@launchdarkly/mcp-server 0.6.2 → 0.7.1

package/dist/commonjs/lib/config.d.ts

@@ -31,8 +31,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "2.0";
-    readonly sdkVersion: "0.6.2";
+    readonly sdkVersion: "0.7.1";
     readonly genVersion: "2.845.15";
-    readonly userAgent: "speakeasy-sdk/typescript 0.6.2 2.845.15 2.0 @launchdarkly/mcp-server";
+    readonly userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server";
 };
 //# sourceMappingURL=config.d.ts.map

package/dist/commonjs/lib/config.js

@@ -39,8 +39,8 @@ function serverURLFromOptions(options) {
 exports.SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "2.0",
-    sdkVersion: "0.6.2",
+    sdkVersion: "0.7.1",
     genVersion: "2.845.15",
-    userAgent: "speakeasy-sdk/typescript 0.6.2 2.845.15 2.0 @launchdarkly/mcp-server",
+    userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server",
 };
 //# sourceMappingURL=config.js.map

package/dist/commonjs/mcp-server/cli/start/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,YAAY,sEA2FvB,CAAC"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,YAAY,sEAyGvB,CAAC"}

package/dist/commonjs/mcp-server/cli/start/command.js

@@ -60,6 +60,18 @@ exports.startCommand = (0, core_1.buildCommand)({
                 default: "2718",
                 parse: (val) => z.coerce.number().int().gte(0).lt(65536).parse(val),
             },
+            host: {
+                kind: "parsed",
+                brief: "The host to listen on when the SSE transport is enabled. Non-loopback hosts require --auth-token",
+                default: "127.0.0.1",
+                parse: (value) => z.string().nonempty().parse(value),
+            },
+            "auth-token": {
+                kind: "parsed",
+                brief: "Bearer token that SSE clients must send in the Authorization header",
+                optional: true,
+                parse: (value) => z.string().min(16).parse(value),
+            },
             tool: {
                 kind: "parsed",
                 brief: "Specify tools to mount on the server",

package/dist/commonjs/mcp-server/cli/start/command.js.map

@@ -1 +1 @@
-{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,wCAA2D;AAC3D,0CAA4B;AAC5B,+DAA8D;AAC9D,+CAA4C;AAE/B,QAAA,YAAY,GAAG,IAAA,mBAAY,EAAC;IACvC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,UAAU,EAAE;QACV,KAAK,EAAE;YACL,SAAS,EAAE;gBACT,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,wDAAwD;gBAC/D,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;aACzB;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CACrB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;aACtD;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,sCAAsC;gBAC7C,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,gEAAgE;gBACvE,MAAM,EAAE,qBAAS;gBACjB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,wCAAwC;gBAC/C,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,kDAAkD;gBACzD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;aAC5C;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,6CAA6C;gBACpD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,mBAAY;aACpB;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,qCAAqC;gBAC5C,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,uCAAmB;aAC5B;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,oDAAoD;gBAC3D,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;oBACrB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACzD,CAAC;oBAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAEpC,OAAO;wBACL,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,qDAAqD;yBAC/D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;wBACb,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,uDAAuD;yBACjE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;qBACW,CAAC;gBAC/B,CAAC;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,uCAAuC;KAC/C;CACF,CAAC,CAAC"}
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,wCAA2D;AAC3D,0CAA4B;AAC5B,+DAA8D;AAC9D,+CAA4C;AAE/B,QAAA,YAAY,GAAG,IAAA,mBAAY,EAAC;IACvC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,UAAU,EAAE;QACV,KAAK,EAAE;YACL,SAAS,EAAE;gBACT,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,wDAAwD;gBAC/D,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;aACzB;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CACrB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;aACtD;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EACH,kGAAkG;gBACpG,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;aACrD;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EACH,qEAAqE;gBACvE,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;aAClD;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,sCAAsC;gBAC7C,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,gEAAgE;gBACvE,MAAM,EAAE,qBAAS;gBACjB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,wCAAwC;gBAC/C,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,kDAAkD;gBACzD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;aAC5C;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,6CAA6C;gBACpD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,mBAAY;aACpB;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,qCAAqC;gBAC5C,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,uCAAmB;aAC5B;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,oDAAoD;gBAC3D,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;oBACrB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACzD,CAAC;oBAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAEpC,OAAO;wBACL,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,qDAAqD;yBAC/D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;wBACb,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,uDAAuD;yBACjE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;qBACW,CAAC;gBAC/B,CAAC;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,uCAAuC;KAC/C;CACF,CAAC,CAAC"}

