@n24q02m/mcp-relay-server 1.0.8 → 1.2.0-beta.1

package/build/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAA;AAI7B,wBAAgB,SAAS,IAAI,OAAO,CAAC,OAAO,CAqB3C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAA;AAK7B,wBAAgB,SAAS,IAAI,OAAO,CAAC,OAAO,CA0B3C"}

package/build/app.js

@@ -1,10 +1,14 @@
 import cors from 'cors';
 import express from 'express';
+import helmet from 'helmet';
 import { mutationLimiter, pollingLimiter } from './middleware/rate-limit.js';
 import { sessionsRouter } from './routes/sessions.js';
 export function createApp() {
     const app = express();
     const corsOrigin = process.env.CORS_ORIGIN ?? '*';
+    app.use(helmet({
+        contentSecurityPolicy: false
+    }));
     app.use(cors({ origin: corsOrigin }));
     app.use(express.json({ limit: '1mb' }));
     // Split rate limits: stricter for mutations, relaxed for polling

package/build/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAA;IACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IACrC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAEvC,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA,CAAC,mCAAmC;IACnE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA,CAAC,0BAA0B;IACrE,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAA,CAAC,8BAA8B;IACpF,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA,CAAC,gBAAgB;IAEpE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAA;IACjD,GAAG,CAAC,GAAG,CACL,MAAM,CAAC;QACL,qBAAqB,EAAE,KAAK;KAC7B,CAAC,CACH,CAAA;IACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IACrC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAEvC,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA,CAAC,mCAAmC;IACnE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA,CAAC,0BAA0B;IACrE,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAA,CAAC,8BAA8B;IACpF,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA,CAAC,gBAAgB;IAEpE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@n24q02m/mcp-relay-server",
-  "version": "1.0.8",
+  "version": "1.2.0-beta.1",
   "description": "Zero-config MCP credential relay server — ECDH P-256 + AES-256-GCM, rate-limited, zero-knowledge",
   "keywords": [
     "mcp",
@@ -39,12 +39,13 @@
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
+    "cors": "^2.8.5",
     "express": "^5.2.1",
     "express-rate-limit": "^8.3.1",
-    "cors": "^2.8.5"
+    "helmet": "^8.1.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.8",
+    "@biomejs/biome": "^2.4.9",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.6",
     "@types/node": "^24.12.0",

package/src/app.ts

@@ -1,5 +1,6 @@
 import cors from 'cors'
 import express from 'express'
+import helmet from 'helmet'
 import { mutationLimiter, pollingLimiter } from './middleware/rate-limit.js'
 import { sessionsRouter } from './routes/sessions.js'
 
@@ -7,6 +8,11 @@ export function createApp(): express.Express {
   const app = express()
 
   const corsOrigin = process.env.CORS_ORIGIN ?? '*'
+  app.use(
+    helmet({
+      contentSecurityPolicy: false
+    })
+  )
   app.use(cors({ origin: corsOrigin }))
   app.use(express.json({ limit: '1mb' }))
 

package/tests/sessions.test.ts

@@ -41,8 +41,8 @@ describe('POST /api/sessions', () => {
     expect(body.sessionId).toBe('test-1')
   })
 
-  it('rejects after 5 sessions from the same IP (429)', async () => {
-    for (let i = 0; i < 5; i++) {
+  it('rejects after 10 sessions from the same IP (429)', async () => {
+    for (let i = 0; i < 10; i++) {
       const res = await fetch(`${baseUrl}/api/sessions`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },