node:http";
 
-import { getConfig, runWithConfig } from "./config.js";
-import { createMcpServer } from "./create-mcp-server.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import express from "express";
+import type { Request, RequestHandler, Response, NextFunction } from "express";
+
+import { getConfig, runWithConfig } from "./config.ts";
+import { createMcpServer } from "./create-mcp-server.ts";
 import {
   admitOAuthToken,
   apiKeysMatch,
@@ -21,7 +22,7 @@ import {
   type OAuthTokenEntry,
   type RateLimiter,
   type SessionStore,
-} from "./http-security.js";
+} from "./http-security.ts";
 
 /** Idle time after which a session is closed and forgotten. */
 const SESSION_MAX_AGE_MS = 30 * 60 * 1000;
@@ -47,10 +48,9 @@ interface ServerRuntime {
 }
 
 /**
- * Resolves and verifies the caller's Bearer token. When `expectedApiKey` is
- * given the token has to resolve to that same key, so possession of a session
- * id grants nothing on its own. Sends the error response itself and resolves to
- * null when the request must not proceed.
+ * Resolves and verifies the caller's Bearer token; when `expectedApiKey`
+ * is given, it must resolve to that same key. Sends the error response
+ * itself and resolves to null when the request must not proceed.
  */
 type Authenticate = (args: {
   req: Request;
@@ -82,16 +82,7 @@ function generateAccessToken(): string {
   return createHash("sha256").update(randomUUID()).digest("hex");
 }
 
-/**
- * Client address used for rate limiting.
- *
- * Forwarded headers only mean something when a trusted proxy sets them, so this
- * reads the socket peer unless proxy trust is turned on explicitly. Defaulting
- * to the socket keeps the limits countable: a caller that reaches the port
- * directly cannot rotate `X-Forwarded-For` to reset its own counter. Where that
- * default is wrong, it is wrong in the strict direction, counting a whole proxy
- * as one client rather than not counting at all.
- */
+// Rate limit key: socket peer unless LANGWATCH_MCP_TRUST_PROXY=true checks X-Forwarded-For.
 function rateLimitKey(req: Request): string {
   if (process.env.LANGWATCH_MCP_TRUST_PROXY === "true") {
     return req.ip ?? req.socket.remoteAddress ?? "unknown";
@@ -100,10 +91,9 @@ function rateLimitKey(req: Request): string {
 }
 
 /**
- * Resolves a Bearer token to the API key it stands for. OAuth-issued access
- * tokens map back to the key they were minted from; anything else is treated as
- * a direct API key. This only translates the token, it does not decide whether
- * the key is valid.
+ * Resolves a Bearer token to its API key. OAuth-issued access tokens map
+ * back to the key they were minted from; anything else is treated as a
+ * direct key. Only translates — does not validate.
  */
 function resolveApiKey({
   token,
@@ -121,13 +111,7 @@ function resolveApiKey({
   return null;
 }
 
-function sendUnauthorized({
-  res,
-  error,
-}: {
-  res: Response;
-  error: string;
-}): void {
+function sendUnauthorized({ res, error }: { res: Response; error: string }): void {
   res.status(401).json({ error });
 }
 
@@ -136,23 +120,13 @@ function sendUnauthorized({
  * tool calls (which read config via `getConfig()`/`requireApiKey()`) see the
  * per-session API key instead of the global one.
  */
-async function handleWithSessionConfig<T>(
-  apiKey: string,
-  fn: () => Promise<T>
-): Promise<T> {
+async function handleWithSessionConfig<T>(apiKey: string, fn: () => Promise<T>): Promise<T> {
   const baseConfig = getConfig();
   return runWithConfig({ ...baseConfig, apiKey }, fn);
 }
 