package/dist/commonjs/mcp-server/cli/start/impl.d.ts

@@ -5,6 +5,8 @@ import { MCPScope } from "../../scopes.js";
 interface StartCommandFlags {
     readonly transport: "stdio" | "sse";
     readonly port: number;
+    readonly host: string;
+    readonly "auth-token"?: string | undefined;
     readonly tool?: string[];
     readonly scope?: MCPScope[];
     readonly "api-key"?: string | undefined;

package/dist/commonjs/mcp-server/cli/start/impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACnC;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,iBAetE"}
+{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAY3C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACnC;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,iBAsBtE"}

package/dist/commonjs/mcp-server/cli/start/impl.js

@@ -9,10 +9,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
 const sse_js_1 = require("@modelcontextprotocol/sdk/server/sse.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const hostHeaderValidation_js_1 = require("@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js");
 const express_1 = __importDefault(require("express"));
 const console_logger_js_1 = require("../../console-logger.js");
 const server_js_1 = require("../../server.js");
+const sse_security_js_1 = require("./sse-security.js");
+const tls_blocklist_js_1 = require("./tls-blocklist.js");
 async function main(flags) {
+    // INC-289: block the compromised eMudhra intermediates before any request.
+    (0, tls_blocklist_js_1.installTlsBlocklist)();
+    const runtimeWarning = (0, tls_blocklist_js_1.unpatchedRuntimeWarning)();
+    if (runtimeWarning) {
+        process.stderr.write(runtimeWarning);
+    }
     flags.env?.forEach(([key, value]) => {
         process.env[key] = value;
     });
@@ -48,31 +57,69 @@ async function startStdio(flags) {
 }
 async function startSSE(flags) {
     const logger = (0, console_logger_js_1.createConsoleLogger)(flags["log-level"]);
+    const host = flags.host;
+    const authToken = flags["auth-token"];
+    (0, sse_security_js_1.assertSafeSSEBind)(host, authToken);
     const app = (0, express_1.default)();
-    const mcpServer = (0, server_js_1.createMCPServer)({
-        logger,
-        allowedTools: flags.tool,
-        scopes: flags.scope,
-        ...{ apiKey: flags["api-key"] ?? "" },
-        serverURL: flags["server-url"],
-        serverIdx: flags["server-index"],
-    });
-    let transport;
+    if ((0, sse_security_js_1.isLoopbackHost)(host)) {
+        app.use((0, hostHeaderValidation_js_1.localhostHostValidation)());
+    }
+    if (authToken) {
+        app.use((0, sse_security_js_1.requireBearerToken)(authToken));
+    }
+    const sessions = new Map();
     const controller = new AbortController();
     app.get("/sse", async (_req, res) => {
-        transport = new sse_js_1.SSEServerTransport("/message", res);
-        await mcpServer.connect(transport);
-        mcpServer.server.onclose = async () => {
-            res.end();
-        };
+        const server = (0, server_js_1.createMCPServer)({
+            logger,
+            allowedTools: flags.tool,
+            scopes: flags.scope,
+            ...{ apiKey: flags["api-key"] ?? "" },
+            serverURL: flags["server-url"],
+            serverIdx: flags["server-index"],
+        });
+        const transport = new sse_js_1.SSEServerTransport("/message", res);
+        sessions.set(transport.sessionId, { transport, server });
+        res.on("close", () => {
+            sessions.delete(transport.sessionId);
+            void server.close();
+        });
+        try {
+            await server.connect(transport);
+        }
+        catch (err) {
+            logger.error("Failed to open SSE session", {
+                error: err instanceof Error ? err.message : String(err),
+            });
+            sessions.delete(transport.sessionId);
+            void server.close();
+            if (!res.headersSent) {
+                res.status(500).send("Internal Server Error");
+            }
+        }
     });
     app.post("/message", async (req, res) => {
-        if (!transport) {
-            throw new Error("Server transport not initialized");
+        const sessionId = typeof req.query["sessionId"] === "string"
+            ? req.query["sessionId"]
+            : "";
+        const session = sessions.get(sessionId);
+        if (!session) {
+            res.status(404).send("Unknown session");
+            return;
+        }
+        try {
+            await session.transport.handlePostMessage(req, res);
+        }
+        catch (err) {
+            logger.error("Failed to handle SSE message", {
+                error: err instanceof Error ? err.message : String(err),
+            });
+            if (!res.headersSent) {
+                res.status(500).send("Internal Server Error");
+            }
         }
-        await transport.handlePostMessage(req, res);
     });
-    const httpServer = app.listen(flags.port, "0.0.0.0", () => {
+    const httpServer = app.listen(flags.port, host, () => {
         const ha = httpServer.address();
         const host = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
         logger.info("MCP HTTP server started", { host });
@@ -84,8 +131,8 @@ async function startSSE(flags) {
             process.exit(1);
         }
         closing = true;
-        logger.info("Shutting down MCP server");
-        await mcpServer.close();
+        logger.info("Shutting down MCP servers");
+        await Promise.all([...sessions.values()].map(({ server }) => server.close()));
         logger.info("Shutting down HTTP server");
         const timer = setTimeout(() => {
             logger.info("Forcing shutdown");

