@ni-c/mcp-hub 0.10.0 → 0.11.1

package/dist/auth/oidc/quirks.js

@@ -0,0 +1,234 @@
+import crypto from 'node:crypto';
+import { Readable } from 'node:stream';
+/**
+ * The one scope the hub knows. Authorization is per client, not per scope —
+ * what a token may reach is decided by the resource it is bound to — but
+ * oidc-provider requires a non-empty granted∩requested set, so the hub needs a
+ * name for "everything this client was approved for". See `defaultScope`.
+ */
+export const HUB_SCOPE = 'mcp';
+/**
+ * Four deliberate concessions to two real clients. Every one of them is
+ * load-bearing: three are pinned by test/client-compat.test.ts because a real
+ * connector broke without them, and the fourth was found by running a real
+ * authorization flow against oidc-provider.
+ *
+ *   1. `client_secret_expires_at: 0` for every client. ChatGPT registers once
+ *      per connector and never re-registers, so an expiring secret bricks it.
+ *      Needs no code: registration.js hardcodes 0 and forbids changing it.
+ *
+ *   2. A throwaway `client_secret` for PUBLIC clients — below.
+ *   3. Refresh tokens without `offline_access` — in provider.ts.
+ *   4. Authorization with no `scope` parameter — `defaultScope` below.
+ */
+/**
+ * Quirk 2. ChatGPT refuses its own registration unless the response carries a
+ * `client_secret`, even for `token_endpoint_auth_method: 'none'`. Claude is
+ * correct and sends none, so the secret must exist in the response and NOT in
+ * the stored record — otherwise every well-behaved public client breaks.
+ *
+ * oidc-provider already gets the storage half right: `Client.needsSecret` is
+ * false for 'none', so registration.js deletes the secret before persisting.
+ * Only the response needs fixing, and `provider.use()` is the documented place:
+ * it installs middleware ahead of the router, so `await next()` returns after
+ * ctx.body was set and before Koa serialises it.
+ *
+ * Not `features.registration.policies` and not `extraClientMetadata`: both run
+ * on the properties *before* they are persisted, so both would store the secret
+ * and defeat the whole point.
+ */
+/**
+ * Quirk 2, storage half. Keeps a public client's record free of a secret.
+ *
+ * The comment above says oidc-provider gets this half right on its own. It does
+ * not, and the reason is an ordering the library is entitled to: RFC 7591 says
+ * an omitted `token_endpoint_auth_method` means `client_secret_basic`, so
+ * `Client.needsSecret` — which runs on the metadata as SENT — mints and
+ * persists a real secret for every client that leaves the field out. The hub's
+ * `clientDefaults` then rewrites the method to `none`, and the record ends up
+ * claiming to be a public client while carrying a credential.
+ *
+ * Leaving the field out is what Claude and ChatGPT both do, so this is the
+ * common case rather than a corner of it. Two things follow, and neither is
+ * visible from the outside:
+ *
+ *   - `state.json` gains a value someone could present, which is the one thing
+ *     `AuthStore` is careful never to store (tokens live there as hashes).
+ *   - `stripPhantomSecret` below gates on the stored client having NO secret,
+ *     so it stops firing for exactly the clients it was written for: a
+ *     connector that echoes the secret from its registration response gets
+ *     `401 invalid_client`, which is the failure quirk 2 exists to prevent.
+ *
+ * The response is left alone — it still carries a secret, which is what
+ * ChatGPT insists on. Only the record is cleaned.
+ */
+export function withoutPhantomSecret(payload) {
+    if (payload.token_endpoint_auth_method !== 'none' || payload.client_secret === undefined)
+        return payload;
+    // An HMAC response algorithm signs with the secret, so a client that declared
+    // one needs it kept even though its auth method does not use it.
