@ni-c/mcp-hub 0.11.1 → 0.11.3

package/dist/supervisor.js

@@ -6,12 +6,14 @@ import { MAX_TOOL_LIST_PAGES, MAX_TOOLS, MAX_TOOL_METADATA_BYTES, jsonSize } fro
 import { BACKOFF_INITIAL_MS, BACKOFF_MAX_MS, BACKOFF_RESET_AFTER_MS, IDLE_SWEEP_INTERVAL_MS, MAX_UNUSED_RESTARTS, PING_INTERVAL_MS, PING_TIMEOUT_MS, WAKE_TIMEOUT_MS } from './timings.js';
 import { SocketTransport } from './transports/socket.js';
 import { DockerTransport } from './transports/docker.js';
+import { setTransportHandlers } from './transports/stream.js';
 import { DockerClient, parseSandboxDockerHost } from './sandbox/docker-client.js';
 import { UpstreamAuth, UpstreamLoginRequiredError } from './upstream/auth.js';
-import { credentialFingerprint } from './upstream/provider.js';
+import { boundedRedirectFetch } from './upstream/redirects.js';
 import { ToolCache } from './tool-cache.js';
 import { filterTools, hasToolFilter, unmatchedPatterns } from './tool-filter.js';
 import { subscriptionsAllowed } from './subscriptions.js';
+import { logSafe } from './auth/text.js';
 /**
  * Whether a failure is one a restart could fix.
  *
@@ -43,6 +45,10 @@ function eraHasPing(client) {
 /**
  * Remote upstreams get their configured headers on EVERY request via a fetch
  * wrapper — requestInit alone does not cover the SSE stream GET.
+ *
+ * Both wrappers follow a redirect only within the configured origin, and at
+ * most three: the platform would otherwise follow a `Location` anywhere,
+ * headers and body included. See `boundedRedirectFetch`.
  */
 function buildRemoteTransport(config, auth) {
     const url = new URL(config.url);
@@ -58,14 +64,15 @@ function buildRemoteTransport(config, auth) {
             ? new SSEClientTransport(url, { authProvider: auth.provider(), fetch: guarded })
             : new StreamableHTTPClientTransport(url, { authProvider: auth.provider(), fetch: guarded });
     }
-    const fetchWithHeaders = (input, init) => {
+    // The headers go on inside the redirect wrapper, so every hop carries them.
+    const fetchWithHeaders = boundedRedirectFetch(url.origin, (input, init) => {
         const merged = new Headers(init?.headers);
         for (const [key, value] of Object.entries(headers)) {
             if (!merged.has(key))
                 merged.set(key, value);
         }
         return fetch(input, { ...init, headers: merged });
-    };
+    });
     if (config.transport === 'sse') {
         return new SSEClientTransport(url, { requestInit: { headers }, fetch: fetchWithHeaders });
     }
@@ -87,13 +94,15 @@ export function setDockerClient(client) {
 function sameFilter(a, b) {
     if (!a)
         return false;
-    // JSON rather than a joined string: with a plain separator, ['a b'] and
-    // ['a', 'b'] compare equal, and the hub would skip a reconcile it owed.
-    const uris = (filter) => JSON.stringify([...(filter.resourceSubscriptions ?? [])].sort());
     return ((a.toolsListChanged ?? false) === (b.toolsListChanged ?? false) &&
         (a.promptsListChanged ?? false) === (b.promptsListChanged ?? false) &&
         (a.resourcesListChanged ?? false) === (b.resourcesListChanged ?? false) &&
-        uris(a) === uris(b));
+        subscriptionUris(a) === subscriptionUris(b));
+}
+/** JSON rather than a joined string: with a plain separator, ['a b'] and
+ *  ['a', 'b'] compare equal, and the hub would skip a reconcile it owed. */
+function subscriptionUris(filter) {
+    return JSON.stringify((filter.resourceSubscriptions ?? []).toSorted());
 }
 /** Whether a filter asks for nothing at all, in which case nothing is held upstream. */
 function emptyFilter(filter) {
@@ -187,6 +196,8 @@ export class ManagedServer {
      * kill the new child.
