@launchdarkly/mcp-server 0.6.2 → 0.7.0

package/src/mcp-server/cli/start/command.ts

@@ -27,6 +27,20 @@ export const startCommand = buildCommand({
         parse: (val: string) =>
           z.coerce.number().int().gte(0).lt(65536).parse(val),
       },
+      host: {
+        kind: "parsed",
+        brief:
+          "The host to listen on when the SSE transport is enabled. Non-loopback hosts require --auth-token",
+        default: "127.0.0.1",
+        parse: (value) => z.string().nonempty().parse(value),
+      },
+      "auth-token": {
+        kind: "parsed",
+        brief:
+          "Bearer token that SSE clients must send in the Authorization header",
+        optional: true,
+        parse: (value) => z.string().min(16).parse(value),
+      },
       tool: {
         kind: "parsed",
         brief: "Specify tools to mount on the server",

package/src/mcp-server/cli/start/impl.ts

@@ -4,6 +4,7 @@
 
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { localhostHostValidation } from "@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js";
 import express from "express";
 import { SDKOptions } from "../../../lib/config.js";
 import { LocalContext } from "../../cli.js";
@@ -13,10 +14,17 @@ import {
 } from "../../console-logger.js";
 import { MCPScope } from "../../scopes.js";
 import { createMCPServer } from "../../server.js";
+import {
+  assertSafeSSEBind,
+  isLoopbackHost,
+  requireBearerToken,
+} from "./sse-security.js";
 
 interface StartCommandFlags {
   readonly transport: "stdio" | "sse";
   readonly port: number;
+  readonly host: string;
+  readonly "auth-token"?: string | undefined;
   readonly tool?: string[];
   readonly scope?: MCPScope[];
   readonly "api-key"?: string | undefined;
@@ -66,37 +74,78 @@ async function startStdio(flags: StartCommandFlags) {
 
 async function startSSE(flags: StartCommandFlags) {
   const logger = createConsoleLogger(flags["log-level"]);
+  const host = flags.host;
+  const authToken = flags["auth-token"];
+  assertSafeSSEBind(host, authToken);
+
   const app = express();
-  const mcpServer = createMCPServer({
-    logger,
-    allowedTools: flags.tool,
-    scopes: flags.scope,
-    ...{ apiKey: flags["api-key"] ?? "" },
-    serverURL: flags["server-url"],
-    serverIdx: flags["server-index"],
-  });
-  let transport: SSEServerTransport | undefined;
+  if (isLoopbackHost(host)) {
+    app.use(localhostHostValidation());
+  }
+  if (authToken) {
+    app.use(requireBearerToken(authToken));
+  }
+
+  const sessions = new Map<
+    string,
+    { transport: SSEServerTransport; server: ReturnType<typeof createMCPServer> }
+  >();
   const controller = new AbortController();
 
   app.get("/sse", async (_req, res) => {
-    transport = new SSEServerTransport("/message", res);
+    const server = createMCPServer({
+      logger,
+      allowedTools: flags.tool,
+      scopes: flags.scope,
+      ...{ apiKey: flags["api-key"] ?? "" },
+      serverURL: flags["server-url"],
+      serverIdx: flags["server-index"],
+    });
+    const transport = new SSEServerTransport("/message", res);
+    sessions.set(transport.sessionId, { transport, server });
 
-    await mcpServer.connect(transport);
+    res.on("close", () => {
+      sessions.delete(transport.sessionId);
+      void server.close();
+    });
 
-    mcpServer.server.onclose = async () => {
-      res.end();
-    };
+    try {
+      await server.connect(transport);
+    } catch (err) {
+      logger.error("Failed to open SSE session", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      sessions.delete(transport.sessionId);
+      void server.close();
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
+    }
   });
 
   app.post("/message", async (req, res) => {
-    if (!transport) {
-      throw new Error("Server transport not initialized");
+    const sessionId = typeof req.query["sessionId"] === "string"
+      ? req.query["sessionId"]
+      : "";
+    const session = sessions.get(sessionId);
+    if (!session) {
+      res.status(404).send("Unknown session");
+      return;
     }
 
-    await transport.handlePostMessage(req, res);
+    try {
+      await session.transport.handlePostMessage(req, res);
+    } catch (err) {
+      logger.error("Failed to handle SSE message", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
+    }
   });
 
-  const httpServer = app.listen(flags.port, "0.0.0.0", () => {
+  const httpServer = app.listen(flags.port, host, () => {
     const ha = httpServer.address();
     const host = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
     logger.info("MCP HTTP server started", { host });
@@ -110,9 +159,9 @@ async function startSSE(flags: StartCommandFlags) {
     }
     closing = true;
 