+    const usesHmac = Object.entries(payload).some(([key, value]) => key.endsWith('_signed_response_alg') && typeof value === 'string' && value.startsWith('HS'));
+    if (usesHmac)
+        return payload;
+    const { client_secret: _secret, client_secret_expires_at: _expires, ...rest } = payload;
+    return rest;
+}
+export function installThrowawaySecret(provider, store) {
+    provider.use(async (ctx, next) => {
+        await next();
+        const body = ctx.body;
+        if (ctx.oidc?.route !== 'registration' || ctx.status !== 201 || !body)
+            return;
+        if (body.token_endpoint_auth_method === 'none' && body.client_secret === undefined) {
+            body.client_secret = crypto.randomBytes(32).toString('base64url');
+            body.client_secret_expires_at = 0;
+        }
+        // The only moment the registration access token is visible. The hub stores
+        // just its hash, which is what lets RFC 7592 management stay on mcp-hub's
+        // own, stricter implementation.
+        if (store && typeof body.client_id === 'string' && typeof body.registration_access_token === 'string') {
+            store.rememberRegistrationToken(body.client_id, body.registration_access_token);
+        }
+    });
+}
+/**
+ * RFC 8414 lists `revocation_endpoint_auth_methods_supported`, the hub
+ * advertised it, and oidc-provider does not emit it at all. A client that reads
+ * the document to decide how to authenticate at /revoke would find nothing
+ * where there used to be an answer.
+ *
+ * Same mechanism as the throwaway secret: middleware installed ahead of the
+ * router, so `ctx.body` is still a plain object when it returns.
+ */
+export function installDiscoveryFixups(provider) {
+    provider.use(async (ctx, next) => {
+        await next();
+        const body = ctx.body;
+        if (ctx.oidc?.route === 'discovery' && ctx.status === 200 && body?.revocation_endpoint) {
+            body.revocation_endpoint_auth_methods_supported = ['client_secret_post', 'none', 'private_key_jwt'];
+        }
+    });
+}
+/**
+ * Quirk 4. MCP clients send no `scope` parameter at all.
+ *
+ * actions/authorization/interactions.js filters the GRANTED scopes by the
+ * REQUESTED ones and throws `access_denied` when the intersection is empty —
+ * so with no scope requested the flow dead-ends no matter what was granted.
+ * The hub issues scopeless, resource-bound tokens today, so defaulting the
+ * scope preserves current behaviour; demanding one from the clients would not,
+ * because they will never send it.
+ *
+ * A client that DOES ask for something is left alone.
+ */
+export const defaultScope = (req, _res, next) => {
+    const url = new URL(req.url, 'http://placeholder.invalid');
+    if (!url.searchParams.get('scope')) {
+        url.searchParams.set('scope', HUB_SCOPE);
+        req.url = `${url.pathname}${url.search}`;
+    }
+    next();
+};
+/**
+ * The most a `/token` body may weigh before it is refused unread.
+ *
+ * Exactly oidc-provider's own ceiling (shared/selective_body.js), because this
+ * middleware reads the stream the library would otherwise read itself: anything
+ * above it was never going to be accepted, so capping here changes nothing a
+ * legitimate client does — and without the cap the read below is unbounded,
+ * which is the one thing a request stream must never be.
+ */
+const MAX_TOKEN_BODY_BYTES = 56 * 1024;
+/**
+ * Restores the hub's existing tolerance for a client that presents the
+ * throwaway secret from quirk 2 back at the token endpoint.
+ *
+ * The SDK the hub used before gated on the STORED client having a secret
+ * (clientAuth.js: `if (client.client_secret)`), and public clients have none,
+ * so a presented secret was ignored. oidc-provider gates on the PRESENTED one
+ * (client_auth.js: any client_secret selects client_secret_basic/post) and then
+ * hard-fails with `401 invalid_client` because the record says 'none'.
