@ni-c/mcp-hub 0.11.4 → 0.11.6

package/CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.11.6] - 2026-10-07
+
+### Security
+
+- **Upstream credentials stay with the authorization server that issued
+  them** (GHSA-6qxp-vccf-f47h, high). An upstream names its authorization
+  server on every discovery, which happens at least once an hour, and the hub
+  refreshes, redeems codes and requests client_credentials tokens itself. A
+  compromised upstream could therefore name a different authorization server
+  and receive the refresh token, a registered or configured client secret, or
+  the code being redeemed. The credential record now carries the issuer it
+  belongs to. A discovery that names another one is refused before anything is
+  sent there, and the server shows `unauthorized`, with both servers named in
+  the log. A genuine move is accepted after a logout and a new login:
+  `mcp-hub-admin upstream logout <server>`. Records from 0.11.5 or earlier are
+  bound to the authorization server named by their cached discovery.
+- `@modelcontextprotocol/client`, `core` and `server` 2.3.0 (were 2.1.0), the
+  SDK's own fix for the same advisory, which also binds the credentials its
+  flows store to their issuer. `@modelcontextprotocol/sdk` 1.32.1 (was 1.30.0),
+  pulled in by `@modelcontextprotocol/server-everything` for the tests only.
+
+## [0.11.5] - 2026-10-06
+
+### Security
+
+- `proxy-addr` 2.0.8 (was 2.0.7, GHSA-jqcg-44mw-7w3h, critical). A trust
+  subnet written as an IPv4-mapped IPv6 block with a short prefix, such as
+  `::ffff:10.0.0.0/8`, matched every IPv4 address. `trustedProxies` is handed
+  to Express as `trust proxy`, so with such an entry any client could set its
+  own `req.ip` through `X-Forwarded-For` — the key of the per-caller rate limit
+  and the address in the consent log. Plain IPv4 notation (`10.0.0.0/8`) was
+  never affected.
+- `source-map-js` 1.2.2 (was 1.2.1, GHSA-68fv-2mgg-jv7q). A development
+  dependency only; it is not in the package or the image.
+- The documentation site builds with `vue` and `@vue/server-renderer` 3.5.43
+  (was 3.5.41, GHSA-g2v6-rqmx-r4w6). The site renders only its own Markdown at
+  build time; neither the package nor the image contains Vue.
+- The image overwrites npm's vendored `brace-expansion` with 5.0.11 instead of
+  5.0.9 and now also its vendored `undici`, with 6.28.1. npm 12.0.2 pins
+  `undici` 6.27.0, and the latest npm, 12.1.0, still ships 6.28.0 and
+  `brace-expansion` 5.0.9, which CVE-2026-19534 (`undici`) and CVE-2026-102276
+  and CVE-2026-102278 (`brace-expansion`) apply to. Only the npm CLI inside the
+  image uses these copies; the hub's own dependencies were not affected.
+
 ## [0.11.4] - 2026-09-24
 
 ### Security

package/dist/docker-proxy/server.js

@@ -30,6 +30,11 @@ function refuse(response, status, reason, closeConnection = false) {
     });
     response.end(body);
 }
+/**
+ * An upgrade is answered on the raw socket, and a refused one must not leave
+ * the caller holding a half-open connection: write, then destroy.
+ */
+const hangUp = (clientSocket, status, reason) => clientSocket.end(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Bad Gateway'}\r\nConnection: close\r\nContent-Length: ${Buffer.byteLength(reason)}\r\n\r\n${reason}`, () => clientSocket.destroy());
 function readBody(request) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -251,16 +256,13 @@ export function createDockerProxy(options) {
     server.on('upgrade', (request, clientSocket, head) => {
         void (async () => {
             const decision = decide(request.method ?? 'GET', request.url ?? '/', undefined);
-            // An upgrade is answered on the raw socket, and a refused one must not
-            // leave the caller holding a half-open connection: write, then destroy.
-            const hangUp = (status, reason) => clientSocket.end(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Bad Gateway'}\r\nConnection: close\r\nContent-Length: ${Buffer.byteLength(reason)}\r\n\r\n${reason}`, () => clientSocket.destroy());
             if (!decision.allow || !decision.upgrade) {
-                hangUp(decision.allow ? 403 : decision.status, decision.allow ? 'this endpoint does not support upgrades' : decision.reason);
+                hangUp(clientSocket, decision.allow ? 403 : decision.status, decision.allow ? 'this endpoint does not support upgrades' : decision.reason);
                 return;
             }
             const ownershipError = await verifyContainer(options, decision);
             if (ownershipError) {
-                hangUp(ownershipError.status, ownershipError.reason);
+                hangUp(clientSocket, ownershipError.status, ownershipError.reason);
                 return;
             }
             const upstream = http.request({
@@ -297,11 +299,11 @@ export function createDockerProxy(options) {
             });
             upstream.on('response', upstreamResponse => {
                 upstreamResponse.resume();
-                hangUp(502, `docker daemon answered ${upstreamResponse.statusCode} instead of upgrading`);
+                hangUp(clientSocket, 502, `docker daemon answered ${upstreamResponse.statusCode} instead of upgrading`);
             });
             upstream.on('error', error => {
                 console.error(`docker-proxy: upstream error on attach: ${error.message}`);
-                hangUp(502, `docker daemon unreachable: ${error.message}`);
+                hangUp(clientSocket, 502, `docker daemon unreachable: ${error.message}`);
             });
             upstream.end();
         })().catch(error => {

