@ni-c/mcp-hub 0.11.2 → 0.11.4

package/CHANGELOG.md

@@ -7,6 +7,116 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.11.4] - 2026-09-24
+
+### Security
+
+- **An approval for one server was an approval for all of them.** The login
+  and consent pages name the resource a client asks for under *Requested
+  access*, but the approval was stored for the client and its redirect URI
+  only. While the operator's session lasted, a client approved for
+  `/paperless/mcp` could ask for `/hub` and receive a code without any page —
+  a token for every server. The approval now records the resources the page
+  showed, and a request for any other one brings the page back: *Approve /
+  Deny* within a live session, the sign-in page otherwise. Approvals written
+  by an older version name no resource, so each connector sees the page once
+  more the next time it authorizes; refresh tokens are unaffected.
+  `mcp-hub-admin clients list` shows `approvedResources`.
+- **A remote upstream's reply had no size limit.** The control plane to an
+  upstream's authorization server has capped every response since August; the
+  MCP requests themselves read whatever came back, so one `tools/call` answered
+  with 300 MiB cost the hub 630 MB of heap, and an event without a line end
+  grew without bound in the SDK's SSE parser. Replies are now held to 10 MiB,
+  the limit the byte-stream transports apply to one message — a JSON reply as a
+  whole, an event stream per event, and a declared `content-length` above it is
+  refused before reading. `resources/updated` URIs longer than
+  `MCP_SUBSCRIPTION_MAX_URI_BYTES` (8 KiB) are dropped.
+- **The consent page could be made to show a different address.** A redirect
+  URI such as `https://claude.ai@attacker.example/cb` connects to
+  `attacker.example`, and a bidi override or zero-width character in a
+  redirect URI or metadata document URL could reorder or hide the host in the
+  line the operator reads. Both are refused now, for every scheme and both
+  registration mechanisms; percent-encoded bytes are still accepted, and
+  values stored earlier are shown with such characters as visible escapes.
+- **`/revoke` was not rate-limited.** It runs the same client authentication as
+  `/token`, `private_key_jwt` signature checks included, and a client can
+  register itself; it now has the same budget as `/token`, counted
+  separately so a flood of one cannot starve the other.
+- **Requests could drive a crashing server's restarts.** Every request to an
+  on-demand server cancelled its crash backoff and reset the give-up count, so
+  a client repeating a call restarted a crashing sandbox container at its own
+  pace — 30 attempts in 12 seconds instead of 4. A request now waits for the
+  scheduled restart; after a give-up the first request retries and further
+  ones within the backoff get the last error.
+- **DPoP was offered but never checked.** oidc-provider enables it by default,
+  so a client that sent a proof received a `DPoP` token that the hub then
+  accepted as a plain bearer. It is switched off, which is what the standards
+  page already said.
+- **Text from a sandbox or an upstream reached the terminal unescaped.** A
+  sandbox container's stderr and an upstream authorization server's error text
+  in `mcp-hub-admin upstream …` now go through the same escaping as every other
+  stranger's text, so an escape sequence or a bare CR can no longer rewrite
+  what the operator sees. `LOG_FILE` was not affected.
+- **An upstream token with a line break broke its server for good.** A token
+  containing CR or LF was stored and then made every request to that server
+  fail in `Headers.set()`, while `/health` kept showing it up. Tokens, and the
+  RFC 7592 registration token, must now be printable ASCII of at most 16 KiB;
+  a malformed one fails the server's authorization instead of being stored,
+  and its value is never logged.
+
+Reported by the 2026-09-24 internal review.
+
+### Fixed
+
+- **A wrongly signed JWT cost a signature check.** A bearer shaped like an
+  API token is now decoded first and only verified when its algorithm,
+  subject and `jti` match a live token, which makes rejecting garbage about
+  twenty times cheaper. A valid token is still verified in full, and
+  revocation is still checked after verification.
+- **`clients revoke` reported 0 refresh tokens.** It counted a map nothing
+  writes any more; it now counts the live ones it invalidates. The revocation
+  itself was always effective.
+- **A character split across two docker frames was garbled** in the sandbox's
+  stderr; the stream is now decoded across frame boundaries, and a last line
+  without a newline is written out when the container stops instead of being
+  dropped.
+
+## [0.11.3] - 2026-09-12
+
+### Security
+
+- **A remote upstream could redirect the hub anywhere.** The MCP requests to
+  a remote server — `tools/call`, the event stream, `subscriptions/listen` —
+  went out with the platform's default of following every redirect, and
+  neither the SDK's transports nor the hub's own fetch wrappers said
+  otherwise. An upstream answering with a `Location` on an internal address
+  had the hub connect there, send the JSON-RPC body and every configured
+  header except `Authorization` and `Cookie`, and read the answer as MCP. The
+  guard the authorization server always had now covers the data plane too: a
+  redirect is followed only within the origin of the configured `url` (same
+  scheme, host and port — `/mcp` to `/mcp/` keeps working), at most three
+  times, with the platform's method and body rules; anything else fails the
+  request with a reason that names the refused origin and nothing more.
+  Reported by the 2026-09-12 internal review.
+
+### Fixed
+
+- **A peer could make the hub copy its input quadratically.** The byte-stream
+  transports — `type: "unix"`, `"tcp"` and the docker attach stream — appended
+  every chunk to one growing buffer, so a line or a frame delivered in small
+  pieces cost the event loop a copy of everything so far, per piece: ten
+  megabytes in 4 KiB pieces took close to a second, a 16 MiB docker frame two
+  and a half, and a peer chooses its piece size. Both decoders now collect the
+  pieces and join them once, which is linear; the existing caps (10 MiB per
+  line, 16 MiB per frame) are unchanged, and a property test holds the framing
+  identical however the bytes are cut.
+- **A remote server that failed to connect was logged as "connection closed".**
+  The SDK closes the transport before `connect()` rejects, so the generic
+  close reason won the race and the rejection — which names the cause and may
+  carry a verdict no restart can fix — was thrown away. The exit is now
+  reported once, from the rejection, so a refused redirect, a TLS failure or
+  an unauthorized upstream reads as what it is.
+
 ## [0.11.2] - 2026-09-07
 
