@launchdarkly/mcp-server 0.6.2 → 0.7.1

package/src/mcp-server/cli/start/impl.ts

@@ -4,6 +4,7 @@
 
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { localhostHostValidation } from "@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js";
 import express from "express";
 import { SDKOptions } from "../../../lib/config.js";
 import { LocalContext } from "../../cli.js";
@@ -13,10 +14,21 @@ import {
 } from "../../console-logger.js";
 import { MCPScope } from "../../scopes.js";
 import { createMCPServer } from "../../server.js";
+import {
+  assertSafeSSEBind,
+  isLoopbackHost,
+  requireBearerToken,
+} from "./sse-security.js";
+import {
+  installTlsBlocklist,
+  unpatchedRuntimeWarning,
+} from "./tls-blocklist.js";
 
 interface StartCommandFlags {
   readonly transport: "stdio" | "sse";
   readonly port: number;
+  readonly host: string;
+  readonly "auth-token"?: string | undefined;
   readonly tool?: string[];
   readonly scope?: MCPScope[];
   readonly "api-key"?: string | undefined;
@@ -27,6 +39,13 @@ interface StartCommandFlags {
 }
 
 export async function main(this: LocalContext, flags: StartCommandFlags) {
+  // INC-289: block the compromised eMudhra intermediates before any request.
+  installTlsBlocklist();
+  const runtimeWarning = unpatchedRuntimeWarning();
+  if (runtimeWarning) {
+    process.stderr.write(runtimeWarning);
+  }
+
   flags.env?.forEach(([key, value]) => {
     process.env[key] = value;
   });
@@ -66,37 +85,78 @@ async function startStdio(flags: StartCommandFlags) {
 
 async function startSSE(flags: StartCommandFlags) {
   const logger = createConsoleLogger(flags["log-level"]);
+  const host = flags.host;
+  const authToken = flags["auth-token"];
+  assertSafeSSEBind(host, authToken);
+
   const app = express();
-  const mcpServer = createMCPServer({
-    logger,
-    allowedTools: flags.tool,
-    scopes: flags.scope,
-    ...{ apiKey: flags["api-key"] ?? "" },
-    serverURL: flags["server-url"],
-    serverIdx: flags["server-index"],
-  });
-  let transport: SSEServerTransport | undefined;
+  if (isLoopbackHost(host)) {
+    app.use(localhostHostValidation());
+  }
+  if (authToken) {
+    app.use(requireBearerToken(authToken));
+  }
+
+  const sessions = new Map<
+    string,
+    { transport: SSEServerTransport; server: ReturnType<typeof createMCPServer> }
+  >();
   const controller = new AbortController();
 
   app.get("/sse", async (_req, res) => {
-    transport = new SSEServerTransport("/message", res);
+    const server = createMCPServer({
+      logger,
+      allowedTools: flags.tool,
+      scopes: flags.scope,
+      ...{ apiKey: flags["api-key"] ?? "" },
+      serverURL: flags["server-url"],
+      serverIdx: flags["server-index"],
+    });
+    const transport = new SSEServerTransport("/message", res);
+    sessions.set(transport.sessionId, { transport, server });
 
-    await mcpServer.connect(transport);
+    res.on("close", () => {
+      sessions.delete(transport.sessionId);
+      void server.close();
+    });
 
-    mcpServer.server.onclose = async () => {
-      res.end();
-    };
+    try {
+      await server.connect(transport);
+    } catch (err) {
+      logger.error("Failed to open SSE session", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      sessions.delete(transport.sessionId);
+      void server.close();
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
+    }
   });
 
   app.post("/message", async (req, res) => {
-    if (!transport) {
-      throw new Error("Server transport not initialized");
+    const sessionId = typeof req.query["sessionId"] === "string"
+      ? req.query["sessionId"]
+      : "";
+    const session = sessions.get(sessionId);
+    if (!session) {
+      res.status(404).send("Unknown session");
+      return;
     }
 
-    await transport.handlePostMessage(req, res);
+    try {
+      await session.transport.handlePostMessage(req, res);
+    } catch (err) {
+      logger.error("Failed to handle SSE message", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
+    }
   });
 
-  const httpServer = app.listen(flags.port, "0.0.0.0", () => {
+  const httpServer = app.listen(flags.port, host, () => {
     const ha = httpServer.address();
     const host = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
     logger.info("MCP HTTP server started", { host });
@@ -110,9 +170,9 @@ async function startSSE(flags: StartCommandFlags) {
     }
     closing = true;
 
-    logger.info("Shutting down MCP server");
+    logger.info("Shutting down MCP servers");
 
-    await mcpServer.close();
+    await Promise.all([...sessions.values()].map(({ server }) => server.close()));
 
     logger.info("Shutting down HTTP server");
 

package/src/mcp-server/cli/start/sse-security.ts

@@ -0,0 +1,31 @@
+import type { RequestHandler } from "express";
+import { timingSafeEqual } from "node:crypto";
+
+export function isLoopbackHost(host: string): boolean {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+
+export function assertSafeSSEBind(
+  host: string,
+  authToken: string | undefined,
+): void {
+  if (!authToken && !isLoopbackHost(host)) {
+    throw new Error(
+      `--auth-token is required when the SSE transport listens on a non-loopback host (${host})`,
+    );
+  }
+}
+
+export function requireBearerToken(token: string): RequestHandler {
+  const expected = Buffer.from(`Bearer ${token}`);
+  return (req, res, next) => {
+    const actual = Buffer.from(req.headers.authorization ?? "");
+    if (
+      actual.length !== expected.length || !timingSafeEqual(actual, expected)
+    ) {
+      res.status(401).send("Unauthorized");
+      return;
+    }
+    next();
+  };
+}

package/src/mcp-server/cli/start/tls-blocklist.ts

@@ -0,0 +1,252 @@
+import { createHash, X509Certificate } from "node:crypto";
+import tls from "node:tls";
+
+/*
+ * INC-289: rejects TLS chains that go through the compromised eMudhra
+ * intermediates (https://emudhra.we-have-a-problem.com/). Go 1.26.10, Node.js
+ * 22.23.4 / 24.22.1 / 26.12.1 and Bun (unreleased, oven-sh/bun#46300) block
+ * the same keys natively. This check covers runtimes that predate those fixes.
+ * It is installed only by the `mcp start` CLI, never for library consumers.
+ */
+
+/**
+ * SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
+ * Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
+ * (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
+ * G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
+ * than the certificate covers both.
+ */
+export const BLOCKED_SPKI_SHA256: ReadonlySet<string> = new Set([
+  "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+  "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+  "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+  "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+  "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
+  "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+  "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+  "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+]);
+
+/**
+ * Common names of the compromised intermediates. Every one of them has
+ * pathlen:0, so any leaf signed with one of their keys must name the
+ * intermediate as its issuer. Bun's fetch only exposes the leaf to
+ * checkServerIdentity, so the issuer name is what blocks these chains there.
+ */
+const BLOCKED_ISSUER_CN = /^em (dv|ov|ev) (tls|cs) ca - g3[bc]$/;
+
+/**
+ * Node.js releases that block these keys natively, by major version. Lines
+ * newer than the highest entry are treated as patched; any other line is
+ * treated as unpatched.
+ */
+const FIXED_NODE_VERSIONS: Readonly<
+  Record<number, readonly [number, number, number]>
+> = {
+  22: [22, 23, 4],
+  24: [24, 22, 1],
+  26: [26, 12, 1],
+};
+
+/**
+ * First Bun release that blocks these keys natively. Set this once one ships
+ * (the fix is oven-sh/bun#46300). While it is undefined, every Bun version
+ * gets the warning.
+ */
+const FIXED_BUN_VERSION: string | undefined = undefined;
+
+export const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
+
+/** The subset of tls.PeerCertificate this check reads. */
+export interface PeerCertificateLike {
+  raw?: Uint8Array | undefined;
+  fingerprint256?: string | undefined;
+  issuer?: { CN?: string | string[] | undefined } | undefined;
+  issuerCertificate?: PeerCertificateLike | undefined;
+}
+
+type CheckServerIdentity = (
+  hostname: string,
+  cert: tls.PeerCertificate,
+) => Error | undefined;
+
+// Captured before installTlsBlocklist() replaces tls.checkServerIdentity.
+const defaultCheckServerIdentity: CheckServerIdentity = tls.checkServerIdentity;
+
+function normalizeName(value: string): string {
+  return value.normalize("NFKC").toLowerCase().replace(/\s+/g, " ").trim();
+}
+
+export function isBlockedIssuerName(
+  cn: string | string[] | undefined,
+): boolean {
+  const names = Array.isArray(cn) ? cn : cn === undefined ? [] : [cn];
+  return names.some((name) => BLOCKED_ISSUER_CN.test(normalizeName(name)));
+}
+
+export function spkiSha256(raw: Uint8Array): string {
+  const spki = new X509Certificate(raw).publicKey.export({
+    type: "spki",
+    format: "der",
+  });
+  return createHash("sha256").update(spki).digest("hex");
+}
+
+/**
+ * Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
+ * returns a description of the first blocked certificate, if any.
+ */
+export function findBlockedCertificate(
+  cert: PeerCertificateLike,
+): string | undefined {
+  const seen = new Set<PeerCertificateLike>();
+  for (