package/dist/hub.js

@@ -178,6 +178,41 @@ const requireAllowedTool = (managed, tool, server) => {
     console.warn(`[${managed.name}] refused "${loggableToolName(tool)}": not permitted by allowTools/denyTools`);
     return toolError(`Unknown tool "${tool}" on server "${server}". Use list_tools to see available tools.`);
 };
+/**
+ * `hub: false` hides a server's TOOLS from the aggregate — those are meant
+ * to be used through the server's own endpoint. Its lifecycle is a different
+ * matter: wake_server/sleep_server manage hidden servers too, so the error
+ * points at the right door instead of pretending the server does not exist
+ * (/health names every server to the same token anyway).
+ */
+const requireExposed = (managed) => {
+    if (managed.config.hub)
+        return undefined;
+    return toolError(`Server "${managed.name}" is not exposed through /hub — connect to its own endpoint /${managed.name}/mcp instead.`);
+};
+/**
+ * Asking about an on-demand server's tools is the strongest hint that a
+ * call follows, so a sleeping server is pre-warmed in the background while
+ * the cached snapshot answers. Only a server with nothing cached yet (first
+ * ever run) blocks on the start — there is nothing truthful to answer from.
+ * Always-running servers pass through untouched.
+ */
+const prepare = async (managed) => {
+    if (!managed.onDemand)
+        return undefined;
+    if (!managed.hasSnapshot) {
+        try {
+            await managed.wake();
+        }
+        catch (error) {
+            return toolError(`Server "${managed.name}" failed to start: ${reason(error)}`);
+        }
+    }
+    else if (managed.state === 'sleeping') {
+        void managed.wake().catch(() => { });
+    }
+    return undefined;
+};
 /**
  * The aggregate, built for the era it will serve.
  *
@@ -190,41 +225,6 @@ const requireAllowedTool = (managed, tool, server) => {
 export function buildHubServer(supervisor, secret, era) {
     const hub = new McpServer({ name: 'mcp-hub', version: VERSION });
     const findServer = (name) => supervisor.get(name);
-    /**
-     * `hub: false` hides a server's TOOLS from the aggregate — those are meant
-     * to be used through the server's own endpoint. Its lifecycle is a different
-     * matter: wake_server/sleep_server manage hidden servers too, so the error
-     * points at the right door instead of pretending the server does not exist
-     * (/health names every server to the same token anyway).
-     */
-    const requireExposed = (managed) => {
-        if (managed.config.hub)
-            return undefined;
-        return toolError(`Server "${managed.name}" is not exposed through /hub — connect to its own endpoint /${managed.name}/mcp instead.`);
-    };
-    /**
-     * Asking about an on-demand server's tools is the strongest hint that a
-     * call follows, so a sleeping server is pre-warmed in the background while
-     * the cached snapshot answers. Only a server with nothing cached yet (first
-     * ever run) blocks on the start — there is nothing truthful to answer from.
-     * Always-running servers pass through untouched.
-     */
-    const prepare = async (managed) => {
-        if (!managed.onDemand)
-            return undefined;
-        if (!managed.hasSnapshot) {
-            try {
-                await managed.wake();
-            }
-            catch (error) {
-                return toolError(`Server "${managed.name}" failed to start: ${reason(error)}`);
-            }
-        }
-        else if (managed.state === 'sleeping') {
-            void managed.wake().catch(() => { });
-        }
-        return undefined;
-    };
     hub.registerTool('list_servers', {
         title: 'List MCP servers',
         description: 'List all MCP servers available through this hub, with their status. Call this first to see what is available. ' +

package/dist/supervisor.js

@@ -1,5 +1,5 @@
 import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
-import { Client, StreamableHTTPClientTransport, SSEClientTransport, UnauthorizedError } from '@modelcontextprotocol/client';
+import { AuthorizationServerMismatchError, Client, StreamableHTTPClientTransport, SSEClientTransport, UnauthorizedError } from '@modelcontextprotocol/client';
 import { ListToolsResultSchema } from '@modelcontextprotocol/core';
 import { VERSION } from './version.js';
 import { MAX_TOOL_LIST_PAGES, MAX_TOOLS, MAX_TOOL_METADATA_BYTES, jsonSize } from './mcp-limits.js';
@@ -17,13 +17,19 @@ import { logSafe } from './auth/text.js';
 /**
  * Whether a failure is one a restart could fix.
  *
- * Only two things mean "a human has to act": our own manager saying there is no
- * usable credential, and the SDK giving up on authorization. Everything else —
+ * Only three things mean "a human has to act": our own manager saying there is
+ * no usable credential, the SDK giving up on authorization, and the SDK refusing
+ * to present a credential to an authorization server it does not belong to —
+ * which a restart would only ask again. Everything else —
  * DNS, a 5xx, a timeout — is transient and must keep its backoff, or an
  * upstream that would have recovered on its own would need manual attention.
  */
 function classifyAuthFailure(error) {
-    return error instanceof UpstreamLoginRequiredError || error instanceof UnauthorizedError ? 'unauthorized' : 'restart';
+    return error instanceof UpstreamLoginRequiredError ||
+        error instanceof UnauthorizedError ||
+        error instanceof AuthorizationServerMismatchError
+        ? 'unauthorized'
+        : 'restart';
 }
 /**
  * Whether this connection's protocol revision still has `ping`.