+ *
+ * Whether ChatGPT actually echoes the secret is unknown and unknowable from the
+ * outside — which is the reason to be tolerant rather than to find out from a
+ * bug report. `ctx.oidc.params` is built inside the router, after every
+ * provider.use() middleware, so the raw body before the mount is the only place
+ * this can happen.
+ *
+ * Reading the body here is what makes the cap above load-bearing. `/token` is
+ * unauthenticated by nature — the credentials are IN the body — so an
+ * unbounded read is a way for anyone to spend the hub's memory, and the
+ * per-path rate limit still allows fifty of them per address per window. Every
+ * other provider path keeps the library's own bounded reader; only this one
+ * takes the stream away from it, so only this one has to bring the ceiling
+ * with it.
+ */
+export function stripPhantomSecret(store, callback) {
+    return (req, res, next) => {
+        // Anything that is not a POST still belongs to the provider, which answers
+        // 405. Handing it to next() instead would drop it into the hub's catch-all
+        // and turn a documented endpoint into a 404.
+        if (req.method !== 'POST') {
+            callback(req, res);
+            return;
+        }
+        // A declared length above the ceiling is refused without reading a byte;
+        // an absent or lying one is caught while reading.
+        const declared = Number(req.headers['content-length']);
+        if (Number.isFinite(declared) && declared > MAX_TOKEN_BODY_BYTES) {
+            refuseOversizedBody(req, res);
+            return;
+        }
+        void (async () => {
+            try {
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of req) {
+                    size += chunk.length;
+                    if (size > MAX_TOKEN_BODY_BYTES) {
+                        refuseOversizedBody(req, res);
+                        return;
+                    }
+                    chunks.push(chunk);
+                }
+                const params = new URLSearchParams(Buffer.concat(chunks).toString('utf8'));
+                const clientId = params.get('client_id');
+                if (params.get('client_secret') && clientId) {
+                    const client = store.getClient(clientId);
+                    // A public client never had a secret, so whatever was presented is
+                    // the throwaway one the hub itself handed out.
+                    if (client && client.client_secret === undefined)
+                        params.delete('client_secret');
+                }
+                const body = Buffer.from(params.toString());
+                const shim = Readable.from([body]);
+                Object.assign(shim, {
+                    headers: { ...req.headers, 'content-length': String(body.length) },
+                    method: req.method,
+                    url: req.url,
+                    socket: req.socket,
+                    httpVersion: req.httpVersion
+                });
+                callback(shim, res);
+            }
+            catch (error) {
+                next(error);
+            }
+        })();
+    };
+}
+/**
+ * The same answer oidc-provider gives a body it will not read, so a client
+ * cannot tell whether the ceiling was enforced here or one layer down.
+ *
+ * The connection is closed rather than drained: the sender is still writing,
+ * and reading the rest to keep it alive would defeat the point of refusing.
+ */
+function refuseOversizedBody(req, res) {
+    const body = JSON.stringify({ error: 'invalid_request', error_description: 'failed to parse the request body' });
+    res.status(400);
+    res.set({ 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': String(Buffer.byteLength(body)), Connection: 'close' });
+    res.end(body);
+    req.destroy();
+}
+//# sourceMappingURL=quirks.js.map