package/dist/commonjs/mcp-server/cli/start/impl.js.map

@@ -1 +1 @@
-{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;AA0BH,oBAeC;AAvCD,oEAA6E;AAC7E,wEAAiF;AACjF,sDAA8B;AAG9B,+DAGiC;AAEjC,+CAAkD;AAc3C,KAAK,UAAU,IAAI,CAAqB,KAAwB;IACrE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,KAAK;YACR,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC;QAC7B,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAwB;IAC9C,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,MAAM,SAAS,GAAG,IAAA,2BAAe,EAAC;QAChC,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,SAAyC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,SAAS,GAAG,IAAI,2BAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAEpD,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEnC,SAAS,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,IAAI,EAAE;YACpC,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QACxD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAExC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;AAsCH,oBAsBC;AA1DD,oEAA6E;AAC7E,wEAAiF;AACjF,iHAA8G;AAC9G,sDAA8B;AAG9B,+DAGiC;AAEjC,+CAAkD;AAClD,uDAI2B;AAC3B,yDAG4B;AAgBrB,KAAK,UAAU,IAAI,CAAqB,KAAwB;IACrE,2EAA2E;IAC3E,IAAA,sCAAmB,GAAE,CAAC;IACtB,MAAM,cAAc,GAAG,IAAA,0CAAuB,GAAE,CAAC;IACjD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,KAAK;YACR,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC;QAC7B,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAwB;IAC9C,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,IAAA,mCAAiB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,IAAI,IAAA,gCAAc,EAAC,IAAI,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAA,iDAAuB,GAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAA,oCAAkB,EAAC,SAAS,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC;YAC7B,MAAM;YACN,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;YACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,2BAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YACxB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC3C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QACnD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE9E,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/commonjs/mcp-server/cli/start/sse-security.d.ts

@@ -0,0 +1,5 @@
+import type { RequestHandler } from "express";
+export declare function isLoopbackHost(host: string): boolean;
+export declare function assertSafeSSEBind(host: string, authToken: string | undefined): void;
+export declare function requireBearerToken(token: string): RequestHandler;
+//# sourceMappingURL=sse-security.d.ts.map

package/dist/commonjs/mcp-server/cli/start/sse-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-security.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/sse-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAMN;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAYhE"}

package/dist/commonjs/mcp-server/cli/start/sse-security.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLoopbackHost = isLoopbackHost;
+exports.assertSafeSSEBind = assertSafeSSEBind;
+exports.requireBearerToken = requireBearerToken;
+const node_crypto_1 = require("node:crypto");
+function isLoopbackHost(host) {
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+function assertSafeSSEBind(host, authToken) {
+    if (!authToken && !isLoopbackHost(host)) {
+        throw new Error(`--auth-token is required when the SSE transport listens on a non-loopback host (${host})`);
+    }
+}
+function requireBearerToken(token) {
+    const expected = Buffer.from(`Bearer ${token}`);
+    return (req, res, next) => {
+        const actual = Buffer.from(req.headers.authorization ?? "");
+        if (actual.length !== expected.length || !(0, node_crypto_1.timingSafeEqual)(actual, expected)) {
+            res.status(401).send("Unauthorized");
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=sse-security.js.map

package/dist/commonjs/mcp-server/cli/start/sse-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-security.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/sse-security.ts"],"names":[],"mappings":";;AAGA,wCAEC;AAED,8CASC;AAED,gDAYC;AA7BD,6CAA8C;AAE9C,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,SAA6B;IAE7B,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,IAAI,GAAG,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC5D,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAA,6BAAe,EAAC,MAAM,EAAE,QAAQ,CAAC,EACvE,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/commonjs/mcp-server/cli/start/tls-blocklist.d.ts

@@ -0,0 +1,48 @@
+/**
+ * SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
+ * Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
+ * (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
+ * G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
+ * than the certificate covers both.
+ */
+export declare const BLOCKED_SPKI_SHA256: ReadonlySet<string>;
+export declare const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
+/** The subset of tls.PeerCertificate this check reads. */
+export interface PeerCertificateLike {
+    raw?: Uint8Array | undefined;
+    fingerprint256?: string | undefined;
+    issuer?: {
+        CN?: string | string[] | undefined;
+    } | undefined;
+    issuerCertificate?: PeerCertificateLike | undefined;
+}
+export declare function isBlockedIssuerName(cn: string | string[] | undefined): boolean;
+export declare function spkiSha256(raw: Uint8Array): string;
+/**
+ * Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
+ * returns a description of the first blocked certificate, if any.
+ */
+export declare function findBlockedCertificate(cert: PeerCertificateLike): string | undefined;
+/**
+ * A tls checkServerIdentity replacement: rejects blocked chains, then runs
+ * the runtime's normal hostname verification.
+ */
+export declare function checkServerIdentity(hostname: string, cert: PeerCertificateLike): Error | undefined;
+/**
+ * Installs the blocklist for this process. On Node.js, global fetch (undici)
+ * and node:https read tls.checkServerIdentity when they connect. Bun's fetch
+ * ignores it, so on Bun global fetch is wrapped to pass the check through
+ * Bun's `tls` fetch option.
+ */
+export declare function installTlsBlocklist(): void;
+export declare function isNodeVersionPatched(version: string): boolean;
+export declare function isBunVersionPatched(version: string): boolean;
+/**
+ * Returns a warning when the current runtime does not block the compromised
+ * eMudhra intermediates natively, or undefined when it does.
+ */
+export declare function unpatchedRuntimeWarning(versions?: {
+    node?: string | undefined;
+    bun?: string | undefined;
+}): string | undefined;
+//# sourceMappingURL=tls-blocklist.d.ts.map

package/dist/commonjs/mcp-server/cli/start/tls-blocklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-blocklist.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/tls-blocklist.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CASlD,CAAC;AA8BH,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACrD;AAcD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAChC,OAAO,CAGT;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAMlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,mBAAmB,GACxB,MAAM,GAAG,SAAS,CAmBpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,mBAAmB,GACxB,KAAK,GAAG,SAAS,CAoBnB;AAID;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,GAAE;IACR,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACP,GACnB,MAAM,GAAG,SAAS,CAoBpB"}

