@launchdarkly/mcp-server 0.7.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -9
- package/bin/mcp-server.js +145 -5
- package/bin/mcp-server.js.map +8 -7
- package/dist/commonjs/lib/config.d.ts +2 -2
- package/dist/commonjs/lib/config.js +2 -2
- package/dist/commonjs/mcp-server/cli/start/impl.d.ts.map +1 -1
- package/dist/commonjs/mcp-server/cli/start/impl.js +7 -0
- package/dist/commonjs/mcp-server/cli/start/impl.js.map +1 -1
- package/dist/commonjs/mcp-server/cli/start/tls-blocklist.d.ts +48 -0
- package/dist/commonjs/mcp-server/cli/start/tls-blocklist.d.ts.map +1 -0
- package/dist/commonjs/mcp-server/cli/start/tls-blocklist.js +206 -0
- package/dist/commonjs/mcp-server/cli/start/tls-blocklist.js.map +1 -0
- package/dist/commonjs/mcp-server/mcp-server.js +1 -1
- package/dist/commonjs/mcp-server/server.js +1 -1
- package/dist/esm/lib/config.d.ts +2 -2
- package/dist/esm/lib/config.js +2 -2
- package/dist/esm/mcp-server/cli/start/impl.d.ts.map +1 -1
- package/dist/esm/mcp-server/cli/start/impl.js +7 -0
- package/dist/esm/mcp-server/cli/start/impl.js.map +1 -1
- package/dist/esm/mcp-server/cli/start/tls-blocklist.d.ts +48 -0
- package/dist/esm/mcp-server/cli/start/tls-blocklist.d.ts.map +1 -0
- package/dist/esm/mcp-server/cli/start/tls-blocklist.js +192 -0
- package/dist/esm/mcp-server/cli/start/tls-blocklist.js.map +1 -0
- package/dist/esm/mcp-server/mcp-server.js +1 -1
- package/dist/esm/mcp-server/server.js +1 -1
- package/jsr.json +1 -1
- package/package.json +2 -1
- package/src/lib/config.ts +2 -2
- package/src/mcp-server/cli/start/impl.ts +11 -0
- package/src/mcp-server/cli/start/tls-blocklist.ts +252 -0
- package/src/mcp-server/mcp-server.ts +1 -1
- package/src/mcp-server/server.ts +1 -1
- package/test/tls-blocklist.test.mjs +314 -0
|
@@ -31,8 +31,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
|
|
|
31
31
|
export declare const SDK_METADATA: {
|
|
32
32
|
readonly language: "typescript";
|
|
33
33
|
readonly openapiDocVersion: "2.0";
|
|
34
|
-
readonly sdkVersion: "0.7.
|
|
34
|
+
readonly sdkVersion: "0.7.1";
|
|
35
35
|
readonly genVersion: "2.845.15";
|
|
36
|
-
readonly userAgent: "speakeasy-sdk/typescript 0.7.
|
|
36
|
+
readonly userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server";
|
|
37
37
|
};
|
|
38
38
|
//# sourceMappingURL=config.d.ts.map
|
|
@@ -39,8 +39,8 @@ function serverURLFromOptions(options) {
|
|
|
39
39
|
exports.SDK_METADATA = {
|
|
40
40
|
language: "typescript",
|
|
41
41
|
openapiDocVersion: "2.0",
|
|
42
|
-
sdkVersion: "0.7.
|
|
42
|
+
sdkVersion: "0.7.1",
|
|
43
43
|
genVersion: "2.845.15",
|
|
44
|
-
userAgent: "speakeasy-sdk/typescript 0.7.
|
|
44
|
+
userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server",
|
|
45
45
|
};
|
|
46
46
|
//# sourceMappingURL=config.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAY3C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACnC;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,iBAsBtE"}
|
|
@@ -14,7 +14,14 @@ const express_1 = __importDefault(require("express"));
|
|
|
14
14
|
const console_logger_js_1 = require("../../console-logger.js");
|
|
15
15
|
const server_js_1 = require("../../server.js");
|
|
16
16
|
const sse_security_js_1 = require("./sse-security.js");
|
|
17
|
+
const tls_blocklist_js_1 = require("./tls-blocklist.js");
|
|
17
18
|
async function main(flags) {
|
|
19
|
+
// INC-289: block the compromised eMudhra intermediates before any request.