package/dist/upstream/auth.js

@@ -4,7 +4,7 @@ import net from 'node:net';
 import { isPrivateAddress, resolvePublicAddress } from '../auth/address.js';
 import { boundedResponse, guardedRequest } from '../auth/pinned-fetch.js';
 import { logSafe } from '../auth/text.js';
-import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata, wellFormedOrUndefined } from './provider.js';
+import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata, sameIssuer, wellFormedOrUndefined } from './provider.js';
 import { boundedRedirectFetch } from './redirects.js';
 /**
  * Everything the hub needs to authenticate itself to one upstream MCP server.
@@ -38,6 +38,11 @@ const EXPIRY_SKEW_S = 60;
 const DISCOVERY_TTL_S = 3600;
 const AS_MAX_BYTES = 256 * 1024;
 const AS_TIMEOUT_MS = 10_000;
+/** The authorization server a discovery names, identified the way the SDK
+ *  stamps credentials: the issuer its validated metadata declares. */
+function issuerOf(discovery) {
+    return discovery.authorizationServerMetadata?.issuer ?? String(discovery.authorizationServerUrl);
+}
 export class UpstreamAuth {
     config;
     store;
@@ -132,10 +137,38 @@ export class UpstreamAuth {
         if (!force && cached?.authorizationServerUrl && now - cached.fetchedAt < DISCOVERY_TTL_S)
             return cached;
         const info = await discoverOAuthServerInfo(this.identity.serverUrl, { fetchFn: this.boundAsFetch });
+        const bound = this.boundIssuer();
+        const named = issuerOf(info);
+        if (bound !== undefined && !sameIssuer(bound, named)) {
+            // Refused before anything is saved, so the cached discovery — and with it
+            // the revocation endpoint `upstream logout` uses — still names the
+            // server the credentials belong to.
+            throw new UpstreamLoginRequiredError(this.identity.serverName, `the upstream now names a different authorization server (${logSafe(named)}) than the one its credentials belong to (${logSafe(bound)}); if that move is intended, run "mcp-hub-admin upstream logout ${logSafe(this.identity.serverName)}" and log in again`);
+        }
         const discovery = { ...info, fetchedAt: now };
         this.provider().saveDiscoveryState(discovery);
         return discovery;
     }
+    /**
+     * The authorization server the stored credentials belong to, or undefined
+     * while nothing is stored that another one could be handed.
+     *
+     * The upstream names its authorization server on every discovery, and
+     * `refreshAuthorization`, `exchangeAuthorization` and the client_credentials
+     * request below go wherever it points — the SDK's own SEP-2352 check covers
+     * none of these direct calls (GHSA-6qxp-vccf-f47h). A record written before
+     * the stamp existed is bound to the authorization server its cached
+     * discovery names: the one these credentials have been used with all along.
+     */
+    boundIssuer() {
+        const record = this.record;
+        if (!record || (record.tokens === undefined && record.clientId === undefined))
+            return undefined;
+        if (record.issuer)
+            return record.issuer;
+        const cached = record.discovery;
+        return cached?.authorizationServerUrl ? issuerOf(cached) : undefined;
+    }
     /**
      * The client_id this hub uses with this upstream, registering dynamically the
      * first time when that is the configured mode.
@@ -154,11 +187,11 @@ export class UpstreamAuth {
                 throw new UpstreamLoginRequiredError(this.identity.serverName, 'the upstream does not accept client ID metadata documents; use mode "dcr" or "static"');
             }
             const clientId = this.provider().clientMetadataUrl;
-            this.provider().saveClientInformation({ client_id: clientId });
+            this.provider().saveClientInformation({ client_id: clientId }, { issuer: issuerOf(discovery) });
             return { client_id: clientId };
         }
         const registered = await this.registerDynamically(discovery);
-        this.provider().saveClientInformation(registered);
+        this.provider().saveClientInformation(registered, { issuer: issuerOf(discovery) });
         console.log(`mcp-hub: registered with ${logSafe(discovery.authorizationServerUrl)} for upstream "${logSafe(this.identity.serverName)}"`);
         return registered;
     }
@@ -238,7 +271,7 @@ export class UpstreamAuth {
         if (this.identity.oauth.grant === 'client_credentials') {
             const tokens = await this.fetchClientCredentialsTokens(discovery, clientInformation, resource);
             try {
-                this.provider().saveTokens(tokens);
+                this.provider().saveTokens(tokens, { issuer: issuerOf(discovery) });
             }
             catch (error) {
                 // Same failure class as a refused refresh below: a human has to act,
@@ -261,7 +294,7 @@ export class UpstreamAuth {
                 addClientAuthentication: this.provider().addClientAuthentication,
                 fetchFn: this.boundAsFetch
             });
-            this.provider().saveTokens(tokens);
+            this.provider().saveTokens(tokens, { issuer: issuerOf(discovery) });
         }
         catch (error) {
             // A refresh token the upstream will not honour cannot be recovered from
@@ -329,6 +362,12 @@ export class UpstreamAuth {
     /** Redeems the code the upstream sent back. */
     async finishLogin(login, code) {
         const discovery = await this.discover();
+        // The code and its verifier belong to the server the login started at; a
+        // discovery that has moved since must not receive them, or the client
+        // secret that goes with them.
+        if (!sameIssuer(login.authorizationServerUrl, String(discovery.authorizationServerUrl))) {
+            throw new UpstreamLoginRequiredError(this.identity.serverName, 'the upstream named a different authorization server while the login was open; start the login again');
+        }
         const clientInformation = await this.clientInformation(discovery);
         const tokens = await exchangeAuthorization(login.authorizationServerUrl, {
             metadata: discovery.authorizationServerMetadata,
@@ -340,7 +379,7 @@ export class UpstreamAuth {
             addClientAuthentication: this.provider().addClientAuthentication,
             fetchFn: this.boundAsFetch
         });
-        this.provider().saveTokens(tokens);
+        this.provider().saveTokens(tokens, { issuer: issuerOf(discovery) });
     }
     /**
      * Best effort: tell the upstream to forget the token (RFC 7009) and, for a

