@modelcontextprotocol/inspector 1.0.2 → 1.0.3

package/client/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-DdyO6kfY.js"></script>
+    <script type="module" crossorigin src="/assets/index-C2CDzlVy.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DXy0twoH.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -53,9 +53,9 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^1.0.2",
-    "@modelcontextprotocol/inspector-client": "^1.0.2",
-    "@modelcontextprotocol/inspector-server": "^1.0.2",
+    "@modelcontextprotocol/inspector-cli": "^1.0.3",
+    "@modelcontextprotocol/inspector-client": "^1.0.3",
+    "@modelcontextprotocol/inspector-server": "^1.0.3",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",

package/server/build/env-flags.js

@@ -0,0 +1,21 @@
+/**
+ * Strict parsing for the proxy's boolean `DANGEROUSLY_*` environment flags.
+ *
+ * Each of those flags weakens a security control, so it must take an explicit
+ * opt-in to turn one on: a typo, `false`, `0` or an empty value has to leave
+ * the control enforcing rather than read as "set". One parser serves every
+ * such flag so they cannot drift apart in what they accept.
+ */
+const TRUTHY_FLAG_VALUES = new Set(["true", "1", "yes"]);
+/**
+ * Whether a flag's value is an explicit opt-in.
+ *
+ * Only `true`, `1` or `yes` (case-insensitive, surrounding whitespace ignored)
+ * count. Anything else (unset, empty, `false`, `0`, or an unrecognized value)
+ * returns false.
+ */
+export function isExplicitTruthyFlag(value) {
+    if (value === undefined)
+        return false;
+    return TRUTHY_FLAG_VALUES.has(value.trim().toLowerCase());
+}

package/server/build/fetch-metadata.js

@@ -0,0 +1,47 @@
+/**
+ * Fetch-metadata check for the proxy's API routes.
+ *
+ * The Inspector client is always served from a different origin than the
+ * proxy (its own port, `CLIENT_PORT`, default 6274, versus `SERVER_PORT`,
+ * default 6277), so a legitimate browser request to an API route is never
+ * `Sec-Fetch-Site: same-origin`. The only documents the proxy itself serves
+ * are the MCP Apps sandbox (`/sandbox`) and the untrusted app HTML it hosts in
+ * an inner frame, which inherits that origin. Those documents have no reason
+ * to call the API routes, and because a same-origin request carries no
+ * `Origin` header, the origin allow-list cannot stop them. This check does.
+ *
+ * Non-browser callers (the CLI, curl, node fetch) send no `Sec-Fetch-Site`
+ * header and are unaffected. `same-site` is deliberately allowed: ports do not
+ * count toward a site, so the real client on `localhost:6274` calling the
+ * proxy on `localhost:6277` is `same-site`.
+ *
+ * Deployments that serve the client and the proxy from one origin (a single
+ * reverse proxy routing by path) can opt out with
+ * `DANGEROUSLY_ALLOW_SAME_ORIGIN_API=true`.
+ */
+import { isExplicitTruthyFlag } from "./env-flags.js";
+export function isSameOriginBrowserRequest(headers) {
+    // Browsers set this header themselves and page script cannot override it
+    // (Sec-* names are forbidden request headers).
+    return headers["sec-fetch-site"]?.trim().toLowerCase() === "same-origin";
+}
+/**
+ * Parses the value of `DANGEROUSLY_ALLOW_SAME_ORIGIN_API`.
+ *
+ * Only an explicit truthy value (`true`, `1` or `yes`, case-insensitive,
+ * surrounding whitespace ignored) disables the same-origin check. Anything
+ * else (unset, empty, `false`, `0`, or an unrecognized value) keeps it
+ * enforcing. It shares its parser with `DANGEROUSLY_OMIT_AUTH`
+ * (`isAuthDisabledFlag` in request-guards.ts) through env-flags.ts, so the two
+ * flags accept exactly the same values.
+ */
+export function isSameOriginApiAllowedFlag(value) {
+    return isExplicitTruthyFlag(value);
+}
+/**
+ * Whether an API request must be rejected: it is a same-origin browser
+ * request and the opt-out is not enabled.
+ */
+export function shouldRejectSameOriginRequest(headers, allowSameOriginApi) {
+    return !allowSameOriginApi && isSameOriginBrowserRequest(headers);
+}

