@ni-c/mcp-hub 0.11.2 → 0.11.3

package/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.11.3] - 2026-09-12
+
+### Security
+
+- **A remote upstream could redirect the hub anywhere.** The MCP requests to
+  a remote server — `tools/call`, the event stream, `subscriptions/listen` —
+  went out with the platform's default of following every redirect, and
+  neither the SDK's transports nor the hub's own fetch wrappers said
+  otherwise. An upstream answering with a `Location` on an internal address
+  had the hub connect there, send the JSON-RPC body and every configured
+  header except `Authorization` and `Cookie`, and read the answer as MCP. The
+  guard the authorization server always had now covers the data plane too: a
+  redirect is followed only within the origin of the configured `url` (same
+  scheme, host and port — `/mcp` to `/mcp/` keeps working), at most three
+  times, with the platform's method and body rules; anything else fails the
+  request with a reason that names the refused origin and nothing more.
+  Reported by the 2026-09-12 internal review.
+
+### Fixed
+
+- **A peer could make the hub copy its input quadratically.** The byte-stream
+  transports — `type: "unix"`, `"tcp"` and the docker attach stream — appended
+  every chunk to one growing buffer, so a line or a frame delivered in small
+  pieces cost the event loop a copy of everything so far, per piece: ten
+  megabytes in 4 KiB pieces took close to a second, a 16 MiB docker frame two
+  and a half, and a peer chooses its piece size. Both decoders now collect the
+  pieces and join them once, which is linear; the existing caps (10 MiB per
+  line, 16 MiB per frame) are unchanged, and a property test holds the framing
+  identical however the bytes are cut.
+- **A remote server that failed to connect was logged as "connection closed".**
+  The SDK closes the transport before `connect()` rejects, so the generic
+  close reason won the race and the rejection — which names the cause and may
+  carry a verdict no restart can fix — was thrown away. The exit is now
+  reported once, from the rejection, so a refused redirect, a TLS failure or
+  an unauthorized upstream reads as what it is.
+
 ## [0.11.2] - 2026-09-07
 
 ### Security

package/dist/supervisor.js

@@ -9,6 +9,7 @@ import { DockerTransport } from './transports/docker.js';
 import { setTransportHandlers } from './transports/stream.js';
 import { DockerClient, parseSandboxDockerHost } from './sandbox/docker-client.js';
 import { UpstreamAuth, UpstreamLoginRequiredError } from './upstream/auth.js';
+import { boundedRedirectFetch } from './upstream/redirects.js';
 import { ToolCache } from './tool-cache.js';
 import { filterTools, hasToolFilter, unmatchedPatterns } from './tool-filter.js';
 import { subscriptionsAllowed } from './subscriptions.js';
@@ -44,6 +45,10 @@ function eraHasPing(client) {
 /**
  * Remote upstreams get their configured headers on EVERY request via a fetch
  * wrapper — requestInit alone does not cover the SSE stream GET.
+ *
+ * Both wrappers follow a redirect only within the configured origin, and at
+ * most three: the platform would otherwise follow a `Location` anywhere,
+ * headers and body included. See `boundedRedirectFetch`.
  */
 function buildRemoteTransport(config, auth) {
     const url = new URL(config.url);
@@ -59,14 +64,15 @@ function buildRemoteTransport(config, auth) {
             ? new SSEClientTransport(url, { authProvider: auth.provider(), fetch: guarded })
             : new StreamableHTTPClientTransport(url, { authProvider: auth.provider(), fetch: guarded });
     }
-    const fetchWithHeaders = (input, init) => {
+    // The headers go on inside the redirect wrapper, so every hop carries them.
+    const fetchWithHeaders = boundedRedirectFetch(url.origin, (input, init) => {
         const merged = new Headers(init?.headers);
         for (const [key, value] of Object.entries(headers)) {
             if (!merged.has(key))
                 merged.set(key, value);
         }
         return fetch(input, { ...init, headers: merged });
-    };
+    });
     if (config.transport === 'sse') {
         return new SSEClientTransport(url, { requestInit: { headers }, fetch: fetchWithHeaders });
     }
@@ -190,6 +196,8 @@ export class ManagedServer {
      * kill the new child.
      */
     generation = 0;
+    /** True while client.connect() is in flight; see start(). */
+    connecting = false;
     /** The one upstream listen stream carrying this route's whole demand (modern era). */
     upstream;
     upstreamFilter;
@@ -353,13 +361,24 @@ export class ManagedServer {
             inputRequired: { autoFulfill: false }
         });
         setTransportHandlers(transport, { onclose: () => this.onExit(this.exitReason(), generation) });
+        // While the opening exchange runs, a close of the transport is not
+        // reported by onclose: the SDK closes the transport *before* connect()
+        // rejects, so the generic "connection closed" used to win the race and the
+        // rejection — which names the cause, and may carry a verdict no restart
+        // can fix — was thrown away by onExit's state guard. A refused redirect,
+        // a TLS failure or an unauthorized upstream all read as "connection
+        // closed" in the log. connect() always rejects once its transport is
+        // gone, so the catch below is the one place that reports this exit.
+        this.connecting = true;
         try {
             await client.connect(transport);
         }
         catch (error) {
+            this.connecting = false;
             this.onExit(`failed to start: ${error.message}`, generation, classifyAuthFailure(error));
             return;
         }
+        this.connecting = false;
         if (generation !== this.generation) {
             // sleep()/stop() ran while we were connecting; it already set the final
             // state, so this child is surplus and only needs to go away again.
@@ -615,6 +634,10 @@ export class ManagedServer {
         // left behind must not touch the current child.
         if (generation !== this.generation)
             return;
+        // A close during the opening exchange is reported by start()'s catch, with
+        // the reason connect() gives — see the note there.
+        if (this.connecting && reason === this.exitReason())
+            return;
         // A failed start reports twice: transport.onclose fires and start()'s catch
         // calls us as well. Without this guard the second call would overwrite
         // restartTimer without clearing it, so two children would be spawned and

