@ni-c/mcp-hub 0.11.0 → 0.11.2

package/CHANGELOG.md

@@ -7,6 +7,179 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.11.2] - 2026-09-07
+
+### Security
+
+- **An unset password was an open login.** With neither `PASSWORD` nor
+  `PASSWORD_HASH` configured, `checkPassword` compared the form field with an
+  empty buffer — which matches an empty field — so anyone who could reach the
+  port approved a client and minted tokens for every server. The hub now starts
+  with its login **disabled** in that case: a warning on the first log line,
+  `503` with the reason on the sign-in page, and every login refused, so
+  nothing can be approved. A `PASSWORD_HASH` that is not a bcrypt hash
+  disables the login the same way instead of falling back to `PASSWORD`; the
+  warning names the variable and its length, never the value. Refusing to
+  *start* was considered and rejected: a health check or a directory crawler
+  that runs the image without a password needs the process, not the login,
+  and the security outcome is the same.
+- **The private-address guard for an upstream's authorization server was off
+  for every DNS-named upstream.** `privateAllowed()` asked `isPrivateAddress`
+  about the upstream's *hostname*; that function answers "refuse" for anything
+  that is not an address literal, and the caller read "refuse" as "the upstream
+  is private, so its authorization server may be too". A public upstream whose
+  metadata pointed the token or registration endpoint at `127.0.0.1` or
+  `169.254.169.254` was followed there. The hostname is now resolved and the
+  upstream counts as private only when every answer is; a resolution failure
+  or a mixed answer keeps the guard on; and the endpoints must be https unless
+  the upstream is private.
+- **The native-fetch path of the upstream OAuth client read bodies without a
+  ceiling.** Literal-IP and private upstreams bypass the pinned transport and
+  its 256 KiB cap; `boundedResponse()` applies the same cap there, including to
+  error bodies and decoded responses.
+- **A forged `state` on `/upstream/callback` hung the request.** A signature of
+  the right length in characters but not in bytes made `timingSafeEqual` throw
+  `RangeError`, and the route's `void (async …)` swallowed the rejection, so
+  the browser waited forever. `signatureMatches` checks the shape before
+  comparing, `readSessionCookie` no longer throws on broken percent-encoding,
+  and both routes are async handlers whose rejection Express answers.
+- **PKCE is required of every client, confidential ones included.**
+  oidc-provider's default asks for a `code_challenge` only from public
+  clients; the discovery document and the standards page have said "S256
+  required" since the first release. A secret proves who redeems a code, the
+  challenge proves it was the one who asked for it.
+- **The session cookie carries the `__Host-` prefix behind HTTPS**, as
+  `docs/guide/security.md` has promised since it was written. The browser then
+  refuses the cookie from any other origin, path or domain, so a session
+  somebody obtained cannot be fixed into another browser from a sibling host.
+  Behind plain http, where the prefix is not settable, the bare name stays.
+- **Prototype names as identifiers no longer fault the authorization server.**
+  Every map in `state.json` is keyed by something a caller chose, and
+  `JSON.parse` handed them back with `Object.prototype` behind them:
+  `state.clients['constructor']` was `Object` itself, a truthy record that is
+  not a client, and `/authorize?client_id=constructor` answered
+  `500 server_error` with a fault in the log. The maps have a null prototype
+  now; an unknown name is `undefined` on every path.
+- **A child's words are cleaned and bounded before they reach a tool result.**
+  `list_servers` carried a child's `title` verbatim, `list_tools` and
+  `get_tool_schema` its descriptions at any length, and every failure sentence
+  quoted the child's error message as received — a bidi override reverses the
+  line, a zero-width character hides text a model still reads, an ESC sequence
+  lands in the terminal. `childText()` strips the same characters an
+  elicitation prompt loses and cuts to the field's size; schemas and
+  annotations stay verbatim by contract. The supervisor's `up (name version)`
+  and failure lines, the client id in the activity warning and the upstream's
+  error on the callback page go through `logSafe` for the same reason.
+- **A URL-mode elicitation is forwarded only for an https page.** The client
+  opens that page under the hub's own attribution line; `javascript:`, plain
+  http, private-use schemes and credentials in the URL are dropped and counted.
+- **A variable called `__proto__` in a sandbox secrets file vanished without a
+  word**, and an elicitation keyed `__proto__` was swallowed: on an ordinary
+  object the assignment replaces the prototype instead of adding a key. Both
+  maps are null-prototype now.
+- **Rotated upstream secrets and headers were never applied** to a running
+  hub: the credential manager was keyed on a fingerprint that deliberately
+  survives a secret rotation, so the old configuration stayed alive in memory
+  until a restart. The manager is rebuilt when the configuration changes; the
+  stored tokens survive, as they should.
+
+### Fixed
+
+- **The nightly end-to-end suite had not run since the move to vitest 5.**
+  vitest 5 removed the `vitest/reporters` subpath; the budget reporter imported
