@ni-c/mcp-hub 0.11.3 → 0.11.4

package/CHANGELOG.md

@@ -7,6 +7,80 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.11.4] - 2026-09-24
+
+### Security
+
+- **An approval for one server was an approval for all of them.** The login
+  and consent pages name the resource a client asks for under *Requested
+  access*, but the approval was stored for the client and its redirect URI
+  only. While the operator's session lasted, a client approved for
+  `/paperless/mcp` could ask for `/hub` and receive a code without any page —
+  a token for every server. The approval now records the resources the page
+  showed, and a request for any other one brings the page back: *Approve /
+  Deny* within a live session, the sign-in page otherwise. Approvals written
+  by an older version name no resource, so each connector sees the page once
+  more the next time it authorizes; refresh tokens are unaffected.
+  `mcp-hub-admin clients list` shows `approvedResources`.
+- **A remote upstream's reply had no size limit.** The control plane to an
+  upstream's authorization server has capped every response since August; the
+  MCP requests themselves read whatever came back, so one `tools/call` answered
+  with 300 MiB cost the hub 630 MB of heap, and an event without a line end
+  grew without bound in the SDK's SSE parser. Replies are now held to 10 MiB,
+  the limit the byte-stream transports apply to one message — a JSON reply as a
+  whole, an event stream per event, and a declared `content-length` above it is
+  refused before reading. `resources/updated` URIs longer than
+  `MCP_SUBSCRIPTION_MAX_URI_BYTES` (8 KiB) are dropped.
+- **The consent page could be made to show a different address.** A redirect
+  URI such as `https://claude.ai@attacker.example/cb` connects to
+  `attacker.example`, and a bidi override or zero-width character in a
+  redirect URI or metadata document URL could reorder or hide the host in the
+  line the operator reads. Both are refused now, for every scheme and both
+  registration mechanisms; percent-encoded bytes are still accepted, and
+  values stored earlier are shown with such characters as visible escapes.
+- **`/revoke` was not rate-limited.** It runs the same client authentication as
+  `/token`, `private_key_jwt` signature checks included, and a client can
+  register itself; it now has the same budget as `/token`, counted
+  separately so a flood of one cannot starve the other.
+- **Requests could drive a crashing server's restarts.** Every request to an
+  on-demand server cancelled its crash backoff and reset the give-up count, so
+  a client repeating a call restarted a crashing sandbox container at its own
+  pace — 30 attempts in 12 seconds instead of 4. A request now waits for the
+  scheduled restart; after a give-up the first request retries and further
+  ones within the backoff get the last error.
+- **DPoP was offered but never checked.** oidc-provider enables it by default,
+  so a client that sent a proof received a `DPoP` token that the hub then
+  accepted as a plain bearer. It is switched off, which is what the standards
+  page already said.
+- **Text from a sandbox or an upstream reached the terminal unescaped.** A
+  sandbox container's stderr and an upstream authorization server's error text
+  in `mcp-hub-admin upstream …` now go through the same escaping as every other
+  stranger's text, so an escape sequence or a bare CR can no longer rewrite
+  what the operator sees. `LOG_FILE` was not affected.
+- **An upstream token with a line break broke its server for good.** A token
+  containing CR or LF was stored and then made every request to that server
+  fail in `Headers.set()`, while `/health` kept showing it up. Tokens, and the
+  RFC 7592 registration token, must now be printable ASCII of at most 16 KiB;
+  a malformed one fails the server's authorization instead of being stored,
+  and its value is never logged.
+
+Reported by the 2026-09-24 internal review.
+
+### Fixed
+
+- **A wrongly signed JWT cost a signature check.** A bearer shaped like an
+  API token is now decoded first and only verified when its algorithm,
+  subject and `jti` match a live token, which makes rejecting garbage about
+  twenty times cheaper. A valid token is still verified in full, and
+  revocation is still checked after verification.
+- **`clients revoke` reported 0 refresh tokens.** It counted a map nothing
+  writes any more; it now counts the live ones it invalidates. The revocation
+  itself was always effective.
+- **A character split across two docker frames was garbled** in the sandbox's
+  stderr; the stream is now decoded across frame boundaries, and a last line
+  without a newline is written out when the container stops instead of being
+  dropped.
+
 ## [0.11.3] - 2026-09-12
 
 ### Security

package/README.md

@@ -4,7 +4,7 @@
 
 [![CI](https://img.shields.io/github/actions/workflow/status/ni-c/mcp-hub/ci.yml?branch=main&label=CI)](https://github.com/ni-c/mcp-hub/actions/workflows/ci.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ni-c/mcp-hub/badge)](https://scorecard.dev/viewer/?uri=github.com/ni-c/mcp-hub)
-<a href="https://socket.dev/npm/package/@ni-c/mcp-hub"><img src="https://socket.dev/api/badge/npm/package/@ni-c/mcp-hub" alt="Socket supply-chain report" height="20"></a>
+[![Socket Badge](https://badge.socket.dev/npm/package/@ni-c/mcp-hub)](https://socket.dev/npm/package/@ni-c/mcp-hub)
 [![Glama score](https://glama.ai/mcp/servers/ni-c/mcp-hub/badges/score.svg)](https://glama.ai/mcp/servers/ni-c/mcp-hub)
 <br>
 [![npm version](https://img.shields.io/npm/v/%40ni-c%2Fmcp-hub)](https://www.npmjs.com/package/@ni-c/mcp-hub)
@@ -386,10 +386,11 @@ and log in once with the password. Claude Code:
 (OpenAI Responses API, xAI, Gemini API) use an admin-minted token instead —
 see [client compatibility](https://mcp-hub.ni-c.de/guide/client-compatibility).
 
-Each client is confirmed once. Entering the password approves the client that
-asked; while a login session is still valid, a client you have not seen before
-gets an explicit _Approve / Deny_ page instead of a code. Approved clients
-reconnect silently from then on.
+Each client is confirmed once per server it asks for. Entering the password
+approves the client that asked, for the server shown on the page; while a login
+session is still valid, a client you have not seen before — or one asking for
+another server — gets an explicit _Approve / Deny_ page instead of a code.
+Approved clients reconnect silently from then on.
 