package/server/build/index.js

@@ -4,6 +4,8 @@ import { parseArgs } from "node:util";
 import { parse as shellParseArgs } from "shell-quote";
 import nodeFetch, { Headers as NodeHeaders } from "node-fetch";
 import { assertSafeProxyTarget, createPinnedAgent, ProxyTargetError, } from "./proxy-security.js";
+import { createOriginValidationMiddleware, isAuthDisabledFlag, } from "./request-guards.js";
+import { readCappedBody, ProxyResponseTooLargeError, } from "./proxy-response.js";
 // Type-compatible wrappers for node-fetch to work with browser-style types
 const fetch = nodeFetch;
 const Headers = NodeHeaders;
@@ -16,6 +18,9 @@ import express from "express";
 import rateLimit from "express-rate-limit";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
+import { nextRedirectRequest, normalizeProxyHeaders, } from "./proxy-redirect.js";
+import { formatHeaderNamesForLog, formatQueryForLog } from "./log-format.js";
+import { isSameOriginApiAllowedFlag } from "./fetch-metadata.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
@@ -178,26 +183,13 @@ const serverTransports = new Map(); // Server Transports by web app sessionId
 const sessionHeaderHolders = new Map(); // For dynamic header updates
 // Use provided token from environment or generate a new one
 const sessionToken = process.env.MCP_PROXY_AUTH_TOKEN || randomBytes(32).toString("hex");
-const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
-// Origin validation middleware to prevent DNS rebinding attacks
-const originValidationMiddleware = (req, res, next) => {
-    const origin = req.headers.origin;
-    // Default origins based on CLIENT_PORT or use environment variable
-    const clientPort = process.env.CLIENT_PORT || "6274";
-    const defaultOrigin = `http://localhost:${clientPort}`;
-    const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
-        defaultOrigin,
-    ];
-    if (origin && !allowedOrigins.includes(origin)) {
-        console.error(`Invalid origin: ${origin}`);
-        res.status(403).json({
-            error: "Forbidden - invalid origin",
-            message: "Request blocked to prevent DNS rebinding attacks. Configure allowed origins via environment variable.",
-        });
-        return;
-    }
-    next();
-};
+const authDisabled = isAuthDisabledFlag(process.env.DANGEROUSLY_OMIT_AUTH);
+const allowSameOriginApi = isSameOriginApiAllowedFlag(process.env.DANGEROUSLY_ALLOW_SAME_ORIGIN_API);
+// Origin validation middleware to prevent DNS rebinding attacks. When auth is
+// disabled it also rejects requests that carry no Origin header, and unless
+// DANGEROUSLY_ALLOW_SAME_ORIGIN_API is set it rejects same-origin browser
+// requests (see fetch-metadata.ts).
+const originValidationMiddleware = createOriginValidationMiddleware(authDisabled, allowSameOriginApi);
 const authMiddleware = (req, res, next) => {
     if (authDisabled) {
         return next();
@@ -334,7 +326,7 @@ const createCustomFetch = (headerHolder) => {
 };
 const createTransport = async (req) => {
     const query = req.query;
-    console.log("Query parameters:", JSON.stringify(query));
+    console.log("Query parameters:", formatQueryForLog(query));
     const transportType = query.transportType;
     if (transportType === "stdio") {
         const command = query.command.trim();
@@ -357,7 +349,7 @@ const createTransport = async (req) => {
         const headers = getHttpHeaders(req);
         headers["Accept"] = "text/event-stream";
         const headerHolder = { headers };
-        console.log(`SSE transport: url=${url}, headers=${JSON.stringify(headers)}`);
+        console.log(`SSE transport: url=${url}, headers=${formatHeaderNamesForLog(headers)}`);
         const transport = new SSEClientTransport(new URL(url), {
             eventSourceInit: {
                 fetch: createCustomFetch(headerHolder),
@@ -684,12 +676,19 @@ const MAX_PROXY_REDIRECTS = 5;
 // connects to the IP we just validated instead of re-resolving the hostname.
 // This eliminates the TOCTOU window between the block-list check and the
 // actual TCP connection that a DNS-rebinding attack would exploit.
+//
+// What each redirect does to the next hop's request — dropping credentials
+// when the origin changes, and the 301/302/303 method and body rewrite — is
+// nextRedirectRequest in proxy-redirect.ts.
 async function safeProxyFetch(initialUrl, init) {
-    let currentUrl = new URL(initialUrl);
-    let method = init?.method ?? "GET";
-    let body = init?.body;
-    const headers = init?.headers ?? {};
+    let request = {
+        url: new URL(initialUrl),
+        method: init?.method ?? "GET",
+        body: init?.body,
+        headers: normalizeProxyHeaders(init?.headers),
+    };
     for (let hop = 0; hop <= MAX_PROXY_REDIRECTS; hop++) {
+        const currentUrl = request.url;
         if (!["http:", "https:"].includes(currentUrl.protocol)) {
             throw new ProxyTargetError("Only http/https URLs are allowed");
         }
@@ -700,9 +699,9 @@ async function safeProxyFetch(initialUrl, init) {
         const validatedAddresses = await assertSafeProxyTarget(currentUrl);
         const agent = createPinnedAgent(currentUrl.protocol, validatedAddresses);
         const response = await fetch(currentUrl.toString(), {
-            method,
-            headers,
-            body,
+            method: request.method,
+            headers: request.headers,
+            body: request.body,
             redirect: "manual",
             agent,
         });
@@ -711,12 +710,7 @@ async function safeProxyFetch(initialUrl, init) {
             if (!location) {
                 return response;
             }
-            currentUrl = new URL(location, currentUrl);
-            // Mirror browser/fetch semantics: 301/302/303 downgrade to a bodyless GET.
-            if ([301, 302, 303].includes(response.status)) {
-                method = "GET";
-                body = undefined;
-            }
+            request = nextRedirectRequest(request, response.status, location);
             continue;
         }
         return response;
@@ -753,7 +747,20 @@ app.post("/fetch", express.json(), originValidationMiddleware, authMiddleware, a
             }
             throw error;
         }
-        const responseBody = await response.text();
+        // Read the body through a byte cap rather than response.text(), which
+        // would buffer whatever the upstream sends. An oversize body is an
+        // upstream failure, reported to the client as 502 Bad Gateway.
+        let responseBody;
+        try {
+            responseBody = await readCappedBody(response);
+        }
+        catch (error) {
+            if (error instanceof ProxyResponseTooLargeError) {
+                res.status(502).json({ error: error.message });
+                return;
+            }
+            throw error;
+        }
         const headers = {};
         response.headers.forEach((value, key) => {
             headers[key] = value;
@@ -815,6 +822,12 @@ server.on("listening", () => {
     else {
         console.log(`⚠️  WARNING: Authentication is disabled. This is not recommended.`);
     }
+    if (allowSameOriginApi) {
+        console.log(`⚠️  WARNING: DANGEROUSLY_ALLOW_SAME_ORIGIN_API is set. Same-origin browser ` +
+            `requests to the proxy API are allowed, including from documents the ` +
+            `proxy serves itself (the MCP Apps sandbox). Opening MCP App links with ` +
+            `noopener in the client is the only remaining layer.`);
+    }
 });
 server.on("error", (err) => {
     if (err.message.includes(`EADDRINUSE`)) {