|
|
20
|
+
(0, tls_blocklist_js_1.installTlsBlocklist)();
|
|
21
|
+
const runtimeWarning = (0, tls_blocklist_js_1.unpatchedRuntimeWarning)();
|
|
22
|
+
if (runtimeWarning) {
|
|
23
|
+
process.stderr.write(runtimeWarning);
|
|
24
|
+
}
|
|
18
25
|
flags.env?.forEach(([key, value]) => {
|
|
19
26
|
process.env[key] = value;
|
|
20
27
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;
|
|
1
|
+
{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;AAsCH,oBAsBC;AA1DD,oEAA6E;AAC7E,wEAAiF;AACjF,iHAA8G;AAC9G,sDAA8B;AAG9B,+DAGiC;AAEjC,+CAAkD;AAClD,uDAI2B;AAC3B,yDAG4B;AAgBrB,KAAK,UAAU,IAAI,CAAqB,KAAwB;IACrE,2EAA2E;IAC3E,IAAA,sCAAmB,GAAE,CAAC;IACtB,MAAM,cAAc,GAAG,IAAA,0CAAuB,GAAE,CAAC;IACjD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,KAAK;YACR,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC;QAC7B,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAwB;IAC9C,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,IAAA,mCAAiB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,IAAI,IAAA,gCAAc,EAAC,IAAI,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAA,iDAAuB,GAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAA,oCAAkB,EAAC,SAAS,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC;YAC7B,MAAM;YACN,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;YACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,2BAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YACxB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC3C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QACnD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE9E,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC"}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
|
|
3
|
+
* Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
|
|
4
|
+
* (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
|
|
5
|
+
* G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
|
|
6
|
+
* than the certificate covers both.
|
|
7
|
+
*/
|
|
8
|
+
export declare const BLOCKED_SPKI_SHA256: ReadonlySet<string>;
|
|
9
|
+
export declare const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
|
|
10
|
+
/** The subset of tls.PeerCertificate this check reads. */
|
|
11
|
+
export interface PeerCertificateLike {
|
|
12
|
+
raw?: Uint8Array | undefined;
|
|
13
|
+
fingerprint256?: string | undefined;
|
|
14
|
+
issuer?: {
|
|
15
|
+
CN?: string | string[] | undefined;
|
|
16
|
+
} | undefined;
|
|
17
|
+
issuerCertificate?: PeerCertificateLike | undefined;
|
|
18
|
+
}
|
|
19
|
+
export declare function isBlockedIssuerName(cn: string | string[] | undefined): boolean;
|
|
20
|
+
export declare function spkiSha256(raw: Uint8Array): string;
|
|
21
|
+
/**
|
|
22
|
+
* Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
|
|
23
|
+
* returns a description of the first blocked certificate, if any.
|
|
24
|
+
*/
|
|
25
|
+
export declare function findBlockedCertificate(cert: PeerCertificateLike): string | undefined;
|
|
26
|
+
/**
|
|
27
|
+
* A tls checkServerIdentity replacement: rejects blocked chains, then runs
|
|
28
|
+
* the runtime's normal hostname verification.
|
|
29
|
+
*/
|
|
30
|
+
export declare function checkServerIdentity(hostname: string, cert: PeerCertificateLike): Error | undefined;
|
|
31
|
+
/**
|
|
32
|
+
* Installs the blocklist for this process. On Node.js, global fetch (undici)
|
|
33
|
+
* and node:https read tls.checkServerIdentity when they connect. Bun's fetch
|
|
34
|
+
* ignores it, so on Bun global fetch is wrapped to pass the check through
|
|
35
|
+
* Bun's `tls` fetch option.