+  its `Reporter` type from there, so `typecheck:e2e` failed before a single
+  test started, on every tier (#58). The type now comes from `vitest/node`.
+- `SOCKET_MODE` is validated as three or four octal digits; `abc` used to reach
+  `chmodSync` as `NaN` and end the proxy with a stack trace.
+- A `CIMD_ALLOWED_ORIGINS` entry that does not look like an origin is described
+  by its length in the startup error rather than printed — it sits a few lines
+  from `PASSWORD_HASH` in every compose file.
+- The subscription debounce window flushes early once it holds 1024 distinct
+  events, instead of growing with the resource URIs a child announces.
+- `/.well-known/mcp-hub-client/<id>.json` has a rate limit like every other
+  unauthenticated route.
+- Four source files carried raw NUL, ESC, VT and FF bytes in string and regex
+  literals, which made git treat them as binary and hide every later change
+  from review. They are `\uXXXX` escapes now, with the same runtime meaning.
+- Both images no longer ship yarn and corepack, which nothing in them runs,
+  and the hub image no longer copies `package-lock.json` into the runtime
+  layer, which nothing reads once the install has happened.
+
+### Changed
+
+- oxlint's `suspicious` category is on; 95 findings resolved (mostly
+  `Array#toSorted()` over copy-and-sort, helpers that captured nothing hoisted
+  to module scope, and un-shadowed names). The MCP Transport callbacks are set
+  through one `setTransportHandlers()` helper, and `_meta` / `_requestHandlers`
+  are allowed as protocol-defined names. No runtime behaviour changed.
+- The documentation says what the code does: the request pipeline parses the
+  body before the per-client gate and has no per-IP limiter on MCP routes;
+  `call_tool`'s deadline is absolute by default; `/revoke` revokes the
+  presented access token; the login and consent pages live under
+  `/interaction/<uid>/`; the reserved-name lists gained `jwks`, `interaction`,
+  `session` and `userinfo`; there are ten runtime dependencies; an unusable
+  upstream token is state `unauthorized`; the ten supervisor clocks in
+  `src/timings.ts` are listed as environment variables; and the 100-entry
+  ceiling on never-approved registrations is written down.
+
+### CI
+
+- **A dependency bump could break the end-to-end suite without any pull
+  request noticing.** The E2E workflow ran on pull requests only for changes
+  under `e2e/` and its configs, and `ci.yml` never type-checked that tree, so
+  the vitest 5 bump was green and the nightly was the first to disagree. The
+  test job now runs `typecheck:e2e` (seconds, once per matrix), and changes to
+  `package.json` or `package-lock.json` trigger the E2E workflow on the pull
+  request itself.
+- The unit tests are type-checked too (`typecheck:test`, `tsconfig.test.json`);
+  the twelve errors it surfaced were narrowing casts in tests.
+- `dependency-review-action` (pinned, fails on high) checks what a pull request
+  changes in the dependency tree; `npm audit` only sees the tree as it is.
+- The release workflow checks that the CHANGELOG has a section for the tag
+  *before* `npm publish`, not after it in the job that creates the GitHub
+  release. The nightly image build passes the same daily apt epoch `ci.yml`
+  does.
+- The fast suite's client helpers list tools before every call, so the SDK's
+  client-side `structuredContent` check runs on every success path.
+
+## [0.11.1] - 2026-09-06
+
+### Security
+
+- **The published image shipped a vulnerable `libssh2`, and no amount of
+  rescanning was going to change that.** `libssh2-1 1.10.0-3+b1` — pulled in as
+  a dependency of `git`, which the image installs so servers can be fetched
+  straight from a repository — is affected by CVE-2026-7598 and CVE-2026-58050,
+  both HIGH, both fixed in `bookworm-security` as `1.10.0-3+deb12u1` before the
+  scanner ever reported them. The fix could not reach the image because the apt
+  layer was never rebuilt: the base digest is pinned and the apt command is a
+  constant, so the layer cache answered every build with the packages installed
+  the day it was first built. The image scanned green one afternoon and red
+  three hours later from the same cached layer, and a workflow rerun reproduced
+  the finding exactly.
+
+  Both Dockerfiles now take an `APT_SECURITY_EPOCH` build argument that is
+  interpolated into the apt command itself, and CI passes the current UTC date.
+  The layer therefore expires once a day rather than never, while builds within
+  a day stay cached. The argument has to appear *in* the command — BuildKit keys
+  a `RUN` on its expanded command line, and an ARG that is merely declared
+  invalidates nothing. In the hub image the npm replacement step moved above
+  that boundary: it is the expensive one, it rots with its pins rather than with
+  time, and it needs neither apt nor the system CA store.
+
+  This is the second time the same cache has held back a Debian security fix
+  (CVE-2026-56408 in `libexpat1` was the first), which is why the remedy is a
+  mechanism rather than another rebuild.
+
+### Changed
+
+- The npm tarball no longer carries the `.js.map` source maps — 61 files and
+  360 kB unpacked, against 540 kB of actual code. `sourceMap` stays on and the
+  maps are still built: the integration tests and CI run `dist/index.js` out of
+  a checkout, where `src/` sits right next to it and a stack trace resolves
+  through them. In an installed package it cannot — the sources those maps point
+  at are not part of it.
+
 ## [0.11.0] - 2026-09-03
 
