@langwatch/mcp-server 2.1.0 → 2.2.0

package/src/__tests__/docker.integration.test.ts

@@ -1,318 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { execSync } from "child_process";
-
-const IMAGE_NAME = "langwatch-mcp-server-test";
-const CONTAINER_NAME = "langwatch-mcp-server-test-container";
-const HOST_PORT = 13099; // unlikely to conflict
-
-/**
- * HTTP mode verifies the bearer against the LangWatch API before creating a
- * session, so the authenticated paths need a key the API actually accepts.
- * Without one, this file still covers startup, CORS, and rejection.
- */
-const BEARER_TOKEN = process.env.LANGWATCH_API_KEY;
-
-/** A syntactically fine token that the LangWatch API does not know. */
-const BOGUS_TOKEN = "totally-not-a-real-key";
-
-/** Standard headers required by the MCP Streamable HTTP protocol */
-const MCP_POST_HEADERS = {
-  "Content-Type": "application/json",
-  Accept: "application/json, text/event-stream",
-};
-
-describe("Docker container", () => {
-  let containerRunning = false;
-
-  beforeAll(async () => {
-    try {
-      // Build from repo root (mcp-server needs langevals/ for build)
-      const repoRoot = process.cwd().replace(/\/mcp-server.*$/, "");
-      execSync(
-        `docker build -t ${IMAGE_NAME} -f mcp/typescript/Dockerfile .`,
-        {
-          cwd: repoRoot,
-          stdio: "pipe",
-          timeout: 180_000,
-        }
-      );
-
-      // Stop any previous container
-      execSync(`docker rm -f ${CONTAINER_NAME} 2>/dev/null || true`, {
-        stdio: "pipe",
-      });
-
-      // Start the container WITHOUT LANGWATCH_API_KEY -- clients bring their own
-      execSync(
-        `docker run -d --name ${CONTAINER_NAME} -p ${HOST_PORT}:3000 ${IMAGE_NAME}`,
-        { stdio: "pipe" }
-      );
-
-      // Wait for the server to be ready
-      let retries = 0;
-      while (retries < 20) {
-        try {
-          const res = await fetch(`http://localhost:${HOST_PORT}/health`);
-          if (res.ok) {
-            containerRunning = true;
-            break;
-          }
-        } catch {
-          // not ready yet
-        }
-        await new Promise((r) => setTimeout(r, 500));
-        retries++;
-      }
-
-      if (!containerRunning) {
-        const logs = execSync(`docker logs ${CONTAINER_NAME}`, {
-          encoding: "utf8",
-        });
-        throw new Error(`Container failed to start. Logs:\n${logs}`);
-      }
-    } catch (error) {
-      console.error("Docker setup failed:", error);
-      // Clean up on failure
-      execSync(`docker rm -f ${CONTAINER_NAME} 2>/dev/null || true`, {
-        stdio: "pipe",
-      });
-    }
-  }, 180_000); // 3 min for build + start
-
-  afterAll(() => {
-    execSync(`docker rm -f ${CONTAINER_NAME} 2>/dev/null || true`, {
-      stdio: "pipe",
-    });
-  });
-
-  it("health endpoint responds without authentication", async () => {
-    if (!containerRunning) return;
-
-    const res = await fetch(`http://localhost:${HOST_PORT}/health`);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body.status).toBe("ok");
-  });
-
-  it("does not answer with a wildcard CORS origin", async () => {
-    if (!containerRunning) return;
-
-    const res = await fetch(`http://localhost:${HOST_PORT}/health`);
-    expect(res.headers.get("access-control-allow-origin")).not.toBe("*");
-  });
-
-  it("reflects an allowed origin and rejects an unlisted one", async () => {
-    if (!containerRunning) return;
-
-    const allowed = await fetch(`http://localhost:${HOST_PORT}/health`, {
-      headers: { Origin: "http://localhost:5173" },
-    });
-    expect(allowed.status).toBe(200);
-    expect(allowed.headers.get("access-control-allow-origin")).toBe(
-      "http://localhost:5173"
-    );
-
-    const rejected = await fetch(`http://localhost:${HOST_PORT}/health`, {
-      headers: { Origin: "https://attacker.example" },
-    });
-    expect(rejected.status).toBe(403);
-  });
-
-  it("rejects a bearer the LangWatch API does not recognise", async () => {
-    if (!containerRunning) return;
-
-    const res = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: {
-        ...MCP_POST_HEADERS,