-/**
- * Origin validation and CORS.
- *
- * The MCP transport specification requires servers to validate Origin on every
- * incoming connection, because a page on an attacker's domain can point DNS at
- * loopback and reach a server that only checks the token. Requests with no
- * Origin header are not browser requests, so they pass: browsers always send
- * Origin on the cross-origin requests this guards.
- */
+// MCP requires origin validation to prevent DNS-rebinding attacks. Requests without
+// Origin header pass since they're not browser requests and can't be compromised this way.
 function createOriginMiddleware({
   allowedOrigins,
 }: {
@@ -171,16 +145,13 @@ function createOriginMiddleware({
       // A cross-origin client cannot read a response header unless it is
       // exposed, and the Streamable HTTP transport reads the session id off
       // the initialize response.
-      res.header(
-        "Access-Control-Expose-Headers",
-        "Mcp-Session-Id, MCP-Protocol-Version"
-      );
+      res.header("Access-Control-Expose-Headers", "Mcp-Session-Id, MCP-Protocol-Version");
     }
 
     res.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
     res.header(
       "Access-Control-Allow-Headers",
-      "Content-Type, Authorization, mcp-session-id, MCP-Protocol-Version"
+      "Content-Type, Authorization, mcp-session-id, MCP-Protocol-Version",
     );
     res.header("X-Content-Type-Options", "nosniff");
     res.header("X-Frame-Options", "DENY");
@@ -205,7 +176,10 @@ function createAuthenticator(runtime: ServerRuntime): Authenticate {
 
     const token = readBearerToken(req);
     if (!token) {
-      sendUnauthorized({ res, error: "Authorization: Bearer <LANGWATCH_API_KEY> header required" });
+      sendUnauthorized({
+        res,
+        error: "Authorization: Bearer <LANGWATCH_API_KEY> header required",
+      });
       return null;
     }
 
@@ -247,10 +221,7 @@ function overSessionLimit({
   sessions: SessionStore<StreamableHTTPServerTransport>;
   sseSessions: SessionStore<SSEServerTransport>;
 }): boolean {
-  return (
-    sessions.countForKey(apiKey) + sseSessions.countForKey(apiKey) >=
-    MAX_SESSIONS_PER_KEY
-  );
+  return sessions.countForKey(apiKey) + sseSessions.countForKey(apiKey) >= MAX_SESSIONS_PER_KEY;
 }
 
 function sendSessionLimitReached(res: Response): void {
@@ -269,20 +240,17 @@ function registerOAuthRoutes({
 }): void {
   const { verifier, oauthTokens, oauthRateLimiter } = runtime;
 
-  app.get(
-    "/.well-known/oauth-authorization-server",
-    (req: Request, res: Response) => {
-      const baseUrl = `${req.protocol}://${req.get("host")}`;
-      res.json({
-        issuer: baseUrl,
-        token_endpoint: `${baseUrl}/oauth/token`,
-        token_endpoint_auth_methods_supported: ["client_secret_post"],
-        grant_types_supported: ["client_credentials"],
-        response_types_supported: [],
-        scopes_supported: ["mcp:tools"],
-      });
-    }
-  );
+  app.get("/.well-known/oauth-authorization-server", (req: Request, res: Response) => {
+    const baseUrl = `${req.protocol}://${req.get("host")}`;
+    res.json({
+      issuer: baseUrl,
+      token_endpoint: `${baseUrl}/oauth/token`,
+      token_endpoint_auth_methods_supported: ["client_secret_post"],
+      grant_types_supported: ["client_credentials"],
+      response_types_supported: [],
+      scopes_supported: ["mcp:tools"],
+    });
+  });
 
   // RFC 6749 requires application/x-www-form-urlencoded on the token endpoint.
   app.post(
@@ -310,8 +278,7 @@ function registerOAuthRoutes({
       if (!clientSecret || typeof clientSecret !== "string") {
         res.status(400).json({
           error: "invalid_request",
-          error_description:
-            "client_secret is required (use your LangWatch API key)",
+          error_description: "client_secret is required (use your LangWatch API key)",
         });
         return;
       }
@@ -343,7 +310,7 @@ function registerOAuthRoutes({
         expires_in: OAUTH_TOKEN_TTL_SECONDS,
         scope: "mcp:tools",
       });
-    }
+    },
   );
 }
 