package/dist/auth/oidc/verifier.js

@@ -0,0 +1,121 @@
+import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
+import { jwtVerify } from 'jose';
+import { API_TOKEN_SUBJECT } from '../api-tokens.js';
+/**
+ * The one error shape `requireBearerAuth` recognises.
+ *
+ * It classifies whatever the verifier throws: an `OAuthError` carrying
+ * `invalid_token` becomes a 401 with a `WWW-Authenticate` challenge pointing at
+ * the protected-resource metadata, and anything else becomes a 500. SDK v1 had
+ * a class per code; v2 has one class and an enum, so the distinction now lives
+ * in the argument rather than in the constructor — which is exactly the kind of
+ * thing that fails silently, by answering 500 to a merely expired token and
+ * leaving the client with nothing to discover the authorization server from.
+ */
+function invalidToken(message) {
+    return new OAuthError(OAuthErrorCode.InvalidToken, message);
+}
+/**
+ * Verifies the two token shapes the hub hands out, which are deliberately not
+ * the same shape.
+ *
+ * OAuth access tokens are **opaque**. That is what makes revocation immediate:
+ * the value is the record's id, so the lookup below is the enforcement point,
+ * and `AuthStore.oidcFind` refuses anything past its expiry or minted before a
+ * `revokedBefore` cutoff. A JWT could not be revoked at all — oidc-provider
+ * never persists one.
+ *
+ * Admin-minted API tokens stay **JWTs**, signed with the hub's own key. They
+ * are not OAuth artifacts: `mcp-hub-admin tokens create` issues them for
+ * clients that cannot do OAuth at all, and only their record (jti) is stored,
+ * which is what `tokens revoke` deletes.
+ *
+ * Order matters. Opaque is tried first because it is the common case and needs
+ * no cryptography; a value that is not a stored token then gets exactly one
+ * signature check. Neither branch may report why it failed — an attacker must
+ * not be able to tell "unknown" from "revoked" from "wrong audience".
+ */
+export class OidcTokenVerifier {
+    store;
+    options;
+    constructor(store, options) {
+        this.store = store;
+        this.options = options;
+    }
+    async verifyAccessToken(token) {
+        const opaque = this.store.oidcFind('AccessToken', token);
+        if (opaque)
+            return this.fromOpaque(token, opaque);
+        return this.fromApiToken(token);
+    }
+    fromOpaque(token, payload) {
+        const clientId = payload.clientId;
+        if (typeof clientId !== 'string')
+            throw invalidToken('Invalid access token claims');
+        // An audience equal to the issuer means "not bound to one resource" — the
+        // pre-0.5 shape, kept so a deployment that never turned binding on is not
+        // logged out by an upgrade. It passes only while binding is not enforced;
+        // the per-route check is what narrows it.
+        const audience = typeof payload.aud === 'string' ? payload.aud : undefined;
+        let resource;
+        if (audience !== undefined && audience !== this.options.externalUrl) {
+            resource = this.resolve(audience);
+            if (!resource)
+                throw invalidToken('Invalid token audience');
+        }
+        else if (this.options.requireResource) {
+            throw invalidToken('Invalid token audience');
+        }
+        const scope = typeof payload.scope === 'string' ? payload.scope : '';
+        return {
+            token,
+            clientId,
+            scopes: scope ? scope.split(' ') : [],
+            ...(typeof payload.exp === 'number' ? { expiresAt: payload.exp } : {}),
+            ...(resource ? { resource } : {})
+        };
+    }
+    async fromApiToken(token) {
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, this.store.publicKey, {
+                issuer: this.options.externalUrl,
+                algorithms: ['EdDSA']
+            }));
+        }
+        catch {
+            throw invalidToken('Invalid or expired access token');
+        }
+        // Only API tokens are JWTs now. An OAuth token in this shape is one the
+        // previous authorization server minted; refusing it is what makes clients
+        // authorize once against the new one instead of silently keeping a
+        // credential nothing can revoke.
+        if (payload.sub !== API_TOKEN_SUBJECT)
+            throw invalidToken('Invalid access token claims');
+        if (typeof payload.jti !== 'string' || !this.store.getApiToken(payload.jti)) {
+            throw invalidToken('Access token has been revoked');
+        }
+        const audience = typeof payload.aud === 'string' ? payload.aud : undefined;
+        const resource = audience ? this.resolve(audience) : undefined;
+        if (!resource)
+            throw invalidToken('Invalid token audience');
+        return {
+            token,
+            clientId: `token:${payload.jti}`,
+            scopes: [],
+            ...(payload.exp !== undefined ? { expiresAt: payload.exp } : {}),
+            resource
+        };
+    }
+    resolve(audience) {
+        let parsed;
+        try {
+            parsed = new URL(audience);
+        }
+        catch {
+            return undefined;
+        }
+        return this.options.resolveResource(parsed);
+    }
+}
+//# sourceMappingURL=verifier.js.map