package/dist/commonjs/mcp-server/cli/start/tls-blocklist.js

@@ -0,0 +1,206 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLOCKED_CERT_ERROR_CODE = exports.BLOCKED_SPKI_SHA256 = void 0;
+exports.isBlockedIssuerName = isBlockedIssuerName;
+exports.spkiSha256 = spkiSha256;
+exports.findBlockedCertificate = findBlockedCertificate;
+exports.checkServerIdentity = checkServerIdentity;
+exports.installTlsBlocklist = installTlsBlocklist;
+exports.isNodeVersionPatched = isNodeVersionPatched;
+exports.isBunVersionPatched = isBunVersionPatched;
+exports.unpatchedRuntimeWarning = unpatchedRuntimeWarning;
+const node_crypto_1 = require("node:crypto");
+const node_tls_1 = __importDefault(require("node:tls"));
+/*
+ * INC-289: rejects TLS chains that go through the compromised eMudhra
+ * intermediates (https://emudhra.we-have-a-problem.com/). Go 1.26.10, Node.js
+ * 22.23.4 / 24.22.1 / 26.12.1 and Bun (unreleased, oven-sh/bun#46300) block
+ * the same keys natively. This check covers runtimes that predate those fixes.
+ * It is installed only by the `mcp start` CLI, never for library consumers.
+ */
+/**
+ * SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
+ * Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
+ * (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
+ * G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
+ * than the certificate covers both.
+ */
+exports.BLOCKED_SPKI_SHA256 = new Set([
+    "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+    "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+    "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+    "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+    "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
+    "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+    "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+    "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+]);
+/**
+ * Common names of the compromised intermediates. Every one of them has
+ * pathlen:0, so any leaf signed with one of their keys must name the
+ * intermediate as its issuer. Bun's fetch only exposes the leaf to
+ * checkServerIdentity, so the issuer name is what blocks these chains there.
+ */
+const BLOCKED_ISSUER_CN = /^em (dv|ov|ev) (tls|cs) ca - g3[bc]$/;
+/**
+ * Node.js releases that block these keys natively, by major version. Lines
+ * newer than the highest entry are treated as patched; any other line is
+ * treated as unpatched.
+ */
+const FIXED_NODE_VERSIONS = {
+    22: [22, 23, 4],
+    24: [24, 22, 1],
+    26: [26, 12, 1],
+};
+/**
+ * First Bun release that blocks these keys natively. Set this once one ships
+ * (the fix is oven-sh/bun#46300). While it is undefined, every Bun version
+ * gets the warning.
+ */
+const FIXED_BUN_VERSION = undefined;
+exports.BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
+// Captured before installTlsBlocklist() replaces tls.checkServerIdentity.
+const defaultCheckServerIdentity = node_tls_1.default.checkServerIdentity;
+function normalizeName(value) {
+    return value.normalize("NFKC").toLowerCase().replace(/\s+/g, " ").trim();
+}
+function isBlockedIssuerName(cn) {
+    const names = Array.isArray(cn) ? cn : cn === undefined ? [] : [cn];
+    return names.some((name) => BLOCKED_ISSUER_CN.test(normalizeName(name)));
+}
+function spkiSha256(raw) {
+    const spki = new node_crypto_1.X509Certificate(raw).publicKey.export({
+        type: "spki",
+        format: "der",
+    });
+    return (0, node_crypto_1.createHash)("sha256").update(spki).digest("hex");
+}
+/**
+ * Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
+ * returns a description of the first blocked certificate, if any.
+ */
+function findBlockedCertificate(cert) {
+    const seen = new Set();
+    for (let current = cert; current && !seen.has(current); current = current.issuerCertificate) {
+        seen.add(current);
+        if (isBlockedIssuerName(current.issuer?.CN)) {
+            return `certificate issued by "${String(current.issuer?.CN)}"`;
+        }
+        if (current.raw && current.raw.length > 0) {
+            const hash = spkiSha256(current.raw);
+            if (exports.BLOCKED_SPKI_SHA256.has(hash)) {