|
|
36
|
+
*/
|
|
37
|
+
export declare function installTlsBlocklist(): void;
|
|
38
|
+
export declare function isNodeVersionPatched(version: string): boolean;
|
|
39
|
+
export declare function isBunVersionPatched(version: string): boolean;
|
|
40
|
+
/**
|
|
41
|
+
* Returns a warning when the current runtime does not block the compromised
|
|
42
|
+
* eMudhra intermediates natively, or undefined when it does.
|
|
43
|
+
*/
|
|
44
|
+
export declare function unpatchedRuntimeWarning(versions?: {
|
|
45
|
+
node?: string | undefined;
|
|
46
|
+
bun?: string | undefined;
|
|
47
|
+
}): string | undefined;
|
|
48
|
+
//# sourceMappingURL=tls-blocklist.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tls-blocklist.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/tls-blocklist.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CASlD,CAAC;AA8BH,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACrD;AAcD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAChC,OAAO,CAGT;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAMlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,mBAAmB,GACxB,MAAM,GAAG,SAAS,CAmBpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,mBAAmB,GACxB,KAAK,GAAG,SAAS,CAoBnB;AAID;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,GAAE;IACR,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACP,GACnB,MAAM,GAAG,SAAS,CAoBpB"}
|
|
@@ -0,0 +1,206 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
3
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
4
|
+
};
|
|
5
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
|
+
exports.BLOCKED_CERT_ERROR_CODE = exports.BLOCKED_SPKI_SHA256 = void 0;
|
|
7
|
+
exports.isBlockedIssuerName = isBlockedIssuerName;
|
|
8
|
+
exports.spkiSha256 = spkiSha256;
|
|
9
|
+
exports.findBlockedCertificate = findBlockedCertificate;
|
|
10
|
+
exports.checkServerIdentity = checkServerIdentity;
|
|
11
|
+
exports.installTlsBlocklist = installTlsBlocklist;
|
|
12
|
+
exports.isNodeVersionPatched = isNodeVersionPatched;
|
|
13
|
+
exports.isBunVersionPatched = isBunVersionPatched;
|
|
14
|
+
exports.unpatchedRuntimeWarning = unpatchedRuntimeWarning;
|
|
15
|
+
const node_crypto_1 = require("node:crypto");
|
|
16
|
+
const node_tls_1 = __importDefault(require("node:tls"));
|
|
17
|
+
/*
|
|
18
|
+
* INC-289: rejects TLS chains that go through the compromised eMudhra
|
|
19
|
+
* intermediates (https://emudhra.we-have-a-problem.com/). Go 1.26.10, Node.js
|
|
20
|
+
* 22.23.4 / 24.22.1 / 26.12.1 and Bun (unreleased, oven-sh/bun#46300) block
|
|
21
|
+
* the same keys natively. This check covers runtimes that predate those fixes.
|
|
22
|
+
* It is installed only by the `mcp start` CLI, never for library consumers.
|
|
23
|
+
*/
|
|
24
|
+
/**
|
|
25
|
+
* SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
|
|
26
|
+
* Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
|
|
27
|
+
* (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
|
|
28
|
+
* G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
|
|
29
|
+
* than the certificate covers both.
|
|
30
|
+
*/
|
|
31
|
+
exports.BLOCKED_SPKI_SHA256 = new Set([
|
|
32
|
+
"43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
|
|
33
|
+
"49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
|
|
34
|
+
"5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
|
|
35
|
+
"63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
|
|
36
|
+
"92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
|
|
37
|
+
"e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
|
|
38
|
+
"ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
|
|
39
|
+
"ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
|
|
40
|
+
]);
|
|
41
|
+
/**
|
|
42
|
+
* Common names of the compromised intermediates. Every one of them has
|
|
43
|
+
* pathlen:0, so any leaf signed with one of their keys must name the
|
|
44
|
+
* intermediate as its issuer. Bun's fetch only exposes the leaf to
|
|
45
|
+
* checkServerIdentity, so the issuer name is what blocks these chains there.