-    logger.info("Shutting down MCP server");
+    logger.info("Shutting down MCP servers");
 
-    await mcpServer.close();
+    await Promise.all([...sessions.values()].map(({ server }) => server.close()));
 
     logger.info("Shutting down HTTP server");
 

package/src/mcp-server/cli/start/sse-security.ts

@@ -0,0 +1,31 @@
+import type { RequestHandler } from "express";
+import { timingSafeEqual } from "node:crypto";
+
+export function isLoopbackHost(host: string): boolean {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+
+export function assertSafeSSEBind(
+  host: string,
+  authToken: string | undefined,
+): void {
+  if (!authToken && !isLoopbackHost(host)) {
+    throw new Error(
+      `--auth-token is required when the SSE transport listens on a non-loopback host (${host})`,
+    );
+  }
+}
+
+export function requireBearerToken(token: string): RequestHandler {
+  const expected = Buffer.from(`Bearer ${token}`);
+  return (req, res, next) => {
+    const actual = Buffer.from(req.headers.authorization ?? "");
+    if (
+      actual.length !== expected.length || !timingSafeEqual(actual, expected)
+    ) {
+      res.status(401).send("Unauthorized");
+      return;
+    }
+    next();
+  };
+}

package/src/mcp-server/mcp-server.ts

@@ -19,7 +19,7 @@ const routes = buildRouteMap({
 export const app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.6.2",
+    currentVersion: "0.7.0",
   },
 });
 

package/src/mcp-server/server.ts

@@ -44,7 +44,7 @@ export function createMCPServer(deps: {
 }) {
   const server = new McpServer({
     name: "LaunchDarkly",
-    version: "0.6.2",
+    version: "0.7.0",
   });
 
   const client = new LaunchDarklyCore({

package/test/sse-security.test.mjs

@@ -0,0 +1,84 @@
+import assert from "node:assert/strict";
+import process from "node:process";
+import { after, before, describe, test } from "node:test";
+import express from "express";
+import { main } from "../dist/esm/mcp-server/cli/start/impl.js";
+import {
+  assertSafeSSEBind,
+  requireBearerToken,
+} from "../dist/esm/mcp-server/cli/start/sse-security.js";
+
+const TOKEN = "0123456789abcdef";
+
+describe("assertSafeSSEBind", () => {
+  for (const host of ["0.0.0.0", "::", "192.168.1.10", "example.com"]) {
+    test(`refuses ${host} without a token`, () => {
+      assert.throws(
+        () => assertSafeSSEBind(host, undefined),
+        /--auth-token is required/,
+      );
+    });
+
+    test(`allows ${host} with a token`, () => {
+      assert.doesNotThrow(() => assertSafeSSEBind(host, TOKEN));
+    });
+  }
+
+  for (const host of ["127.0.0.1", "localhost", "::1"]) {
+    test(`allows loopback ${host} without a token`, () => {
+      assert.doesNotThrow(() => assertSafeSSEBind(host, undefined));
+    });
+  }
+});
+
+test("start --transport sse refuses a non-loopback host without a token", async () => {
+  await assert.rejects(
+    main.call({ process }, {
+      transport: "sse",
+      host: "0.0.0.0",
+      port: 0,
+      "log-level": "error",
+    }),
+    /--auth-token is required/,
+  );
+});
+
+describe("requireBearerToken", () => {
+  let server;
+  let url;
+
+  before(async () => {
+    const app = express();
+    app.use(requireBearerToken(TOKEN));
+    app.get("/", (_req, res) => res.send("ok"));
+    await new Promise((resolve) => {
+      server = app.listen(0, "127.0.0.1", resolve);
+    });
+    url = `http://127.0.0.1:${server.address().port}/`;
+  });
+
+  after(() => new Promise((resolve) => server.close(resolve)));
+
+  const cases = [
+    ["a missing header", undefined],
+    ["a wrong token of the same length", "Bearer fedcba9876543210"],
+    ["a token prefix", `Bearer ${TOKEN.slice(0, -1)}`],
+    ["the token without the Bearer scheme", TOKEN],
+  ];
+  for (const [name, header] of cases) {
+    test(`returns 401 for ${name}`, async () => {
+      const res = await fetch(url, {
+        headers: header === undefined ? {} : { Authorization: header },
+      });
+      assert.equal(res.status, 401);
+    });
+  }
+
+  test("passes the request through for the right token", async () => {
+    const res = await fetch(url, {
+      headers: { Authorization: `Bearer ${TOKEN}` },
+    });
+    assert.equal(res.status, 200);
+    assert.equal(await res.text(), "ok");
+  });
+});