@launchdarkly/mcp-server 0.6.2 → 0.7.1

package/dist/esm/mcp-server/cli/start/impl.d.ts

@@ -5,6 +5,8 @@ import { MCPScope } from "../../scopes.js";
 interface StartCommandFlags {
     readonly transport: "stdio" | "sse";
     readonly port: number;
+    readonly host: string;
+    readonly "auth-token"?: string | undefined;
     readonly tool?: string[];
     readonly scope?: MCPScope[];
     readonly "api-key"?: string | undefined;

package/dist/esm/mcp-server/cli/start/impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACnC;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,iBAetE"}
+{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAY3C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACnC;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,iBAsBtE"}

package/dist/esm/mcp-server/cli/start/impl.js

@@ -3,10 +3,19 @@
  */
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { localhostHostValidation } from "@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js";
 import express from "express";
 import { createConsoleLogger, } from "../../console-logger.js";
 import { createMCPServer } from "../../server.js";
+import { assertSafeSSEBind, isLoopbackHost, requireBearerToken, } from "./sse-security.js";
+import { installTlsBlocklist, unpatchedRuntimeWarning, } from "./tls-blocklist.js";
 export async function main(flags) {
+    // INC-289: block the compromised eMudhra intermediates before any request.
+    installTlsBlocklist();
+    const runtimeWarning = unpatchedRuntimeWarning();
+    if (runtimeWarning) {
+        process.stderr.write(runtimeWarning);
+    }
     flags.env?.forEach(([key, value]) => {
         process.env[key] = value;
     });
@@ -42,31 +51,69 @@ async function startStdio(flags) {
 }
 async function startSSE(flags) {
     const logger = createConsoleLogger(flags["log-level"]);
+    const host = flags.host;
+    const authToken = flags["auth-token"];
+    assertSafeSSEBind(host, authToken);
     const app = express();
-    const mcpServer = createMCPServer({
-        logger,
-        allowedTools: flags.tool,
-        scopes: flags.scope,
-        ...{ apiKey: flags["api-key"] ?? "" },
-        serverURL: flags["server-url"],
-        serverIdx: flags["server-index"],
-    });
-    let transport;
+    if (isLoopbackHost(host)) {
+        app.use(localhostHostValidation());
+    }
+    if (authToken) {
+        app.use(requireBearerToken(authToken));
+    }
+    const sessions = new Map();
     const controller = new AbortController();
     app.get("/sse", async (_req, res) => {
-        transport = new SSEServerTransport("/message", res);
-        await mcpServer.connect(transport);
-        mcpServer.server.onclose = async () => {
-            res.end();
-        };
+        const server = createMCPServer({
+            logger,
+            allowedTools: flags.tool,
+            scopes: flags.scope,
+            ...{ apiKey: flags["api-key"] ?? "" },
+            serverURL: flags["server-url"],
+            serverIdx: flags["server-index"],
+        });
+        const transport = new SSEServerTransport("/message", res);
+        sessions.set(transport.sessionId, { transport, server });
+        res.on("close", () => {
+            sessions.delete(transport.sessionId);
+            void server.close();
+        });
+        try {
+            await server.connect(transport);
+        }
+        catch (err) {
+            logger.error("Failed to open SSE session", {
+                error: err instanceof Error ? err.message : String(err),
+            });
+            sessions.delete(transport.sessionId);
+            void server.close();
+            if (!res.headersSent) {
+                res.status(500).send("Internal Server Error");
+            }
+        }
     });
     app.post("/message", async (req, res) => {
-        if (!transport) {
-            throw new Error("Server transport not initialized");
+        const sessionId = typeof req.query["sessionId"] === "string"
+            ? req.query["sessionId"]
+            : "";
+        const session = sessions.get(sessionId);
+        if (!session) {
+            res.status(404).send("Unknown session");
+            return;
+        }
+        try {
+            await session.transport.handlePostMessage(req, res);
+        }
+        catch (err) {
+            logger.error("Failed to handle SSE message", {
+                error: err instanceof Error ? err.message : String(err),
+            });
+            if (!res.headersSent) {
+                res.status(500).send("Internal Server Error");
+            }
         }
-        await transport.handlePostMessage(req, res);
     });
-    const httpServer = app.listen(flags.port, "0.0.0.0", () => {
+    const httpServer = app.listen(flags.port, host, () => {
         const ha = httpServer.address();
         const host = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
         logger.info("MCP HTTP server started", { host });
@@ -78,8 +125,8 @@ async function startSSE(flags) {
             process.exit(1);
         }
         closing = true;
-        logger.info("Shutting down MCP server");
-        await mcpServer.close();
+        logger.info("Shutting down MCP servers");
+        await Promise.all([...sessions.values()].map(({ server }) => server.close()));
         logger.info("Shutting down HTTP server");
         const timer = setTimeout(() => {
             logger.info("Forcing shutdown");