package/dist/transports/docker.js

@@ -15,7 +15,16 @@ const STDERR = 2;
 export class DockerFrameDecoder {
     onFrame;
     onError;
-    buffer = Buffer.alloc(0);
+    /**
+     * The bytes of the frame in progress, as the chunks they arrived in, joined
+     * once the whole frame is here. One growing buffer would copy itself on every
+     * chunk — quadratic in the frame size, on the hub's event loop, for a size
+     * the peer chooses.
+     */
+    pending = [];
+    pendingBytes = 0;
+    /** The header of the frame in progress, once eight bytes have arrived. */
+    header;
     failed = false;
     constructor(onFrame, onError) {
         this.onFrame = onFrame;
@@ -24,25 +33,44 @@ export class DockerFrameDecoder {
     push(chunk) {
         if (this.failed)
             return;
-        this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+        if (chunk.length === 0)
+            return;
+        this.pending.push(chunk);
+        this.pendingBytes += chunk.length;
         for (;;) {
-            if (this.buffer.length < 8)
-                return;
-            const size = this.buffer.readUInt32BE(4);
-            if (size > MAX_FRAME_BYTES) {
-                this.failed = true;
-                this.onError(new Error(`docker frame of ${size} bytes exceeds the ${MAX_FRAME_BYTES} byte limit`));
-                this.buffer = Buffer.alloc(0);
-                return;
+            if (this.header === undefined) {
+                if (this.pendingBytes < 8)
+                    return;
+                // Joining here is cheap: the pending pieces hold at most a header's
+                // worth of bytes plus whatever one chunk brought with it.
+                const joined = this.join();
+                const size = joined.readUInt32BE(4);
+                if (size > MAX_FRAME_BYTES) {
+                    this.failed = true;
+                    this.onError(new Error(`docker frame of ${size} bytes exceeds the ${MAX_FRAME_BYTES} byte limit`));
+                    this.pending = [];
+                    this.pendingBytes = 0;
+                    return;
+                }
+                this.header = { stream: joined[0], size };
+                this.replace(joined.subarray(8));
             }
-            if (this.buffer.length < 8 + size)
+            if (this.pendingBytes < this.header.size)
                 return;
-            const stream = this.buffer[0];
-            const payload = this.buffer.subarray(8, 8 + size);
-            this.buffer = this.buffer.subarray(8 + size);
-            this.onFrame(stream, payload);
+            const joined = this.join();
+            const { stream, size } = this.header;
+            this.header = undefined;
+            this.replace(joined.subarray(size));
+            this.onFrame(stream, joined.subarray(0, size));
         }
     }
+    join() {
+        return this.pending.length === 1 ? this.pending[0] : Buffer.concat(this.pending);
+    }
+    replace(rest) {
+        this.pending = rest.length > 0 ? [rest] : [];
+        this.pendingBytes = rest.length;
+    }
 }
 /**
  * An MCP server running in its own container, spoken to over the Docker API.