      */
     generation = 0;
+    /** True while client.connect() is in flight; see start(). */
+    connecting = false;
     /** The one upstream listen stream carrying this route's whole demand (modern era). */
     upstream;
     upstreamFilter;
@@ -349,14 +360,25 @@ export class ManagedServer {
             // question on, not answer it.
             inputRequired: { autoFulfill: false }
         });
-        transport.onclose = () => this.onExit(this.exitReason(), generation);
+        setTransportHandlers(transport, { onclose: () => this.onExit(this.exitReason(), generation) });
+        // While the opening exchange runs, a close of the transport is not
+        // reported by onclose: the SDK closes the transport *before* connect()
+        // rejects, so the generic "connection closed" used to win the race and the
+        // rejection — which names the cause, and may carry a verdict no restart
+        // can fix — was thrown away by onExit's state guard. A refused redirect,
+        // a TLS failure or an unauthorized upstream all read as "connection
+        // closed" in the log. connect() always rejects once its transport is
+        // gone, so the catch below is the one place that reports this exit.
+        this.connecting = true;
         try {
             await client.connect(transport);
         }
         catch (error) {
+            this.connecting = false;
             this.onExit(`failed to start: ${error.message}`, generation, classifyAuthFailure(error));
             return;
         }
+        this.connecting = false;
         if (generation !== this.generation) {
             // sleep()/stop() ran while we were connecting; it already set the final
             // state, so this child is surplus and only needs to go away again.
@@ -371,7 +393,9 @@ export class ManagedServer {
         // The start itself opens a full idle window, so a pre-warmed server is not
         // swept away just before the tool call it was warmed for.
         this.lastUsedAt = this.startedAt;
-        console.log(`[${this.name}] up (${this.serverInfo?.name ?? 'unknown'} ${this.serverInfo?.version ?? ''})`.trim());
+        // The child's declared identity, on its way into a file LOG_FILE mirrors
+        // and fail2ban reads: escaped and bounded like any other stranger's text.
+        console.log(`[${this.name}] up (${logSafe(this.serverInfo?.name ?? 'unknown', 100)} ${logSafe(this.serverInfo?.version ?? '', 40)})`.trim());
         this.resolveWakeWaiters();
         if (this.capabilities?.tools) {
             client.setNotificationHandler('notifications/tools/list_changed', () => {
@@ -444,7 +468,7 @@ export class ManagedServer {
         }
         this.reconciling = true;
         void this.runReconcile()
-            .catch(error => console.error(`[${this.name}] could not update subscriptions: ${error.message}`))
+            .catch(error => console.error(`[${this.name}] could not update subscriptions: ${logSafe(error.message, 500)}`))
             .finally(() => {
             this.reconciling = false;
             if (!this.reconcileQueued)
@@ -563,7 +587,7 @@ export class ManagedServer {
             this.options.persist?.(this);
         }
         catch (error) {
-            console.error(`[${this.name}] failed to list tools: ${error.message}`);
+            console.error(`[${this.name}] failed to list tools: ${logSafe(error.message, 500)}`);
         }
     }
     async checkAlive() {
@@ -599,7 +623,7 @@ export class ManagedServer {
             await client.ping({ timeout: PING_TIMEOUT_MS });
         }
         catch (error) {
-            console.error(`[${this.name}] ping failed, restarting: ${error.message}`);
+            console.error(`[${this.name}] ping failed, restarting: ${logSafe(error.message, 500)}`);
             // close() triggers transport.onclose -> onExit -> restart with backoff.
             // Already-closed transports reject here; onExit has then run regardless.
             await client.close().catch(() => { });
@@ -610,6 +634,10 @@ export class ManagedServer {
         // left behind must not touch the current child.
         if (generation !== this.generation)
             return;
+        // A close during the opening exchange is reported by start()'s catch, with
+        // the reason connect() gives — see the note there.