package/dist/esm/mcp-server/cli/start/impl.js.map

@@ -1 +1 @@
-{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAEL,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAclD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAqB,KAAwB;IACrE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,KAAK;YACR,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAwB;IAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,SAAyC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,SAAS,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAEpD,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEnC,SAAS,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,IAAI,EAAE;YACpC,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QACxD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAExC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAEL,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAgB5B,MAAM,CAAC,KAAK,UAAU,IAAI,CAAqB,KAAwB;IACrE,2EAA2E;IAC3E,mBAAmB,EAAE,CAAC;IACtB,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;IACjD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,KAAK;YACR,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAwB;IAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC7B,MAAM;YACN,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;YACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YACxB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC3C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QACnD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE9E,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/esm/mcp-server/cli/start/sse-security.d.ts

@@ -0,0 +1,5 @@
+import type { RequestHandler } from "express";
+export declare function isLoopbackHost(host: string): boolean;
+export declare function assertSafeSSEBind(host: string, authToken: string | undefined): void;
+export declare function requireBearerToken(token: string): RequestHandler;
+//# sourceMappingURL=sse-security.d.ts.map

package/dist/esm/mcp-server/cli/start/sse-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-security.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/sse-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAMN;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAYhE"}

package/dist/esm/mcp-server/cli/start/sse-security.js

@@ -0,0 +1,21 @@
+import { timingSafeEqual } from "node:crypto";
+export function isLoopbackHost(host) {
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+export function assertSafeSSEBind(host, authToken) {
+    if (!authToken && !isLoopbackHost(host)) {
+        throw new Error(`--auth-token is required when the SSE transport listens on a non-loopback host (${host})`);
+    }
+}
+export function requireBearerToken(token) {
+    const expected = Buffer.from(`Bearer ${token}`);
+    return (req, res, next) => {
+        const actual = Buffer.from(req.headers.authorization ?? "");
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+            res.status(401).send("Unauthorized");
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=sse-security.js.map

package/dist/esm/mcp-server/cli/start/sse-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-security.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/sse-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,SAA6B;IAE7B,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,mFAAmF,IAAI,GAAG,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC5D,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EACvE,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/mcp-server/cli/start/tls-blocklist.d.ts

@@ -0,0 +1,48 @@
+/**
+ * SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
+ * Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
+ * (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
+ * G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
+ * than the certificate covers both.
+ */
+export declare const BLOCKED_SPKI_SHA256: ReadonlySet<string>;
+export declare const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
+/** The subset of tls.PeerCertificate this check reads. */
+export interface PeerCertificateLike {
+    raw?: Uint8Array | undefined;
+    fingerprint256?: string | undefined;
+    issuer?: {
+        CN?: string | string[] | undefined;
+    } | undefined;
+    issuerCertificate?: PeerCertificateLike | undefined;
+}
+export declare function isBlockedIssuerName(cn: string | string[] | undefined): boolean;
+export declare function spkiSha256(raw: Uint8Array): string;
+/**
+ * Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
+ * returns a description of the first blocked certificate, if any.
+ */
+export declare function findBlockedCertificate(cert: PeerCertificateLike): string | undefined;
+/**
+ * A tls checkServerIdentity replacement: rejects blocked chains, then runs
+ * the runtime's normal hostname verification.
+ */
+export declare function checkServerIdentity(hostname: string, cert: PeerCertificateLike): Error | undefined;
+/**
+ * Installs the blocklist for this process. On Node.js, global fetch (undici)
+ * and node:https read tls.checkServerIdentity when they connect. Bun's fetch
+ * ignores it, so on Bun global fetch is wrapped to pass the check through
+ * Bun's `tls` fetch option.
+ */
+export declare function installTlsBlocklist(): void;
+export declare function isNodeVersionPatched(version: string): boolean;
+export declare function isBunVersionPatched(version: string): boolean;
+/**
+ * Returns a warning when the current runtime does not block the compromised
+ * eMudhra intermediates natively, or undefined when it does.
+ */
+export declare function unpatchedRuntimeWarning(versions?: {
+    node?: string | undefined;
+    bun?: string | undefined;
+}): string | undefined;
+//# sourceMappingURL=tls-blocklist.d.ts.map

package/dist/esm/mcp-server/cli/start/tls-blocklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-blocklist.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/tls-blocklist.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CASlD,CAAC;AA8BH,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACrD;AAcD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAChC,OAAO,CAGT;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAMlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,mBAAmB,GACxB,MAAM,GAAG,SAAS,CAmBpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,mBAAmB,GACxB,KAAK,GAAG,SAAS,CAoBnB;AAID;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,GAAE;IACR,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACP,GACnB,MAAM,GAAG,SAAS,CAoBpB"}

package/dist/esm/mcp-server/cli/start/tls-blocklist.js

@@ -0,0 +1,192 @@
+import { createHash, X509Certificate } from "node:crypto";
+import tls from "node:tls";
+/*
+ * INC-289: rejects TLS chains that go through the compromised eMudhra
+ * intermediates (https://emudhra.we-have-a-problem.com/). Go 1.26.10, Node.js
+ * 22.23.4 / 24.22.1 / 26.12.1 and Bun (unreleased, oven-sh/bun#46300) block
+ * the same keys natively. This check covers runtimes that predate those fixes.
+ * It is installed only by the `mcp start` CLI, never for library consumers.
+ */
+/**
+ * SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
+ * Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
+ * (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
+ * G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
+ * than the certificate covers both.
+ */
+export const BLOCKED_SPKI_SHA256 = new Set([
+    "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+    "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+    "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+    "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+    "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
+    "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+    "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+    "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+]);
+/**
+ * Common names of the compromised intermediates. Every one of them has
+ * pathlen:0, so any leaf signed with one of their keys must name the
+ * intermediate as its issuer. Bun's fetch only exposes the leaf to
+ * checkServerIdentity, so the issuer name is what blocks these chains there.
+ */
+const BLOCKED_ISSUER_CN = /^em (dv|ov|ev) (tls|cs) ca - g3[bc]$/;
+/**
+ * Node.js releases that block these keys natively, by major version. Lines
+ * newer than the highest entry are treated as patched; any other line is
+ * treated as unpatched.
+ */
+const FIXED_NODE_VERSIONS = {
+    22: [22, 23, 4],
+    24: [24, 22, 1],
+    26: [26, 12, 1],
+};
+/**
+ * First Bun release that blocks these keys natively. Set this once one ships
+ * (the fix is oven-sh/bun#46300). While it is undefined, every Bun version
+ * gets the warning.
+ */
+const FIXED_BUN_VERSION = undefined;
+export const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
+// Captured before installTlsBlocklist() replaces tls.checkServerIdentity.
+const defaultCheckServerIdentity = tls.checkServerIdentity;
+function normalizeName(value) {
+    return value.normalize("NFKC").toLowerCase().replace(/\s+/g, " ").trim();
+}
+export function isBlockedIssuerName(cn) {
+    const names = Array.isArray(cn) ? cn : cn === undefined ? [] : [cn];
+    return names.some((name) => BLOCKED_ISSUER_CN.test(normalizeName(name)));
+}
+export function spkiSha256(raw) {
+    const spki = new X509Certificate(raw).publicKey.export({
+        type: "spki",
+        format: "der",
+    });
+    return createHash("sha256").update(spki).digest("hex");
+}
+/**
+ * Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
+ * returns a description of the first blocked certificate, if any.
+ */
+export function findBlockedCertificate(cert) {
+    const seen = new Set();
+    for (let current = cert; current && !seen.has(current); current = current.issuerCertificate) {
+        seen.add(current);
+        if (isBlockedIssuerName(current.issuer?.CN)) {
+            return `certificate issued by "${String(current.issuer?.CN)}"`;
+        }
+        if (current.raw && current.raw.length > 0) {