@@ -357,133 +324,145 @@ function registerStreamableHttpRoutes({
   runtime: ServerRuntime;
   authenticate: Authenticate;
 }): void {
-  const { sessions, sseSessions } = runtime;
-
-  const sessionIdOf = (req: Request): string | undefined =>
-    req.headers["mcp-session-id"] as string | undefined;
+  const route = { runtime, authenticate };
+  app.post("/mcp", (req: Request, res: Response) => handleMcpPost({ req, res, ...route }));
+  app.get("/mcp", (req: Request, res: Response) => handleMcpGet({ req, res, ...route }));
+  app.delete("/mcp", (req: Request, res: Response) => handleMcpDelete({ req, res, ...route }));
+}
 
-  app.post("/mcp", async (req: Request, res: Response) => {
-    const sessionId = sessionIdOf(req);
-    const session = sessionId ? sessions.get(sessionId) : undefined;
+type McpRoute = {
+  req: Request;
+  res: Response;
+  runtime: ServerRuntime;
+  authenticate: Authenticate;
+};
 
-    if (sessionId && session) {
-      const apiKey = await authenticate({
-        req,
-        res,
-        expectedApiKey: session.apiKey,
-      });
-      if (!apiKey) return;
+const sessionIdOf = (req: Request): string | undefined =>
+  req.headers["mcp-session-id"] as string | undefined;
 
-      sessions.touch(sessionId);
-      await handleWithSessionConfig(session.apiKey, () =>
-        session.transport.handleRequest(req, res, req.body)
-      );
-      return;
-    }
+async function handleMcpPost({ req, res, runtime, authenticate }: McpRoute): Promise<void> {
+  const { sessions } = runtime;
+  const sessionId = sessionIdOf(req);
+  const session = sessionId ? sessions.get(sessionId) : undefined;
 
-    if (!sessionId && isInitializeRequest(req.body)) {
-      const apiKey = await authenticate({ req, res });
-      if (!apiKey) return;
+  if (sessionId && session) {
+    const apiKey = await authenticate({
+      req,
+      res,
+      expectedApiKey: session.apiKey,
+    });
+    if (!apiKey) return;
 
-      if (overSessionLimit({ apiKey, sessions, sseSessions })) {
-        sendSessionLimitReached(res);
-        return;
-      }
+    sessions.touch(sessionId);
+    await handleWithSessionConfig(session.apiKey, () =>
+      session.transport.handleRequest(req, res, req.body),
+    );
+    return;
+  }
 
-      // Claimed before the first await. The session id only exists once
-      // initialize completes, so without holding the slot from here concurrent
-      // requests for one key would all pass the check above at a count of zero.
-      const reservation = sessions.reserve(apiKey);
-      const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: () => randomUUID(),
-        onsessioninitialized: (id) => {
-          reservation.commit({ sessionId: id, transport });
-        },
-      });
-      transport.onclose = () => {
-        if (transport.sessionId) sessions.remove(transport.sessionId);
-      };
-
-      const sessionServer = createMcpServer();
-      try {
-        await handleWithSessionConfig(apiKey, () =>
-          sessionServer.connect(transport)
-        );
-        await handleWithSessionConfig(apiKey, () =>
-          transport.handleRequest(req, res, req.body)
-        );
-      } catch (error) {
-        if (transport.sessionId) sessions.remove(transport.sessionId);
-        await transport.close().catch(() => undefined);
-        throw error;
-      } finally {
-        // A no-op once the session took the slot, so this only returns it when
-        // initialization never produced one.
-        reservation.release();
-      }
-      return;
-    }
+  if (!sessionId && isInitializeRequest(req.body)) {
+    await initializeSession({ req, res, runtime, authenticate });
+    return;
+  }
 
-    // An unknown session id gets the same answer as a missing token, so the
-    // response does not reveal whether the session exists.
-    if (sessionId) {
-      sendUnauthorized({ res, error: "Session expired or not found" });
-      return;
-    }
+  // An unknown session id gets the same answer as a missing token, so the
+  // response does not reveal whether the session exists.
+  if (sessionId) {
+    sendUnauthorized({ res, error: "Session expired or not found" });
+    return;
+  }
 
-    res.status(400).json({
-      error: "Invalid request, no session ID or not an initialize request",
-    });
+  res.status(400).json({
+    error: "Invalid request, no session ID or not an initialize request",
   });
+}
 