 List clients or revoke one. The CLI shares `/data` with the running hub and
 both sides re-read the state file before they touch it, so this works against a

package/dist/admin.js

@@ -2,7 +2,7 @@
 import crypto from 'node:crypto';
 import { AuthStore, clientLimitsFromEnv } from './auth/store.js';
 import { isSafeRedirectUri } from './auth/redirect-uri.js';
-import { clampDisplayName } from './auth/text.js';
+import { clampDisplayName, logSafe } from './auth/text.js';
 import { isClientIdMetadataUrl } from './auth/cimd.js';
 import { mintApiToken } from './auth/api-tokens.js';
 import { loadConfig } from './config.js';
@@ -31,8 +31,10 @@ function usage() {
     ].join('\n'));
     process.exit(2);
 }
+/** Messages here can carry an upstream authorization server's own error
+ *  text, so they are escaped before they reach the operator's terminal. */
 function fail(message) {
-    console.error(message);
+    console.error(logSafe(message));
     process.exit(2);
 }
 function flag(args, name) {
@@ -65,6 +67,7 @@ if (group === 'clients' && action === 'list') {
         via: clientOrigin(id),
         registeredRedirectUris: client.redirect_uris,
         approvedRedirectUris: approvals[id]?.redirectUris ?? [],
+        approvedResources: approvals[id]?.resources ?? [],
         approvedAt: approvals[id] ? new Date(approvals[id].approvedAt * 1000).toISOString() : null
     }));
     // Metadata-document clients are never stored — the document is fetched fresh
@@ -80,6 +83,7 @@ if (group === 'clients' && action === 'list') {
             via: clientOrigin(id),
             registeredRedirectUris: [],
             approvedRedirectUris: approval.redirectUris,
+            approvedResources: approval.resources,
             approvedAt: new Date(approval.approvedAt * 1000).toISOString()
         });
     }
@@ -324,8 +328,9 @@ if (group === 'upstream') {
         // unreachable must never leave a credential behind here.
         const problems = await auth.revokeRemotely().catch(error => [error.message]);
         const forgotten = store.forgetUpstreamCredentials(name);
+        // A revocation failure can carry the authorization server's own text.
         for (const problem of problems)
-            console.error(`Upstream revocation: ${problem}`);
+            console.error(`Upstream revocation: ${logSafe(problem)}`);
         console.log(JSON.stringify({ server: name, forgotten, revokedAtUpstream: problems.length === 0 }, null, 2));
         process.exit(problems.length > 0 ? 1 : 0);
     }

package/dist/auth/cimd.js

@@ -1,6 +1,6 @@
 import { isPrivateAddress, resolvePublicAddress } from './address.js';
 import { guardedRequest } from './pinned-fetch.js';
-import { isSafeRedirectUri } from './redirect-uri.js';
+import { hasUserinfo, isPrintableAsciiUri, isSafeRedirectUri } from './redirect-uri.js';
 import { clampDisplayName, logSafe } from './text.js';
 // Lives in address.ts now — re-exported because it is part of this module's
 // established surface and the test suite reaches for it here.
@@ -59,8 +59,14 @@ export function setCimdFetch(fn) {
  * fragment, no credentials and no dot-segments. A `client_id` that fails this
  * is not a metadata document URL at all and is looked up as a locally
  * registered client instead — which is what keeps DCR working beside CIMD.
+ *
+ * The consent page shows this URL as the part of the client's identity that
+ * cannot be invented, so it is held to the same printable-ASCII and
+ * no-userinfo rules as a redirect URI.
  */
 export function isClientIdMetadataUrl(clientId) {
+    if (!isPrintableAsciiUri(clientId))
+        return false;
     let url;
     try {
         url = new URL(clientId);
@@ -70,7 +76,7 @@ export function isClientIdMetadataUrl(clientId) {
     }
     if (url.protocol !== 'https:')
         return false;
-    if (url.hash || url.username || url.password)
+    if (url.hash || hasUserinfo(clientId, url))
         return false;
     if (url.pathname === '' || url.pathname === '/')
         return false;

package/dist/auth/oidc/interactions.js

@@ -5,9 +5,17 @@ import { renderLoginPage } from '../login-page.js';
 import { earlyRateLimit, LoginRateLimiter } from '../rate-limit.js';
 import { operatorCredential } from '../password.js';
 import { isLoopbackOnly } from '../redirect-uri.js';
+import { approvalResourceKey } from '../resource.js';
 import { createSessionCookie, csrfToken, readSessionCookie, SESSION_TTL_MS, sessionCookieName, verifyCsrfToken } from '../session.js';
 import { logSafe } from '../text.js';
 import { HUB_ACCOUNT_ID } from './provider.js';
+/** The resources the page showed under "Requested access", in the form
+ *  loadExistingGrant looks an approval up by. */
+function canonicalizeRequestedResources(resource, options) {
+    return [resource ?? []]
+        .flat()
+        .map(value => approvalResourceKey(String(value), options.externalUrl, options.resolveResource));
+}
 /** Express 5 forwards a rejected handler promise on its own; this makes that explicit and typed. */
 const asyncHandler = (handler) => (req, res, next) => {
     handler(req, res, next).catch(next);
@@ -140,11 +148,13 @@ export function createOidcInteractionRoutes(options) {
         }
         rateLimiter.reset(ip);
         console.log(`mcp-hub: successful login from ${logSafe(ip)}`);
-        // Typing the password is the consent for the client that triggered it.
+        // Typing the password is the consent for the client that triggered it:
+        // for its redirect target and for the resource the page showed.
         const clientId = String(params.client_id);
         const client = await provider.Client.find(clientId);
         const clientName = client?.metadata()?.client_name;
-        store.saveApproval(clientId, redirectUri, typeof clientName === 'string' ? clientName : undefined);
+        const resources = canonicalizeRequestedResources(params.resource, options);
+        store.saveApproval(clientId, redirectUri, typeof clientName === 'string' ? clientName : undefined, resources);
         console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(redirectUri)}`);
         // `__Host-` behind HTTPS: the browser then refuses the cookie from any
         // other origin, path or domain, so nobody can fix a session into this
@@ -191,7 +201,8 @@ export function createOidcInteractionRoutes(options) {
         const clientId = String(params.client_id);
         const client = await provider.Client.find(clientId);
         const clientName = client?.metadata()?.client_name;
-        store.saveApproval(clientId, String(params.redirect_uri ?? ''), typeof clientName === 'string' ? clientName : undefined);
+        const resources = canonicalizeRequestedResources(params.resource, options);
+        store.saveApproval(clientId, String(params.redirect_uri ?? ''), typeof clientName === 'string' ? clientName : undefined, resources);
         console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(String(params.redirect_uri ?? ''))}`);
         // The grant itself is minted by loadExistingGrant on the resumed request,
         // which is the same code path an already-approved client takes.