+        if (this.connecting && reason === this.exitReason())
+            return;
         // A failed start reports twice: transport.onclose fires and start()'s catch
         // calls us as well. Without this guard the second call would overwrite
         // restartTimer without clearing it, so two children would be spawned and
@@ -629,7 +657,7 @@ export class ManagedServer {
             this.state = 'unauthorized';
             this.lastError = reason;
             this.rejectWakeWaiters(new Error(`Server "${this.name}" needs an upstream login`));
-            console.error(`[${this.name}] unauthorized (${reason}); run: mcp-hub-admin upstream login ${this.name}`);
+            console.error(`[${this.name}] unauthorized (${logSafe(reason, 500)}); run: mcp-hub-admin upstream login ${this.name}`);
             return;
         }
         this.state = 'down';
@@ -641,12 +669,12 @@ export class ManagedServer {
         if (this.onDemand && this.restartsSinceUse > (this.options.maxUnusedRestarts ?? MAX_UNUSED_RESTARTS)) {
             // A crash-looping server nobody asks for would occupy the machine
             // forever. Give up until the next wake, which starts fresh.
-            console.error(`[${this.name}] down (${reason}), giving up until next use after ${this.restartsSinceUse - 1} failed restarts`);
+            console.error(`[${this.name}] down (${logSafe(reason, 500)}), giving up until next use after ${this.restartsSinceUse - 1} failed restarts`);
             this.state = 'sleeping';
             this.rejectWakeWaiters(new Error(`Server "${this.name}" failed to start: ${reason}`));
             return;
         }
-        console.error(`[${this.name}] down (${reason}), restarting in ${Math.round(this.backoffMs / 1000)}s`);
+        console.error(`[${this.name}] down (${logSafe(reason, 500)}), restarting in ${Math.round(this.backoffMs / 1000)}s`);
         this.restartTimer = setTimeout(() => {
             this.restarts++;
             void this.start();
@@ -733,7 +761,10 @@ export class UpstreamAuthRegistry {
         if (!config.oauth)
             return undefined;
         const auth = new UpstreamAuth(name, config, this.store, this.externalUrl);
-        const fingerprint = credentialFingerprint(auth.identity);
+        // Manager identity includes live headers and authentication settings. The
+        // persisted credential fingerprint intentionally survives secret rotation;
+        // it must not keep the old in-memory configuration alive as well.
+        const fingerprint = JSON.stringify(config);
         const existing = this.managers.get(name);
         if (existing?.fingerprint === fingerprint)
             return existing.auth;
@@ -899,7 +930,7 @@ export class Supervisor {
                 if (!managed || managed.state !== 'sleeping')
                     continue;
             }
-            console.log(`mcp-hub: removing orphaned sandbox container ${container.name}`);
+            console.log(`mcp-hub: removing orphaned sandbox container ${logSafe(container.name)}`);
             await dockerClient().removeContainer(container.name);
         }
     }

package/dist/transports/docker.js

@@ -1,5 +1,5 @@
 import { buildCreateRequest, containerName } from '../sandbox/container-spec.js';
-import { StreamTransport } from './stream.js';
+import { StreamTransport, setTransportHandlers } from './stream.js';
 /** Guards against a corrupt header turning into a multi-gigabyte allocation. */
 const MAX_FRAME_BYTES = 16 * 1024 * 1024;
 const STDOUT = 1;
@@ -15,7 +15,16 @@ const STDERR = 2;
 export class DockerFrameDecoder {
     onFrame;
     onError;
-    buffer = Buffer.alloc(0);
+    /**
+     * The bytes of the frame in progress, as the chunks they arrived in, joined
+     * once the whole frame is here. One growing buffer would copy itself on every
+     * chunk — quadratic in the frame size, on the hub's event loop, for a size
+     * the peer chooses.