-  app.get("/mcp", async (req: Request, res: Response) => {
-    const sessionId = sessionIdOf(req);
-    const session = sessionId ? sessions.get(sessionId) : undefined;
+/** Opens a session for an initialize request, holding the key's slot until it exists. */
+async function initializeSession({ req, res, runtime, authenticate }: McpRoute): Promise<void> {
+  const { sessions, sseSessions } = runtime;
+  const apiKey = await authenticate({ req, res });
+  if (!apiKey) return;
 
-    if (sessionId && session) {
-      const apiKey = await authenticate({
-        req,
-        res,
-        expectedApiKey: session.apiKey,
-      });
-      if (!apiKey) return;
+  if (overSessionLimit({ apiKey, sessions, sseSessions })) {
+    sendSessionLimitReached(res);
+    return;
+  }
 
-      sessions.touch(sessionId);
-      await handleWithSessionConfig(session.apiKey, () =>
-        session.transport.handleRequest(req, res)
-      );
-      return;
-    }
+  // Claimed before the first await. The session id only exists once
+  // initialize completes, so without holding the slot from here concurrent
+  // requests for one key would all pass the check above at a count of zero.
+  const reservation = sessions.reserve(apiKey);
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: () => randomUUID(),
+    onsessioninitialized: (id) => {
+      reservation.commit({ sessionId: id, transport });
+    },
+  });
+  transport.onclose = () => {
+    if (transport.sessionId) sessions.remove(transport.sessionId);
+  };
 
-    if (sessionId) {
-      sendUnauthorized({ res, error: "Session expired or not found" });
-      return;
-    }
+  const sessionServer = createMcpServer();
+  try {
+    await handleWithSessionConfig(apiKey, () => sessionServer.connect(transport));
+    await handleWithSessionConfig(apiKey, () => transport.handleRequest(req, res, req.body));
+  } catch (error) {
+    if (transport.sessionId) sessions.remove(transport.sessionId);
+    await transport.close().catch(() => undefined);
+    throw error;
+  } finally {
+    // A no-op once the session took the slot, so this only returns it when
+    // initialization never produced one.
+    reservation.release();
+  }
+}
 
-    res.status(400).json({ error: "Invalid request, no valid session ID" });
-  });
+async function handleMcpGet({ req, res, runtime, authenticate }: McpRoute): Promise<void> {
+  const { sessions } = runtime;
+  const sessionId = sessionIdOf(req);
+  const session = sessionId ? sessions.get(sessionId) : undefined;
 
-  app.delete("/mcp", async (req: Request, res: Response) => {
-    // Authenticate before looking the session up, so that a session the caller
-    // does not own is indistinguishable from one that does not exist.
-    const apiKey = await authenticate({ req, res });
+  if (sessionId && session) {
+    const apiKey = await authenticate({
+      req,
+      res,
+      expectedApiKey: session.apiKey,
+    });
     if (!apiKey) return;
 
-    const sessionId = sessionIdOf(req);
-    const session = sessionId ? sessions.get(sessionId) : undefined;
-    const owned =
-      session !== undefined &&
-      apiKeysMatch({ presentedKey: apiKey, expectedKey: session.apiKey });
+    sessions.touch(sessionId);
+    await handleWithSessionConfig(session.apiKey, () => session.transport.handleRequest(req, res));
+    return;
+  }
 
-    if (!sessionId || !session || !owned) {
-      res.status(404).json({ error: "Session not found" });
-      return;
-    }
+  if (sessionId) {
+    sendUnauthorized({ res, error: "Session expired or not found" });
+    return;
+  }
 
-    sessions.remove(sessionId);
-    await session.transport.close();
-    res.status(200).json({ status: "session closed" });
-  });
+  res.status(400).json({ error: "Invalid request, no valid session ID" });
+}
+
+async function handleMcpDelete({ req, res, runtime, authenticate }: McpRoute): Promise<void> {
+  const { sessions } = runtime;
+  // Authenticate before looking the session up, so that a session the caller
+  // does not own is indistinguishable from one that does not exist.
+  const apiKey = await authenticate({ req, res });
+  if (!apiKey) return;
+
+  const sessionId = sessionIdOf(req);
+  const session = sessionId ? sessions.get(sessionId) : undefined;
+  const owned =
+    session !== undefined && apiKeysMatch({ presentedKey: apiKey, expectedKey: session.apiKey });
+
+  if (!sessionId || !session || !owned) {
+    res.status(404).json({ error: "Session not found" });
+    return;
+  }
+
+  sessions.remove(sessionId);
+  await session.transport.close();
+  res.status(200).json({ status: "session closed" });
 }
 