package/dist/auth/protected-resource.js

@@ -0,0 +1,41 @@
+import { Router } from 'express';
+import { authSecurityHeaders } from './headers.js';
+/**
+ * RFC 9728 Protected Resource Metadata.
+ *
+ * This is the RESOURCE SERVER's document, not the authorization server's, which
+ * is why it lives outside `createAuthRoutes` and survives whichever
+ * authorization server the hub is running. Losing it would take out discovery
+ * for every client, and it is the one piece of the auth surface that is not
+ * oidc-provider's to serve.
+ *
+ * Two shapes, both required: the root document the SDK used to publish, and the
+ * path-scoped form (§3.1) a client connected to `/<name>/mcp` looks up first.
+ */
+export function createProtectedResourceRoutes(options) {
+    const router = Router();
+    const issuerUrl = new URL(options.externalUrl);
+    const resourceName = options.resourceName ?? 'mcp-hub';
+    // These used to be served from inside the auth router and inherited its
+    // headers; pulled out here, they would have quietly lost them. A discovery
+    // document is exactly the thing a shared cache should not keep.
+    router.use(authSecurityHeaders);
+    router.get('/.well-known/oauth-protected-resource', (_req, res) => {
+        res.json({
+            resource: issuerUrl.href,
+            authorization_servers: [options.externalUrl],
+            resource_name: resourceName
+        });
+    });
+    router.get('/.well-known/oauth-protected-resource/{*splat}', (req, res) => {
+        const suffix = req.path.replace('/.well-known/oauth-protected-resource', '');
+        res.json({
+            resource: issuerUrl.origin + suffix,
+            authorization_servers: [options.externalUrl],
+            bearer_methods_supported: ['header'],
+            resource_name: resourceName
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=protected-resource.js.map