|
|
46
|
+
*/
|
|
47
|
+
const BLOCKED_ISSUER_CN = /^em (dv|ov|ev) (tls|cs) ca - g3[bc]$/;
|
|
48
|
+
/**
|
|
49
|
+
* Node.js releases that block these keys natively, by major version. Lines
|
|
50
|
+
* newer than the highest entry are treated as patched; any other line is
|
|
51
|
+
* treated as unpatched.
|
|
52
|
+
*/
|
|
53
|
+
const FIXED_NODE_VERSIONS = {
|
|
54
|
+
22: [22, 23, 4],
|
|
55
|
+
24: [24, 22, 1],
|
|
56
|
+
26: [26, 12, 1],
|
|
57
|
+
};
|
|
58
|
+
/**
|
|
59
|
+
* First Bun release that blocks these keys natively. Set this once one ships
|
|
60
|
+
* (the fix is oven-sh/bun#46300). While it is undefined, every Bun version
|
|
61
|
+
* gets the warning.
|
|
62
|
+
*/
|
|
63
|
+
const FIXED_BUN_VERSION = undefined;
|
|
64
|
+
exports.BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
|
|
65
|
+
// Captured before installTlsBlocklist() replaces tls.checkServerIdentity.
|
|
66
|
+
const defaultCheckServerIdentity = node_tls_1.default.checkServerIdentity;
|
|
67
|
+
function normalizeName(value) {
|
|
68
|
+
return value.normalize("NFKC").toLowerCase().replace(/\s+/g, " ").trim();
|
|
69
|
+
}
|
|
70
|
+
function isBlockedIssuerName(cn) {
|
|
71
|
+
const names = Array.isArray(cn) ? cn : cn === undefined ? [] : [cn];
|
|
72
|
+
return names.some((name) => BLOCKED_ISSUER_CN.test(normalizeName(name)));
|
|
73
|
+
}
|
|
74
|
+
function spkiSha256(raw) {
|
|
75
|
+
const spki = new node_crypto_1.X509Certificate(raw).publicKey.export({
|
|
76
|
+
type: "spki",
|
|
77
|
+
format: "der",
|
|
78
|
+
});
|
|
79
|
+
return (0, node_crypto_1.createHash)("sha256").update(spki).digest("hex");
|
|
80
|
+
}
|
|
81
|
+
/**
|
|
82
|
+
* Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
|
|
83
|
+
* returns a description of the first blocked certificate, if any.
|
|
84
|
+
*/
|
|
85
|
+
function findBlockedCertificate(cert) {
|
|
86
|
+
const seen = new Set();
|
|
87
|
+
for (let current = cert; current && !seen.has(current); current = current.issuerCertificate) {
|
|
88
|
+
seen.add(current);
|
|
89
|
+
if (isBlockedIssuerName(current.issuer?.CN)) {
|
|
90
|
+
return `certificate issued by "${String(current.issuer?.CN)}"`;
|
|
91
|
+
}
|
|
92
|
+
if (current.raw && current.raw.length > 0) {
|
|
93
|
+
const hash = spkiSha256(current.raw);
|
|
94
|
+
if (exports.BLOCKED_SPKI_SHA256.has(hash)) {
|
|
95
|
+
return `certificate with blocked public key sha256/${hash}`;
|
|
96
|
+
}
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
return undefined;
|
|
100
|
+
}
|
|
101
|
+
/**
|
|
102
|
+
* A tls checkServerIdentity replacement: rejects blocked chains, then runs
|
|
103
|
+
* the runtime's normal hostname verification.
|
|
104
|
+
*/
|
|
105
|
+
function checkServerIdentity(hostname, cert) {
|
|
106
|
+
let blocked;
|
|
107
|
+
try {
|
|
108
|
+
blocked = findBlockedCertificate(cert);
|
|
109
|
+
}
|
|
110
|
+
catch (err) {
|
|
111
|
+
blocked = `certificate that could not be parsed (${String(err)})`;
|
|
112
|
+
}
|
|
113
|
+
if (blocked) {
|
|
114
|
+
return Object.assign(new Error(`Refusing TLS connection to ${hostname}: the chain contains a ${blocked}, ` +
|
|
115
|
+
"which belongs to a compromised eMudhra intermediate CA."), { code: exports.BLOCKED_CERT_ERROR_CODE });
|
|
116
|
+
}
|
|
117
|
+
return defaultCheckServerIdentity(hostname, cert);
|
|
118
|
+
}
|
|
119
|
+
let installed = false;
|
|
120
|
+
/**
|
|
121
|
+
* Installs the blocklist for this process. On Node.js, global fetch (undici)
|
|
122
|
+
* and node:https read tls.checkServerIdentity when they connect. Bun's fetch
|
|
123
|
+
* ignores it, so on Bun global fetch is wrapped to pass the check through
|
|
124
|
+
* Bun's `tls` fetch option.
|
|
125
|
+
*/
|
|
126
|
+
function installTlsBlocklist() {
|
|
127
|
+
if (installed)
|
|
128
|
+
return;
|
|
129
|
+
installed = true;
|
|
130
|
+
if (isBun()) {
|
|
131
|
+
const originalFetch = globalThis.fetch;
|
|
132
|
+
const wrapped = (input, init) => {
|
|
133
|
+
const tlsOptions = init?.tls;
|
|
134
|
+
const callerCheck = tlsOptions?.checkServerIdentity;
|
|
135
|
+
const combined = callerCheck
|
|
136
|
+
? (hostname, cert) => checkServerIdentity(hostname, cert) ?? callerCheck(hostname, cert)
|
|
137
|
+
: checkServerIdentity;
|
|
138
|
+
return originalFetch(input, {
|
|
139
|
+
...init,
|
|
140
|
+
tls: { ...tlsOptions, checkServerIdentity: combined },
|
|
141
|
+
});
|
|
142
|
+
};
|
|
143
|
+
globalThis.fetch = Object.assign(wrapped, originalFetch);
|
|
144
|
+
}
|
|
145
|
+
else {
|
|
146
|
+
node_tls_1.default.checkServerIdentity =
|
|
147
|
+
checkServerIdentity;
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
function isBun() {
|
|
151
|
+
return typeof globalThis.Bun !== "undefined";
|
|
152
|
+
}
|
|
153
|
+
function parseVersion(version) {
|
|
154
|
+
const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version);
|
|
155
|
+
if (!match)
|
|
156
|
+
return undefined;
|
|
157
|
+
return [Number(match[1]), Number(match[2]), Number(match[3])];
|
|
158
|
+
}
|
|
159
|
+
function compareVersions(a, b) {
|
|
160
|
+
return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
|
|
161
|
+
}
|
|
162
|
+
function isNodeVersionPatched(version) {
|
|
163
|
+
const parsed = parseVersion(version);
|
|
164
|
+
if (!parsed)
|
|
165
|
+
return false;
|
|
166
|
+
const fixed = FIXED_NODE_VERSIONS[parsed[0]];
|
|
167
|
+
if (fixed)
|
|
168
|
+
return compareVersions(parsed, fixed) >= 0;
|
|
169
|
+
const newestLine = Math.max(...Object.keys(FIXED_NODE_VERSIONS).map(Number));
|
|
170
|
+
return parsed[0] > newestLine;
|
|
171
|
+
}
|
|
172
|
+
function isBunVersionPatched(version) {
|
|
173
|
+
if (FIXED_BUN_VERSION === undefined)
|
|
174
|
+
return false;
|
|
175
|
+
const parsed = parseVersion(version);
|
|
176
|
+
const fixed = parseVersion(FIXED_BUN_VERSION);
|
|
177
|
+
return !!parsed && !!fixed && compareVersions(parsed, fixed) >= 0;
|
|
178
|
+
}
|
|
179
|
+
/**
|
|
180
|
+
* Returns a warning when the current runtime does not block the compromised
|
|
181
|
+
* eMudhra intermediates natively, or undefined when it does.