+     */
+    pending = [];
+    pendingBytes = 0;
+    /** The header of the frame in progress, once eight bytes have arrived. */
+    header;
     failed = false;
     constructor(onFrame, onError) {
         this.onFrame = onFrame;
@@ -24,25 +33,44 @@ export class DockerFrameDecoder {
     push(chunk) {
         if (this.failed)
             return;
-        this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+        if (chunk.length === 0)
+            return;
+        this.pending.push(chunk);
+        this.pendingBytes += chunk.length;
         for (;;) {
-            if (this.buffer.length < 8)
-                return;
-            const size = this.buffer.readUInt32BE(4);
-            if (size > MAX_FRAME_BYTES) {
-                this.failed = true;
-                this.onError(new Error(`docker frame of ${size} bytes exceeds the ${MAX_FRAME_BYTES} byte limit`));
-                this.buffer = Buffer.alloc(0);
-                return;
+            if (this.header === undefined) {
+                if (this.pendingBytes < 8)
+                    return;
+                // Joining here is cheap: the pending pieces hold at most a header's
+                // worth of bytes plus whatever one chunk brought with it.
+                const joined = this.join();
+                const size = joined.readUInt32BE(4);
+                if (size > MAX_FRAME_BYTES) {
+                    this.failed = true;
+                    this.onError(new Error(`docker frame of ${size} bytes exceeds the ${MAX_FRAME_BYTES} byte limit`));
+                    this.pending = [];
+                    this.pendingBytes = 0;
+                    return;
+                }
+                this.header = { stream: joined[0], size };
+                this.replace(joined.subarray(8));
             }
-            if (this.buffer.length < 8 + size)
+            if (this.pendingBytes < this.header.size)
                 return;
-            const stream = this.buffer[0];
-            const payload = this.buffer.subarray(8, 8 + size);
-            this.buffer = this.buffer.subarray(8 + size);
-            this.onFrame(stream, payload);
+            const joined = this.join();
+            const { stream, size } = this.header;
+            this.header = undefined;
+            this.replace(joined.subarray(size));
+            this.onFrame(stream, joined.subarray(0, size));
         }
     }
+    join() {
+        return this.pending.length === 1 ? this.pending[0] : Buffer.concat(this.pending);
+    }
+    replace(rest) {
+        this.pending = rest.length > 0 ? [rest] : [];
+        this.pendingBytes = rest.length;
+    }
 }
 /**
  * An MCP server running in its own container, spoken to over the Docker API.
@@ -92,14 +120,16 @@ export class DockerTransport {
         }
         this.stream = stream;
         const inner = new StreamTransport(stream, false);
-        inner.onmessage = message => this.onmessage?.(message);
-        inner.onerror = error => this.onerror?.(error);
-        inner.onclose = () => {
-            this.onclose?.();
-            // Best effort: with AutoRemove the daemon usually got there first.
-            if (!this.closing)
-                void this.client.removeContainer(name).catch(() => { });
-        };
+        setTransportHandlers(inner, {
+            onmessage: message => this.onmessage?.(message),
+            onerror: error => this.onerror?.(error),
+            onclose: () => {
+                this.onclose?.();
+                // Best effort: with AutoRemove the daemon usually got there first.
+                if (!this.closing)
+                    void this.client.removeContainer(name).catch(() => { });
+            }
+        });
         await inner.start();
         this.inner = inner;
         const decoder = new DockerFrameDecoder((streamType, payload) => {

package/dist/transports/stream.js

@@ -18,7 +18,17 @@ export class StreamTransport {
     onclose;
     onerror;
     onmessage;
-    buffer = Buffer.alloc(0);
+    /**
+     * Bytes received since the last newline, as the chunks they arrived in.
+     *
+     * A list rather than one growing buffer: appending a chunk to a buffer copies
+     * the whole buffer, so a peer that sends a long line in small pieces makes
+     * the hub copy quadratically — ten megabytes in 4 KiB chunks cost a second
+     * of the event loop, on every restart the peer cared to provoke. The pieces
+     * are joined once, when a newline arrives, which is linear.
+     */
+    pending = [];
+    pendingBytes = 0;
     started = false;
     closed = false;
     reportedClose = false;
@@ -55,25 +65,40 @@ export class StreamTransport {
      * own codec still does the parsing; only the policy is local.