 ### Security

package/README.md

@@ -4,7 +4,7 @@
 
 [![CI](https://img.shields.io/github/actions/workflow/status/ni-c/mcp-hub/ci.yml?branch=main&label=CI)](https://github.com/ni-c/mcp-hub/actions/workflows/ci.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ni-c/mcp-hub/badge)](https://scorecard.dev/viewer/?uri=github.com/ni-c/mcp-hub)
-<a href="https://socket.dev/npm/package/@ni-c/mcp-hub"><img src="https://socket.dev/api/badge/npm/package/@ni-c/mcp-hub" alt="Socket supply-chain report" height="20"></a>
+[![Socket Badge](https://badge.socket.dev/npm/package/@ni-c/mcp-hub)](https://socket.dev/npm/package/@ni-c/mcp-hub)
 [![Glama score](https://glama.ai/mcp/servers/ni-c/mcp-hub/badges/score.svg)](https://glama.ai/mcp/servers/ni-c/mcp-hub)
 <br>
 [![npm version](https://img.shields.io/npm/v/%40ni-c%2Fmcp-hub)](https://www.npmjs.com/package/@ni-c/mcp-hub)
@@ -386,10 +386,11 @@ and log in once with the password. Claude Code:
 (OpenAI Responses API, xAI, Gemini API) use an admin-minted token instead —
 see [client compatibility](https://mcp-hub.ni-c.de/guide/client-compatibility).
 
-Each client is confirmed once. Entering the password approves the client that
-asked; while a login session is still valid, a client you have not seen before
-gets an explicit _Approve / Deny_ page instead of a code. Approved clients
-reconnect silently from then on.
+Each client is confirmed once per server it asks for. Entering the password
+approves the client that asked, for the server shown on the page; while a login
+session is still valid, a client you have not seen before — or one asking for
+another server — gets an explicit _Approve / Deny_ page instead of a code.
+Approved clients reconnect silently from then on.
 
 List clients or revoke one. The CLI shares `/data` with the running hub and
 both sides re-read the state file before they touch it, so this works against a

package/dist/admin.js

@@ -2,7 +2,7 @@
 import crypto from 'node:crypto';
 import { AuthStore, clientLimitsFromEnv } from './auth/store.js';
 import { isSafeRedirectUri } from './auth/redirect-uri.js';
-import { clampDisplayName } from './auth/text.js';
+import { clampDisplayName, logSafe } from './auth/text.js';
 import { isClientIdMetadataUrl } from './auth/cimd.js';
 import { mintApiToken } from './auth/api-tokens.js';
 import { loadConfig } from './config.js';
@@ -31,8 +31,10 @@ function usage() {
     ].join('\n'));
     process.exit(2);
 }
+/** Messages here can carry an upstream authorization server's own error
+ *  text, so they are escaped before they reach the operator's terminal. */
 function fail(message) {
-    console.error(message);
+    console.error(logSafe(message));
     process.exit(2);
 }
 function flag(args, name) {
@@ -65,6 +67,7 @@ if (group === 'clients' && action === 'list') {
         via: clientOrigin(id),
         registeredRedirectUris: client.redirect_uris,
         approvedRedirectUris: approvals[id]?.redirectUris ?? [],
+        approvedResources: approvals[id]?.resources ?? [],
         approvedAt: approvals[id] ? new Date(approvals[id].approvedAt * 1000).toISOString() : null
     }));
     // Metadata-document clients are never stored — the document is fetched fresh
@@ -80,6 +83,7 @@ if (group === 'clients' && action === 'list') {
             via: clientOrigin(id),
             registeredRedirectUris: [],
             approvedRedirectUris: approval.redirectUris,
+            approvedResources: approval.resources,
             approvedAt: new Date(approval.approvedAt * 1000).toISOString()
         });
     }
@@ -324,8 +328,9 @@ if (group === 'upstream') {
         // unreachable must never leave a credential behind here.
         const problems = await auth.revokeRemotely().catch(error => [error.message]);
         const forgotten = store.forgetUpstreamCredentials(name);
+        // A revocation failure can carry the authorization server's own text.
         for (const problem of problems)
-            console.error(`Upstream revocation: ${problem}`);
+            console.error(`Upstream revocation: ${logSafe(problem)}`);
         console.log(JSON.stringify({ server: name, forgotten, revokedAtUpstream: problems.length === 0 }, null, 2));
         process.exit(problems.length > 0 ? 1 : 0);
     }

package/dist/auth/cimd.js

@@ -1,6 +1,6 @@
 import { isPrivateAddress, resolvePublicAddress } from './address.js';
 import { guardedRequest } from './pinned-fetch.js';
-import { isSafeRedirectUri } from './redirect-uri.js';
+import { hasUserinfo, isPrintableAsciiUri, isSafeRedirectUri } from './redirect-uri.js';
 import { clampDisplayName, logSafe } from './text.js';
 // Lives in address.ts now — re-exported because it is part of this module's
 // established surface and the test suite reaches for it here.
@@ -59,8 +59,14 @@ export function setCimdFetch(fn) {
  * fragment, no credentials and no dot-segments. A `client_id` that fails this
  * is not a metadata document URL at all and is looked up as a locally
  * registered client instead — which is what keeps DCR working beside CIMD.
+ *
+ * The consent page shows this URL as the part of the client's identity that
+ * cannot be invented, so it is held to the same printable-ASCII and
+ * no-userinfo rules as a redirect URI.
  */
 export function isClientIdMetadataUrl(clientId) {
+    if (!isPrintableAsciiUri(clientId))
+        return false;
     let url;
     try {
         url = new URL(clientId);
@@ -70,7 +76,7 @@ export function isClientIdMetadataUrl(clientId) {
     }
     if (url.protocol !== 'https:')
         return false;
-    if (url.hash || url.username || url.password)
+    if (url.hash || hasUserinfo(clientId, url))
         return false;
     if (url.pathname === '' || url.pathname === '/')
         return false;

package/dist/auth/oidc/interactions.js

@@ -5,9 +5,17 @@ import { renderLoginPage } from '../login-page.js';
 import { earlyRateLimit, LoginRateLimiter } from '../rate-limit.js';
 import { operatorCredential } from '../password.js';
 import { isLoopbackOnly } from '../redirect-uri.js';
+import { approvalResourceKey } from '../resource.js';
 import { createSessionCookie, csrfToken, readSessionCookie, SESSION_TTL_MS, sessionCookieName, verifyCsrfToken } from '../session.js';
 import { logSafe } from '../text.js';
 import { HUB_ACCOUNT_ID } from './provider.js';
+/** The resources the page showed under "Requested access", in the form
+ *  loadExistingGrant looks an approval up by. */
+function canonicalizeRequestedResources(resource, options) {
+    return [resource ?? []]
+        .flat()
+        .map(value => approvalResourceKey(String(value), options.externalUrl, options.resolveResource));
+}
 /** Express 5 forwards a rejected handler promise on its own; this makes that explicit and typed. */
 const asyncHandler = (handler) => (req, res, next) => {
     handler(req, res, next).catch(next);
@@ -140,11 +148,13 @@ export function createOidcInteractionRoutes(options) {
         }
         rateLimiter.reset(ip);
         console.log(`mcp-hub: successful login from ${logSafe(ip)}`);
-        // Typing the password is the consent for the client that triggered it.
+        // Typing the password is the consent for the client that triggered it:
+        // for its redirect target and for the resource the page showed.
         const clientId = String(params.client_id);
         const client = await provider.Client.find(clientId);
         const clientName = client?.metadata()?.client_name;
-        store.saveApproval(clientId, redirectUri, typeof clientName === 'string' ? clientName : undefined);
+        const resources = canonicalizeRequestedResources(params.resource, options);
+        store.saveApproval(clientId, redirectUri, typeof clientName === 'string' ? clientName : undefined, resources);
         console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(redirectUri)}`);
         // `__Host-` behind HTTPS: the browser then refuses the cookie from any
         // other origin, path or domain, so nobody can fix a session into this
@@ -191,7 +201,8 @@ export function createOidcInteractionRoutes(options) {
         const clientId = String(params.client_id);
         const client = await provider.Client.find(clientId);
         const clientName = client?.metadata()?.client_name;
-        store.saveApproval(clientId, String(params.redirect_uri ?? ''), typeof clientName === 'string' ? clientName : undefined);
+        const resources = canonicalizeRequestedResources(params.resource, options);
+        store.saveApproval(clientId, String(params.redirect_uri ?? ''), typeof clientName === 'string' ? clientName : undefined, resources);
         console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(String(params.redirect_uri ?? ''))}`);
         // The grant itself is minted by loadExistingGrant on the resumed request,
         // which is the same code path an already-approved client takes.

package/dist/auth/oidc/mount.js

@@ -76,7 +76,12 @@ export function defaultRateLimits() {
         '/register/:id': [earlyRateLimit(60 * 60_000, 60, 600)],
         '/authorize': [earlyRateLimit(15 * 60_000, 100, 1_000)],
         '/authorize/:uid': [earlyRateLimit(15 * 60_000, 100, 1_000)],
-        '/token': [earlyRateLimit(15 * 60_000, 50, 500)]
+        '/token': [earlyRateLimit(15 * 60_000, 50, 500)],
+        // '/revoke' authenticates the client exactly as '/token' does,
+        // private_key_jwt signature checks included, for any caller that has
+        // registered itself — so it gets the same budget, counted separately so a
+        // flood of one cannot starve the other.
+        '/revoke': [earlyRateLimit(15 * 60_000, 50, 500)]
     };
 }
 /**

