@launchdarkly/mcp-server 0.7.0 → 0.7.1

package/README.md

@@ -35,6 +35,15 @@ The local [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) serve
 
 This MCP server can be installed in any AI client that supports the MCP protocol. Refer to your AI client's instructions if it isn't listed here.
 
+### Runtime requirements
+
+> [!IMPORTANT]
+> Some eMudhra intermediate certificate authorities were compromised in October 2026 ([advisory](https://emudhra.we-have-a-problem.com/)). Anyone on your network who holds one of their keys could intercept the server's connection to LaunchDarkly and read your API access token.
+>
+> - **npx and local installs:** use Node.js **22.23.4, 24.22.1, 26.12.1 or later**. These releases reject the compromised intermediates. The server also rejects them itself and prints a warning on startup when your runtime does not.
+> - **Docker:** use image 0.7.1 or later. Those run on Node.js 24.22.1; 0.7.0 and earlier run on Node.js 24.2.0.
+> - **Standalone binaries:** stop using the `mcp-server-bun-*` binaries attached to releases v0.6.1 and earlier. They embed a Bun runtime that does not reject the compromised intermediates, and they are no longer published. Switch to npx with a patched Node.js or to Docker.
+
 ### Cursor installation steps
 
 Create a `.cursor/mcp.json` file in your project root with the following content:
@@ -128,15 +137,6 @@ Specify your API key as found on LaunchDarkly's Authorization page.
 
 For more information, see the [GitHub Copilot CLI documentation](https://docs.github.com/en/copilot/concepts/agents/about-copilot-cli).
 
-### Standalone binary installation steps
-
-You can also run the MCP server as a standalone binary with no additional dependencies. You must pull these binaries from available GitHub releases while specifying the appropriate `tag` value:
-
-```bash
-curl -L -o mcp-server https://github.com/launchdarkly/mcp-server/releases/download/{tag}/mcp-server-bun-darwin-arm64 && \
-chmod +x mcp-server
-```
-
 ### Installation steps from a local clone
 
 You can also run the MCP server locally by cloning this repository. Once cloned, you'll need to install dependencies (`npm install`) and build the server (`npm run build`).

package/bin/mcp-server.js

@@ -54339,9 +54339,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "2.0",
-    sdkVersion: "0.7.0",
+    sdkVersion: "0.7.1",
     genVersion: "2.845.15",
-    userAgent: "speakeasy-sdk/typescript 0.7.0 2.845.15 2.0 @launchdarkly/mcp-server"
+    userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server"
   };
 });
 
@@ -62064,7 +62064,7 @@ var init_featureFlagsPatch2 = __esm(() => {
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "LaunchDarkly",
-    version: "0.7.0"
+    version: "0.7.1"
   });
   const client = new LaunchDarklyCore({
     apiKey: deps.apiKey,
@@ -62150,12 +62150,151 @@ function requireBearerToken(token) {
 }
 var init_sse_security = () => {};
 