package/dist/auth/oidc/mount.js

@@ -76,7 +76,12 @@ export function defaultRateLimits() {
         '/register/:id': [earlyRateLimit(60 * 60_000, 60, 600)],
         '/authorize': [earlyRateLimit(15 * 60_000, 100, 1_000)],
         '/authorize/:uid': [earlyRateLimit(15 * 60_000, 100, 1_000)],
-        '/token': [earlyRateLimit(15 * 60_000, 50, 500)]
+        '/token': [earlyRateLimit(15 * 60_000, 50, 500)],
+        // '/revoke' authenticates the client exactly as '/token' does,
+        // private_key_jwt signature checks included, for any caller that has
+        // registered itself — so it gets the same budget, counted separately so a
+        // flood of one cannot starve the other.
+        '/revoke': [earlyRateLimit(15 * 60_000, 50, 500)]
     };
 }
 /**

package/dist/auth/oidc/provider.js

@@ -1,5 +1,6 @@
 import Provider, { errors } from 'oidc-provider';
 import { isSafeRedirectUri, redirectUriMatches } from '../redirect-uri.js';
+import { approvalResourceKey } from '../resource.js';
 import { clampDisplayName } from '../text.js';
 import { createOidcAdapter } from './adapter.js';
 import { HUB_SCOPE, installDiscoveryFixups, installThrowawaySecret } from './quirks.js';
@@ -103,6 +104,11 @@ export function buildOidcProvider(store, options) {
                 ack: 'draft-02',
                 allowFetch: () => false
             },
+            // On by default in oidc-provider. The resource server never checks a
+            // proof, so a `token_type: "DPoP"` token would promise a sender
+            // constraint nothing enforces. Off, clients get the bearer token they
+            // actually hold.
+            dPoP: { enabled: false },
             resourceIndicators: {
                 enabled: true,
                 useGrantedResource: () => true,
@@ -359,9 +365,24 @@ export function buildOidcProvider(store, options) {
                 .filter(Boolean);
             if (scopes.length > 0)
                 grant.addOIDCScope(scopes.join(' '));
+            /**
+             * The resource gets the same discipline as the redirect URI: the page
+             * named it under "Requested access", so the approval covers that
+             * resource and no other. One the operator has not approved is left off
+             * the grant, and oidc-provider's own `rs_scopes_missing` check then asks
+             * — the consent page with a live session, the login page without — and
+             * approving adds it before this runs again for the resumed request.
+             *
+             * Matched in raw and canonical form, since the interaction routes may
+             * run without a canonicaliser; added in raw form, because that is the
+             * key `rs_scopes_missing` looks the resource up by.
+             */
+            const approvedResources = approval?.resources ?? [];
             const requested = ctx.oidc.params?.resource;
-            for (const resource of [requested ?? []].flat()) {
-                grant.addResourceScope(String(resource), HUB_SCOPE);
+            for (const resource of [requested ?? []].flat().map(String)) {
+                const key = approvalResourceKey(resource, options.externalUrl, options.resolveResource);
+                if (approvedResources.includes(resource) || approvedResources.includes(key))
+                    grant.addResourceScope(resource, HUB_SCOPE);
             }
             await grant.save();
             return grant;

package/dist/auth/oidc/verifier.js

@@ -1,5 +1,5 @@
 import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
-import { jwtVerify } from 'jose';
+import { decodeJwt, decodeProtectedHeader, jwtVerify } from 'jose';
 import { API_TOKEN_SUBJECT } from '../api-tokens.js';
 /**
  * The one error shape `requireBearerAuth` recognises.
@@ -31,9 +31,11 @@ function invalidToken(message) {
  * which is what `tokens revoke` deletes.
  *
  * Order matters. Opaque is tried first because it is the common case and needs
- * no cryptography; a value that is not a stored token then gets exactly one
- * signature check. Neither branch may report why it failed — an attacker must
- * not be able to tell "unknown" from "revoked" from "wrong audience".
+ * no cryptography; a value that is not a stored token then reaches at most one
+ * signature check, and only if its decoded claims name a live API token.
+ * Neither branch may report why it failed — an
+ * attacker must not be able to tell "unknown" from "revoked" from "wrong
+ * audience".
  */
 export class OidcTokenVerifier {
     store;
@@ -76,6 +78,12 @@ export class OidcTokenVerifier {
         };
     }
     async fromApiToken(token) {
+        // Anyone can send a well-formed, wrongly signed JWT for free, and an EdDSA
+        // verification costs about twenty times a decode. The decode proves
+        // nothing, so it can only reject early: a token naming a live jti still
+        // has its signature checked below before anything is trusted.
+        if (!this.mayBeLiveApiToken(token))
+            throw invalidToken('Invalid or expired access token');
         let payload;
         try {
             ({ payload } = await jwtVerify(token, this.store.publicKey, {
@@ -92,6 +100,9 @@ export class OidcTokenVerifier {
         // credential nothing can revoke.
         if (payload.sub !== API_TOKEN_SUBJECT)
             throw invalidToken('Invalid access token claims');
+        // Checked again after verification, not only in the pre-check: a
+        // `tokens revoke` that lands while the signature is being verified must
+        // still refuse this request.
         if (typeof payload.jti !== 'string' || !this.store.getApiToken(payload.jti)) {
             throw invalidToken('Access token has been revoked');
         }
@@ -107,6 +118,26 @@ export class OidcTokenVerifier {
             resource
         };
     }
+    /**
+     * Whether a token's unverified claims could belong to a live API token. The
+     * checks mirror what `fromApiToken` requires after verification —
+     * algorithm, subject, a live jti — so this never rejects a token that would
+     * otherwise pass.
+     */
+    mayBeLiveApiToken(token) {
+        let header;
+        let payload;
+        try {
+            header = decodeProtectedHeader(token);
+            payload = decodeJwt(token);
+        }
+        catch {
+            return false;
+        }
+        if (header.alg !== 'EdDSA' || payload.sub !== API_TOKEN_SUBJECT || typeof payload.jti !== 'string')
+            return false;
+        return this.store.getApiToken(payload.jti) !== undefined;
+    }
     resolve(audience) {
         let parsed;
         try {