package/dist/auth/oidc/provider.js

@@ -1,5 +1,6 @@
 import Provider, { errors } from 'oidc-provider';
 import { isSafeRedirectUri, redirectUriMatches } from '../redirect-uri.js';
+import { approvalResourceKey } from '../resource.js';
 import { clampDisplayName } from '../text.js';
 import { createOidcAdapter } from './adapter.js';
 import { HUB_SCOPE, installDiscoveryFixups, installThrowawaySecret } from './quirks.js';
@@ -103,6 +104,11 @@ export function buildOidcProvider(store, options) {
                 ack: 'draft-02',
                 allowFetch: () => false
             },
+            // On by default in oidc-provider. The resource server never checks a
+            // proof, so a `token_type: "DPoP"` token would promise a sender
+            // constraint nothing enforces. Off, clients get the bearer token they
+            // actually hold.
+            dPoP: { enabled: false },
             resourceIndicators: {
                 enabled: true,
                 useGrantedResource: () => true,
@@ -359,9 +365,24 @@ export function buildOidcProvider(store, options) {
                 .filter(Boolean);
             if (scopes.length > 0)
                 grant.addOIDCScope(scopes.join(' '));
+            /**
+             * The resource gets the same discipline as the redirect URI: the page
+             * named it under "Requested access", so the approval covers that
+             * resource and no other. One the operator has not approved is left off
+             * the grant, and oidc-provider's own `rs_scopes_missing` check then asks
+             * — the consent page with a live session, the login page without — and
+             * approving adds it before this runs again for the resumed request.
+             *
+             * Matched in raw and canonical form, since the interaction routes may
+             * run without a canonicaliser; added in raw form, because that is the
+             * key `rs_scopes_missing` looks the resource up by.
+             */
+            const approvedResources = approval?.resources ?? [];
             const requested = ctx.oidc.params?.resource;
-            for (const resource of [requested ?? []].flat()) {
-                grant.addResourceScope(String(resource), HUB_SCOPE);
+            for (const resource of [requested ?? []].flat().map(String)) {
+                const key = approvalResourceKey(resource, options.externalUrl, options.resolveResource);
+                if (approvedResources.includes(resource) || approvedResources.includes(key))
+                    grant.addResourceScope(resource, HUB_SCOPE);
             }
             await grant.save();
             return grant;

package/dist/auth/oidc/verifier.js

@@ -1,5 +1,5 @@
 import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
-import { jwtVerify } from 'jose';
+import { decodeJwt, decodeProtectedHeader, jwtVerify } from 'jose';
 import { API_TOKEN_SUBJECT } from '../api-tokens.js';
 /**
  * The one error shape `requireBearerAuth` recognises.
@@ -31,9 +31,11 @@ function invalidToken(message) {
  * which is what `tokens revoke` deletes.
  *
  * Order matters. Opaque is tried first because it is the common case and needs
- * no cryptography; a value that is not a stored token then gets exactly one
- * signature check. Neither branch may report why it failed — an attacker must
- * not be able to tell "unknown" from "revoked" from "wrong audience".
+ * no cryptography; a value that is not a stored token then reaches at most one
+ * signature check, and only if its decoded claims name a live API token.
+ * Neither branch may report why it failed — an
+ * attacker must not be able to tell "unknown" from "revoked" from "wrong
+ * audience".
  */
 export class OidcTokenVerifier {
     store;
@@ -76,6 +78,12 @@ export class OidcTokenVerifier {
         };
     }
     async fromApiToken(token) {
+        // Anyone can send a well-formed, wrongly signed JWT for free, and an EdDSA
+        // verification costs about twenty times a decode. The decode proves
+        // nothing, so it can only reject early: a token naming a live jti still
+        // has its signature checked below before anything is trusted.
+        if (!this.mayBeLiveApiToken(token))
+            throw invalidToken('Invalid or expired access token');
         let payload;
         try {
             ({ payload } = await jwtVerify(token, this.store.publicKey, {
@@ -92,6 +100,9 @@ export class OidcTokenVerifier {
         // credential nothing can revoke.
         if (payload.sub !== API_TOKEN_SUBJECT)
             throw invalidToken('Invalid access token claims');
+        // Checked again after verification, not only in the pre-check: a
+        // `tokens revoke` that lands while the signature is being verified must
+        // still refuse this request.
         if (typeof payload.jti !== 'string' || !this.store.getApiToken(payload.jti)) {
             throw invalidToken('Access token has been revoked');
         }
@@ -107,6 +118,26 @@ export class OidcTokenVerifier {
             resource
         };
     }
+    /**
+     * Whether a token's unverified claims could belong to a live API token. The
+     * checks mirror what `fromApiToken` requires after verification —
+     * algorithm, subject, a live jti — so this never rejects a token that would
+     * otherwise pass.
+     */
+    mayBeLiveApiToken(token) {
+        let header;
+        let payload;
+        try {
+            header = decodeProtectedHeader(token);
+            payload = decodeJwt(token);
+        }
+        catch {
+            return false;
+        }
+        if (header.alg !== 'EdDSA' || payload.sub !== API_TOKEN_SUBJECT || typeof payload.jti !== 'string')
+            return false;
+        return this.store.getApiToken(payload.jti) !== undefined;
+    }
     resolve(audience) {
         let parsed;
         try {