+            const hash = spkiSha256(current.raw);
+            if (BLOCKED_SPKI_SHA256.has(hash)) {
+                return `certificate with blocked public key sha256/${hash}`;
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * A tls checkServerIdentity replacement: rejects blocked chains, then runs
+ * the runtime's normal hostname verification.
+ */
+export function checkServerIdentity(hostname, cert) {
+    let blocked;
+    try {
+        blocked = findBlockedCertificate(cert);
+    }
+    catch (err) {
+        blocked = `certificate that could not be parsed (${String(err)})`;
+    }
+    if (blocked) {
+        return Object.assign(new Error(`Refusing TLS connection to ${hostname}: the chain contains a ${blocked}, ` +
+            "which belongs to a compromised eMudhra intermediate CA."), { code: BLOCKED_CERT_ERROR_CODE });
+    }
+    return defaultCheckServerIdentity(hostname, cert);
+}
+let installed = false;
+/**
+ * Installs the blocklist for this process. On Node.js, global fetch (undici)
+ * and node:https read tls.checkServerIdentity when they connect. Bun's fetch
+ * ignores it, so on Bun global fetch is wrapped to pass the check through
+ * Bun's `tls` fetch option.
+ */
+export function installTlsBlocklist() {
+    if (installed)
+        return;
+    installed = true;
+    if (isBun()) {
+        const originalFetch = globalThis.fetch;
+        const wrapped = (input, init) => {
+            const tlsOptions = init?.tls;
+            const callerCheck = tlsOptions?.checkServerIdentity;
+            const combined = callerCheck
+                ? (hostname, cert) => checkServerIdentity(hostname, cert) ?? callerCheck(hostname, cert)
+                : checkServerIdentity;
+            return originalFetch(input, {
+                ...init,
+                tls: { ...tlsOptions, checkServerIdentity: combined },
+            });
+        };
+        globalThis.fetch = Object.assign(wrapped, originalFetch);
+    }
+    else {
+        tls.checkServerIdentity =
+            checkServerIdentity;
+    }
+}
+function isBun() {
+    return typeof globalThis.Bun !== "undefined";
+}
+function parseVersion(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version);
+    if (!match)
+        return undefined;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function compareVersions(a, b) {
+    return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+export function isNodeVersionPatched(version) {
+    const parsed = parseVersion(version);
+    if (!parsed)
+        return false;
+    const fixed = FIXED_NODE_VERSIONS[parsed[0]];
+    if (fixed)
+        return compareVersions(parsed, fixed) >= 0;
+    const newestLine = Math.max(...Object.keys(FIXED_NODE_VERSIONS).map(Number));
+    return parsed[0] > newestLine;
+}
+export function isBunVersionPatched(version) {
+    if (FIXED_BUN_VERSION === undefined)
+        return false;
+    const parsed = parseVersion(version);
+    const fixed = parseVersion(FIXED_BUN_VERSION);
+    return !!parsed && !!fixed && compareVersions(parsed, fixed) >= 0;
+}
+/**
+ * Returns a warning when the current runtime does not block the compromised
+ * eMudhra intermediates natively, or undefined when it does.
+ */
+export function unpatchedRuntimeWarning(versions = process.versions) {
+    let runtime;
+    let upgrade;
+    if (versions.bun !== undefined) {
+        if (isBunVersionPatched(versions.bun))
+            return undefined;
+        runtime = `Bun ${versions.bun}`;
+        upgrade =
+            "run the server with Node.js 22.23.4, 24.22.1, 26.12.1 or later, or use the Docker image";
+    }
+    else if (versions.node !== undefined) {
+        if (isNodeVersionPatched(versions.node))
+            return undefined;
+        runtime = `Node.js ${versions.node}`;
+        upgrade = "upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 or later";
+    }
+    else {
+        return undefined;
+    }
+    return (`WARNING: ${runtime} does not block the compromised eMudhra intermediate CAs. ` +
+        "The LaunchDarkly MCP server rejects them for its own requests, but the runtime does not; " +
+        `${upgrade}. See https://github.com/launchdarkly/mcp-server#runtime-requirements\n`);
+}
+//# sourceMappingURL=tls-blocklist.js.map