|
|
182
|
+
*/
|
|
183
|
+
function unpatchedRuntimeWarning(versions = process.versions) {
|
|
184
|
+
let runtime;
|
|
185
|
+
let upgrade;
|
|
186
|
+
if (versions.bun !== undefined) {
|
|
187
|
+
if (isBunVersionPatched(versions.bun))
|
|
188
|
+
return undefined;
|
|
189
|
+
runtime = `Bun ${versions.bun}`;
|
|
190
|
+
upgrade =
|
|
191
|
+
"run the server with Node.js 22.23.4, 24.22.1, 26.12.1 or later, or use the Docker image";
|
|
192
|
+
}
|
|
193
|
+
else if (versions.node !== undefined) {
|
|
194
|
+
if (isNodeVersionPatched(versions.node))
|
|
195
|
+
return undefined;
|
|
196
|
+
runtime = `Node.js ${versions.node}`;
|
|
197
|
+
upgrade = "upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 or later";
|
|
198
|
+
}
|
|
199
|
+
else {
|
|
200
|
+
return undefined;
|
|
201
|
+
}
|
|
202
|
+
return (`WARNING: ${runtime} does not block the compromised eMudhra intermediate CAs. ` +
|
|
203
|
+
"The LaunchDarkly MCP server rejects them for its own requests, but the runtime does not; " +
|
|
204
|
+
`${upgrade}. See https://github.com/launchdarkly/mcp-server#runtime-requirements\n`);
|
|
205
|
+
}
|
|
206
|
+
//# sourceMappingURL=tls-blocklist.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tls-blocklist.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/tls-blocklist.ts"],"names":[],"mappings":";;;;;;AA+EA,kDAKC;AAED,gCAMC;AAMD,wDAqBC;AAMD,kDAuBC;AAUD,kDA6BC;AAmBD,oDAOC;AAED,kDAKC;AAMD,0DAyBC;AA3PD,6CAA0D;AAC1D,wDAA2B;AAE3B;;;;;;GAMG;AAEH;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;CACnE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,mBAAmB,GAErB;IACF,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAuB,SAAS,CAAC;AAE3C,QAAA,uBAAuB,GAAG,sBAAsB,CAAC;AAe9D,0EAA0E;AAC1E,MAAM,0BAA0B,GAAwB,kBAAG,CAAC,mBAAmB,CAAC;AAEhF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,SAAgB,mBAAmB,CACjC,EAAiC;IAEjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAgB,UAAU,CAAC,GAAe;IACxC,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QACrD,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,IAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KACE,IAAI,OAAO,GAAoC,IAAI,EACnD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAC7B,OAAO,GAAG,OAAO,CAAC,iBAAiB,EACnC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,OAAO,0BAA0B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,2BAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,8CAA8C,IAAI,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,QAAgB,EAChB,IAAyB;IAEzB,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,yCAAyC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CACP,8BAA8B,QAAQ,0BAA0B,OAAO,IAAI;YACzE,yDAAyD,CAC5D,EACD,EAAE,IAAI,EAAE,+BAAuB,EAAE,CAClC,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,CAC/B,QAAQ,EACR,IAAsC,CACvC,CAAC;AACJ,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;;;;GAKG;AACH,SAAgB,mBAAmB;IACjC,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,IAAI,KAAK,EAAE,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACvC,MAAM,OAAO,GAAG,CACd,KAAkC,EAClC,IAAkC,EACR,EAAE;YAC5B,MAAM,UAAU,GACd,IAED,EAAE,GAAG,CAAC;YACP,MAAM,WAAW,GAAG,UAAU,EAAE,mBAAmB,CAAC;YACpD,MAAM,QAAQ,GAAwB,WAAW;gBAC/C,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CACjB,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC;gBACtE,CAAC,CAAE,mBAAsD,CAAC;YAC5D,OAAO,aAAa,CAAC,KAAK,EAAE;gBAC1B,GAAG,IAAI;gBACP,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE;aACvC,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,mBAAmB;YACrB,mBAAqD,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CACtB,CAAoC,EACpC,CAAoC;IAEpC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;AAChC,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAAe;IACjD,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,WAGI,OAAO,CAAC,QAAQ;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,GAAG,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO;YACL,yFAAyF,CAAC;IAC9F,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,OAAO,GAAG,WAAW,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,GAAG,uDAAuD,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CACL,YAAY,OAAO,4DAA4D;QAC/E,2FAA2F;QAC3F,GAAG,OAAO,yEAAyE,CACpF,CAAC;AACJ,CAAC"}
|
|
@@ -22,7 +22,7 @@ const routes = (0, core_1.buildRouteMap)({
|
|
|
22
22
|
exports.app = (0, core_1.buildApplication)(routes, {
|
|
23
23
|
name: "mcp",
|
|
24
24
|
versionInfo: {
|
|
25
|
-
currentVersion: "0.7.
