@nifrajs/mcp 3.3.0 → 4.0.0

package/src/http.ts

@@ -8,12 +8,20 @@
  * the MCP Apps `ui://` widgets) so each host supplies its own corpus/source behind one core.
  */
 
+import {
+  assertTransportByteLimit,
+  MAX_TRANSPORT_BYTES,
+  parseTransportContentLength,
+  readBoundedTransportBytes,
+} from "@nifrajs/agent-protocol"
 import {
   handleRpc,
+  isJsonRpcRequest,
   type JsonRpcNotification,
   type JsonRpcRequest,
   type JsonRpcResponse,
   MCP_ERROR,
+  type McpProtocolState,
   type McpServerFeatures,
   type McpTool,
   modernVersionOf,
@@ -32,28 +40,119 @@ const CORS_BASE: Record<string, string> = {
   "access-control-max-age": "86400",
 }
 
+/**
+ * Same host, and an Origin scheme equal to or stronger than the request URL's: an `https:` page may reach
+ * an `http:` URL (a TLS-terminating proxy in front of the server), never the reverse. Mirrors core's
+ * `isSameOriginRequest`; inlined because `@nifrajs/core` is an optional peer of this transport.
+ */
+function isSameOrigin(origin: string, request: Request): boolean {
+  try {
+    const from = new URL(origin)
+    const own = new URL(request.url)
+    if (from.host !== own.host) return false
+    if (from.protocol === "https:") return own.protocol === "https:" || own.protocol === "http:"
+    if (from.protocol === "http:") return own.protocol === "http:"
+    return false
+  } catch {
+    return false
+  }
+}
+
+interface HostAuthority {
+  readonly hostname: string
+  readonly port?: string
+}
+
+/** Parse a bare `host[:port]` authority without accepting userinfo, paths, whitespace, or fragments. */
+function parseHostAuthority(value: string): HostAuthority | undefined {
+  if (value.length === 0 || /[\r\n\s@/?#]/.test(value)) return undefined
+  let hostname: string
+  let port: string | undefined
+  if (value.startsWith("[")) {
+    const close = value.indexOf("]")
+    if (close === -1) return undefined
+    const address = value.slice(1, close)
+    if (address.length === 0 || !/^[0-9a-f:.%]+$/i.test(address)) return undefined
+    hostname = `[${address.toLowerCase()}]`
+    const rest = value.slice(close + 1)
+    if (rest !== "") {
+      if (!rest.startsWith(":")) return undefined
+      port = rest.slice(1)
+    }
+  } else {
+    const colon = value.indexOf(":")
+    if (colon === -1) {
+      hostname = value.toLowerCase()
+    } else {
+      if (value.indexOf(":", colon + 1) !== -1) return undefined
+      hostname = value.slice(0, colon).toLowerCase()
+      port = value.slice(colon + 1)
+    }
+    if (hostname.length === 0 || !/^[a-z0-9.-]+$/.test(hostname)) return undefined
+  }
+  if (port !== undefined) {
+    if (!/^\d{1,5}$/.test(port)) return undefined
+    const numeric = Number(port)
+    if (!Number.isSafeInteger(numeric) || numeric > 65_535) return undefined
+    port = String(numeric)
+  }
+  return port === undefined ? { hostname } : { hostname, port }
+}
+
+function defaultPort(protocol: string): string | undefined {
+  if (protocol === "http:") return "80"
+  if (protocol === "https:") return "443"
+  return undefined
+}
+
+/**
+ * The Host guard. Prefer the inbound Host header: an adapter may deliberately build `request.url`
+ * with a canonical authority, but that must not hide the attacker-controlled Host this guard exists
+ * to check. An allowlist entry without a port matches any port; one with a port matches the effective
+ * port (so `localhost:80` matches an HTTP URL whose canonical form omits `:80`).
+ */
+function hostAllowed(request: Request, allowedHosts: readonly string[] | undefined): boolean {
+  if (allowedHosts === undefined) return true
+  const url = new URL(request.url)
+  const actual = parseHostAuthority(request.headers.get("host") ?? url.host)
+  if (actual === undefined) return false
+  const actualPort = actual.port ?? defaultPort(url.protocol)
+  for (const value of allowedHosts) {
+    const candidate = parseHostAuthority(value)
+    if (candidate === undefined || candidate.hostname !== actual.hostname) continue
+    if (candidate.port === undefined || candidate.port === actualPort) return true
+  }
+  return false
+}
+
 /**
  * Resolve the CORS/Origin headers for one request against the host's `allowedOrigins` policy, or `null`
  * when the request's `Origin` is present but not allowed - the caller then answers 403, per the
  * Streamable-HTTP DNS-rebinding rule ("Servers MUST validate the `Origin` header ... respond with 403").
- * With no policy (the default) every origin is allowed and reflected as `*` - correct for a public,
- * secret-free, unauthenticated server, whose browser clients send arbitrary origins we can't enumerate.
+ * The default is same-origin. Public, secret-free servers must explicitly opt into `allowAnyOrigin`.
  */
 function corsFor(
   request: Request,
   allowedOrigins: readonly string[] | undefined,
+  allowAnyOrigin: boolean,
 ): Record<string, string> | null {
-  if (allowedOrigins === undefined) return { ...CORS_BASE, "access-control-allow-origin": "*" }
+  if (allowAnyOrigin) return { ...CORS_BASE, "access-control-allow-origin": "*" }
   const origin = request.headers.get("origin")
-  // A caller with no Origin (curl, server-to-server) can't mount a DNS-rebinding attack - allow it.
+  // No Origin: curl, server-to-server, or a same-origin browser GET. `allowedHosts` covers the last one.
   if (origin === null) return { ...CORS_BASE, vary: "Origin" }
-  if (allowedOrigins.includes(origin)) {
+  if (allowedOrigins?.includes(origin)) {
+    return { ...CORS_BASE, "access-control-allow-origin": origin, vary: "Origin" }
+  }
+  if (allowedOrigins === undefined && isSameOrigin(origin, request)) {
     return { ...CORS_BASE, "access-control-allow-origin": origin, vary: "Origin" }
   }
   return null
 }
 