      */
     receive(chunk) {
-        if (this.buffer.length + chunk.length > STDIO_DEFAULT_MAX_BUFFER_SIZE) {
+        if (this.pendingBytes + chunk.length > STDIO_DEFAULT_MAX_BUFFER_SIZE) {
             // A peer that keeps sending without ever writing a newline. This runs
             // inside a 'data' handler, so a throw here would reach
             // process.on('uncaughtException') and take the entire hub down — every
             // other server with it — because one sandboxed server misbehaved. The
             // stream is desynchronised anyway: report it, end this connection, let
             // the supervisor restart it.
-            this.buffer = Buffer.alloc(0);
+            this.pending = [];
+            this.pendingBytes = 0;
             this.onerror?.(new Error(`ReadBuffer exceeded maximum size of ${STDIO_DEFAULT_MAX_BUFFER_SIZE} bytes`));
             void this.close();
             return;
         }
-        this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+        // Only the new chunk can hold the newline that completes a line; the
+        // pending pieces were already searched when they arrived.
+        if (chunk.indexOf('\n') === -1) {
+            this.pending.push(chunk);
+            this.pendingBytes += chunk.length;
+            return;
+        }
+        let buffer = this.pending.length === 0 ? chunk : Buffer.concat([...this.pending, chunk]);
+        this.pending = [];
+        this.pendingBytes = 0;
         for (;;) {
-            const newline = this.buffer.indexOf('\n');
-            if (newline === -1)
+            const newline = buffer.indexOf('\n');
+            if (newline === -1) {
+                if (buffer.length > 0) {
+                    this.pending.push(buffer);
+                    this.pendingBytes = buffer.length;
+                }
                 return;
-            const line = this.buffer.toString('utf8', 0, newline).replace(/\r$/, '');
-            this.buffer = this.buffer.subarray(newline + 1);
+            }
+            const line = buffer.toString('utf8', 0, newline).replace(/\r$/, '');
+            buffer = buffer.subarray(newline + 1);
             let message;
             try {
                 message = deserializeMessage(line);
@@ -108,8 +133,19 @@ export class StreamTransport {
             return;
         this.reportedClose = true;
         this.closed = true;
-        this.buffer = Buffer.alloc(0);
+        this.pending = [];
+        this.pendingBytes = 0;
         this.onclose?.();
     }
 }
+/**
+ * Installs callbacks on a transport. The MCP Transport contract has no
+ * listener API: `onmessage`, `onerror` and `onclose` are properties holding
+ * one handler each, and the SDK's own Protocol class sets them exactly this
+ * way. Keeping that assignment in one place says so once instead of at every
+ * call site.
+ */
+export function setTransportHandlers(transport, handlers) {
+    Object.assign(transport, handlers);
+}
 //# sourceMappingURL=stream.js.map

package/dist/upstream/auth.js

@@ -1,8 +1,11 @@
 import { discoverOAuthServerInfo, exchangeAuthorization, refreshAuthorization, startAuthorization } from '@modelcontextprotocol/client';
+import dns from 'node:dns/promises';
+import net from 'node:net';
 import { isPrivateAddress, resolvePublicAddress } from '../auth/address.js';
-import { guardedRequest } from '../auth/pinned-fetch.js';
+import { boundedResponse, guardedRequest } from '../auth/pinned-fetch.js';
 import { logSafe } from '../auth/text.js';
 import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata } from './provider.js';
+import { boundedRedirectFetch } from './redirects.js';
 /**
  * Everything the hub needs to authenticate itself to one upstream MCP server.
  *
@@ -81,12 +84,13 @@ export class UpstreamAuth {
     async privateAllowed() {
         if (this.allowPrivate === undefined) {
             const hostname = new URL(this.identity.serverUrl).hostname.replace(/^\[|\]$/g, '');
-            try {
-                this.allowPrivate = isPrivateAddress(hostname) || (await resolvePublicAddress(hostname).then(() => false, () => true));
-            }
-            catch {
-                this.allowPrivate = true;
-            }
+            // isPrivateAddress accepts numeric addresses only and rejects everything
+            // else. Passing a DNS name to it used to enable private access for every
+            // named upstream. Failed or mixed DNS answers must not relax the policy.