package/server/build/log-format.js

@@ -0,0 +1,48 @@
+/**
+ * Formatting helpers for the proxy's diagnostic log lines.
+ *
+ * Extracted from index.ts so they can be unit-tested independently (index.ts
+ * starts the server on import).
+ *
+ * The header object built for an upstream connection carries the values the
+ * user supplied for that server — `Authorization`, and any custom headers
+ * named through `x-custom-auth-header(s)` — and the stdio `env` query
+ * parameter carries the environment the user configured for a local server.
+ * Both are forwarded on purpose, but stdout is a different audience (terminal
+ * scrollback, container log drivers, CI capture), so the log lines describe
+ * them by NAME only and never print a value.
+ */
+/**
+ * Returns the header names of `headers` as a JSON array, without any values.
+ */
+export function formatHeaderNamesForLog(headers) {
+    return JSON.stringify(Object.keys(headers));
+}
+/**
+ * Returns a JSON rendering of the request query in which the `env` parameter
+ * is reduced to its variable names. An `env` that is not a JSON object is
+ * replaced by a fixed placeholder rather than echoed.
+ */
+export function formatQueryForLog(query) {
+    if (!("env" in query)) {
+        return JSON.stringify(query);
+    }
+    return JSON.stringify({ ...query, env: describeEnv(query.env) });
+}
+function describeEnv(env) {
+    if (typeof env !== "string") {
+        return "[omitted]";
+    }
+    try {
+        const parsed = JSON.parse(env);
+        if (parsed !== null &&
+            typeof parsed === "object" &&
+            !Array.isArray(parsed)) {
+            return `[names: ${Object.keys(parsed).join(", ")}]`;
+        }
+    }
+    catch {
+        // Fall through to the placeholder: an unparseable value is still not logged.
+    }
+    return "[omitted]";
+}