-        Authorization: `Bearer ${BOGUS_TOKEN}`,
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-          protocolVersion: "2025-03-26",
-          capabilities: {},
-          clientInfo: { name: "docker-test", version: "1.0.0" },
-        },
-      }),
-    });
-
-    expect(res.status).toBe(401);
-    expect(res.headers.get("mcp-session-id")).toBeNull();
-  });
-
-  it("rejects a session id presented without a bearer token", async () => {
-    if (!containerRunning || !BEARER_TOKEN) return;
-
-    const initRes = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: {
-        ...MCP_POST_HEADERS,
-        Authorization: `Bearer ${BEARER_TOKEN}`,
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-          protocolVersion: "2025-03-26",
-          capabilities: {},
-          clientInfo: { name: "docker-test", version: "1.0.0" },
-        },
-      }),
-    });
-    const sessionId = initRes.headers.get("mcp-session-id");
-    expect(sessionId).toBeTruthy();
-    await initRes.text();
-
-    const res = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: { ...MCP_POST_HEADERS, "mcp-session-id": sessionId! },
-      body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
-    });
-
-    expect(res.status).toBe(401);
-  });
-
-  it("returns 401 on initialize without Bearer token", async () => {
-    if (!containerRunning) return;
-
-    const res = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: MCP_POST_HEADERS,
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-          protocolVersion: "2025-03-26",
-          capabilities: {},
-          clientInfo: { name: "docker-test", version: "1.0.0" },
-        },
-      }),
-    });
-
-    expect(res.status).toBe(401);
-    const body = await res.json();
-    expect(body.error).toContain("Authorization");
-  });
-
-  it("MCP initialize works with Bearer token", async () => {
-    if (!containerRunning || !BEARER_TOKEN) return;
-
-    const res = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: {
-        ...MCP_POST_HEADERS,
-        Authorization: `Bearer ${BEARER_TOKEN}`,
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-          protocolVersion: "2025-03-26",
-          capabilities: {},
-          clientInfo: { name: "docker-test", version: "1.0.0" },
-        },
-      }),
-    });
-
-    expect(res.status).toBe(200);
-    const sessionId = res.headers.get("mcp-session-id");
-    expect(sessionId).toBeTruthy();
-
-    // Parse SSE response for the initialize result
-    const text = await res.text();
-    expect(text).toContain("serverInfo");
-  });
-
-  it("lists tools after initialization with Bearer token", async () => {
-    if (!containerRunning || !BEARER_TOKEN) return;
-
-    // Initialize a session
-    const initRes = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: {
-        ...MCP_POST_HEADERS,
-        Authorization: `Bearer ${BEARER_TOKEN}`,
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-          protocolVersion: "2025-03-26",
-          capabilities: {},
-          clientInfo: { name: "docker-test", version: "1.0.0" },
-        },
-      }),
-    });
-
-    const sessionId = initRes.headers.get("mcp-session-id");
-
-    // Send initialized notification
-    await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: {
-        ...MCP_POST_HEADERS,
-        "mcp-session-id": sessionId!,
-        Authorization: `Bearer ${BEARER_TOKEN}`,
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        method: "notifications/initialized",
-      }),
-    });
-
-    // List tools
-    const toolsRes = await fetch(`http://localhost:${HOST_PORT}/mcp`, {
-      method: "POST",
-      headers: {
-        ...MCP_POST_HEADERS,
-        "mcp-session-id": sessionId!,
-        Authorization: `Bearer ${BEARER_TOKEN}`,
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: 2,
-        method: "tools/list",
-      }),
-    });
-
-    expect(toolsRes.status).toBe(200);
-    const toolsText = await toolsRes.text();
-    expect(toolsText).toContain("fetch_langwatch_docs");
-    expect(toolsText).toContain("search_traces");
-  });
-
-  it("legacy SSE endpoint responds with Bearer token", async () => {