+            const addresses = net.isIP(hostname) ? [{ address: hostname }] : await dns.lookup(hostname, { all: true });
+            if (addresses.length === 0)
+                throw new Error('upstream hostname resolved to no addresses');
+            this.allowPrivate = addresses.every(entry => isPrivateAddress(entry.address));
         }
         return this.allowPrivate;
     }
@@ -95,9 +99,13 @@ export class UpstreamAuth {
     async asFetch(input, init) {
         const url = new URL(input instanceof Request ? input.url : String(input));
         const allowPrivate = await this.privateAllowed();
+        if (url.username || url.password || (url.protocol !== 'https:' && !(allowPrivate && url.protocol === 'http:'))) {
+            throw new Error('upstream OAuth endpoints must use HTTPS (HTTP is allowed only for private upstreams) without URL credentials');
+        }
         const pinned = await resolvePublicAddress(url.hostname, allowPrivate);
         if (!pinned) {
-            return fetch(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(AS_TIMEOUT_MS) });
+            const response = await fetch(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(AS_TIMEOUT_MS) });
+            return boundedResponse(response, AS_MAX_BYTES);
         }
         return guardedRequest(url, {
             pinnedAddress: pinned,
@@ -373,6 +381,9 @@ export class UpstreamAuth {
      */
     createFetch() {
         const upstreamOrigin = new URL(this.identity.serverUrl).origin;
+        // Data-plane redirects stay within the upstream's origin, three at most;
+        // the control plane refuses them outright in asFetch.
+        const dataPlane = boundedRedirectFetch(upstreamOrigin);
         return async (input, init) => {
             const url = new URL(input instanceof Request ? input.url : String(input));
             const isControlPlane = url.origin !== upstreamOrigin || url.pathname.startsWith('/.well-known/');
@@ -387,7 +398,7 @@ export class UpstreamAuth {
                     if (!headers.has(key))
                         headers.set(key, value);
                 }
-                return { response: await fetch(url, { ...init, headers }), token };
+                return { response: await dataPlane(url, { ...init, headers }), token };
             };
             const first = await send();
             if (first.response.status !== 401)

package/dist/upstream/provider.js

@@ -33,7 +33,7 @@ export function credentialFingerprint(identity) {
     const { oauth } = identity;
     return crypto
         .createHash('sha256')
-        .update(JSON.stringify([identity.serverUrl, oauth.mode, oauth.grant, oauth.clientId ?? null, [...oauth.scopes].sort()]))
+        .update(JSON.stringify([identity.serverUrl, oauth.mode, oauth.grant, oauth.clientId ?? null, oauth.scopes.toSorted()]))
         .digest('hex');
 }
 export function callbackUrl(externalUrl) {

package/dist/upstream/redirects.js

@@ -0,0 +1,86 @@
+import { logSafe } from '../auth/text.js';
+/**
+ * Redirects on the data plane of a remote upstream, followed only within the
+ * origin the operator configured.
+ *
+ * `fetch` follows a 3xx by default, and neither the SDK's transports nor the
+ * hub's own wrappers said otherwise — so a remote MCP server could answer a
+ * `tools/call`, the SSE stream or a `subscriptions/listen` with a `Location`
+ * pointing at an internal address, and the hub would connect there, send the
+ * JSON-RPC body and every configured header except `Authorization` and
+ * `Cookie` (the two the platform strips across origins), and parse whatever
+ * came back as MCP. The control plane — discovery, token, registration — has
+ * refused redirects since the guard for the authorization server was written;
+ * this closes the same door on the other side.
+ *
+ * Same origin is the line, not same host: a different port on the same name
+ * is a different service, and a plain-http twin of an https upstream is not
+ * the upstream. Within that line a hop is followed because servers really do
+ * redirect `/mcp` to `/mcp/`, and refusing it would break upstreams that were
+ * never a problem.