package/dist/auth/page.js

@@ -1,3 +1,4 @@
+import { escapeInvisibles } from './text.js';
 export function escapeHtml(value) {
     return value.replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
 }
@@ -8,16 +9,21 @@ export function escapeHtml(value) {
  * identity that cannot be invented, which is why the specification asks for it
  * to be shown; a client whose redirect URIs are all local cannot be attributed
  * to anything at all, so that gets said outright.
+ *
+ * Each field also goes through `escapeInvisibles`: registration refuses bidi
+ * and zero-width characters now, but a client stored before that must not be
+ * able to reorder the line the operator judges it by. (`clientName` is
+ * cleaned by `clampDisplayName` before it gets here.)
  */
 export function renderIdentity(redirectUri, identity) {
     const lines = [
         '  <p class="label">Requested access</p>',
-        `  <code class="target">${escapeHtml(identity.resource ?? 'Every server on this hub')}</code>`
+        `  <code class="target">${escapeHtml(escapeInvisibles(identity.resource ?? 'Every server on this hub'))}</code>`
     ];
     if (identity.clientId) {
-        lines.push('  <p class="label">Identified by</p>', `  <code class="target">${escapeHtml(identity.clientId)}</code>`);
+        lines.push('  <p class="label">Identified by</p>', `  <code class="target">${escapeHtml(escapeInvisibles(identity.clientId))}</code>`);
     }
-    lines.push('  <p class="label">Codes will be sent to</p>', `  <code class="target">${escapeHtml(redirectUri)}</code>`);
+    lines.push('  <p class="label">Codes will be sent to</p>', `  <code class="target">${escapeHtml(escapeInvisibles(redirectUri))}</code>`);
     if (identity.loopbackOnly) {
         lines.push('  <p class="error">This client only accepts codes on this machine, so any program running here could be the one asking.</p>');
     }

package/dist/auth/redirect-uri.js

@@ -14,6 +14,38 @@ const DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:',
 function isLoopbackHostname(hostname) {
     return LOOPBACK_HOSTNAMES.has(hostname);
 }
+/**
+ * Printable ASCII, 0x21 `!` through 0x7E `~`. A URI is an ASCII string by
+ * definition (RFC 3986): a control character, a space or any non-ASCII code
+ * point — a bidi override or a zero-width character included — belongs in one
+ * only as `%XX`, and that encoding is itself inside this range.
+ */
+const PRINTABLE_ASCII_ONLY = /^[\x21-\x7E]+$/;
+export function isPrintableAsciiUri(value) {
+    return PRINTABLE_ASCII_ONLY.test(value);
+}
+/**
+ * Whether a URI names a user before its host, `https://claude.ai@evil.example`
+ * being the reason: the reader's eye lands on the part before the `@`, the
+ * browser connects to the part after it.
+ *
+ * Two checks, because each misses a spelling the other catches. The raw string
+ * is needed for an empty userinfo, which the WHATWG parser drops without a
+ * trace (`https://:@host` parses to an empty username and password). The parsed
+ * URL is needed for authorities the parser finds by another spelling, such as
+ * a backslash in place of a slash (`https:/\user@host`). An `@` in the path
+ * or query, or percent-encoded, is not userinfo and stays allowed.
+ */
+export function hasUserinfo(uri, parsed) {
+    if (parsed.username || parsed.password)
+        return true;
+    const marker = uri.indexOf('://');
+    if (marker === -1)
+        return false;
+    const afterMarker = uri.slice(marker + 3);
+    const authorityEnd = afterMarker.search(/[/?#\\]/);
+    return (authorityEnd === -1 ? afterMarker : afterMarker.slice(0, authorityEnd)).includes('@');
+}
 /**
  * https anywhere, plain http only on this machine, and — where the policy
  * allows it — a private-use scheme for a native client.
@@ -21,8 +53,14 @@ function isLoopbackHostname(hostname) {
  * The point of refusing remote `http://` is that the code travels in the clear
  * on the final redirect: anyone on the path between the browser and the client
  * reads it, and a public client has nothing else to prove itself with.
+ *
+ * Every scheme is held to printable ASCII and refused with a userinfo part:
+ * this is the address the login and consent pages show as the one thing "not
+ * chosen by the application", so it must read as what it is.
  */
 export function isSafeRedirectUri(uri, policy) {
+    if (!PRINTABLE_ASCII_ONLY.test(uri))
+        return false;
     let parsed;
     try {
         parsed = new URL(uri);
@@ -30,6 +68,8 @@ export function isSafeRedirectUri(uri, policy) {
     catch {
         return false;
     }
+    if (hasUserinfo(uri, parsed))
+        return false;
     if (DANGEROUS_SCHEMES.has(parsed.protocol))
         return false;
     if (parsed.protocol === 'https:')

package/dist/auth/resource.js

@@ -9,6 +9,22 @@ export function canonicalResourceUrl(resource, origin, config) {
         return undefined;
     return new URL(`/${match[1]}/mcp`, origin);
 }
+/**
+ * The form an operator approval records a resource in, and is looked up by:
+ * canonical when a canonicaliser is available and the value parses, the raw
+ * value otherwise. The issuer itself — the audience of an unbound token —
+ * names no MCP route and is kept as it is.
+ */
+export function approvalResourceKey(resource, issuer, canonicalize) {
+    if (resource === issuer || !canonicalize)
+        return resource;
+    try {
+        return canonicalize(new URL(resource))?.href ?? resource;
+    }
+    catch {
+        return resource;
+    }
+}
 export function resourceUrlForRoute(origin, name) {
     return new URL(name === 'hub' ? '/hub' : `/${name}/mcp`, origin);
 }