package/dist/auth/rate-limit.js

@@ -1,5 +1,46 @@
+import net from 'node:net';
 /**
- * A per-IP request budget that rejects before any body is read.
+ * The unit a budget is counted against.
+ *
+ * Not the address. One IPv6 address is not one caller: the smallest block
+ * handed to a single subscriber is a /64, and a residential line usually gets a
+ * /56 or /48 on top of that. A limiter keyed on the full address therefore
+ * counts a single host as billions of distinct callers, and every per-address
+ * budget in this file becomes decorative — a /64 walks around all of them
+ * without any infrastructure at all.
+ *
+ * IPv4 keeps its own address, where one address really is roughly one caller,
+ * and an IPv4-mapped form (`::ffff:1.2.3.4`, what a dual-stack listener reports
+ * for an IPv4 peer) is folded back onto it so the same client is not counted in
+ * two places depending on how the socket was opened.
+ *
+ * Only the KEY is bucketed. Log lines keep the full address — fail2ban bans
+ * what it is given, and it should be given the host that actually connected.
+ */
+export function rateLimitKey(ip) {
+    const bare = ip.replace(/^\[|\]$/g, '').split('%')[0];
+    if (net.isIPv4(bare))
+        return bare;
+    if (!net.isIPv6(bare))
+        return ip; // 'unknown', or something we cannot parse
+    const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(bare);
+    if (mapped)
+        return mapped[1];
+    return `${expandIPv6(bare).slice(0, 4).join(':')}::/64`;
+}
+/** The eight hextets of an IPv6 address, with `::` filled back in. */
+function expandIPv6(address) {
+    const [head, tail] = address.toLowerCase().split('::');
+    const left = head ? head.split(':') : [];
+    const right = tail ? tail.split(':') : [];
+    const missing = 8 - left.length - right.length;
+    const groups = [...left, ...Array.from({ length: Math.max(0, missing) }, () => '0'), ...right];
+    // Leading zeros are not part of the value; without this `2001:0db8:…` and
+    // `2001:db8:…` would be two different keys for one network.
+    return groups.map(group => (Number.parseInt(group, 16) || 0).toString(16));
+}
+/**
+ * A per-caller request budget that rejects before any body is read.
  *
  * The SDK applies its own limits to the OAuth endpoints, but only after body
  * parsing — which is the expensive part. This runs first, and refuses without
@@ -13,7 +54,7 @@ export function earlyRateLimit(windowMs, maxPerIp, maxTotal) {
         const now = Date.now();
         if (total.resetAt <= now)
             total = { count: 0, resetAt: now + windowMs };
-        const ip = req.ip ?? 'unknown';
+        const ip = rateLimitKey(req.ip ?? 'unknown');
         let entry = byIp.get(ip);
         if (entry && entry.resetAt <= now) {
             byIp.delete(ip);
@@ -40,4 +81,76 @@ export function earlyRateLimit(windowMs, maxPerIp, maxTotal) {
         next();
     };
 }
+const LOGIN_MAX_ATTEMPTS = 10;
+const LOGIN_WINDOW_MS = 15 * 60_000;
+/** A global ceiling as well, so a distributed guess cannot spend the per-address
+ *  budget many times over. */
+const LOGIN_MAX_ATTEMPTS_TOTAL = 100;
+/**
+ * Per-caller lockout for the password form.
+ *
+ * Separate from `earlyRateLimit` because it counts FAILURES, not requests: a
+ * correct login resets the counter, so someone who knows the password is never
+ * locked out by someone else guessing from the same address.
+ */
+export class LoginRateLimiter {
+    attempts = new Map();
+    total = { count: 0, resetAt: 0 };
+    /**
+     * Whether this caller has spent its budget.
+     *
+     * The global ceiling refuses the callers that are doing the guessing, and
+     * only those. It used to refuse everyone, which turned an attacker's cheapest
+     * possible traffic into a lockout of the only administrative way in: a
+     * hundred wrong passwords — under a second of work, and renewable every
+     * fifteen minutes — left the operator holding the correct password and
+     * getting 429 from an address that had never been near the form.
+     *
+     * What the ceiling is for survives the change. A caller that guesses is
+     * counted, and once the hub as a whole is under a distributed attempt that
+     * caller is refused on its FIRST failure instead of its tenth — so the total
+     * number of guesses still collapses, and it collapses hardest for exactly the
+     * addresses doing the guessing. What no longer happens is that they can spend
+     * somebody else's budget. Repeated failures remain a fail2ban matter; that is
+     * what the log line exists for.
+     */
+    isBlocked(ip) {
+        const key = rateLimitKey(ip);
+        const entry = this.attempts.get(key);
+        const live = entry && entry.resetAt >= Date.now() ? entry : undefined;
+        if (this.total.resetAt > Date.now() && this.total.count >= LOGIN_MAX_ATTEMPTS_TOTAL && live !== undefined)
+            return true;
+        return (live?.count ?? 0) >= LOGIN_MAX_ATTEMPTS;
+    }
+    recordFailure(ip) {
+        this.sweepExpired(); // entries are otherwise only dropped on a successful login from that exact caller
+        const now = Date.now();
+        // Behind a reverse proxy req.ip is the proxy for every request, and a
+        // spoofable X-Forwarded-For makes the per-caller counter meaningless — this
+        // caps the total either way.
+        if (this.total.resetAt < now)
+            this.total = { count: 1, resetAt: now + LOGIN_WINDOW_MS };
+        else
+            this.total.count++;
+        const key = rateLimitKey(ip);
+        const entry = this.attempts.get(key);
+        if (!entry || entry.resetAt < now) {
+            this.attempts.set(key, { count: 1, resetAt: now + LOGIN_WINDOW_MS });
+        }
+        else {
+            entry.count++;
+        }
+    }
+    sweepExpired() {
+        const now = Date.now();
+        for (const [ip, entry] of this.attempts) {
+            if (entry.resetAt < now)
+                this.attempts.delete(ip);
+        }
+    }
+    reset(ip) {
+        this.attempts.delete(rateLimitKey(ip));
+        this.total = { count: 0, resetAt: 0 };
+    }
+}
 //# sourceMappingURL=rate-limit.js.map