-    if (!containerRunning || !BEARER_TOKEN) return;
-
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
-
-    try {
-      const res = await fetch(`http://localhost:${HOST_PORT}/sse`, {
-        signal: controller.signal,
-        headers: { Authorization: `Bearer ${BEARER_TOKEN}` },
-      });
-      expect(res.status).toBe(200);
-      expect(res.headers.get("content-type")).toContain("text/event-stream");
-    } catch (error: any) {
-      if (error.name !== "AbortError") throw error;
-      // AbortError is expected -- SSE stays open
-    } finally {
-      clearTimeout(timeout);
-    }
-  });
-
-  it("legacy SSE endpoint returns 401 without token", async () => {
-    if (!containerRunning) return;
-
-    const res = await fetch(`http://localhost:${HOST_PORT}/sse`);
-    expect(res.status).toBe(401);
-  });
-});

package/src/__tests__/documentation-fetch-security.integration.test.ts

@@ -1,182 +0,0 @@
-import { createServer, type Server } from "node:http";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-
-import { initConfig } from "../config.js";
-import { fetchDocumentation, resolveDocumentationUrl } from "../documentation-fetch.js";
-import { countingVerifier } from "./support/http-server-harness.js";
-
-const TEST_API_KEY = "security-regression-test";
-
-const MCP_HEADERS = {
-  Accept: "application/json, text/event-stream",
-  Authorization: `Bearer ${TEST_API_KEY}`,
-  "Content-Type": "application/json",
-};
-
-describe("MCP documentation fetch security", () => {
-  describe("URL validation", () => {
-    /** @scenario A documentation tool accepts its own trusted HTTPS pages */
-    it.each([
-      ["langwatch" as const, undefined, "https://langwatch.ai/docs/llms.txt"],
-      ["scenario" as const, undefined, "https://langwatch.ai/scenario/llms.txt"],
-      ["langwatch" as const, "observability/tracing", "https://langwatch.ai/docs/observability/tracing.md"],
-      ["scenario" as const, "/scenario/guides/quickstart", "https://langwatch.ai/scenario/guides/quickstart.md"],
-      [
-        "langwatch" as const,
-        "https://langwatch.ai/docs/llms.txt?format=raw",
-        "https://langwatch.ai/docs/llms.txt?format=raw",
-      ],
-    ])("resolves trusted %s documentation URL %s", (kind, input, expected) => {
-      expect(resolveDocumentationUrl(kind, input).toString()).toBe(expected);
-    });
-
-    /** @scenario A documentation tool rejects non-HTTPS and untrusted hosts */
-    /** @scenario A documentation tool rejects a trusted host outside its namespace */
-    it.each([
-      ["langwatch" as const, "http://169.254.169.254/latest/meta-data/"],
-      ["langwatch" as const, "https://langwatch.ai.attacker.example/docs/x"],
-      ["langwatch" as const, "https://langwatch.ai@127.0.0.1/docs/x"],
-      ["langwatch" as const, "https://langwatch.ai:444/docs/x"],
-      ["langwatch" as const, "file:///etc/passwd"],
-      ["langwatch" as const, "https://langwatch.ai/scenario/llms.txt"],
-      ["langwatch" as const, "https://langwatch.ai/docs-evil/page.md"],
-      ["scenario" as const, "https://langwatch.ai/docs/llms.txt"],
-      ["scenario" as const, "https://langwatch.ai/scenario-evil/page.md"],
-      ["langwatch" as const, "https://langwatch.ai/docs/../scenario/llms.txt"],
-    ])("rejects untrusted %s documentation URL %s", (kind, input) => {
-      expect(() => resolveDocumentationUrl(kind, input)).toThrow(/trusted LangWatch documentation URL/);
-    });
-  });
-
-  /** @scenario Documentation fetches do not follow redirects */
-  it("disables redirects and bounds trusted documentation fetches", async () => {
-    let receivedRedirectMode: RequestRedirect | undefined;
-    let receivedSignal: AbortSignal | null | undefined;
-    const fetchForTest: typeof fetch = async (_input, init) => {
-      receivedRedirectMode = init?.redirect;
-      receivedSignal = init?.signal;
-      return new Response("# documentation");
-    };
-
-    const text = await fetchDocumentation("langwatch", "https://langwatch.ai/docs/llms.txt", fetchForTest);
-
-    expect(text).toBe("# documentation");
-    expect(receivedRedirectMode).toBe("error");
-    expect(receivedSignal).toBeInstanceOf(AbortSignal);
-  });
-
-  it("rejects non-document responses from the trusted origin", async () => {
-    const fetchForTest: typeof fetch = async () =>
-      new Response("<html>unexpected</html>", {
-        headers: { "Content-Type": "text/html" },
-      });
-
-    await expect(fetchDocumentation("langwatch", "https://langwatch.ai/docs/llms.txt", fetchForTest)).rejects.toThrow(
-      /unexpected content type/
-    );
-  });
-
-  describe("HTTP tool transport", () => {
-    let mcpServer: Server;
-    let targetServer: Server;
-    let mcpPort: number;
-    let targetPort: number;
-    let sessionId: string;
-    let targetHits = 0;
-    let rpcId = 10;
-
-    beforeAll(async () => {
-      targetServer = createServer((_request, response) => {
-        targetHits += 1;
-        response.end("internal-only response");
-      });
-      await new Promise<void>((resolve) => {
-        targetServer.listen(0, "127.0.0.1", resolve);
-      });
-      const targetAddress = targetServer.address();
-      targetPort = typeof targetAddress === "object" && targetAddress ? targetAddress.port : 0;
-
-      initConfig({ endpoint: "https://app.langwatch.ai" });
-      const { startHttpServer } = await import("../http-server.js");
-      // These cases are about SSRF in the documentation tools, so the key check
-      // is stubbed to keep the test on its own subject.
-      const { verifier } = countingVerifier([TEST_API_KEY]);
-      const started = await startHttpServer({ port: 0, apiKeyVerifier: verifier });
-      mcpServer = started.server;
-      mcpPort = started.port;
-
-      const initializeResponse = await fetch(`http://127.0.0.1:${mcpPort}/mcp`, {
-        method: "POST",
-        headers: MCP_HEADERS,
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          id: 1,
-          method: "initialize",
-          params: {
-            protocolVersion: "2025-03-26",
-            capabilities: {},
-            clientInfo: { name: "security-test", version: "1.0.0" },
-          },
-        }),
-      });
-      sessionId = initializeResponse.headers.get("mcp-session-id") ?? "";
-      expect(sessionId).not.toBe("");
-
-      await fetch(`http://127.0.0.1:${mcpPort}/mcp`, {
-        method: "POST",
-        headers: { ...MCP_HEADERS, "mcp-session-id": sessionId },
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          method: "notifications/initialized",
-        }),
-      });
-    });
-
-    afterAll(async () => {
-      await Promise.all([
-        new Promise<void>((resolve, reject) => {
-          mcpServer.close((error) => (error ? reject(error) : resolve()));
-        }),
-        new Promise<void>((resolve, reject) => {
-          targetServer.close((error) => (error ? reject(error) : resolve()));
-        }),
-      ]);
-    });
-
-    async function callDocumentationTool(
-      name: "fetch_langwatch_docs" | "fetch_scenario_docs",
-      url: string
-    ): Promise<string> {
-      const response = await fetch(`http://127.0.0.1:${mcpPort}/mcp`, {
-        method: "POST",
-        headers: { ...MCP_HEADERS, "mcp-session-id": sessionId },
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          id: rpcId++,
-          method: "tools/call",
-          params: { name, arguments: { url } },
-        }),
-      });
-
-      expect(response.status).toBe(200);
-      return response.text();
-    }
-
-    it.each(["fetch_langwatch_docs" as const, "fetch_scenario_docs" as const])(
-      "blocks %s from reaching a loopback HTTP server",
-      async (tool) => {
-        const hitsBefore = targetHits;
-        const body = await callDocumentationTool(tool, `http://127.0.0.1:${targetPort}/secrets`);
-
-        expect(body).toContain("trusted LangWatch documentation URL");
-        expect(targetHits).toBe(hitsBefore);
-      }
-    );
-
-    it("blocks cross-namespace fetches through the real MCP handler", async () => {
-      const body = await callDocumentationTool("fetch_langwatch_docs", "https://langwatch.ai/scenario/llms.txt");
-
-      expect(body).toContain("trusted LangWatch documentation URL");
-    });
-  });
-});