package/dist/auth/store.js

@@ -296,6 +296,17 @@ export class AuthStore {
         this.state = next;
         this.signature = this.fileSignature();
     }
+    /** An approval as a state file may hold it: a missing or malformed field
+     *  becomes empty — approved for nothing — rather than stopping the load. */
+    static normalizeApproval(approval) {
+        const source = (approval && typeof approval === 'object' ? approval : {});
+        return {
+            redirectUris: Array.isArray(source.redirectUris) ? source.redirectUris.filter((uri) => typeof uri === 'string') : [],
+            resources: Array.isArray(source.resources) ? source.resources.filter((r) => typeof r === 'string') : [],
+            ...(typeof source.clientName === 'string' ? { clientName: source.clientName } : {}),
+            approvedAt: typeof source.approvedAt === 'number' ? source.approvedAt : Math.floor(Date.now() / 1000)
+        };
+    }
     /**
      * Shapes a parsed state file, or undefined when it is unusable. Fields added
      * later default to empty: a state.json written before client approvals
@@ -310,7 +321,7 @@ export class AuthStore {
             cookieSecret: state.cookieSecret,
             clients: bare(state.clients),
             refreshTokens: bare(state.refreshTokens),
-            approvals: bare(state.approvals),
+            approvals: bare(Object.fromEntries(Object.entries(bare(state.approvals)).map(([id, approval]) => [id, AuthStore.normalizeApproval(approval)]))),
             consumedRefreshTokens: bare(state.consumedRefreshTokens),
             revokedBefore: bare(state.revokedBefore),
             apiTokens: bare(state.apiTokens),
@@ -740,14 +751,20 @@ export class AuthStore {
         this.reloadIfChanged();
         return this.state.approvals[clientId];
     }
-    /** Records consent for one client; a client may legitimately use several
-     *  redirect URIs, so they accumulate rather than replace each other. */
-    saveApproval(clientId, redirectUri, clientName) {
+    /**
+     * Records consent for one client. A client may use several redirect URIs
+     * and be approved for several resources over time, so both accumulate.
+     * `resources` are the ones the page showed; `mcp-hub-admin clients add`
+     * has no page and passes none, so it approves the redirect target only.
+     */
+    saveApproval(clientId, redirectUri, clientName, resources = []) {
         this.mutate(() => {
             const existing = this.state.approvals[clientId];
             const redirectUris = existing ? [...new Set([...existing.redirectUris, redirectUri])] : [redirectUri];
+            const mergedResources = [...new Set([...(existing?.resources ?? []), ...resources])];
             this.state.approvals[clientId] = {
                 redirectUris,
+                resources: mergedResources,
                 clientName: clientName ?? existing?.clientName,
                 approvedAt: existing?.approvedAt ?? Math.floor(Date.now() / 1000)
             };
@@ -772,6 +789,8 @@ export class AuthStore {
     revokeClientAccess(clientId) {
         return this.mutate(() => {
             delete this.state.approvals[clientId];
+            // Only a state file from before the oidc-provider migration still has
+            // entries here; nothing writes this map any more.
             let refreshTokens = 0;
             for (const [hash, record] of Object.entries(this.state.refreshTokens)) {
                 if (record.clientId === clientId) {
@@ -779,6 +798,18 @@ export class AuthStore {
                     refreshTokens++;
                 }
             }
+            // The live refresh tokens are oidc-provider artifacts. revokedBefore
+            // below is what makes them unusable; this only counts them for the
+            // operator reading the command's output.
+            const now = Math.floor(Date.now() / 1000);
+            for (const record of Object.values(this.state.oidcArtifacts.RefreshToken ?? {})) {
+                if (record.consumedAt !== undefined)
+                    continue;
+                if (record.expiresAt !== 0 && record.expiresAt < now)
+                    continue;
+                if (record.payload.clientId === clientId)
+                    refreshTokens++;
+            }
             const revokedBefore = Date.now();
             this.state.revokedBefore[clientId] = revokedBefore;
             return { refreshTokens, revokedBefore };

package/dist/auth/text.js

@@ -33,6 +33,15 @@ export function logSafe(value, maxLength = MAX_LOGGED_LENGTH) {
     });
     return escaped.length > maxLength ? `${escaped.slice(0, maxLength)}…` : escaped;
 }
+/**
+ * Control, format and line/paragraph-separator characters rewritten as a
+ * literal `\u{XXXX}`, so they print instead of acting: a bidi override no
+ * longer reorders the text around it, a zero-width character no longer hides.
+ * For text shown on the login and consent pages, before `escapeHtml`.
+ */
+export function escapeInvisibles(value) {
+    return value.replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, character => `\\u{${(character.codePointAt(0) ?? 0).toString(16)}}`);
+}
 /**
  * A self-declared client name the login and consent pages can show without the
  * name becoming the page. Escaping alone is not enough: the text is still

package/dist/index.js

@@ -194,7 +194,10 @@ export async function createHub(options) {
         externalUrl,
         password: options.password,
         passwordHash: options.passwordHash,
-        cimd
+        cimd,
+        // Same canonicaliser as buildOidcProvider, so an approval is stored
+        // under the key the provider looks up.
+        resolveResource: resource => canonicalResourceUrl(resource, origin, watcher.current)
     }));
     // Ahead of the mount, so the hub's stricter RFC 7592 handlers win the
     // /register/:id route over oidc-provider's.

package/dist/subscriptions.js

@@ -1,3 +1,4 @@
+import { logSafe } from './auth/text.js';
 import { booleanEnv, nonNegativeIntegerEnv, positiveIntegerEnv } from './mcp-limits.js';
 /**
  * Carrying a child's change notifications to the client that asked for them.
@@ -71,6 +72,15 @@ export const MAX_STREAM_MS = nonNegativeIntegerEnv('MCP_SUBSCRIPTION_MAX_MS', 30
  * window would otherwise be a million map entries the hub holds for it.
  */
 const MAX_PENDING_EVENTS = 1024;
+/**
+ * Longest `resources/updated` URI the hub holds or forwards; a longer one is
+ * dropped. A URI names what to re-read — nothing legitimate comes near this.
+ * `MAX_PENDING_EVENTS` bounds how many one window holds, this how large each
+ * may be, whichever transport the child sends it over.
+ */
+export const MAX_RESOURCE_URI_BYTES = positiveIntegerEnv('MCP_SUBSCRIPTION_MAX_URI_BYTES', 8 * 1024);
+/** At most one log line a minute per registry about dropped URIs. */
+const OVERSIZED_URI_WARNING_INTERVAL_MS = 60_000;
 /** True unless an operator said otherwise, globally or for this server. */
 export function subscriptionsAllowed(config) {
     return SUBSCRIPTIONS_ENABLED && config.subscriptions !== 'off';
@@ -131,6 +141,7 @@ export class SubscriptionRegistry {
     nextId = 1;
     timer;
     closed = false;
+    lastOversizedUriWarningAt = 0;
     constructor(notifier, options = {}) {
         this.notifier = notifier;
         this.options = options;
@@ -172,6 +183,10 @@ export class SubscriptionRegistry {
     publish(event) {
         if (this.closed)
             return;
+        if (event.kind === 'resource_updated' && Buffer.byteLength(event.uri, 'utf8') > MAX_RESOURCE_URI_BYTES) {
+            this.warnOversizedUri(event.uri);
+            return;
+        }
         const debounceMs = this.options.debounceMs ?? DEBOUNCE_MS;
         if (debounceMs <= 0) {
             this.deliver(event);
@@ -236,6 +251,14 @@ export class SubscriptionRegistry {
                 return;
         }
     }
+    /** The URI is the child's own text, so it is escaped and truncated. */
+    warnOversizedUri(uri) {
+        const now = Date.now();
+        if (now - this.lastOversizedUriWarningAt < OVERSIZED_URI_WARNING_INTERVAL_MS)
+            return;
+        this.lastOversizedUriWarningAt = now;
+        console.error(`mcp-hub: dropped a resources/updated notification whose uri exceeded ${MAX_RESOURCE_URI_BYTES} bytes: ${logSafe(uri)}`);
+    }
     close() {
         this.closed = true;
         clearTimeout(this.timer);