+ */
+export const MAX_REDIRECT_HOPS = 3;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/**
+ * Wraps a fetch so that every redirect it would follow is checked first.
+ *
+ * `origin` is the configured upstream's origin (`new URL(config.url).origin`).
+ * The returned function has the platform's shape and can be handed to the SDK
+ * transports as their `fetch`; every hop goes through `fetchImpl`, so a wrapper
+ * that adds headers still adds them on each hop.
+ */
+export function boundedRedirectFetch(origin, fetchImpl = fetch) {
+    return async (input, init) => {
+        let url = new URL(input instanceof Request ? input.url : String(input));
+        let request = { ...init, redirect: 'manual' };
+        for (let hop = 0;; hop++) {
+            // A caller that built a Request keeps it on the first hop — its body
+            // lives there. Nothing in the hub does, but the shape is the platform's.
+            const response = await fetchImpl(hop === 0 && input instanceof Request ? new Request(input, request) : url, request);
+            if (!REDIRECT_STATUSES.has(response.status))
+                return response;
+            const location = response.headers.get('location');
+            if (location === null)
+                return response;
+            // Nothing of the redirect's body is wanted, and holding the stream open
+            // would keep the connection with it.
+            await response.body?.cancel().catch(() => { });
+            let next;
+            try {
+                next = new URL(location, url);
+            }
+            catch {
+                throw new Error(`upstream at ${logSafe(url.origin)} redirected to an unparseable location`);
+            }
+            if (next.origin !== origin) {
+                throw new Error(`upstream at ${logSafe(url.origin)} redirected to ${logSafe(next.origin)} — refused, redirects are followed only within the configured origin`);
+            }
+            if (hop + 1 >= MAX_REDIRECT_HOPS) {
+                throw new Error(`upstream at ${logSafe(url.origin)} redirected more than ${MAX_REDIRECT_HOPS} times`);
+            }
+            // A fragment on the request URL survives a redirect that has none.
+            if (!next.hash && url.hash)
+                next.hash = url.hash;
+            url = next;
+            request = nextRequest(request, response.status);
+        }
+    };
+}
+/**
+ * What the platform would do to the method and body on this hop (Fetch
+ * standard, "HTTP-redirect fetch"): a 303 always becomes a GET, a 301 or 302
+ * turns a POST into a GET, and a 307 or 308 keeps both. The body is dropped
+ * whenever the method changes, with the headers that only described it.
+ */
+function nextRequest(request, status) {
+    const method = (request.method ?? 'GET').toUpperCase();
+    const becomesGet = status === 303 ? method !== 'GET' && method !== 'HEAD' : (status === 301 || status === 302) && method === 'POST';
+    if (!becomesGet)
+        return request;
+    const headers = new Headers(request.headers);
+    for (const name of ['content-encoding', 'content-language', 'content-location', 'content-type', 'content-length']) {
+        headers.delete(name);
+    }
+    return { ...request, method: 'GET', body: undefined, headers };
+}
+//# sourceMappingURL=redirects.js.map

package/dist/upstream/routes.js

@@ -2,6 +2,7 @@ import { Router } from 'express';
 import { readSignedPayload } from '../auth/signed-token.js';
 import { renderPage, escapeHtml } from '../auth/page.js';
 import { logSafe } from '../auth/text.js';
+import { earlyRateLimit } from '../auth/rate-limit.js';
 import { readSessionCookie } from '../auth/session.js';
 import { UPSTREAM_CALLBACK_PATH, UPSTREAM_CLIENT_METADATA_PREFIX, UpstreamAuthProvider, clientDocumentId, clientMetadataUrl, hubClientMetadata } from './provider.js';
 const page = (res, status, title, body) => {
@@ -10,6 +11,7 @@ const page = (res, status, title, body) => {
 export function createUpstreamRoutes(options) {
     const { store, registry, supervisor, watcher, externalUrl } = options;
     const router = Router();
+    const secure = new URL(externalUrl).protocol === 'https:';
     /**
      * One document per upstream, addressed by a derived identifier.