package/server/build/proxy-redirect.js

@@ -0,0 +1,123 @@
+/**
+ * Redirect-hop rules for the `/fetch` proxy's manual redirect loop.
+ *
+ * `safeProxyFetch` (index.ts) follows redirects itself, with
+ * `redirect: "manual"`, so every hop can be re-validated against the SSRF
+ * guard and pinned to the addresses it resolved. Taking redirects away from
+ * the fetch library also took away the request rewriting the library did on
+ * each hop, so that rewriting lives here, as one pure function per hop:
+ *
+ *  - **Credentials stay with their origin.** When a hop changes origin —
+ *    scheme, host or port — `Authorization`, `Proxy-Authorization`, `Cookie`,
+ *    `Cookie2` and `WWW-Authenticate` are dropped, matching the Fetch
+ *    standard's "HTTP-redirect fetch" step and node-fetch's own redirect
+ *    handling. An https→http downgrade is an origin change, so it is covered.
+ *    Header names are compared case-insensitively.
+ *  - **Method and body follow the Fetch standard.** A 301/302 turns a POST
+ *    into a bodyless GET; a 303 turns anything but GET/HEAD into a bodyless
+ *    GET; 307/308 keep both. When the body is dropped, the headers describing
+ *    it go with it.
+ *
+ *  - **A body never crosses an origin boundary.** A cross-origin hop that
+ *    would still carry a body after that rewrite — a 307/308 of a POST, say —
+ *    is refused rather than followed, since a proxied body is typically an
+ *    OAuth form holding a refresh token or client secret. A 301/302/303 that
+ *    rewrites to a bodyless GET is followed (with credentials dropped), and a
+ *    same-origin 307/308 keeps its body as the standard says.
+ *
+ * Every hop gets a fresh headers object, so the caller's input is never
+ * mutated and a header dropped on one hop cannot reappear on a later one.
+ */
+import { ProxyTargetError } from "./proxy-security.js";
+/** Headers that carry credentials and must not cross an origin boundary. */
+const CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "cookie2",
+    "www-authenticate",
+]);
+/**
+ * Headers that describe the request body. They are dropped together with the
+ * body, so a rewritten GET does not announce a body it no longer has (a stale
+ * `Content-Length` would leave the upstream waiting for bytes never sent).
+ */
+const BODY_HEADERS = new Set([
+    "content-type",
+    "content-length",
+    "content-encoding",
+    "content-language",
+    "content-location",
+]);
+/**
+ * Copies the caller-supplied `init.headers` into a plain string record. The
+ * route receives them as JSON, so anything that is not a string-valued plain
+ * object entry is ignored rather than handed to the fetch library.
+ */
+export function normalizeProxyHeaders(raw) {
+    const headers = {};
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        return headers;
+    }
+    for (const [name, value] of Object.entries(raw)) {
+        if (typeof value === "string") {
+            headers[name] = value;
+        }
+    }
+    return headers;
+}
+function withoutHeaders(headers, names) {
+    const kept = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (!names.has(name.toLowerCase())) {
+            kept[name] = value;
+        }
+    }
+    return kept;
+}
+/**
+ * Whether the Fetch standard rewrites this redirect into a bodyless GET:
+ * 301/302 do so for POST only, 303 for every method except GET and HEAD.
+ */
+function rewritesToGet(status, method) {
+    const upper = method.toUpperCase();
+    if (status === 301 || status === 302) {
+        return upper === "POST";
+    }
+    if (status === 303) {
+        return upper !== "GET" && upper !== "HEAD";
+    }
+    return false;
+}
+/**
+ * Builds the request for the hop that follows a redirect response.
+ *
+ * @param current  the request that just received the redirect
+ * @param status   the redirect response's status code
+ * @param location the redirect response's `Location` header value
+ * @returns the next hop's request; the SSRF guard still has to validate its
+ *          URL before it is fetched
+ * @throws ProxyTargetError when the hop changes origin and would still carry
+ *         a body — the same refusal (403) the route returns for a blocked
+ *         target
+ */
+export function nextRedirectRequest(current, status, location) {
+    const url = new URL(location, current.url);
+    let { method, body } = current;
+    let headers = { ...current.headers };
+    const crossOrigin = url.origin !== current.url.origin;
+    if (crossOrigin) {
+        headers = withoutHeaders(headers, CREDENTIAL_HEADERS);
+    }
+    if (rewritesToGet(status, method)) {
+        method = "GET";
+        body = undefined;
+        headers = withoutHeaders(headers, BODY_HEADERS);
+    }
+    // `!= null`: the body arrives as JSON, so "no body" can be null as well as
+    // undefined. An empty string is still a body the caller chose to send.
+    if (crossOrigin && body != null) {
+        throw new ProxyTargetError("Refusing to follow a cross-origin redirect for a request with a body");
+    }
+    return { url, method, body, headers };
+}