package/dist/upstream/provider.js

@@ -129,6 +129,19 @@ export function wellFormedOrUndefined(tokens) {
         return undefined;
     return tokens;
 }
+/**
+ * Whether two issuer identifiers name the same authorization server — the
+ * SDK's comparison, with RFC 8414 §3.3's one tolerance: a single trailing `/`.
+ */
+export function sameIssuer(a, b) {
+    return a === b || (a.endsWith('/') && a.slice(0, -1) === b) || (b.endsWith('/') && b.slice(0, -1) === a);
+}
+/** The issuer a credential is saved under: the SDK's stamp on the value, or
+ *  the authorization server the caller resolved. */
+function stampFrom(value, ctx) {
+    const issuer = value.issuer ?? ctx?.issuer;
+    return issuer ? { issuer } : {};
+}
 export class UpstreamAuthProvider {
     identity;
     store;
@@ -176,13 +189,22 @@ export class UpstreamAuthProvider {
             return undefined;
         return clientMetadataUrl(this.identity.externalUrl, this.identity.serverName, this.store.cookieSecret);
     }
+    /**
+     * Handed back with every credential, so the SDK's own flows refuse to present
+     * one to a different authorization server just as UpstreamAuth does.
+     */
+    issuerStamp() {
+        const issuer = this.record?.issuer;
+        return issuer ? { issuer } : {};
+    }
     clientInformation() {
         // Configured credentials win: with them there is nothing to register, and
         // the SDK skips both CIMD and dynamic registration.
         if (this.identity.oauth.mode === 'static') {
             return {
                 client_id: this.identity.oauth.clientId,
-                ...(this.identity.oauth.clientSecret ? { client_secret: this.identity.oauth.clientSecret } : {})
+                ...(this.identity.oauth.clientSecret ? { client_secret: this.identity.oauth.clientSecret } : {}),
+                ...this.issuerStamp()
             };
         }
         const record = this.record;
@@ -190,11 +212,13 @@ export class UpstreamAuthProvider {
             return undefined;
         return {
             client_id: record.clientId,
-            ...(record.clientSecret ? { client_secret: record.clientSecret } : {})
+            ...(record.clientSecret ? { client_secret: record.clientSecret } : {}),
+            ...this.issuerStamp()
         };
     }
-    saveClientInformation(information) {
+    saveClientInformation(information, ctx) {
         this.patch({
+            ...stampFrom(information, ctx),
             clientId: information.client_id,
             ...(typeof information.client_secret === 'string' ? { clientSecret: information.client_secret } : {}),
             // RFC 7592 credentials, when the upstream issued them — what `upstream
@@ -222,16 +246,19 @@ export class UpstreamAuthProvider {
         if (!stored)
             return undefined;
         const { refresh_token: _withheld, ...rest } = stored;
-        return rest;
+        return { ...rest, ...this.issuerStamp() };
     }
     /** The full pair, for the one caller that is allowed to spend it. */
     storedTokens() {
         return wellFormedOrUndefined(this.record?.tokens);
     }
-    saveTokens(tokens) {
+    saveTokens(stamped, ctx) {
+        // The stamp lives on the record, once for tokens and registration alike.
+        const { issuer: _stamp, ...tokens } = stamped;
         assertWellFormedTokens(tokens);
         const expiresIn = typeof tokens.expires_in === 'number' ? tokens.expires_in : undefined;
         this.patch({
+            ...stampFrom(stamped, ctx),
             tokens: tokens,
             ...(expiresIn !== undefined ? { accessTokenValidUntil: Math.floor(Date.now() / 1000) + expiresIn } : {})
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ni-c/mcp-hub",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "description": "Serve multiple stdio MCP servers from one container: Claude-Code-style mcpServers config, path-based routing, hub meta-tools, and CIMD-first OAuth 2.1 + API tokens for ChatGPT, Claude and any Streamable-HTTP MCP client.",
   "keywords": [
     "mcp",
@@ -78,7 +78,7 @@
     "@types/node": "^26.2.0",
     "@types/oidc-provider": "^9.11.1",
     "@types/supertest": "^7.2.1",
-    "@vitest/coverage-v8": "5.0.1",
+    "@vitest/coverage-v8": "5.0.2",
     "fast-check": "^4.9.0",
     "oxlint": "^1.80.0",
     "supertest": "^7.0.0",