@mcpmake/core 0.4.4 → 0.4.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -552,6 +552,17 @@ if (transportMode === 'http') {
|
|
|
552
552
|
rpcError(res, null, -32600, 'Empty request body');
|
|
553
553
|
return;
|
|
554
554
|
}
|
|
555
|
+
/* Fail closed on media type: parse only bodies declared as JSON. A
|
|
556
|
+
* tools/call body mislabeled (e.g. text/plain) must not execute — this
|
|
557
|
+
* mirrors the hosted edge gate so self-hosted servers share one
|
|
558
|
+
* request-classification contract. */
|
|
559
|
+
const contentType = headerValue(req.headers['content-type']);
|
|
560
|
+
if (!contentType || !contentType.toLowerCase().includes('json')) {
|
|
561
|
+
sendJson(res, 415, {
|
|
562
|
+
error: 'Unsupported Media Type: MCP requests must use Content-Type: application/json',
|
|
563
|
+
});
|
|
564
|
+
return;
|
|
565
|
+
}
|
|
555
566
|
let parsed: unknown;
|
|
556
567
|
try {
|
|
557
568
|
parsed = JSON.parse(raw.toString('utf-8'));
|
package/package.json
CHANGED