+                return `certificate with blocked public key sha256/${hash}`;
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * A tls checkServerIdentity replacement: rejects blocked chains, then runs
+ * the runtime's normal hostname verification.
+ */
+function checkServerIdentity(hostname, cert) {
+    let blocked;
+    try {
+        blocked = findBlockedCertificate(cert);
+    }
+    catch (err) {
+        blocked = `certificate that could not be parsed (${String(err)})`;
+    }
+    if (blocked) {
+        return Object.assign(new Error(`Refusing TLS connection to ${hostname}: the chain contains a ${blocked}, ` +
+            "which belongs to a compromised eMudhra intermediate CA."), { code: exports.BLOCKED_CERT_ERROR_CODE });
+    }
+    return defaultCheckServerIdentity(hostname, cert);
+}
+let installed = false;
+/**
+ * Installs the blocklist for this process. On Node.js, global fetch (undici)
+ * and node:https read tls.checkServerIdentity when they connect. Bun's fetch
+ * ignores it, so on Bun global fetch is wrapped to pass the check through
+ * Bun's `tls` fetch option.
+ */
+function installTlsBlocklist() {
+    if (installed)
+        return;
+    installed = true;
+    if (isBun()) {
+        const originalFetch = globalThis.fetch;
+        const wrapped = (input, init) => {
+            const tlsOptions = init?.tls;
+            const callerCheck = tlsOptions?.checkServerIdentity;
+            const combined = callerCheck
+                ? (hostname, cert) => checkServerIdentity(hostname, cert) ?? callerCheck(hostname, cert)
+                : checkServerIdentity;
+            return originalFetch(input, {
+                ...init,
+                tls: { ...tlsOptions, checkServerIdentity: combined },
+            });
+        };
+        globalThis.fetch = Object.assign(wrapped, originalFetch);
+    }
+    else {
+        node_tls_1.default.checkServerIdentity =
+            checkServerIdentity;
+    }
+}
+function isBun() {
+    return typeof globalThis.Bun !== "undefined";
+}
+function parseVersion(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version);
+    if (!match)
+        return undefined;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function compareVersions(a, b) {
+    return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+function isNodeVersionPatched(version) {
+    const parsed = parseVersion(version);
+    if (!parsed)
+        return false;
+    const fixed = FIXED_NODE_VERSIONS[parsed[0]];
+    if (fixed)
+        return compareVersions(parsed, fixed) >= 0;
+    const newestLine = Math.max(...Object.keys(FIXED_NODE_VERSIONS).map(Number));
+    return parsed[0] > newestLine;
+}
+function isBunVersionPatched(version) {
+    if (FIXED_BUN_VERSION === undefined)
+        return false;
+    const parsed = parseVersion(version);
+    const fixed = parseVersion(FIXED_BUN_VERSION);
+    return !!parsed && !!fixed && compareVersions(parsed, fixed) >= 0;
+}
+/**
+ * Returns a warning when the current runtime does not block the compromised
+ * eMudhra intermediates natively, or undefined when it does.
+ */
+function unpatchedRuntimeWarning(versions = process.versions) {
+    let runtime;
+    let upgrade;
+    if (versions.bun !== undefined) {
+        if (isBunVersionPatched(versions.bun))
+            return undefined;
+        runtime = `Bun ${versions.bun}`;
+        upgrade =
+            "run the server with Node.js 22.23.4, 24.22.1, 26.12.1 or later, or use the Docker image";
+    }
+    else if (versions.node !== undefined) {
+        if (isNodeVersionPatched(versions.node))
+            return undefined;
+        runtime = `Node.js ${versions.node}`;
+        upgrade = "upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 or later";
+    }
+    else {
+        return undefined;
+    }
+    return (`WARNING: ${runtime} does not block the compromised eMudhra intermediate CAs. ` +
+        "The LaunchDarkly MCP server rejects them for its own requests, but the runtime does not; " +
+        `${upgrade}. See https://github.com/launchdarkly/mcp-server#runtime-requirements\n`);
+}
+//# sourceMappingURL=tls-blocklist.js.map