 ### Added

package/README.md

@@ -1,13 +1,18 @@
 # mcp-hub
 
+<!-- badges: start -->
+
 [![CI](https://img.shields.io/github/actions/workflow/status/ni-c/mcp-hub/ci.yml?branch=main&label=CI)](https://github.com/ni-c/mcp-hub/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ni-c/mcp-hub/badge)](https://scorecard.dev/viewer/?uri=github.com/ni-c/mcp-hub)
+<a href="https://socket.dev/npm/package/@ni-c/mcp-hub"><img src="https://socket.dev/api/badge/npm/package/@ni-c/mcp-hub" alt="Socket supply-chain report" height="20"></a>
+[![Glama score](https://glama.ai/mcp/servers/ni-c/mcp-hub/badges/score.svg)](https://glama.ai/mcp/servers/ni-c/mcp-hub)
+<br>
 [![npm version](https://img.shields.io/npm/v/%40ni-c%2Fmcp-hub)](https://www.npmjs.com/package/@ni-c/mcp-hub)
-[![npm downloads](https://img.shields.io/npm/dm/%40ni-c%2Fmcp-hub)](https://www.npmjs.com/package/@ni-c/mcp-hub)
-[![node](https://img.shields.io/node/v/%40ni-c%2Fmcp-hub)](https://nodejs.org)
-[![license](https://img.shields.io/npm/l/%40ni-c%2Fmcp-hub)](LICENSE)
-[![container](https://img.shields.io/badge/ghcr.io-ni--c%2Fmcp--hub-blue)](https://github.com/ni-c/mcp-hub/pkgs/container/mcp-hub)
-[![docs](https://img.shields.io/badge/docs-mcp--hub.ni--c.de-informational)](https://mcp-hub.ni-c.de)
+[![container image](https://img.shields.io/badge/ghcr.io-ni--c%2Fmcp--hub-4f46e5?logo=docker&logoColor=white)](https://github.com/ni-c/mcp-hub/pkgs/container/mcp-hub)
+<br>
+[![docs](https://img.shields.io/badge/docs-mcp--hub.ni--c.de-4f46e5?logo=readthedocs&logoColor=white)](https://mcp-hub.ni-c.de)
 [![sponsor](https://img.shields.io/badge/sponsor-ni--c-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ni-c)
+<!-- badges: end -->
 
 A dual-era [Model Context Protocol](https://modelcontextprotocol.io) (MCP) gateway: it
 serves many stdio MCP servers from **one container**, published over HTTPS, and speaks
@@ -112,14 +117,14 @@ replaces N containers with one process:
   re-read on waking; `subscriptions: "off"` withdraws one server's right to
   push; [details](https://mcp-hub.ni-c.de/guide/subscriptions).
 - **Lightweight by design**: one Node process, no database (state is one JSON
-  file plus a signing key under `/data`), six runtime dependencies, and
+  file plus a signing key under `/data`), ten runtime dependencies, and
   multi-arch images — a stated project goal is to run comfortably on a
   single-board computer like a Raspberry Pi.
 