|
|
25
|
+
currentVersion: "0.7.1",
|
|
26
26
|
},
|
|
27
27
|
});
|
|
28
28
|
(0, core_1.run)(exports.app, node_process_1.default.argv.slice(2), (0, cli_js_1.buildContext)(node_process_1.default));
|
|
@@ -32,7 +32,7 @@ const featureFlagsPatch_js_1 = require("./tools/featureFlagsPatch.js");
|
|
|
32
32
|
function createMCPServer(deps) {
|
|
33
33
|
const server = new mcp_js_1.McpServer({
|
|
34
34
|
name: "LaunchDarkly",
|
|
35
|
-
version: "0.7.
|
|
35
|
+
version: "0.7.1",
|
|
36
36
|
});
|
|
37
37
|
const client = new core_js_1.LaunchDarklyCore({
|
|
38
38
|
apiKey: deps.apiKey,
|
package/dist/esm/lib/config.d.ts
CHANGED
|
@@ -31,8 +31,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
|
|
|
31
31
|
export declare const SDK_METADATA: {
|
|
32
32
|
readonly language: "typescript";
|
|
33
33
|
readonly openapiDocVersion: "2.0";
|
|
34
|
-
readonly sdkVersion: "0.7.
|
|
34
|
+
readonly sdkVersion: "0.7.1";
|
|
35
35
|
readonly genVersion: "2.845.15";
|
|
36
|
-
readonly userAgent: "speakeasy-sdk/typescript 0.7.
|
|
36
|
+
readonly userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server";
|
|
37
37
|
};
|
|
38
38
|
//# sourceMappingURL=config.d.ts.map
|
package/dist/esm/lib/config.js
CHANGED
|
@@ -35,8 +35,8 @@ export function serverURLFromOptions(options) {
|
|
|
35
35
|
export const SDK_METADATA = {
|
|
36
36
|
language: "typescript",
|
|
37
37
|
openapiDocVersion: "2.0",
|
|
38
|
-
sdkVersion: "0.7.
|
|
38
|
+
sdkVersion: "0.7.1",
|
|
39
39
|
genVersion: "2.845.15",
|
|
40
|
-
userAgent: "speakeasy-sdk/typescript 0.7.
|
|
40
|
+
userAgent: "speakeasy-sdk/typescript 0.7.1 2.845.15 2.0 @launchdarkly/mcp-server",
|
|
41
41
|
};
|
|
42
42
|
//# sourceMappingURL=config.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"impl.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAY3C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CACnC;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,iBAsBtE"}
|
|
@@ -8,7 +8,14 @@ import express from "express";
|
|
|
8
8
|
import { createConsoleLogger, } from "../../console-logger.js";
|
|
9
9
|
import { createMCPServer } from "../../server.js";
|
|
10
10
|
import { assertSafeSSEBind, isLoopbackHost, requireBearerToken, } from "./sse-security.js";
|
|
11
|
+
import { installTlsBlocklist, unpatchedRuntimeWarning, } from "./tls-blocklist.js";
|
|
11
12
|
export async function main(flags) {
|
|
13
|
+
// INC-289: block the compromised eMudhra intermediates before any request.