package/dist/auth/page.js

@@ -1,3 +1,4 @@
+import { escapeInvisibles } from './text.js';
 export function escapeHtml(value) {
     return value.replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
 }
@@ -8,16 +9,21 @@ export function escapeHtml(value) {
  * identity that cannot be invented, which is why the specification asks for it
  * to be shown; a client whose redirect URIs are all local cannot be attributed
  * to anything at all, so that gets said outright.
+ *
+ * Each field also goes through `escapeInvisibles`: registration refuses bidi
+ * and zero-width characters now, but a client stored before that must not be
+ * able to reorder the line the operator judges it by. (`clientName` is
+ * cleaned by `clampDisplayName` before it gets here.)
  */
 export function renderIdentity(redirectUri, identity) {
     const lines = [
         '  <p class="label">Requested access</p>',
-        `  <code class="target">${escapeHtml(identity.resource ?? 'Every server on this hub')}</code>`
+        `  <code class="target">${escapeHtml(escapeInvisibles(identity.resource ?? 'Every server on this hub'))}</code>`
     ];
     if (identity.clientId) {
-        lines.push('  <p class="label">Identified by</p>', `  <code class="target">${escapeHtml(identity.clientId)}</code>`);
+        lines.push('  <p class="label">Identified by</p>', `  <code class="target">${escapeHtml(escapeInvisibles(identity.clientId))}</code>`);
     }
-    lines.push('  <p class="label">Codes will be sent to</p>', `  <code class="target">${escapeHtml(redirectUri)}</code>`);
+    lines.push('  <p class="label">Codes will be sent to</p>', `  <code class="target">${escapeHtml(escapeInvisibles(redirectUri))}</code>`);
     if (identity.loopbackOnly) {
         lines.push('  <p class="error">This client only accepts codes on this machine, so any program running here could be the one asking.</p>');
     }