package/dist/esm/mcp-server/cli/start/tls-blocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-blocklist.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/tls-blocklist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;CACnE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,mBAAmB,GAErB;IACF,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAuB,SAAS,CAAC;AAExD,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAe9D,0EAA0E;AAC1E,MAAM,0BAA0B,GAAwB,GAAG,CAAC,mBAAmB,CAAC;AAEhF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAiC;IAEjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAe;IACxC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QACrD,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KACE,IAAI,OAAO,GAAoC,IAAI,EACnD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAC7B,OAAO,GAAG,OAAO,CAAC,iBAAiB,EACnC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,OAAO,0BAA0B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,8CAA8C,IAAI,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,IAAyB;IAEzB,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,yCAAyC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CACP,8BAA8B,QAAQ,0BAA0B,OAAO,IAAI;YACzE,yDAAyD,CAC5D,EACD,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAClC,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,CAC/B,QAAQ,EACR,IAAsC,CACvC,CAAC;AACJ,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,IAAI,KAAK,EAAE,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACvC,MAAM,OAAO,GAAG,CACd,KAAkC,EAClC,IAAkC,EACR,EAAE;YAC5B,MAAM,UAAU,GACd,IAED,EAAE,GAAG,CAAC;YACP,MAAM,WAAW,GAAG,UAAU,EAAE,mBAAmB,CAAC;YACpD,MAAM,QAAQ,GAAwB,WAAW;gBAC/C,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CACjB,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC;gBACtE,CAAC,CAAE,mBAAsD,CAAC;YAC5D,OAAO,aAAa,CAAC,KAAK,EAAE;gBAC1B,GAAG,IAAI;gBACP,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE;aACvC,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,mBAAmB;YACrB,mBAAqD,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CACtB,CAAoC,EACpC,CAAoC;IAEpC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAGI,OAAO,CAAC,QAAQ;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,GAAG,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO;YACL,yFAAyF,CAAC;IAC9F,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,OAAO,GAAG,WAAW,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,GAAG,uDAAuD,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CACL,YAAY,OAAO,4DAA4D;QAC/E,2FAA2F;QAC3F,GAAG,OAAO,yEAAyE,CACpF,CAAC;AACJ,CAAC"}

package/dist/esm/mcp-server/mcp-server.js

@@ -16,7 +16,7 @@ const routes = buildRouteMap({
 export const app = buildApplication(routes, {
     name: "mcp",
     versionInfo: {
-        currentVersion: "0.6.2",
+        currentVersion: "0.7.1",
     },
 });
 run(app, process.argv.slice(2), buildContext(process));

package/dist/esm/mcp-server/server.js

@@ -29,7 +29,7 @@ import { tool$featureFlagsPatch } from "./tools/featureFlagsPatch.js";
 export function createMCPServer(deps) {
     const server = new McpServer({
         name: "LaunchDarkly",
-        version: "0.6.2",
+        version: "0.7.1",
     });
     const client = new LaunchDarklyCore({
         apiKey: deps.apiKey,

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@launchdarkly/mcp-server",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchdarkly/mcp-server",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "author": "LaunchDarkly",
   "keywords": [
     "feature-flags",
@@ -38,6 +38,8 @@
     "lint": "eslint --cache --max-warnings=0 src",
     "build:mcp": "bun src/mcp-server/build.mts",
     "build": "npm run build:mcp && tshy",
+    "test:sse-security": "node --test --test-force-exit test/sse-security.test.mjs",
+    "test:tls-blocklist": "node --test --test-force-exit test/tls-blocklist.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "peerDependencies": {},

package/src/lib/config.ts

@@ -69,8 +69,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "2.0",
-  sdkVersion: "0.6.2",
+  sdkVersion: "0.7.1",
   genVersion: "2.845.15",
   userAgent:
-    "speakeasy-sdk/typescript 0.6.2 2.845.15 2.0 @launchdarkly/mcp-server",
+    "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server",
 } as const;

package/src/mcp-server/cli/start/command.ts

@@ -27,6 +27,20 @@ export const startCommand = buildCommand({
         parse: (val: string) =>
           z.coerce.number().int().gte(0).lt(65536).parse(val),
       },
+      host: {
+        kind: "parsed",
+        brief:
+          "The host to listen on when the SSE transport is enabled. Non-loopback hosts require --auth-token",
+        default: "127.0.0.1",
+        parse: (value) => z.string().nonempty().parse(value),
+      },
+      "auth-token": {
+        kind: "parsed",
+        brief:
+          "Bearer token that SSE clients must send in the Authorization header",
+        optional: true,
+        parse: (value) => z.string().min(16).parse(value),
+      },
       tool: {
         kind: "parsed",
         brief: "Specify tools to mount on the server",