package/server/build/proxy-response.js

@@ -0,0 +1,81 @@
+/**
+ * Bounded body reading for the /fetch reverse proxy.
+ *
+ * Extracted from index.ts so it can be unit-tested independently, alongside
+ * proxy-security.ts.
+ *
+ * /fetch buffers the upstream response in full, because it hands the body back
+ * to the browser inside a JSON envelope. Reading it with `response.text()`
+ * puts no ceiling on that buffer, so an upstream that streams (or announces)
+ * an arbitrarily large body grows the proxy's memory without limit. This
+ * module reads the body through its stream instead and stops at a fixed cap.
+ */
+/**
+ * Largest upstream response body /fetch will buffer, in bytes (5 MiB).
+ *
+ * The proxy exists to carry OAuth traffic past browser CORS restrictions:
+ * protected-resource and authorization-server metadata, client registration
+ * and token responses. Those documents are a few kilobytes at most, so 5 MiB
+ * leaves three orders of magnitude of headroom for any legitimate response
+ * while keeping the per-request buffer small enough that concurrent requests
+ * cannot exhaust the process.
+ */
+export const MAX_PROXY_RESPONSE_BYTES = 5 * 1024 * 1024;
+/** Thrown when an upstream response body exceeds the configured cap. */
+export class ProxyResponseTooLargeError extends Error {
+    constructor(maxBytes) {
+        super(`Upstream response body exceeds the ${maxBytes}-byte limit`);
+        this.name = "ProxyResponseTooLargeError";
+    }
+}
+/**
+ * Reads `response`'s body as UTF-8 text, refusing to buffer more than
+ * `maxBytes`.
+ *
+ * - A `Content-Length` larger than the cap is rejected before any of the body
+ *   is read.
+ * - Otherwise the body is accumulated chunk by chunk, and the moment the
+ *   running total passes the cap the stream is destroyed and the read fails.
+ *   `destroy()` is synchronous and is deliberately not awaited on anything:
+ *   waiting for a stream to acknowledge teardown can block indefinitely if the
+ *   source never settles.
+ *
+ * Throws {@link ProxyResponseTooLargeError} in both cases.
+ */
+export async function readCappedBody(response, maxBytes = MAX_PROXY_RESPONSE_BYTES) {
+    const { body } = response;
+    const contentLength = response.headers.get("content-length");
+    if (contentLength !== null) {
+        const declared = Number(contentLength);
+        if (Number.isFinite(declared) && declared > maxBytes) {
+            body?.destroy?.();
+            throw new ProxyResponseTooLargeError(maxBytes);
+        }
+    }
+    if (body === null) {
+        return "";
+    }
+    // Iterate by hand rather than with `for await`: leaving a `for await` loop
+    // early awaits the iterator's `return()`, which is exactly the teardown wait
+    // described above. On overflow we destroy the stream and walk away.
+    const iterator = body[Symbol.asyncIterator]();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await iterator.next();
+        if (done) {
+            break;
+        }
+        const chunk = typeof value === "string" ? Buffer.from(value) : value;
+        total += chunk.byteLength;
+        if (total > maxBytes) {
+            body.destroy?.();
+            throw new ProxyResponseTooLargeError(maxBytes);
+        }
+        chunks.push(chunk);
+    }
+    // Decode the way node-fetch's response.text() does (a default TextDecoder),
+    // so a leading UTF-8 BOM is still stripped; Buffer#toString would keep it
+    // and break JSON.parse on BOM-prefixed documents downstream.
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}