package/dist/auth/redirect-uri.js

@@ -14,6 +14,38 @@ const DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:',
 function isLoopbackHostname(hostname) {
     return LOOPBACK_HOSTNAMES.has(hostname);
 }
+/**
+ * Printable ASCII, 0x21 `!` through 0x7E `~`. A URI is an ASCII string by
+ * definition (RFC 3986): a control character, a space or any non-ASCII code
+ * point — a bidi override or a zero-width character included — belongs in one
+ * only as `%XX`, and that encoding is itself inside this range.
+ */
+const PRINTABLE_ASCII_ONLY = /^[\x21-\x7E]+$/;
+export function isPrintableAsciiUri(value) {
+    return PRINTABLE_ASCII_ONLY.test(value);
+}
+/**
+ * Whether a URI names a user before its host, `https://claude.ai@evil.example`
+ * being the reason: the reader's eye lands on the part before the `@`, the
+ * browser connects to the part after it.
+ *
+ * Two checks, because each misses a spelling the other catches. The raw string
+ * is needed for an empty userinfo, which the WHATWG parser drops without a
+ * trace (`https://:@host` parses to an empty username and password). The parsed
+ * URL is needed for authorities the parser finds by another spelling, such as
+ * a backslash in place of a slash (`https:/\user@host`). An `@` in the path
+ * or query, or percent-encoded, is not userinfo and stays allowed.
+ */
+export function hasUserinfo(uri, parsed) {
+    if (parsed.username || parsed.password)
+        return true;
+    const marker = uri.indexOf('://');
+    if (marker === -1)
+        return false;
+    const afterMarker = uri.slice(marker + 3);
+    const authorityEnd = afterMarker.search(/[/?#\\]/);
+    return (authorityEnd === -1 ? afterMarker : afterMarker.slice(0, authorityEnd)).includes('@');
+}
 /**
  * https anywhere, plain http only on this machine, and — where the policy
  * allows it — a private-use scheme for a native client.
@@ -21,8 +53,14 @@ function isLoopbackHostname(hostname) {
  * The point of refusing remote `http://` is that the code travels in the clear
  * on the final redirect: anyone on the path between the browser and the client
  * reads it, and a public client has nothing else to prove itself with.
+ *
+ * Every scheme is held to printable ASCII and refused with a userinfo part:
+ * this is the address the login and consent pages show as the one thing "not
+ * chosen by the application", so it must read as what it is.
  */
 export function isSafeRedirectUri(uri, policy) {
+    if (!PRINTABLE_ASCII_ONLY.test(uri))
+        return false;
     let parsed;
     try {
         parsed = new URL(uri);
@@ -30,6 +68,8 @@ export function isSafeRedirectUri(uri, policy) {
     catch {
         return false;
     }
+    if (hasUserinfo(uri, parsed))
+        return false;
     if (DANGEROUS_SCHEMES.has(parsed.protocol))
         return false;
     if (parsed.protocol === 'https:')

package/dist/auth/resource.js

@@ -9,6 +9,22 @@ export function canonicalResourceUrl(resource, origin, config) {
         return undefined;
     return new URL(`/${match[1]}/mcp`, origin);
 }
+/**
+ * The form an operator approval records a resource in, and is looked up by:
+ * canonical when a canonicaliser is available and the value parses, the raw
+ * value otherwise. The issuer itself — the audience of an unbound token —
+ * names no MCP route and is kept as it is.
+ */
+export function approvalResourceKey(resource, issuer, canonicalize) {
+    if (resource === issuer || !canonicalize)
+        return resource;
+    try {
+        return canonicalize(new URL(resource))?.href ?? resource;
+    }
+    catch {
+        return resource;
+    }
+}
 export function resourceUrlForRoute(origin, name) {
     return new URL(name === 'hub' ? '/hub' : `/${name}/mcp`, origin);
 }