package/dist/commonjs/mcp-server/cli/start/tls-blocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-blocklist.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/tls-blocklist.ts"],"names":[],"mappings":";;;;;;AA+EA,kDAKC;AAED,gCAMC;AAMD,wDAqBC;AAMD,kDAuBC;AAUD,kDA6BC;AAmBD,oDAOC;AAED,kDAKC;AAMD,0DAyBC;AA3PD,6CAA0D;AAC1D,wDAA2B;AAE3B;;;;;;GAMG;AAEH;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;CACnE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,mBAAmB,GAErB;IACF,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAuB,SAAS,CAAC;AAE3C,QAAA,uBAAuB,GAAG,sBAAsB,CAAC;AAe9D,0EAA0E;AAC1E,MAAM,0BAA0B,GAAwB,kBAAG,CAAC,mBAAmB,CAAC;AAEhF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,SAAgB,mBAAmB,CACjC,EAAiC;IAEjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAgB,UAAU,CAAC,GAAe;IACxC,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QACrD,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,IAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KACE,IAAI,OAAO,GAAoC,IAAI,EACnD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAC7B,OAAO,GAAG,OAAO,CAAC,iBAAiB,EACnC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,OAAO,0BAA0B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,2BAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,8CAA8C,IAAI,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,QAAgB,EAChB,IAAyB;IAEzB,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,yCAAyC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CACP,8BAA8B,QAAQ,0BAA0B,OAAO,IAAI;YACzE,yDAAyD,CAC5D,EACD,EAAE,IAAI,EAAE,+BAAuB,EAAE,CAClC,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,CAC/B,QAAQ,EACR,IAAsC,CACvC,CAAC;AACJ,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;;;;GAKG;AACH,SAAgB,mBAAmB;IACjC,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,IAAI,KAAK,EAAE,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACvC,MAAM,OAAO,GAAG,CACd,KAAkC,EAClC,IAAkC,EACR,EAAE;YAC5B,MAAM,UAAU,GACd,IAED,EAAE,GAAG,CAAC;YACP,MAAM,WAAW,GAAG,UAAU,EAAE,mBAAmB,CAAC;YACpD,MAAM,QAAQ,GAAwB,WAAW;gBAC/C,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CACjB,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC;gBACtE,CAAC,CAAE,mBAAsD,CAAC;YAC5D,OAAO,aAAa,CAAC,KAAK,EAAE;gBAC1B,GAAG,IAAI;gBACP,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE;aACvC,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,mBAAmB;YACrB,mBAAqD,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CACtB,CAAoC,EACpC,CAAoC;IAEpC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;AAChC,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAAe;IACjD,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,WAGI,OAAO,CAAC,QAAQ;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,GAAG,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO;YACL,yFAAyF,CAAC;IAC9F,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,OAAO,GAAG,WAAW,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,GAAG,uDAAuD,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CACL,YAAY,OAAO,4DAA4D;QAC/E,2FAA2F;QAC3F,GAAG,OAAO,yEAAyE,CACpF,CAAC;AACJ,CAAC"}