package/dist/auth/redirect-uri.js

@@ -11,7 +11,7 @@ const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
 /** Schemes a browser or the operating system would treat as executable content
  *  or local file access. Never a legitimate redirect target. */
 const DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:', 'blob:']);
-export function isLoopbackHostname(hostname) {
+function isLoopbackHostname(hostname) {
     return LOOPBACK_HOSTNAMES.has(hostname);
 }
 /**
@@ -38,6 +38,38 @@ export function isSafeRedirectUri(uri, policy) {
         return isLoopbackHostname(parsed.hostname);
     return policy.allowPrivateUseSchemes;
 }
+/**
+ * Whether a requested redirect URI is covered by a registered one.
+ *
+ * RFC 8252 §7.3: an authorization server MUST allow any port on a loopback
+ * redirect URI, because a native client is handed an ephemeral one by the
+ * operating system and cannot register it in advance. Everything else is an
+ * exact match — a prefix or origin comparison here is the classic open-redirect
+ * hole.
+ *
+ * Lives here rather than being imported because SDK v2 dropped it: the helper
+ * belonged to the authorization-server half, which the SDK no longer ships. It
+ * is a dozen lines, and keeping the loopback set shared with the checks above
+ * is worth more than the import was.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
+ */
+export function redirectUriMatches(requested, registered) {
+    if (requested === registered)
+        return true;
+    let req;
+    let reg;
+    try {
+        req = new URL(requested);
+        reg = new URL(registered);
+    }
+    catch {
+        return false;
+    }
+    if (!isLoopbackHostname(req.hostname) || !isLoopbackHostname(reg.hostname))
+        return false;
+    return (req.protocol === reg.protocol && req.hostname === reg.hostname && req.pathname === reg.pathname && req.search === reg.search);
+}
 /**
  * True when every redirect URI points at this machine — the case the MCP
  * security considerations single out, because any local program could be the

package/dist/auth/registration.js

@@ -1,5 +1,5 @@
 import express, { Router } from 'express';
-import { OAuthClientMetadataSchema } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { OAuthClientMetadataSchema } from '@modelcontextprotocol/core';
 import { isSafeRedirectUri } from './redirect-uri.js';
 import { earlyRateLimit } from './rate-limit.js';
 import { clampDisplayName, logSafe } from './text.js';

package/dist/auth/session.js

@@ -0,0 +1,43 @@
+import { sign, signatureMatches } from './signed-token.js';
+/** Deliberately short: it only has to outlive a connector's authorization. */
+export const SESSION_TTL_MS = 30 * 60_000;
+export const SESSION_COOKIE = 'mcp_hub_session';
+/**
+ * The operator's browser session, carried entirely by the client.
+ *
+ * `"<expiresMs>.<HMAC>"` and nothing else — there is no session table, which is
+ * what lets the hub stay stateless while still recognising someone who has
+ * already typed the password. The value doubles as the handle the consent
+ * form's CSRF token is bound to.
+ *
+ * Shared rather than reimplemented: `hasValidSession` is read outside the auth
+ * layer (the upstream OAuth callback in `src/upstream/routes.ts`), so two
+ * copies of this format drifting apart would break a flow that neither of them
+ * looks like it owns.
+ */
+export function createSessionCookie(secret) {
+    const expires = String(Date.now() + SESSION_TTL_MS);
+    return `${expires}.${sign(expires, secret)}`;
+}
+/** The verified cookie value, or undefined when absent, forged or expired. */
+export function readSessionCookie(cookieHeader, secret) {
+    const match = cookieHeader?.match(new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([^;]+)`));
+    if (!match)
+        return undefined;
+    const value = decodeURIComponent(match[1]);
+    const [expires, signature] = value.split('.');
+    if (!expires || !signature)
+        return undefined;
+    if (!signatureMatches(expires, signature, secret))
+        return undefined;
+    return Number(expires) > Date.now() ? value : undefined;
+}
+export function csrfToken(sessionValue, secret) {
+    return sign(`csrf:${sessionValue}`, secret);
+}
+export function verifyCsrfToken(sessionValue, token, secret) {
+    if (typeof token !== 'string')
+        return false;
+    return signatureMatches(`csrf:${sessionValue}`, token, secret);
+}
+//# sourceMappingURL=session.js.map