package/dist/supervisor.js

@@ -186,8 +186,16 @@ export class ManagedServer {
     restartTimer;
     pingTimer;
     stopping = false;
-    /** Failed restarts since the last real use; wake() and markUsed() reset it. */
+    /** Failed restarts since the server was last up or used; a start that
+     *  reaches 'up' and markUsed() reset it, wake() does not. */
     restartsSinceUse = 0;
+    /**
+     * When a request last revived a server that had given up. The first request
+     * after a give-up retries at once; another one within the current backoff is
+     * refused, so a caller repeating it cannot restart the server faster than its
+     * own crashes allow. Cleared by a start that reaches 'up'.
+     */
+    lastGiveUpRetryAt = 0;
     wakeWaiters = [];
     /**
      * Invalidates callbacks of an abandoned transport: sleep() and stop() tear a
@@ -250,6 +258,15 @@ export class ManagedServer {
         if (this.state === 'unauthorized') {
             return Promise.reject(new Error(`Server "${this.name}" needs an upstream login`));
         }
+        // A server that gave up revives on request, but no faster than its backoff.
+        // A request inside the window fails fast with the error the give-up
+        // reported, rather than queueing behind an attempt that is not coming.
+        if (this.state === 'sleeping' && this.restartsSinceUse > 0) {
+            if (Date.now() - this.lastGiveUpRetryAt < this.backoffMs) {
+                return Promise.reject(new Error(`Server "${this.name}" failed to start: ${this.lastError}`));
+            }
+            this.lastGiveUpRetryAt = Date.now();
+        }
         const timeoutMs = this.options.wakeTimeoutMs ?? WAKE_TIMEOUT_MS;
         const promise = new Promise((resolve, reject) => {
             const waiter = {
@@ -264,16 +281,20 @@ export class ManagedServer {
             waiter.timer.unref();
             this.wakeWaiters.push(waiter);
         });
-        if (this.state === 'sleeping') {
-            this.restartsSinceUse = 0;
+        if (this.state === 'sleeping' && this.restartsSinceUse === 0) {
+            // Idle sleep or a cache-hydrated boot: no crash history, wake at once.
             this.backoffMs = this.options.backoffInitialMs ?? BACKOFF_INITIAL_MS;
             void this.start();
         }
-        else if (this.state === 'down') {
-            // Someone is asking — no point in sitting out the rest of the backoff.
-            clearTimeout(this.restartTimer);
+        else if (this.state === 'sleeping') {
+            // Given up earlier: this is the one attempt the window above allows.
+            // The backoff and the give-up count carry on from where the crashes
+            // left them instead of starting over.
             void this.start();
         }
+        // 'down': a restart is already scheduled by the backoff. The caller waits
+        // for it; cancelling the timer to start now would let requests set the
+        // pace of a crash loop.
         // 'starting': the in-flight start resolves the waiter.
         return promise;
     }
@@ -393,6 +414,9 @@ export class ManagedServer {
         // The start itself opens a full idle window, so a pre-warmed server is not
         // swept away just before the tool call it was warmed for.
         this.lastUsedAt = this.startedAt;
+        // Coming up is what clears the crash history — being asked for does not.
+        this.restartsSinceUse = 0;
+        this.lastGiveUpRetryAt = 0;
         // The child's declared identity, on its way into a file LOG_FILE mirrors
         // and fail2ban reads: escaped and bounded like any other stranger's text.
         console.log(`[${this.name}] up (${logSafe(this.serverInfo?.name ?? 'unknown', 100)} ${logSafe(this.serverInfo?.version ?? '', 40)})`.trim());
@@ -671,6 +695,9 @@ export class ManagedServer {
             // forever. Give up until the next wake, which starts fresh.
             console.error(`[${this.name}] down (${logSafe(reason, 500)}), giving up until next use after ${this.restartsSinceUse - 1} failed restarts`);
             this.state = 'sleeping';
+            // lastGiveUpRetryAt stays as it is: zero after a first give-up, so the
+            // next request retries at once; the time of that retry when the retry
+            // is what failed, so the one after it waits for the backoff.
             this.rejectWakeWaiters(new Error(`Server "${this.name}" failed to start: ${reason}`));
             return;
         }

package/dist/transports/docker.js

@@ -1,3 +1,5 @@
+import { StringDecoder } from 'node:string_decoder';
+import { logSafe } from '../auth/text.js';
 import { buildCreateRequest, containerName } from '../sandbox/container-spec.js';
 import { StreamTransport, setTransportHandlers } from './stream.js';
 /** Guards against a corrupt header turning into a multi-gigabyte allocation. */
@@ -96,6 +98,9 @@ export class DockerTransport {
     stream;
     closing = false;
     stderrTail = '';
+    // A frame boundary can split a multi-byte UTF-8 character; the decoder
+    // carries the partial bytes into the next frame.
+    stderrDecoder = new StringDecoder('utf8');
     constructor(server, config, client, writeStderr = line => process.stderr.write(line)) {
         this.server = server;
         this.config = config;
@@ -162,6 +167,12 @@ export class DockerTransport {
         this.closing = true;
         await this.inner?.close();
         this.stream?.destroy();
+        // A last line without a newline, or a character cut off by the exit, would
+        // otherwise go down with the container — and it is often the reason.
+        const rest = this.stderrTail + this.stderrDecoder.end();
+        this.stderrTail = '';
+        if (rest)
+            this.writeStderr(`[${this.server}] ${logSafe(rest, Infinity)}\n`);
         await this.client.removeContainer(containerName(this.server)).catch(() => { });
     }
     async ensureImage() {
@@ -177,15 +188,20 @@ export class DockerTransport {
      * to the process's stderr rather than through console: stdio children use
      * `stderr: 'inherit'` and bypass console too, which is what keeps LOG_FILE
      * (read by fail2ban) free of server chatter.
+     *
+     * The container is untrusted, so each line is escaped like any other text
+     * from a child: an ESC or a bare CR would otherwise reach the terminal of
+     * whoever watches `docker logs -f`. No length cap from logSafe — the 64 KiB
+     * tail flush below already bounds a line.
      */
     logStderr(payload) {
-        this.stderrTail += payload.toString('utf8');
+        this.stderrTail += this.stderrDecoder.write(payload);
         const lines = this.stderrTail.split('\n');
         this.stderrTail = lines.pop() ?? '';
         for (const line of lines)
-            this.writeStderr(`[${this.server}] ${line}\n`);
+            this.writeStderr(`[${this.server}] ${logSafe(line, Infinity)}\n`);
         if (this.stderrTail.length > 64 * 1024) {
-            this.writeStderr(`[${this.server}] ${this.stderrTail}\n`);
+            this.writeStderr(`[${this.server}] ${logSafe(this.stderrTail, Infinity)}\n`);
             this.stderrTail = '';
         }
     }