package/server/build/request-guards.js

@@ -0,0 +1,83 @@
+/**
+ * Request guards for the proxy server: the auth-disable flag parser and the
+ * Origin validation middleware (which also applies the same-origin
+ * fetch-metadata check from fetch-metadata.ts).
+ *
+ * Extracted from index.ts so they can be unit-tested independently (index.ts
+ * starts listening on import).
+ */
+import { isExplicitTruthyFlag } from "./env-flags.js";
+import { shouldRejectSameOriginRequest } from "./fetch-metadata.js";
+/**
+ * Parses the value of `DANGEROUSLY_OMIT_AUTH`.
+ *
+ * Only an explicit truthy value (`true`, `1` or `yes`, case-insensitive,
+ * surrounding whitespace ignored) disables authentication. Anything else —
+ * unset, empty, `false`, `0`, or an unrecognized value — leaves auth enabled.
+ *
+ * `client/bin/start.js` carries an identical copy of this function so the
+ * launcher and the proxy always agree on whether auth is disabled; keep the
+ * two in sync.
+ */
+export function isAuthDisabledFlag(value) {
+    return isExplicitTruthyFlag(value);
+}
+/**
+ * Returns the list of origins allowed to talk to the proxy: the
+ * comma-separated `ALLOWED_ORIGINS` environment variable, or the client's
+ * default origin (`http://localhost:${CLIENT_PORT}`, port 6274 by default).
+ */
+export function getAllowedOrigins(env = process.env) {
+    const clientPort = env.CLIENT_PORT || "6274";
+    const defaultOrigin = `http://localhost:${clientPort}`;
+    return env.ALLOWED_ORIGINS?.split(",") || [defaultOrigin];
+}
+/**
+ * Builds the Origin validation middleware.
+ *
+ * A request carrying an `Origin` header that is not in the allowed list is
+ * always rejected with 403.
+ *
+ * A request with no `Origin` header is handled according to `authDisabled`:
+ * - auth enabled: it passes this check. Non-browser clients legitimately send
+ *   no `Origin`, and the session token checked by the auth middleware is what
+ *   protects them.
+ * - auth disabled: it is rejected with the same 403. With no token to check,
+ *   the `Origin` header is the only thing tying a request to the Inspector web
+ *   client, whose requests to the proxy are cross-origin and always carry one.
+ *
+ * Before either of those, a same-origin browser request
+ * (`Sec-Fetch-Site: same-origin`) is rejected with 403 unless
+ * `allowSameOriginApi` is true (`DANGEROUSLY_ALLOW_SAME_ORIGIN_API`). Such a
+ * request carries no `Origin` header, so the allow-list cannot see it; see
+ * fetch-metadata.ts.
+ */
+export function createOriginValidationMiddleware(authDisabled, allowSameOriginApi = false) {
+    return (req, res, next) => {
+        // A same-origin request carries no Origin header, so the allow-list below
+        // cannot see it. The client never shares the proxy's origin; only documents
+        // the proxy serves itself (the MCP Apps sandbox) do. See fetch-metadata.ts.
+        if (shouldRejectSameOriginRequest(req.headers, allowSameOriginApi)) {
+            console.error("Rejected same-origin request to an API route");
+            res.status(403).json({
+                error: "Forbidden - same-origin request",
+                message: "API routes cannot be called from documents served by the proxy.",
+            });
+            return;
+        }
+        const origin = req.headers.origin;
+        const allowedOrigins = getAllowedOrigins();
+        const rejected = origin ? !allowedOrigins.includes(origin) : authDisabled;
+        if (rejected) {
+            console.error(origin
+                ? `Invalid origin: ${origin}`
+                : "Missing origin (required when authentication is disabled)");
+            res.status(403).json({
+                error: "Forbidden - invalid origin",
+                message: "Request blocked to prevent DNS rebinding attacks. Configure allowed origins via environment variable.",
+            });
+            return;
+        }
+        next();
+    };
+}