+    let current: PeerCertificateLike | undefined = cert;
+    current && !seen.has(current);
+    current = current.issuerCertificate
+  ) {
+    seen.add(current);
+    if (isBlockedIssuerName(current.issuer?.CN)) {
+      return `certificate issued by "${String(current.issuer?.CN)}"`;
+    }
+    if (current.raw && current.raw.length > 0) {
+      const hash = spkiSha256(current.raw);
+      if (BLOCKED_SPKI_SHA256.has(hash)) {
+        return `certificate with blocked public key sha256/${hash}`;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * A tls checkServerIdentity replacement: rejects blocked chains, then runs
+ * the runtime's normal hostname verification.
+ */
+export function checkServerIdentity(
+  hostname: string,
+  cert: PeerCertificateLike,
+): Error | undefined {
+  let blocked: string | undefined;
+  try {
+    blocked = findBlockedCertificate(cert);
+  } catch (err) {
+    blocked = `certificate that could not be parsed (${String(err)})`;
+  }
+  if (blocked) {
+    return Object.assign(
+      new Error(
+        `Refusing TLS connection to ${hostname}: the chain contains a ${blocked}, ` +
+          "which belongs to a compromised eMudhra intermediate CA.",
+      ),
+      { code: BLOCKED_CERT_ERROR_CODE },
+    );
+  }
+  return defaultCheckServerIdentity(
+    hostname,
+    cert as unknown as tls.PeerCertificate,
+  );
+}
+
+let installed = false;
+
+/**
+ * Installs the blocklist for this process. On Node.js, global fetch (undici)
+ * and node:https read tls.checkServerIdentity when they connect. Bun's fetch
+ * ignores it, so on Bun global fetch is wrapped to pass the check through
+ * Bun's `tls` fetch option.
+ */
+export function installTlsBlocklist(): void {
+  if (installed) return;
+  installed = true;
+
+  if (isBun()) {
+    const originalFetch = globalThis.fetch;
+    const wrapped = (
+      input: Parameters<typeof fetch>[0],
+      init?: Parameters<typeof fetch>[1],
+    ): ReturnType<typeof fetch> => {
+      const tlsOptions = (
+        init as
+          { tls?: { checkServerIdentity?: CheckServerIdentity } } | undefined
+      )?.tls;
+      const callerCheck = tlsOptions?.checkServerIdentity;
+      const combined: CheckServerIdentity = callerCheck
+        ? (hostname, cert) =>
+            checkServerIdentity(hostname, cert) ?? callerCheck(hostname, cert)
+        : (checkServerIdentity as unknown as CheckServerIdentity);
+      return originalFetch(input, {
+        ...init,
+        tls: { ...tlsOptions, checkServerIdentity: combined },
+      } as RequestInit);
+    };
+    globalThis.fetch = Object.assign(wrapped, originalFetch);
+  } else {
+    tls.checkServerIdentity =
+      checkServerIdentity as unknown as CheckServerIdentity;
+  }
+}
+
+function isBun(): boolean {
+  return typeof (globalThis as { Bun?: unknown }).Bun !== "undefined";
+}
+
+function parseVersion(version: string): [number, number, number] | undefined {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version);
+  if (!match) return undefined;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+function compareVersions(
+  a: readonly [number, number, number],
+  b: readonly [number, number, number],
+): number {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+
+export function isNodeVersionPatched(version: string): boolean {
+  const parsed = parseVersion(version);
+  if (!parsed) return false;
+  const fixed = FIXED_NODE_VERSIONS[parsed[0]];
+  if (fixed) return compareVersions(parsed, fixed) >= 0;
+  const newestLine = Math.max(...Object.keys(FIXED_NODE_VERSIONS).map(Number));
+  return parsed[0] > newestLine;
+}
+
+export function isBunVersionPatched(version: string): boolean {
+  if (FIXED_BUN_VERSION === undefined) return false;
+  const parsed = parseVersion(version);
+  const fixed = parseVersion(FIXED_BUN_VERSION);
+  return !!parsed && !!fixed && compareVersions(parsed, fixed) >= 0;
+}
+
+/**
+ * Returns a warning when the current runtime does not block the compromised
+ * eMudhra intermediates natively, or undefined when it does.
+ */
+export function unpatchedRuntimeWarning(
+  versions: {
+    node?: string | undefined;
+    bun?: string | undefined;
+  } = process.versions,
+): string | undefined {
+  let runtime: string;
+  let upgrade: string;
+  if (versions.bun !== undefined) {
+    if (isBunVersionPatched(versions.bun)) return undefined;
+    runtime = `Bun ${versions.bun}`;
+    upgrade =
+      "run the server with Node.js 22.23.4, 24.22.1, 26.12.1 or later, or use the Docker image";
+  } else if (versions.node !== undefined) {
+    if (isNodeVersionPatched(versions.node)) return undefined;
+    runtime = `Node.js ${versions.node}`;
+    upgrade = "upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 or later";
+  } else {
+    return undefined;
+  }
+  return (
+    `WARNING: ${runtime} does not block the compromised eMudhra intermediate CAs. ` +
+    "The LaunchDarkly MCP server rejects them for its own requests, but the runtime does not; " +
+    `${upgrade}. See https://github.com/launchdarkly/mcp-server#runtime-requirements\n`
+  );
+}