      *
@@ -17,28 +19,29 @@ export function createUpstreamRoutes(options) {
      * hot-reloadable, so a server can become `cimd` long after boot, and an
      * Express route cannot be added later.
      */
-    router.get(`/${UPSTREAM_CLIENT_METADATA_PREFIX}/:id.json`, (req, res) => {
-        void (async () => {
-            const wanted = String(req.params.id);
-            for (const [name, server] of watcher.current) {
-                if (server.kind !== 'remote' || server.oauth?.mode !== 'cimd')
-                    continue;
-                if (clientDocumentId(name, store.cookieSecret) !== wanted)
-                    continue;
-                const identity = { serverName: name, serverUrl: server.url, oauth: server.oauth, externalUrl };
-                const provider = new UpstreamAuthProvider(identity, store);
-                // The document must name itself byte-for-byte or the upstream refuses it.
-                res.json({
-                    client_id: clientMetadataUrl(externalUrl, name, store.cookieSecret),
-                    ...hubClientMetadata(identity, server.oauth.clientAuth === 'private_key_jwt' ? await provider.publicJwk() : undefined)
-                });
-                return;
-            }
-            res.status(404).json({ error: 'not_found', error_description: 'No upstream publishes a document here' });
-        })();
+    // Unauthenticated, and each hit derives one HMAC per configured upstream and
+    // may export a public key: cheap, but not free, and nothing legitimate asks
+    // for it more than once per login.
+    router.get(`/${UPSTREAM_CLIENT_METADATA_PREFIX}/:id.json`, earlyRateLimit(15 * 60_000, 60, 600), async (req, res) => {
+        const wanted = String(req.params.id);
+        for (const [name, server] of watcher.current) {
+            if (server.kind !== 'remote' || server.oauth?.mode !== 'cimd')
+                continue;
+            if (clientDocumentId(name, store.cookieSecret) !== wanted)
+                continue;
+            const identity = { serverName: name, serverUrl: server.url, oauth: server.oauth, externalUrl };
+            const provider = new UpstreamAuthProvider(identity, store);
+            // The document must name itself byte-for-byte or the upstream refuses it.
+            res.json({
+                client_id: clientMetadataUrl(externalUrl, name, store.cookieSecret),
+                ...hubClientMetadata(identity, server.oauth.clientAuth === 'private_key_jwt' ? await provider.publicJwk() : undefined)
+            });
+            return;
+        }
+        res.status(404).json({ error: 'not_found', error_description: 'No upstream publishes a document here' });
     });
     router.get(`/${UPSTREAM_CALLBACK_PATH}`, (req, res) => {
-        void handleCallback(req.query, req.headers.cookie, res);
+        return handleCallback(req.query, req.headers.cookie, res);
     });
     async function handleCallback(query, cookie, res) {
         const state = typeof query.state === 'string' ? query.state : '';
@@ -51,7 +54,7 @@ export function createUpstreamRoutes(options) {
         // Proving the browser belongs to the operator, not just to whoever ended up
         // holding the redirect. The session cookie rides along because the upstream
         // sends a top-level navigation and the cookie is SameSite=Lax.
-        if (readSessionCookie(cookie, store.cookieSecret) === undefined) {
+        if (readSessionCookie(cookie, store.cookieSecret, secure) === undefined) {
             page(res, 401, 'Not signed in', 'Sign in to this hub in the same browser, then run the login again.');
             return;
         }
@@ -64,7 +67,9 @@ export function createUpstreamRoutes(options) {
         }
         if (typeof query.error === 'string') {
             console.warn(`mcp-hub: upstream login for ${logSafe(login.serverName)} was declined: ${logSafe(query.error)}`);
-            page(res, 400, 'Authorization declined', `The upstream reported "${query.error}". Nothing was changed.`);
+            // An OAuth error code is a short token; anything else is a page written
+            // by whoever answered as the upstream, and it does not get to write ours.
+            page(res, 400, 'Authorization declined', `The upstream reported "${logSafe(query.error, 80)}". Nothing was changed.`);
             return;
         }
         const code = typeof query.code === 'string' ? query.code : '';