package/dist/commonjs/mcp-server/mcp-server.js

@@ -22,7 +22,7 @@ const routes = (0, core_1.buildRouteMap)({
 exports.app = (0, core_1.buildApplication)(routes, {
     name: "mcp",
     versionInfo: {
-        currentVersion: "0.6.2",
+        currentVersion: "0.7.1",
     },
 });
 (0, core_1.run)(exports.app, node_process_1.default.argv.slice(2), (0, cli_js_1.buildContext)(node_process_1.default));

package/dist/commonjs/mcp-server/server.js

@@ -32,7 +32,7 @@ const featureFlagsPatch_js_1 = require("./tools/featureFlagsPatch.js");
 function createMCPServer(deps) {
     const server = new mcp_js_1.McpServer({
         name: "LaunchDarkly",
-        version: "0.6.2",
+        version: "0.7.1",
     });
     const client = new core_js_1.LaunchDarklyCore({
         apiKey: deps.apiKey,

package/dist/esm/lib/config.d.ts

@@ -31,8 +31,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "2.0";
-    readonly sdkVersion: "0.6.2";
+    readonly sdkVersion: "0.7.1";
     readonly genVersion: "2.845.15";
-    readonly userAgent: "speakeasy-sdk/typescript 0.6.2 2.845.15 2.0 @launchdarkly/mcp-server";
+    readonly userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server";
 };
 //# sourceMappingURL=config.d.ts.map

package/dist/esm/lib/config.js

@@ -35,8 +35,8 @@ export function serverURLFromOptions(options) {
 export const SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "2.0",
-    sdkVersion: "0.6.2",
+    sdkVersion: "0.7.1",
     genVersion: "2.845.15",
-    userAgent: "speakeasy-sdk/typescript 0.6.2 2.845.15 2.0 @launchdarkly/mcp-server",
+    userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server",
 };
 //# sourceMappingURL=config.js.map

package/dist/esm/mcp-server/cli/start/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,YAAY,sEA2FvB,CAAC"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,YAAY,sEAyGvB,CAAC"}

package/dist/esm/mcp-server/cli/start/command.js

@@ -24,6 +24,18 @@ export const startCommand = buildCommand({
                 default: "2718",
                 parse: (val) => z.coerce.number().int().gte(0).lt(65536).parse(val),
             },
+            host: {
+                kind: "parsed",
+                brief: "The host to listen on when the SSE transport is enabled. Non-loopback hosts require --auth-token",
+                default: "127.0.0.1",
+                parse: (value) => z.string().nonempty().parse(value),
+            },
+            "auth-token": {
+                kind: "parsed",
+                brief: "Bearer token that SSE clients must send in the Authorization header",
+                optional: true,
+                parse: (value) => z.string().min(16).parse(value),
+            },
             tool: {
                 kind: "parsed",
                 brief: "Specify tools to mount on the server",

package/dist/esm/mcp-server/cli/start/command.js.map

@@ -1 +1 @@
-{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC;IACvC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,UAAU,EAAE;QACV,KAAK,EAAE;YACL,SAAS,EAAE;gBACT,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,wDAAwD;gBAC/D,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;aACzB;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CACrB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;aACtD;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,sCAAsC;gBAC7C,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,gEAAgE;gBACvE,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,wCAAwC;gBAC/C,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,kDAAkD;gBACzD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;aAC5C;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,6CAA6C;gBACpD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,YAAY;aACpB;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,qCAAqC;gBAC5C,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,mBAAmB;aAC5B;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,oDAAoD;gBAC3D,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;oBACrB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACzD,CAAC;oBAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAEpC,OAAO;wBACL,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,qDAAqD;yBAC/D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;wBACb,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,uDAAuD;yBACjE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;qBACW,CAAC;gBAC/B,CAAC;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,uCAAuC;KAC/C;CACF,CAAC,CAAC"}
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC;IACvC,MAAM,EAAE,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,UAAU,EAAE;QACV,KAAK,EAAE;YACL,SAAS,EAAE;gBACT,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,wDAAwD;gBAC/D,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;aACzB;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mDAAmD;gBAC1D,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CACrB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;aACtD;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EACH,kGAAkG;gBACpG,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;aACrD;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EACH,qEAAqE;gBACvE,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;aAClD;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,sCAAsC;gBAC7C,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,gEAAgE;gBACvE,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;aACf;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,wCAAwC;gBAC/C,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;oBACf,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;aACF;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,kDAAkD;gBACzD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;aAC5C;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,6CAA6C;gBACpD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,YAAY;aACpB;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,qCAAqC;gBAC5C,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,mBAAmB;aAC5B;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,oDAAoD;gBAC3D,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;oBACrB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACzD,CAAC;oBAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAEpC,OAAO;wBACL,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,qDAAqD;yBAC/D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;wBACb,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC;4BAClB,OAAO,EAAE,uDAAuD;yBACjE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;qBACW,CAAC;gBAC/B,CAAC;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,uCAAuC;KAC/C;CACF,CAAC,CAAC"}