+// src/mcp-server/cli/start/tls-blocklist.ts
+import { createHash, X509Certificate } from "node:crypto";
+import tls from "node:tls";
+function normalizeName(value) {
+  return value.normalize("NFKC").toLowerCase().replace(/\s+/g, " ").trim();
+}
+function isBlockedIssuerName(cn) {
+  const names = Array.isArray(cn) ? cn : cn === undefined ? [] : [cn];
+  return names.some((name) => BLOCKED_ISSUER_CN.test(normalizeName(name)));
+}
+function spkiSha256(raw) {
+  const spki = new X509Certificate(raw).publicKey.export({
+    type: "spki",
+    format: "der"
+  });
+  return createHash("sha256").update(spki).digest("hex");
+}
+function findBlockedCertificate(cert) {
+  const seen = new Set;
+  for (let current = cert;current && !seen.has(current); current = current.issuerCertificate) {
+    seen.add(current);
+    if (isBlockedIssuerName(current.issuer?.CN)) {
+      return `certificate issued by "${String(current.issuer?.CN)}"`;
+    }
+    if (current.raw && current.raw.length > 0) {
+      const hash = spkiSha256(current.raw);
+      if (BLOCKED_SPKI_SHA256.has(hash)) {
+        return `certificate with blocked public key sha256/${hash}`;
+      }
+    }
+  }
+  return;
+}
+function checkServerIdentity(hostname, cert) {
+  let blocked;
+  try {
+    blocked = findBlockedCertificate(cert);
+  } catch (err) {
+    blocked = `certificate that could not be parsed (${String(err)})`;
+  }
+  if (blocked) {
+    return Object.assign(new Error(`Refusing TLS connection to ${hostname}: the chain contains a ${blocked}, ` + "which belongs to a compromised eMudhra intermediate CA."), { code: BLOCKED_CERT_ERROR_CODE });
+  }
+  return defaultCheckServerIdentity(hostname, cert);
+}
+function installTlsBlocklist() {
+  if (installed)
+    return;
+  installed = true;
+  if (isBun()) {
+    const originalFetch = globalThis.fetch;
+    const wrapped = (input, init) => {
+      const tlsOptions = init?.tls;
+      const callerCheck = tlsOptions?.checkServerIdentity;
+      const combined = callerCheck ? (hostname, cert) => checkServerIdentity(hostname, cert) ?? callerCheck(hostname, cert) : checkServerIdentity;
+      return originalFetch(input, {
+        ...init,
+        tls: { ...tlsOptions, checkServerIdentity: combined }
+      });
+    };
+    globalThis.fetch = Object.assign(wrapped, originalFetch);
+  } else {
+    tls.checkServerIdentity = checkServerIdentity;
+  }
+}
+function isBun() {
+  return typeof globalThis.Bun !== "undefined";
+}
+function parseVersion(version2) {
+  const match2 = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version2);
+  if (!match2)
+    return;
+  return [Number(match2[1]), Number(match2[2]), Number(match2[3])];
+}
+function compareVersions(a, b2) {
+  return a[0] - b2[0] || a[1] - b2[1] || a[2] - b2[2];
+}
+function isNodeVersionPatched(version2) {
+  const parsed = parseVersion(version2);
+  if (!parsed)
+    return false;
+  const fixed = FIXED_NODE_VERSIONS[parsed[0]];
+  if (fixed)
+    return compareVersions(parsed, fixed) >= 0;
+  const newestLine = Math.max(...Object.keys(FIXED_NODE_VERSIONS).map(Number));
+  return parsed[0] > newestLine;
+}
+function isBunVersionPatched(version2) {
+  if (FIXED_BUN_VERSION === undefined)
+    return false;
+  const parsed = parseVersion(version2);
+  const fixed = parseVersion(FIXED_BUN_VERSION);
+  return !!parsed && !!fixed && compareVersions(parsed, fixed) >= 0;
+}
+function unpatchedRuntimeWarning(versions2 = process.versions) {
+  let runtime;
+  let upgrade;
+  if (versions2.bun !== undefined) {
+    if (isBunVersionPatched(versions2.bun))
+      return;
+    runtime = `Bun ${versions2.bun}`;
+    upgrade = "run the server with Node.js 22.23.4, 24.22.1, 26.12.1 or later, or use the Docker image";
+  } else if (versions2.node !== undefined) {
+    if (isNodeVersionPatched(versions2.node))
+      return;
+    runtime = `Node.js ${versions2.node}`;
+    upgrade = "upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 or later";
+  } else {
+    return;
+  }
+  return `WARNING: ${runtime} does not block the compromised eMudhra intermediate CAs. ` + "The LaunchDarkly MCP server rejects them for its own requests, but the runtime does not; " + `${upgrade}. See https://github.com/launchdarkly/mcp-server#runtime-requirements
+`;
+}
+var BLOCKED_SPKI_SHA256, BLOCKED_ISSUER_CN, FIXED_NODE_VERSIONS, FIXED_BUN_VERSION = undefined, BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED", defaultCheckServerIdentity, installed = false;
+var init_tls_blocklist = __esm(() => {
+  BLOCKED_SPKI_SHA256 = new Set([
+    "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+    "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+    "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+    "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+    "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
+    "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+    "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+    "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6"
+  ]);
+  BLOCKED_ISSUER_CN = /^em (dv|ov|ev) (tls|cs) ca - g3[bc]$/;
+  FIXED_NODE_VERSIONS = {
+    22: [22, 23, 4],
+    24: [24, 22, 1],
+    26: [26, 12, 1]
+  };
+  defaultCheckServerIdentity = tls.checkServerIdentity;
+});
+
 // src/mcp-server/cli/start/impl.ts
 var exports_impl = {};
 __export(exports_impl, {
   main: () => main
 });
 async function main(flags) {
+  installTlsBlocklist();
+  const runtimeWarning = unpatchedRuntimeWarning();
+  if (runtimeWarning) {
+    process.stderr.write(runtimeWarning);
+  }
   flags.env?.forEach(([key, value]) => {
     process.env[key] = value;
   });
@@ -62286,6 +62425,7 @@ var init_impl = __esm(() => {
   init_console_logger();
   init_server3();
   init_sse_security();
+  init_tls_blocklist();
 });
 
 // node_modules/@stricli/core/dist/index.js
@@ -63386,7 +63526,7 @@ var routes = an({
 var app = He(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.7.0"
+    currentVersion: "0.7.1"
   }
 });
 zt(app, process4.argv.slice(2), buildContext(process4));
@@ -63394,5 +63534,5 @@ export {
   app
 };
 
-//# debugId=1BB1876EEFF45EEC64756E2164756E21
+//# debugId=7226CCD8FB08BAF664756E2164756E21
 //# sourceMappingURL=mcp-server.js.map