package/src/mcp-server/mcp-server.ts

@@ -19,7 +19,7 @@ const routes = buildRouteMap({
 export const app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.6.2",
+    currentVersion: "0.7.1",
   },
 });
 

package/src/mcp-server/server.ts

@@ -44,7 +44,7 @@ export function createMCPServer(deps: {
 }) {
   const server = new McpServer({
     name: "LaunchDarkly",
-    version: "0.6.2",
+    version: "0.7.1",
   });
 
   const client = new LaunchDarklyCore({

package/test/sse-security.test.mjs

@@ -0,0 +1,84 @@
+import assert from "node:assert/strict";
+import process from "node:process";
+import { after, before, describe, test } from "node:test";
+import express from "express";
+import { main } from "../dist/esm/mcp-server/cli/start/impl.js";
+import {
+  assertSafeSSEBind,
+  requireBearerToken,
+} from "../dist/esm/mcp-server/cli/start/sse-security.js";
+
+const TOKEN = "0123456789abcdef";
+
+describe("assertSafeSSEBind", () => {
+  for (const host of ["0.0.0.0", "::", "192.168.1.10", "example.com"]) {
+    test(`refuses ${host} without a token`, () => {
+      assert.throws(
+        () => assertSafeSSEBind(host, undefined),
+        /--auth-token is required/,
+      );
+    });
+
+    test(`allows ${host} with a token`, () => {
+      assert.doesNotThrow(() => assertSafeSSEBind(host, TOKEN));
+    });
+  }
+
+  for (const host of ["127.0.0.1", "localhost", "::1"]) {
+    test(`allows loopback ${host} without a token`, () => {
+      assert.doesNotThrow(() => assertSafeSSEBind(host, undefined));
+    });
+  }
+});
+
+test("start --transport sse refuses a non-loopback host without a token", async () => {
+  await assert.rejects(
+    main.call({ process }, {
+      transport: "sse",
+      host: "0.0.0.0",
+      port: 0,
+      "log-level": "error",
+    }),
+    /--auth-token is required/,
+  );
+});
+
+describe("requireBearerToken", () => {
+  let server;
+  let url;
+
+  before(async () => {
+    const app = express();
+    app.use(requireBearerToken(TOKEN));
+    app.get("/", (_req, res) => res.send("ok"));
+    await new Promise((resolve) => {
+      server = app.listen(0, "127.0.0.1", resolve);
+    });
+    url = `http://127.0.0.1:${server.address().port}/`;
+  });
+
+  after(() => new Promise((resolve) => server.close(resolve)));
+
+  const cases = [
+    ["a missing header", undefined],
+    ["a wrong token of the same length", "Bearer fedcba9876543210"],
+    ["a token prefix", `Bearer ${TOKEN.slice(0, -1)}`],
+    ["the token without the Bearer scheme", TOKEN],
+  ];
+  for (const [name, header] of cases) {
+    test(`returns 401 for ${name}`, async () => {
+      const res = await fetch(url, {
+        headers: header === undefined ? {} : { Authorization: header },
+      });
+      assert.equal(res.status, 401);
+    });
+  }
+
+  test("passes the request through for the right token", async () => {
+    const res = await fetch(url, {
+      headers: { Authorization: `Bearer ${TOKEN}` },
+    });
+    assert.equal(res.status, 200);
+    assert.equal(await res.text(), "ok");
+  });
+});