package/dist/transports/stream.js

@@ -18,7 +18,17 @@ export class StreamTransport {
     onclose;
     onerror;
     onmessage;
-    buffer = Buffer.alloc(0);
+    /**
+     * Bytes received since the last newline, as the chunks they arrived in.
+     *
+     * A list rather than one growing buffer: appending a chunk to a buffer copies
+     * the whole buffer, so a peer that sends a long line in small pieces makes
+     * the hub copy quadratically — ten megabytes in 4 KiB chunks cost a second
+     * of the event loop, on every restart the peer cared to provoke. The pieces
+     * are joined once, when a newline arrives, which is linear.
+     */
+    pending = [];
+    pendingBytes = 0;
     started = false;
     closed = false;
     reportedClose = false;
@@ -55,25 +65,40 @@ export class StreamTransport {
      * own codec still does the parsing; only the policy is local.
      */
     receive(chunk) {
-        if (this.buffer.length + chunk.length > STDIO_DEFAULT_MAX_BUFFER_SIZE) {
+        if (this.pendingBytes + chunk.length > STDIO_DEFAULT_MAX_BUFFER_SIZE) {
             // A peer that keeps sending without ever writing a newline. This runs
             // inside a 'data' handler, so a throw here would reach
             // process.on('uncaughtException') and take the entire hub down — every
             // other server with it — because one sandboxed server misbehaved. The
             // stream is desynchronised anyway: report it, end this connection, let
             // the supervisor restart it.
-            this.buffer = Buffer.alloc(0);
+            this.pending = [];
+            this.pendingBytes = 0;
             this.onerror?.(new Error(`ReadBuffer exceeded maximum size of ${STDIO_DEFAULT_MAX_BUFFER_SIZE} bytes`));
             void this.close();
             return;
         }
-        this.buffer = this.buffer.length === 0 ? chunk : Buffer.concat([this.buffer, chunk]);
+        // Only the new chunk can hold the newline that completes a line; the
+        // pending pieces were already searched when they arrived.
+        if (chunk.indexOf('\n') === -1) {
+            this.pending.push(chunk);
+            this.pendingBytes += chunk.length;
+            return;
+        }
+        let buffer = this.pending.length === 0 ? chunk : Buffer.concat([...this.pending, chunk]);
+        this.pending = [];
+        this.pendingBytes = 0;
         for (;;) {
-            const newline = this.buffer.indexOf('\n');
-            if (newline === -1)
+            const newline = buffer.indexOf('\n');
+            if (newline === -1) {
+                if (buffer.length > 0) {
+                    this.pending.push(buffer);
+                    this.pendingBytes = buffer.length;
+                }
                 return;
-            const line = this.buffer.toString('utf8', 0, newline).replace(/\r$/, '');
-            this.buffer = this.buffer.subarray(newline + 1);
+            }
+            const line = buffer.toString('utf8', 0, newline).replace(/\r$/, '');
+            buffer = buffer.subarray(newline + 1);
             let message;
             try {
                 message = deserializeMessage(line);
@@ -108,7 +133,8 @@ export class StreamTransport {
             return;
         this.reportedClose = true;
         this.closed = true;
-        this.buffer = Buffer.alloc(0);
+        this.pending = [];
+        this.pendingBytes = 0;
         this.onclose?.();
     }
 }

package/dist/upstream/auth.js

@@ -5,6 +5,7 @@ import { isPrivateAddress, resolvePublicAddress } from '../auth/address.js';
 import { boundedResponse, guardedRequest } from '../auth/pinned-fetch.js';
 import { logSafe } from '../auth/text.js';
 import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata } from './provider.js';
+import { boundedRedirectFetch } from './redirects.js';
 /**
  * Everything the hub needs to authenticate itself to one upstream MCP server.
  *
@@ -380,6 +381,9 @@ export class UpstreamAuth {
      */
     createFetch() {
         const upstreamOrigin = new URL(this.identity.serverUrl).origin;
+        // Data-plane redirects stay within the upstream's origin, three at most;
+        // the control plane refuses them outright in asFetch.
+        const dataPlane = boundedRedirectFetch(upstreamOrigin);
         return async (input, init) => {
             const url = new URL(input instanceof Request ? input.url : String(input));
             const isControlPlane = url.origin !== upstreamOrigin || url.pathname.startsWith('/.well-known/');
@@ -394,7 +398,7 @@ export class UpstreamAuth {
                     if (!headers.has(key))
                         headers.set(key, value);
                 }
-                return { response: await fetch(url, { ...init, headers }), token };
+                return { response: await dataPlane(url, { ...init, headers }), token };
             };
             const first = await send();
             if (first.response.status !== 401)