 ## Servers to run behind it
 
 The hub is server-agnostic — it serves any stdio MCP server whose entry fits
-Claude Code's `mcpServers` format, which is most of them. These seventeen are
+Claude Code's `mcpServers` format, which is most of them. These nineteen are
 built and maintained alongside it, so their documentation carries the hub entry
 you need and their tool filters line up with the hub's own `allowTools` /
 `denyTools`:
@@ -127,7 +132,9 @@ you need and their tool filters line up with the hub's own `allowTools` /
 | Server                                                                 | npm                               | What it reaches                                                                |
 | ---------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------ |
 | [audiobookshelf-mcp](https://audiobookshelf-mcp.ni-c.de)               | `audiobookshelf-mcp`              | Audiobookshelf — libraries, listening progress, collections and playlists      |
+| [caldav-mcp](https://caldav-mcp.ni-c.de)                               | `@ni-c/caldav-mcp`                | CalDAV — events, tasks and journal entries on any server that speaks it        |
 | [calibreweb-mcp](https://calibreweb-mcp.ni-c.de)                       | `calibreweb-mcp`                  | Calibre-Web — read-only library access through the OPDS feed                   |
+| [carddav-mcp](https://carddav-mcp.ni-c.de)                             | `@ni-c/carddav-mcp`               | CardDAV — contacts, groups and photos on any server that speaks it             |
 | [freshrss-mcp](https://freshrss-mcp.ni-c.de)                           | `@ni-c/freshrss-mcp`              | FreshRSS — feeds, categories and articles as plain text, not stream ids        |
 | [google-search-console-mcp](https://google-search-console-mcp.ni-c.de) | `@ni-c/google-search-console-mcp` | Google Search Console — properties, sitemaps, search analytics, URL inspection |
 | [healthchecks-mcp](https://healthchecks-mcp.ni-c.de)                   | `healthchecks-mcp`                | Healthchecks — cron and uptime checks, and why one failed                      |
@@ -146,7 +153,7 @@ you need and their tool filters line up with the hub's own `allowTools` /
 
 Each one runs perfectly well on its own over stdio. Put them behind the hub when
 you want them reachable from a client that cannot spawn a local process, or when
-you would rather register one connector than seventeen.
+you would rather register one connector than nineteen.
 
 ## Configuration
 
@@ -197,7 +204,8 @@ working. `allowTools` / `denyTools` cut finer and apply to every kind of
 server: a filtered tool is absent from both `tools/list` and `/hub`, and is
 refused if called anyway — before the server is woken.
 Reserved names: `mcp`, `hub`, `authorize`, `token`, `register`,
-`login`, `consent`, `health`, `livez`, `revoke`, `upstream`, `.well-known`.
+`login`, `consent`, `health`, `livez`, `revoke`, `jwks`, `interaction`,
+`session`, `userinfo`, `upstream`, `.well-known`.
 
 All stdio children share the hub's Unix user and can read its mounted files.
 Only install fully trusted stdio servers. A server with a different trust level
@@ -230,6 +238,13 @@ USER node
 
 ### Environment
 
+Without a non-empty `PASSWORD` or a bcrypt `PASSWORD_HASH` the HTTP hub still
+starts, but its login is disabled: the startup log says so, the sign-in page
+answers `503` with the reason, and no client can be approved — so no token can
+be issued. A configured hash takes precedence, and a hash that is not a bcrypt
+hash disables the login the same way rather than falling back to `PASSWORD`.
+The local `--stdio` mode uses neither variable.
+
 | Variable                        | Required            | Description                                                                                                                   |
 | ------------------------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
 | `EXTERNAL_URL`                  | yes                 | Public base URL, e.g. `https://mcp.example.net` (no path)                                                                     |
@@ -417,7 +432,7 @@ immediately. Per-client recipes:
 | `/hub`                                                               | Bearer                     | aggregate endpoint with the 6 meta-tools                          |
 | `/livez`                                                             | none                       | minimal process liveness (`200`)                                  |
 | `/health`                                                            | Bearer                     | per-server status (`200` all up / `503` degraded)                 |
-| `/authorize`, `/token`, `/register`, `/login`, `/consent`, `/revoke` | —                          | OAuth 2.1 · CIMD + DCR                                            |
+| `/authorize`, `/token`, `/register`, `/revoke`, `/interaction/<uid>/…` | —                          | OAuth 2.1 · CIMD + DCR; the login and consent pages live under `/interaction/` |
 | `/register/<client_id>`                                              | registration token         | RFC 7592: a client reads, changes or removes its own registration |
 | `/upstream/callback`                                                 | signed state + hub session | where an upstream returns after `upstream login`                  |
 | `/.well-known/mcp-hub-client/<id>.json`                              | none                       | the hub's own client metadata document, one per `cimd` upstream   |
@@ -441,7 +456,7 @@ immediately. Per-client recipes:
   rotate; replaying one that was already rotated away is treated as a leak and
   revokes the whole grant, access tokens included.
 - Upstream auth is fully decoupled from the hub's own OAuth: an expired
-  upstream token just marks that one server `down` (503 on its path, visible
+  upstream token just marks that one server `unauthorized` (503 on its path, visible
   in `/health`) — clients never see the upstream's 401.
 - One login can approve multiple connectors, but each token is valid only for
   its requested server or `/hub`. Registration remains open as the MCP

package/dist/admin.js

@@ -31,6 +31,10 @@ function usage() {
     ].join('\n'));
     process.exit(2);
 }
+function fail(message) {
+    console.error(message);
+    process.exit(2);
+}
 function flag(args, name) {
     const index = args.indexOf(`--${name}`);
     if (index === -1)
@@ -238,10 +242,6 @@ if (group === 'upstream') {
     // value the hub recorded at boot is normally the one that applies.
     const externalUrl = process.env.EXTERNAL_URL ?? store.getExternalUrl();
     const name = rest.find(argument => !argument.startsWith('--'));
-    const fail = message => {
-        console.error(message);
-        process.exit(2);
-    };
     if (action === 'list' || action === 'status') {
         try {
             console.log(JSON.stringify(upstreamStatus(store, config, action === 'status' ? name : undefined), null, 2));

package/dist/auth/address.js

@@ -79,7 +79,7 @@ export async function resolvePublicAddress(hostname, allowPrivate = false) {
         addresses = await dns.lookup(hostname, { all: true });
     }
     catch (error) {
-        throw new Error(`cannot resolve ${hostname}: ${error.message}`);
+        throw new Error(`cannot resolve ${hostname}: ${error.message}`, { cause: error });
     }
     if (addresses.some(entry => isPrivateAddress(entry.address))) {
         throw new Error(`${hostname} resolves to a private address`);

package/dist/auth/oidc/interactions.js

@@ -1,14 +1,20 @@
-import crypto from 'node:crypto';
-import bcrypt from 'bcryptjs';
 import express, { Router } from 'express';
 import { renderConsentPage } from '../consent-page.js';
 import { allowFormActionTo, authSecurityHeaders } from '../headers.js';
 import { renderLoginPage } from '../login-page.js';
 import { earlyRateLimit, LoginRateLimiter } from '../rate-limit.js';
+import { operatorCredential } from '../password.js';
 import { isLoopbackOnly } from '../redirect-uri.js';
-import { createSessionCookie, csrfToken, readSessionCookie, SESSION_COOKIE, SESSION_TTL_MS, verifyCsrfToken } from '../session.js';
+import { createSessionCookie, csrfToken, readSessionCookie, SESSION_TTL_MS, sessionCookieName, verifyCsrfToken } from '../session.js';
 import { logSafe } from '../text.js';
 import { HUB_ACCOUNT_ID } from './provider.js';
+/** Express 5 forwards a rejected handler promise on its own; this makes that explicit and typed. */
+const asyncHandler = (handler) => (req, res, next) => {
+    handler(req, res, next).catch(next);
+};
+function expired(res, status, message) {
+    res.status(status).type('html').send(`<p>${message}</p>`);
+}
 /**
  * The hub's own login and consent pages, driven by oidc-provider's interaction
  * loop instead of by HubOAuthProvider's hand-rolled one.
@@ -40,13 +46,11 @@ export function createOidcInteractionRoutes(options) {
     // the single page that has a redirect target to allow.
     router.use(authSecurityHeaders);
     const secure = new URL(options.externalUrl).protocol === 'https:';
-    const checkPassword = (password) => {
-        if (options.passwordHash)
-            return bcrypt.compareSync(password, options.passwordHash);
-        const expected = Buffer.from(options.password ?? '');
-        const given = Buffer.from(password);
-        return expected.length === given.length && crypto.timingSafeEqual(expected, given);
-    };
+    // Missing or unusable means nobody signs in — never that anybody does. The
+    // empty-buffer comparison this replaced let an empty form field through when
+    // no password was configured, which approved the client and minted tokens.
+    const credential = operatorCredential(options);
+    const disabledNotice = 'Sign-in is disabled: this hub has no usable operator password configured.';
     /** What the page may say about who is asking, and what it must not claim. */
     const identityOf = async (clientId, resource) => {
         const client = await provider.Client.find(clientId);
@@ -60,16 +64,13 @@ export function createOidcInteractionRoutes(options) {
             loopbackOnly: isLoopbackOnly(metadata?.redirect_uris)
         };
     };
-    const expired = (res, status, message) => {
-        res.status(status).type('html').send(`<p>${message}</p>`);
-    };
     // The two POSTs below carry a limiter and this GET did not, which is the
     // asymmetry CodeQL noticed and it was right. The page is unauthenticated by
     // construction — the uid is all a caller has — and rendering it costs a
     // provider store lookup, so a flood is cheap to send and not free to serve.
     // The same window as its siblings; a person opening a login page a hundred
     // times in fifteen minutes has a different problem.
-    router.get('/interaction/:uid', earlyRateLimit(15 * 60_000, 100, 500), async (req, res, next) => {
+    router.get('/interaction/:uid', earlyRateLimit(15 * 60_000, 100, 500), asyncHandler(async (req, res) => {
         try {
             const details = await provider.interactionDetails(req, res);
             const params = details.params;
@@ -77,10 +78,13 @@ export function createOidcInteractionRoutes(options) {
             const identity = await identityOf(String(params.client_id), params.resource);
             allowFormActionTo(res, redirectUri);
             if (details.prompt.name === 'login') {
-                res.status(200).type('html').send(renderLoginPage(details.uid, redirectUri, identity));
+                res
+                    .status(credential.enabled ? 200 : 503)
+                    .type('html')
+                    .send(renderLoginPage(details.uid, redirectUri, identity, credential.enabled ? undefined : disabledNotice));
                 return;
             }
-            const session = readSessionCookie(req.headers.cookie, store.cookieSecret);
+            const session = readSessionCookie(req.headers.cookie, store.cookieSecret, secure);
             if (!session) {
                 expired(res, 401, 'Session expired. Close this window and connect again.');
                 return;
@@ -94,10 +98,9 @@ export function createOidcInteractionRoutes(options) {
             // interactionDetails throws for an unknown or expired uid, which is not
             // an error worth a stack trace: the window was left open too long.
             expired(res, 400, 'Authorization request expired. Close this window and connect again.');
-            void next;
         }
-    });
-    router.post('/interaction/:uid/login', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), async (req, res) => {
+    }));
+    router.post('/interaction/:uid/login', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), asyncHandler(async (req, res) => {
         const ip = req.ip ?? 'unknown';
         const { password, request } = req.body;
         let details;
@@ -119,7 +122,15 @@ export function createOidcInteractionRoutes(options) {
         }
         const params = details.params;
         const redirectUri = String(params.redirect_uri ?? '');
-        if (typeof password !== 'string' || !checkPassword(password)) {
+        if (!credential.enabled) {
+            // Not a failed guess: there is nothing to guess. Counting it would let
+            // a misconfigured hub fill the fail2ban log with its own visitors.
+            const identity = await identityOf(String(params.client_id), params.resource);
+            allowFormActionTo(res, redirectUri);
+            res.status(503).type('html').send(renderLoginPage(details.uid, redirectUri, identity, disabledNotice));
+            return;
+        }
+        if (typeof password !== 'string' || !credential.check(password)) {
             rateLimiter.recordFailure(ip);
             console.warn(`mcp-hub: authentication failure from ${logSafe(ip)}`);
             const identity = await identityOf(String(params.client_id), params.resource);
@@ -135,7 +146,11 @@ export function createOidcInteractionRoutes(options) {
         const clientName = client?.metadata()?.client_name;
         store.saveApproval(clientId, redirectUri, typeof clientName === 'string' ? clientName : undefined);
         console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(redirectUri)}`);
-        res.cookie(SESSION_COOKIE, createSessionCookie(store.cookieSecret), {
+        // `__Host-` behind HTTPS: the browser then refuses the cookie from any
+        // other origin, path or domain, so nobody can fix a session into this
+        // browser from a sibling host. No `domain`, and `path: '/'`, are what the
+        // prefix requires.
+        res.cookie(sessionCookieName(secure), createSessionCookie(store.cookieSecret), {
             httpOnly: true,
             secure,
             sameSite: 'lax',
@@ -143,8 +158,8 @@ export function createOidcInteractionRoutes(options) {
             path: '/'
         });
         await provider.interactionFinished(req, res, { login: { accountId: HUB_ACCOUNT_ID } }, { mergeWithLastSubmission: false });
-    });
-    router.post('/interaction/:uid/consent', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), async (req, res) => {
+    }));
+    router.post('/interaction/:uid/consent', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), asyncHandler(async (req, res) => {
         const { request, csrf, action } = req.body;
         let details;
         try {
@@ -158,7 +173,7 @@ export function createOidcInteractionRoutes(options) {
             expired(res, 400, 'Authorization request expired. Close this window and connect again.');
             return;
         }
-        const session = readSessionCookie(req.headers.cookie, store.cookieSecret);
+        const session = readSessionCookie(req.headers.cookie, store.cookieSecret, secure);
         if (!session) {
             expired(res, 401, 'Session expired. Close this window and connect again.');
             return;
@@ -181,7 +196,7 @@ export function createOidcInteractionRoutes(options) {
         // The grant itself is minted by loadExistingGrant on the resumed request,
         // which is the same code path an already-approved client takes.
         await provider.interactionFinished(req, res, { consent: {} }, { mergeWithLastSubmission: true });
-    });
+    }));
     return router;
 }
 //# sourceMappingURL=interactions.js.map

package/dist/auth/oidc/provider.js

@@ -157,6 +157,18 @@ export function buildOidcProvider(store, options) {
          * and an authentication mechanism nobody uses is only an attack surface.
          */
         clientAuthMethods: ['client_secret_post', 'none', 'private_key_jwt'],
+        /**
+         * PKCE for every client, not only the public ones.
+         *
+         * oidc-provider's default requires it when `token_endpoint_auth_method`
+         * is `none` and lets a confidential client skip it. OAuth 2.1 and the MCP
+         * authorization specification require it of all clients, the discovery
+         * document and docs/reference/standards.md have said "S256 required"
+         * since the first release — and a confidential client's secret proves who
+         * redeems a code, not that the redeemer is the one who asked for it. The
+         * challenge is what binds the two halves of the flow.
+         */
+        pkce: { required: () => true },
         // The set the hub advertised before. oidc-provider's default is narrower
         // (one algorithm per family), which would refuse a private_key_jwt client
         // that signs with RS384 -- something the old document promised to accept.

package/dist/auth/password.js

@@ -0,0 +1,50 @@
+import crypto from 'node:crypto';
+import bcrypt from 'bcryptjs';
+/**
+ * The one operator credential the HTTP hub has, and what to do when it is
+ * missing or unusable.
+ *
+ * The answer is "nobody can sign in", not "refuse to start". Both keep every
+ * token out of reach — approving a client is the only way to one, and approval
+ * needs the password — so the security outcome is the same. What differs is
+ * what an operator, an inspector or a health check sees: a container that
+ * boots, serves `/livez` and the discovery documents, and says loudly in its
+ * log and on its login page why nobody can get further, rather than a process
+ * that exits before it has said anything. Directory crawlers that start the
+ * image without a password to see what it offers (Glama does) fall in the
+ * same category as a health check: they need the process, not the login.
+ *
+ * `PASSWORD_HASH` wins over `PASSWORD` when both are set, and a hash that is
+ * not a bcrypt hash disables the login rather than falling back to the
+ * plain-text sibling: a hash was configured on purpose, and silently using the
+ * weaker variable instead would be a surprise in the wrong direction.
+ */
+/** `$2a$`, `$2b$` or `$2y$`, a cost of 04–31, then 53 characters of salt+digest. */
+const BCRYPT_HASH = /^\$2[aby]\$(?:0[4-9]|[12]\d|3[01])\$[./A-Za-z0-9]{53}$/;
+export function operatorCredential(options) {
+    const hash = options.passwordHash?.trim();
+    if (hash) {
+        if (!BCRYPT_HASH.test(hash)) {
+            return disabled(`PASSWORD_HASH is not a bcrypt hash (expected $2a$, $2b$ or $2y$, a cost and 53 characters, ${hash.length} characters given) — the operator login is disabled, no client can be approved`);
+        }
+        return { enabled: true, check: password => bcrypt.compareSync(password, hash) };
+    }
+    // Trimmed for the test only: a value of whitespace is an unset variable that
+    // somebody quoted, not a password. The comparison itself is on the raw value.
+    const password = options.password ?? '';
+    if (password.trim().length === 0) {
+        return disabled('neither PASSWORD_HASH nor PASSWORD is set — the operator login is disabled, no client can be approved');
+    }
+    const expected = Buffer.from(password);
+    return {
+        enabled: true,
+        check: given => {
+            const buffer = Buffer.from(given);
+            return buffer.length === expected.length && crypto.timingSafeEqual(buffer, expected);
+        }
+    };
+}
+function disabled(problem) {
+    return { enabled: false, problem, check: () => false };
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/pinned-fetch.js

@@ -28,6 +28,36 @@ export function pinnedLookup(address) {
             done(null, address, family);
     });
 }
+/** Apply the same byte ceiling to native fetch, including decoded/compressed
+ * bodies and error responses. Literal IPs and private upstreams use this path. */
+export async function boundedResponse(response, maxBytes) {
+    const reader = response.body?.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        if (Number(response.headers.get('content-length')) > maxBytes) {
+            throw new Error(`response exceeds ${maxBytes} bytes`);
+        }
+        if (!reader)
+            return response;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > maxBytes)
+                throw new Error(`response exceeds ${maxBytes} bytes`);
+            chunks.push(value);
+        }
+        const headers = new Headers(response.headers);
+        headers.delete('content-encoding');
+        headers.delete('content-length');
+        return new Response(Buffer.concat(chunks), { status: response.status, statusText: response.statusText, headers });
+    }
+    finally {
+        await reader?.cancel().catch(() => { });
+    }
+}
 export async function guardedRequest(url, options) {
     // Only https reaches this in production — the caller rejects anything else
     // before resolving. Plain http is here so the transport can be exercised

package/dist/auth/registration.js

@@ -40,9 +40,6 @@ export function createRegistrationManagementRoutes(options) {
     // can register; these routes sit in front of it and need their own. Opening
     // them is safe: the credential is a bearer token in a header, never a cookie,
     // so no browser attaches it to a cross-site request on its own.
-    const allowCrossOrigin = (res) => {
-        res.set('Access-Control-Allow-Origin', '*');
-    };
     router.options(path, limit, (_req, res) => {
         allowCrossOrigin(res);
         res.set({
@@ -137,10 +134,13 @@ export function createRegistrationManagementRoutes(options) {
     });
     return router;
 }
+function allowCrossOrigin(res) {
+    res.set('Access-Control-Allow-Origin', '*');
+}
 /** Order is not part of the meaning of a redirect URI list. */
 function sameUris(before, after) {
-    const a = [...(before ?? [])].sort();
-    const b = [...(after ?? [])].sort();
+    const a = (before ?? []).toSorted();
+    const b = (after ?? []).toSorted();
     return a.length === b.length && a.every((uri, index) => uri === b[index]);
 }
 //# sourceMappingURL=registration.js.map