package/dist/upstream/auth.js

@@ -4,7 +4,7 @@ import net from 'node:net';
 import { isPrivateAddress, resolvePublicAddress } from '../auth/address.js';
 import { boundedResponse, guardedRequest } from '../auth/pinned-fetch.js';
 import { logSafe } from '../auth/text.js';
-import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata } from './provider.js';
+import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata, wellFormedOrUndefined } from './provider.js';
 import { boundedRedirectFetch } from './redirects.js';
 /**
  * Everything the hub needs to authenticate itself to one upstream MCP server.
@@ -70,10 +70,18 @@ export class UpstreamAuth {
     get record() {
         return this.store.getUpstreamCredentials(this.identity.serverName, this.fingerprint);
     }
-    /** The full pair including the refresh token: this class is the only thing
-     *  allowed to spend it, which is why the provider withholds it. */
+    /**
+     * The full pair including the refresh token: this class is the only thing
+     * allowed to spend it, which is why the provider withholds it.
+     *
+     * A stored record may predate `saveTokens()`'s validation, or have been
+     * written by another process — `wellFormedOrUndefined` treats a malformed
+     * one as though nothing were stored, so it can never reach `send()`'s
+     * `headers.set()` below and throw with the token embedded in its own
+     * message.
+     */
     tokens() {
-        return this.record?.tokens;
+        return wellFormedOrUndefined(this.record?.tokens);
     }
     /** The public key the upstream needs, but only when we sign assertions. */
     async publicJwkIfNeeded() {
@@ -229,7 +237,15 @@ export class UpstreamAuth {
         const resource = discovery.resourceMetadata?.resource ? new URL(discovery.resourceMetadata.resource) : undefined;
         if (this.identity.oauth.grant === 'client_credentials') {
             const tokens = await this.fetchClientCredentialsTokens(discovery, clientInformation, resource);
-            this.provider().saveTokens(tokens);
+            try {
+                this.provider().saveTokens(tokens);
+            }
+            catch (error) {
+                // Same failure class as a refused refresh below: a human has to act,
+                // and restarting on a timer would only ask the same broken
+                // authorization server the same question forever.
+                throw new UpstreamLoginRequiredError(this.identity.serverName, error.message);
+            }
             return;
         }
         const refreshToken = this.tokens()?.refresh_token;

package/dist/upstream/provider.js

@@ -78,6 +78,57 @@ export function hubClientMetadata(identity, publicJwk) {
 }
 /** RFC 7523 §2.2: assertions are single-use and short-lived. */
 const ASSERTION_LIFETIME_S = 300;
+/**
+ * The shape every token from an upstream has to fit before the hub stores it:
+ * printable ASCII without whitespace, at most 16 KiB.
+ *
+ * RFC 6749 leaves a token's format to the authorization server, but every real
+ * one issues an opaque printable string. The hub sends it back as a header
+ * value, and `Headers.set()` throws on CR or LF, quoting the value in its
+ * message. Stored anyway, such a token would break every later request to that
+ * server rather than this one, and put the value into whatever error reached a
+ * caller. Past 16 KiB a token is a payload, not an identifier.
+ */
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_PATTERN = /^[\x21-\x7e]+$/;
+function isWellFormedToken(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= MAX_TOKEN_BYTES && TOKEN_PATTERN.test(value);
+}
+/**
+ * Refuses a token pair the upstream cannot have meant, before anything reaches
+ * the state file. Neither the log line nor the thrown message carries the
+ * value: a malformed token can still be somebody's secret.
+ */
+function assertWellFormedTokens(tokens) {
+    const fields = [
+        ['access_token', tokens.access_token],
+        ['refresh_token', tokens.refresh_token]
+    ];
+    for (const [field, value] of fields) {
+        if (field === 'refresh_token' && value === undefined)
+            continue;
+        if (isWellFormedToken(value))
+            continue;
+        const length = typeof value === 'string' ? value.length : 0;
+        console.error(`mcp-hub: rejected a malformed ${field} from an upstream authorization server (${length} characters)`);
+        throw new Error(`upstream returned a malformed ${field}`);
+    }
+}
+/**
+ * A stored token pair, or undefined when it does not pass the same check. A
+ * record may predate the check or come from another process; treating it as
+ * absent means the next request refreshes or asks for a login instead of
+ * building a header that throws.
+ */
+export function wellFormedOrUndefined(tokens) {
+    if (!tokens)
+        return undefined;
+    if (!isWellFormedToken(tokens.access_token))
+        return undefined;
+    if (tokens.refresh_token !== undefined && !isWellFormedToken(tokens.refresh_token))
+        return undefined;
+    return tokens;
+}
 export class UpstreamAuthProvider {
     identity;
     store;
@@ -148,7 +199,9 @@ export class UpstreamAuthProvider {
             ...(typeof information.client_secret === 'string' ? { clientSecret: information.client_secret } : {}),
             // RFC 7592 credentials, when the upstream issued them — what `upstream
             // logout` needs to delete the registration again.
-            ...(typeof information.registration_access_token === 'string'
+            // It goes out as a bearer header later, so it has to fit the same shape
+            // as any other token; a malformed one is dropped rather than stored.
+            ...(isWellFormedToken(information.registration_access_token)
                 ? { registrationAccessToken: information.registration_access_token }
                 : {}),
             ...(typeof information.registration_client_uri === 'string'
@@ -165,7 +218,7 @@ export class UpstreamAuthProvider {
      * the whole family. Refresh belongs to UpstreamAuth, which serializes it.
      */
     tokens() {
-        const stored = this.record?.tokens;
+        const stored = wellFormedOrUndefined(this.record?.tokens);
         if (!stored)
             return undefined;
         const { refresh_token: _withheld, ...rest } = stored;
@@ -173,9 +226,10 @@ export class UpstreamAuthProvider {
     }
     /** The full pair, for the one caller that is allowed to spend it. */
     storedTokens() {
-        return this.record?.tokens;
+        return wellFormedOrUndefined(this.record?.tokens);
     }
     saveTokens(tokens) {
+        assertWellFormedTokens(tokens);
         const expiresIn = typeof tokens.expires_in === 'number' ? tokens.expires_in : undefined;
         this.patch({
             tokens: tokens,