package/dist/auth/store.js

@@ -296,6 +296,17 @@ export class AuthStore {
         this.state = next;
         this.signature = this.fileSignature();
     }
+    /** An approval as a state file may hold it: a missing or malformed field
+     *  becomes empty — approved for nothing — rather than stopping the load. */
+    static normalizeApproval(approval) {
+        const source = (approval && typeof approval === 'object' ? approval : {});
+        return {
+            redirectUris: Array.isArray(source.redirectUris) ? source.redirectUris.filter((uri) => typeof uri === 'string') : [],
+            resources: Array.isArray(source.resources) ? source.resources.filter((r) => typeof r === 'string') : [],
+            ...(typeof source.clientName === 'string' ? { clientName: source.clientName } : {}),
+            approvedAt: typeof source.approvedAt === 'number' ? source.approvedAt : Math.floor(Date.now() / 1000)
+        };
+    }
     /**
      * Shapes a parsed state file, or undefined when it is unusable. Fields added
      * later default to empty: a state.json written before client approvals
@@ -310,7 +321,7 @@ export class AuthStore {
             cookieSecret: state.cookieSecret,
             clients: bare(state.clients),
             refreshTokens: bare(state.refreshTokens),
-            approvals: bare(state.approvals),
+            approvals: bare(Object.fromEntries(Object.entries(bare(state.approvals)).map(([id, approval]) => [id, AuthStore.normalizeApproval(approval)]))),
             consumedRefreshTokens: bare(state.consumedRefreshTokens),
             revokedBefore: bare(state.revokedBefore),
             apiTokens: bare(state.apiTokens),
@@ -740,14 +751,20 @@ export class AuthStore {
         this.reloadIfChanged();
         return this.state.approvals[clientId];
     }
-    /** Records consent for one client; a client may legitimately use several
-     *  redirect URIs, so they accumulate rather than replace each other. */
-    saveApproval(clientId, redirectUri, clientName) {
+    /**
+     * Records consent for one client. A client may use several redirect URIs
+     * and be approved for several resources over time, so both accumulate.
+     * `resources` are the ones the page showed; `mcp-hub-admin clients add`
+     * has no page and passes none, so it approves the redirect target only.
+     */
+    saveApproval(clientId, redirectUri, clientName, resources = []) {
         this.mutate(() => {
             const existing = this.state.approvals[clientId];
             const redirectUris = existing ? [...new Set([...existing.redirectUris, redirectUri])] : [redirectUri];
+            const mergedResources = [...new Set([...(existing?.resources ?? []), ...resources])];
             this.state.approvals[clientId] = {
                 redirectUris,
+                resources: mergedResources,
                 clientName: clientName ?? existing?.clientName,
                 approvedAt: existing?.approvedAt ?? Math.floor(Date.now() / 1000)
             };
@@ -772,6 +789,8 @@ export class AuthStore {
     revokeClientAccess(clientId) {
         return this.mutate(() => {
             delete this.state.approvals[clientId];
+            // Only a state file from before the oidc-provider migration still has
+            // entries here; nothing writes this map any more.
             let refreshTokens = 0;
             for (const [hash, record] of Object.entries(this.state.refreshTokens)) {
                 if (record.clientId === clientId) {
@@ -779,6 +798,18 @@ export class AuthStore {
                     refreshTokens++;
                 }
             }
+            // The live refresh tokens are oidc-provider artifacts. revokedBefore
+            // below is what makes them unusable; this only counts them for the
+            // operator reading the command's output.
+            const now = Math.floor(Date.now() / 1000);
+            for (const record of Object.values(this.state.oidcArtifacts.RefreshToken ?? {})) {
+                if (record.consumedAt !== undefined)
+                    continue;
+                if (record.expiresAt !== 0 && record.expiresAt < now)
+                    continue;
+                if (record.payload.clientId === clientId)
+                    refreshTokens++;
+            }
             const revokedBefore = Date.now();
             this.state.revokedBefore[clientId] = revokedBefore;
             return { refreshTokens, revokedBefore };

package/dist/auth/text.js

@@ -33,6 +33,15 @@ export function logSafe(value, maxLength = MAX_LOGGED_LENGTH) {
     });
     return escaped.length > maxLength ? `${escaped.slice(0, maxLength)}…` : escaped;
 }
+/**
+ * Control, format and line/paragraph-separator characters rewritten as a
+ * literal `\u{XXXX}`, so they print instead of acting: a bidi override no
+ * longer reorders the text around it, a zero-width character no longer hides.
+ * For text shown on the login and consent pages, before `escapeHtml`.
+ */
+export function escapeInvisibles(value) {
+    return value.replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, character => `\\u{${(character.codePointAt(0) ?? 0).toString(16)}}`);
+}
 /**
  * A self-declared client name the login and consent pages can show without the
  * name becoming the page. Escaping alone is not enough: the text is still

package/dist/index.js

@@ -194,7 +194,10 @@ export async function createHub(options) {
         externalUrl,
         password: options.password,
         passwordHash: options.passwordHash,
-        cimd
+        cimd,
+        // Same canonicaliser as buildOidcProvider, so an approval is stored
+        // under the key the provider looks up.
+        resolveResource: resource => canonicalResourceUrl(resource, origin, watcher.current)
     }));
     // Ahead of the mount, so the hub's stricter RFC 7592 handlers win the
     // /register/:id route over oidc-provider's.