|
|
14
|
+
installTlsBlocklist();
|
|
15
|
+
const runtimeWarning = unpatchedRuntimeWarning();
|
|
16
|
+
if (runtimeWarning) {
|
|
17
|
+
process.stderr.write(runtimeWarning);
|
|
18
|
+
}
|
|
12
19
|
flags.env?.forEach(([key, value]) => {
|
|
13
20
|
process.env[key] = value;
|
|
14
21
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAEL,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"impl.js","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/impl.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAEL,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAgB5B,MAAM,CAAC,KAAK,UAAU,IAAI,CAAqB,KAAwB;IACrE,2EAA2E;IAC3E,mBAAmB,EAAE,CAAC;IACtB,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;IACjD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,KAAK;YACR,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM;QACR;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAwB;IAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC7B,MAAM;YACN,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;YACrC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YACxB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC3C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QACnD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE9E,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC"}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
|
|
3
|
+
* Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
|
|
4
|
+
* (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
|
|
5
|
+
* G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
|
|
6
|
+
* than the certificate covers both.
|
|
7
|
+
*/
|
|
8
|
+
export declare const BLOCKED_SPKI_SHA256: ReadonlySet<string>;
|
|
9
|
+
export declare const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
|
|
10
|
+
/** The subset of tls.PeerCertificate this check reads. */
|
|
11
|
+
export interface PeerCertificateLike {
|
|
12
|
+
raw?: Uint8Array | undefined;
|
|
13
|
+
fingerprint256?: string | undefined;
|
|
14
|
+
issuer?: {
|
|
15
|
+
CN?: string | string[] | undefined;
|
|
16
|
+
} | undefined;
|
|
17
|
+
issuerCertificate?: PeerCertificateLike | undefined;
|
|
18
|
+
}
|
|
19
|
+
export declare function isBlockedIssuerName(cn: string | string[] | undefined): boolean;
|
|
20
|
+
export declare function spkiSha256(raw: Uint8Array): string;
|
|
21
|
+
/**
|
|
22
|
+
* Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
|
|
23
|
+
* returns a description of the first blocked certificate, if any.
|
|
24
|
+
*/
|
|
25
|
+
export declare function findBlockedCertificate(cert: PeerCertificateLike): string | undefined;
|
|
26
|
+
/**
|
|
27
|
+
* A tls checkServerIdentity replacement: rejects blocked chains, then runs
|
|
28
|
+
* the runtime's normal hostname verification.
|
|
29
|
+
*/
|
|
30
|
+
export declare function checkServerIdentity(hostname: string, cert: PeerCertificateLike): Error | undefined;
|
|
31
|
+
/**
|
|
32
|
+
* Installs the blocklist for this process. On Node.js, global fetch (undici)
|
|
33
|
+
* and node:https read tls.checkServerIdentity when they connect. Bun's fetch
|
|
34
|
+
* ignores it, so on Bun global fetch is wrapped to pass the check through
|
|
35
|
+
* Bun's `tls` fetch option.
|
|
36
|
+
*/
|
|
37
|
+
export declare function installTlsBlocklist(): void;
|
|
38
|
+
export declare function isNodeVersionPatched(version: string): boolean;
|
|
39
|
+
export declare function isBunVersionPatched(version: string): boolean;
|
|
40
|
+
/**
|
|
41
|
+
* Returns a warning when the current runtime does not block the compromised
|
|
42
|
+
* eMudhra intermediates natively, or undefined when it does.
|
|
43
|
+
*/
|
|
44
|
+
export declare function unpatchedRuntimeWarning(versions?: {
|
|
45
|
+
node?: string | undefined;
|
|
46
|
+
bun?: string | undefined;
|
|
47
|
+
}): string | undefined;
|
|
48
|
+
//# sourceMappingURL=tls-blocklist.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tls-blocklist.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/cli/start/tls-blocklist.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CASlD,CAAC;AA8BH,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACrD;AAcD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAChC,OAAO,CAGT;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAMlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,mBAAmB,GACxB,MAAM,GAAG,SAAS,CAmBpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,mBAAmB,GACxB,KAAK,GAAG,SAAS,CAoBnB;AAID;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,GAAE;IACR,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACP,GACnB,MAAM,GAAG,SAAS,CAoBpB"}
|