package/dist/upstream/redirects.js

@@ -1,3 +1,4 @@
+import { STDIO_DEFAULT_MAX_BUFFER_SIZE } from '@modelcontextprotocol/server';
 import { logSafe } from '../auth/text.js';
 /**
  * Redirects on the data plane of a remote upstream, followed only within the
@@ -22,14 +23,108 @@ import { logSafe } from '../auth/text.js';
 export const MAX_REDIRECT_HOPS = 3;
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 /**
- * Wraps a fetch so that every redirect it would follow is checked first.
+ * Ceiling on one message from a remote upstream: the same limit the
+ * byte-stream transports apply (`src/transports/stream.ts`), because a remote
+ * server is no more trusted than a sandboxed one. It bounds a JSON reply as a
+ * whole and an event stream per event, so a long-lived stream is never cut
+ * off for its length.
+ */
+export const MAX_UPSTREAM_RESPONSE_BYTES = STDIO_DEFAULT_MAX_BUFFER_SIZE;
+function isEventStream(response) {
+    const contentType = response.headers.get('content-type');
+    return contentType !== null && contentType.split(';')[0].trim().toLowerCase() === 'text/event-stream';
+}
+/**
+ * Passes bytes through until more than `maxBytes` have gone by, then errors
+ * the stream, so `.json()` or the SDK's SSE reader fails instead of buffering
+ * without end. For an event stream the count restarts at every blank line —
+ * the event separator, in any mix of CR, LF and CRLF. A CR at the end of a
+ * chunk may be the first half of a CRLF, so `sawCR` carries it into the next.
+ */
+function budgetedStream(maxBytes, sse) {
+    let sinceBoundary = 0;
+    let sawCR = false;
+    let terminatorRun = 0;
+    // One line terminator (`\r`, `\n` or `\r\n`) completed. Two in a row with no
+    // content byte between them is a blank line — the event boundary.
+    const closeTerminator = () => {
+        if (++terminatorRun < 2)
+            return;
+        sinceBoundary = 0;
+        terminatorRun = 0;
+    };
+    return new TransformStream({
+        transform(chunk, controller) {
+            if (!sse) {
+                sinceBoundary += chunk.byteLength;
+                if (sinceBoundary > maxBytes) {
+                    controller.error(new Error(`upstream response exceeds the ${maxBytes} byte limit`));
+                    return;
+                }
+                controller.enqueue(chunk);
+                return;
+            }
+            for (let i = 0; i < chunk.byteLength; i++) {
+                sinceBoundary++;
+                if (sinceBoundary > maxBytes) {
+                    controller.error(new Error(`upstream SSE event exceeds the ${maxBytes} byte limit`));
+                    return;
+                }
+                const byte = chunk[i];
+                if (byte === 0x0d) {
+                    if (sawCR)
+                        closeTerminator();
+                    sawCR = true;
+                }
+                else if (byte === 0x0a) {
+                    closeTerminator();
+                    sawCR = false;
+                }
+                else {
+                    if (sawCR)
+                        closeTerminator();
+                    sawCR = false;
+                    terminatorRun = 0;
+                }
+            }
+            controller.enqueue(chunk);
+        }
+    });
+}
+/**
+ * Puts the final response's body under the budget above. A JSON reply that
+ * declares more than the limit in `content-length` is refused before reading;
+ * an event stream's length describes the connection, not one event, so it is
+ * not consulted there.
+ */
+function capResponseBody(response, maxBytes) {
+    if (!response.body)
+        return response;
+    const sse = isEventStream(response);
+    if (!sse) {
+        const declared = Number(response.headers.get('content-length'));
+        if (Number.isFinite(declared) && declared > maxBytes) {
+            void response.body.cancel().catch(() => { });
+            throw new Error(`upstream declared a ${declared} byte response, exceeding the ${maxBytes} byte limit`);
+        }
+    }
+    return new Response(response.body.pipeThrough(budgetedStream(maxBytes, sse)), {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+    });
+}
+/**
+ * Wraps a fetch so that every redirect it would follow is checked first and
+ * the response it returns is byte-budgeted.
  *
  * `origin` is the configured upstream's origin (`new URL(config.url).origin`).
  * The returned function has the platform's shape and can be handed to the SDK
  * transports as their `fetch`; every hop goes through `fetchImpl`, so a wrapper
- * that adds headers still adds them on each hop.
+ * that adds headers still adds them on each hop. `maxBytes` is a parameter so
+ * tests can exercise the budget without megabytes of fixtures.
  */
-export function boundedRedirectFetch(origin, fetchImpl = fetch) {
+export function boundedRedirectFetch(origin, fetchImpl = fetch, maxBytes = MAX_UPSTREAM_RESPONSE_BYTES) {
     return async (input, init) => {
         let url = new URL(input instanceof Request ? input.url : String(input));
         let request = { ...init, redirect: 'manual' };
@@ -38,10 +133,10 @@ export function boundedRedirectFetch(origin, fetchImpl = fetch) {
             // lives there. Nothing in the hub does, but the shape is the platform's.
             const response = await fetchImpl(hop === 0 && input instanceof Request ? new Request(input, request) : url, request);
             if (!REDIRECT_STATUSES.has(response.status))
-                return response;
+                return capResponseBody(response, maxBytes);
             const location = response.headers.get('location');
             if (location === null)
-                return response;
+                return capResponseBody(response, maxBytes);
             // Nothing of the redirect's body is wanted, and holding the stream open
             // would keep the connection with it.
             await response.body?.cancel().catch(() => { });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ni-c/mcp-hub",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "description": "Serve multiple stdio MCP servers from one container: Claude-Code-style mcpServers config, path-based routing, hub meta-tools, and CIMD-first OAuth 2.1 + API tokens for ChatGPT, Claude and any Streamable-HTTP MCP client.",
   "keywords": [
     "mcp",
@@ -78,7 +78,7 @@
     "@types/node": "^26.2.0",
     "@types/oidc-provider": "^9.11.1",
     "@types/supertest": "^7.2.1",
-    "@vitest/coverage-v8": "5.0.0",
+    "@vitest/coverage-v8": "5.0.1",
     "fast-check": "^4.9.0",
     "oxlint": "^1.80.0",
     "supertest": "^7.0.0",