 /** Legacy SSE transport, kept for backwards compatibility. */
@@ -517,9 +496,7 @@ function registerSseRoutes({
     });
 
     try {
-      await handleWithSessionConfig(apiKey, () =>
-        sessionServer.connect(transport)
-      );
+      await handleWithSessionConfig(apiKey, () => sessionServer.connect(transport));
     } catch (error) {
       // Without this the entry holds one of the per-key slots until the reaper
       // sweeps it, because res "close" may never fire if the stream never
@@ -533,21 +510,33 @@ function registerSseRoutes({
     }
   });
 
-  // Mounted at both /messages and /sse/messages because some clients resolve
-  // the relative /messages URL differently.
-  //
-  // The session id travels in the query string because the SSE transport hands
-  // the client its POST endpoint as a URI. It identifies the session and
-  // nothing more: the Bearer token is what authorizes the request.
-  const handleSseMessage = async (req: Request, res: Response) => {
+  // Mounted at both /messages and /sse/messages because some clients
+  // resolve the relative /messages URL differently.
+
+  // The session id in the query string only identifies the session; it's
+  // how the SSE transport hands the client its POST endpoint as a URI.
+  // The Bearer token is what authorizes the request.
+  const handleSseMessage = createSseMessageHandler({ authenticate, sseSessions });
+
+  app.post("/messages", handleSseMessage);
+  app.post("/sse/messages", handleSseMessage);
+}
+
+function createSseMessageHandler({
+  authenticate,
+  sseSessions,
+}: {
+  authenticate: Authenticate;
+  sseSessions: ServerRuntime["sseSessions"];
+}) {
+  return async (req: Request, res: Response) => {
     const apiKey = await authenticate({ req, res });
     if (!apiKey) return;
 
     const sessionId = req.query["sessionId"] as string | undefined;
     const session = sessionId ? sseSessions.get(sessionId) : undefined;
     const owned =
-      session !== undefined &&
-      apiKeysMatch({ presentedKey: apiKey, expectedKey: session.apiKey });
+      session !== undefined && apiKeysMatch({ presentedKey: apiKey, expectedKey: session.apiKey });
 
     if (!sessionId || !session || !owned) {
       res.status(400).json({ error: "Invalid or missing session ID" });
@@ -556,24 +545,15 @@ function registerSseRoutes({
 
     sseSessions.touch(sessionId);
     await handleWithSessionConfig(session.apiKey, () =>
-      session.transport.handlePostMessage(req, res, req.body)
+      session.transport.handlePostMessage(req, res, req.body),
     );
   };
-
-  app.post("/messages", handleSseMessage);
-  app.post("/sse/messages", handleSseMessage);
 }
 
 /** Sweeps idle sessions, expired tokens, and stale rate limiter entries. */
 function startReaper(runtime: ServerRuntime): NodeJS.Timeout {
-  const {
-    sessions,
-    sseSessions,
-    oauthTokens,
-    verifier,
-    authFailRateLimiter,
-    oauthRateLimiter,
-  } = runtime;
+  const { sessions, sseSessions, oauthTokens, verifier, authFailRateLimiter, oauthRateLimiter } =
+    runtime;
 
   const reaper = setInterval(() => {
     sessions.sweep();
@@ -647,32 +627,17 @@ export interface StartedHttpServer {
   allowedOrigins: string[];
 }
 