package/dist/upstream/redirects.js

@@ -0,0 +1,86 @@
+import { logSafe } from '../auth/text.js';
+/**
+ * Redirects on the data plane of a remote upstream, followed only within the
+ * origin the operator configured.
+ *
+ * `fetch` follows a 3xx by default, and neither the SDK's transports nor the
+ * hub's own wrappers said otherwise — so a remote MCP server could answer a
+ * `tools/call`, the SSE stream or a `subscriptions/listen` with a `Location`
+ * pointing at an internal address, and the hub would connect there, send the
+ * JSON-RPC body and every configured header except `Authorization` and
+ * `Cookie` (the two the platform strips across origins), and parse whatever
+ * came back as MCP. The control plane — discovery, token, registration — has
+ * refused redirects since the guard for the authorization server was written;
+ * this closes the same door on the other side.
+ *
+ * Same origin is the line, not same host: a different port on the same name
+ * is a different service, and a plain-http twin of an https upstream is not
+ * the upstream. Within that line a hop is followed because servers really do
+ * redirect `/mcp` to `/mcp/`, and refusing it would break upstreams that were
+ * never a problem.
+ */
+export const MAX_REDIRECT_HOPS = 3;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/**
+ * Wraps a fetch so that every redirect it would follow is checked first.
+ *
+ * `origin` is the configured upstream's origin (`new URL(config.url).origin`).
+ * The returned function has the platform's shape and can be handed to the SDK
+ * transports as their `fetch`; every hop goes through `fetchImpl`, so a wrapper
+ * that adds headers still adds them on each hop.
+ */
+export function boundedRedirectFetch(origin, fetchImpl = fetch) {
+    return async (input, init) => {
+        let url = new URL(input instanceof Request ? input.url : String(input));
+        let request = { ...init, redirect: 'manual' };
+        for (let hop = 0;; hop++) {
+            // A caller that built a Request keeps it on the first hop — its body
+            // lives there. Nothing in the hub does, but the shape is the platform's.
+            const response = await fetchImpl(hop === 0 && input instanceof Request ? new Request(input, request) : url, request);
+            if (!REDIRECT_STATUSES.has(response.status))
+                return response;
+            const location = response.headers.get('location');
+            if (location === null)
+                return response;
+            // Nothing of the redirect's body is wanted, and holding the stream open
+            // would keep the connection with it.
+            await response.body?.cancel().catch(() => { });
+            let next;
+            try {
+                next = new URL(location, url);
+            }
+            catch {
+                throw new Error(`upstream at ${logSafe(url.origin)} redirected to an unparseable location`);
+            }
+            if (next.origin !== origin) {
+                throw new Error(`upstream at ${logSafe(url.origin)} redirected to ${logSafe(next.origin)} — refused, redirects are followed only within the configured origin`);
+            }
+            if (hop + 1 >= MAX_REDIRECT_HOPS) {
+                throw new Error(`upstream at ${logSafe(url.origin)} redirected more than ${MAX_REDIRECT_HOPS} times`);
+            }
+            // A fragment on the request URL survives a redirect that has none.
+            if (!next.hash && url.hash)
+                next.hash = url.hash;
+            url = next;
+            request = nextRequest(request, response.status);
+        }
+    };
+}
+/**
+ * What the platform would do to the method and body on this hop (Fetch
+ * standard, "HTTP-redirect fetch"): a 303 always becomes a GET, a 301 or 302
+ * turns a POST into a GET, and a 307 or 308 keeps both. The body is dropped
+ * whenever the method changes, with the headers that only described it.
+ */
+function nextRequest(request, status) {
+    const method = (request.method ?? 'GET').toUpperCase();
+    const becomesGet = status === 303 ? method !== 'GET' && method !== 'HEAD' : (status === 301 || status === 302) && method === 'POST';
+    if (!becomesGet)
+        return request;
+    const headers = new Headers(request.headers);
+    for (const name of ['content-encoding', 'content-language', 'content-location', 'content-type', 'content-length']) {
+        headers.delete(name);
+    }
+    return { ...request, method: 'GET', body: undefined, headers };
+}
+//# sourceMappingURL=redirects.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ni-c/mcp-hub",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Serve multiple stdio MCP servers from one container: Claude-Code-style mcpServers config, path-based routing, hub meta-tools, and CIMD-first OAuth 2.1 + API tokens for ChatGPT, Claude and any Streamable-HTTP MCP client.",
   "keywords": [
     "mcp",