-/**
- * Starts an Express HTTP server with Streamable HTTP and legacy SSE transports
- * for the LangWatch MCP server.
- *
- * Every request carries `Authorization: Bearer <key>`. The key is verified
- * against the LangWatch API before any per-session state is allocated, and
- * re-checked on every subsequent request against the key the session was
- * created with, so a session id on its own authorizes nothing.
- *
- * Endpoints:
- * - GET /health - Health check for Kubernetes probes (no auth)
- * - POST/GET/DELETE /mcp - Streamable HTTP transport (modern)
- * - GET /sse - Legacy SSE transport (backwards compatibility)
- * - POST /messages - Legacy SSE message endpoint
- */
+// HTTP server with Streamable HTTP and legacy SSE transports; every request
+// re-verifies the bearer token against the LangWatch API.
 export async function startHttpServer({
   port,
   host,
   allowedOrigins,
   apiKeyVerifier,
 }: StartHttpServerOptions): Promise<StartedHttpServer> {
-  const bindHost =
-    host ?? process.env.LANGWATCH_MCP_HTTP_HOST ?? DEFAULT_BIND_HOST;
+  const bindHost = host ?? process.env.LANGWATCH_MCP_HTTP_HOST ?? DEFAULT_BIND_HOST;
   const originAllowlist =
-    allowedOrigins ??
-    parseAllowedOrigins(process.env.LANGWATCH_MCP_ALLOWED_ORIGINS);
+    allowedOrigins ?? parseAllowedOrigins(process.env.LANGWATCH_MCP_ALLOWED_ORIGINS);
 
   const runtime = createRuntime({
     endpoint: getConfig().endpoint,

package/src/index.ts

@@ -2,8 +2,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
-import { initConfig } from "./config.js";
-import { createMcpServer } from "./create-mcp-server.js";
+import { initConfig } from "./config.ts";
+import { createMcpServer } from "./create-mcp-server.ts";
 
 const argv = await yargs(hideBin(process.argv))
   .option("apiKey", {
@@ -14,6 +14,10 @@ const argv = await yargs(hideBin(process.argv))
     type: "string",
     description: "LangWatch API endpoint",
   })
+  .option("projectId", {
+    type: "string",
+    description: "LangWatch project ID",
+  })
   .option("http", {
     type: "boolean",
     description: "Start HTTP/SSE server instead of stdio",
@@ -41,13 +45,12 @@ const argv = await yargs(hideBin(process.argv))
 initConfig({
   apiKey: argv.apiKey,
   endpoint: argv.endpoint,
+  projectId: argv.projectId,
 });
 
 if (argv.http) {
-  const { startHttpServer } = await import("./http-server.js");
-  const { isLoopbackHost, parseAllowedOrigins } = await import(
-    "./http-security.js"
-  );
+  const { startHttpServer } = await import("./http-server.ts");
+  const { isLoopbackHost, parseAllowedOrigins } = await import("./http-security.ts");
 
   const allowedOrigins =
     argv.allowedOrigin && argv.allowedOrigin.length > 0
@@ -62,19 +65,14 @@ if (argv.http) {
 
   // An IPv6 literal has to be bracketed inside a URL, and must not be
   // double-bracketed when the operator already wrote it that way.
-  const displayHost =
-    host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
-  console.log(
-    `LangWatch MCP server listening on http://${displayHost}:${port}/mcp`
-  );
-  console.log(
-    "Clients must provide their API key via Authorization: Bearer <key> header"
-  );
+  const displayHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  console.log(`LangWatch MCP server listening on http://${displayHost}:${port}/mcp`);
+  console.log("Clients must provide their API key via Authorization: Bearer <key> header");
   if (!isLoopbackHost(host)) {
     console.warn(
       `Warning: bound to ${host}, so the server is reachable from other machines. ` +
         "Make sure it sits behind a trusted network boundary and that --allowedOrigin " +
-        "lists only origins you control."
+        "lists only origins you control.",
     );
   }
   if (process.env.LANGWATCH_MCP_TRUST_PROXY === "true") {
@@ -83,7 +81,7 @@ if (argv.http) {
         "authentication uses the client address from X-Forwarded-For. Keep this " +
         "on only when a trusted proxy terminates in front of the port and " +
         "overwrites that header. Otherwise a client can supply any address there " +
-        "and the limit stops counting."
+        "and the limit stops counting.",
     );
   }
 } else {