 const DEFAULT_MAX_BODY_BYTES = 1_000_000
+const MAX_BODY_BYTES = MAX_TRANSPORT_BYTES
+const DEFAULT_MAX_RESPONSE_BYTES = 1_000_000
+const MAX_RESPONSE_BYTES = MAX_TRANSPORT_BYTES
 const TEXT_DECODER = new TextDecoder()
 const TEXT_ENCODER = new TextEncoder()
 const SSE_CONTENT_TYPE = "text/event-stream; charset=utf-8"
@@ -62,24 +161,53 @@ const SSE_KEEP_ALIVE_MS = 15_000
 /** Invalid byte caps make `total > maxBytes` fail open (especially for `NaN`). Reject configuration
  * before any request body is read so MCP cannot silently lose its memory bound. */
 function assertByteLimit(value: number): void {
-  if (!Number.isSafeInteger(value) || value < 0) {
-    throw new RangeError("MCP maxBodyBytes must be a non-negative safe integer")
-  }
+  assertTransportByteLimit(value, { maximum: MAX_BODY_BYTES, label: "MCP maxBodyBytes" })
+}
+
+function assertResponseLimit(value: number): void {
+  assertTransportByteLimit(value, {
+    minimum: 1_024,
+    maximum: MAX_RESPONSE_BYTES,
+    label: "MCP maxResponseBytes",
+  })
 }
 
 export interface McpHttpOptions {
   /** Maximum JSON-RPC request body size in bytes. Default 1 MB. */
   readonly maxBodyBytes?: number
+  /** Maximum serialized JSON-RPC response or SSE frame size. Default 1 MB. */
+  readonly maxResponseBytes?: number
   /** Resources / prompts / the MCP Apps UI extension served alongside the tools. */
   readonly features?: McpServerFeatures
   /** Shown on the GET health page so each host can describe itself. */
   readonly health?: string
+  /** Explicitly expose a secret-free, unauthenticated server to browser clients from any origin. */
+  readonly allowAnyOrigin?: boolean
+  /** Origin allowlist for the DNS-rebinding guard. When set, only exact origins are accepted. */
+  readonly allowedOrigins?: readonly string[]
   /**
-   * Origin allowlist for the DNS-rebinding guard. Omit (the default) to allow any origin - the right
-   * choice for a public, unauthenticated docs server that can't enumerate its browser clients' origins.
-   * Set it (e.g. a localhost origin for a hardened local host) to reject any other browser origin with 403.
+   * Host allowlist - the DNS-rebinding guard for a server on localhost or a private network. A rebound
+   * page reaches the server under the attacker's hostname with a matching Origin, so the Origin check
+   * alone cannot stop it. Entries are `host[:port]`; without a port they match any port. Every request,
+   * with or without an Origin, whose Host is not listed gets 403. Example: `["localhost", "127.0.0.1"]`.
    */
-  readonly allowedOrigins?: readonly string[]
+  readonly allowedHosts?: readonly string[]
+  /**
+   * Shared request registry for one authenticated MCP session. Pass the same state to the
+   * request that starts a tool call and its `notifications/cancelled` request. Do not share one
+   * state across unrelated callers unless the surrounding authorization boundary makes their
+   * request-id namespace exclusive.
+   */
+  readonly state?: McpProtocolState
+  /**
+   * Resolve a session-scoped request registry after authorization. This is the preferred seam for
+   * multi-user HTTP hosts: bind the returned state to the authenticated caller/session and return
+   * `undefined` for stateless requests. A resolver failure fails closed with a generic denial.
+   */
+  readonly resolveState?: (
+    request: Request,
+    message: JsonRpcRequest,
+  ) => McpProtocolState | undefined | Promise<McpProtocolState | undefined>
   /**
    * Optional authorization, run once per request against the parsed message - after the body has been
    * read under the size cap, so it never costs a second read of the stream. Returning `false` answers
@@ -108,6 +236,7 @@ function eventStreamResponse(
   headers: Record<string, string>,
   run: (stream: EventStreamControl) => void | Promise<void>,
   keepAliveMs = 0,
+  maxFrameBytes = DEFAULT_MAX_RESPONSE_BYTES,
 ): Response {
   const abortController = new AbortController()
   let closed = false
@@ -154,7 +283,15 @@ function eventStreamResponse(
     signal: abortController.signal,
     closed: closedPromise,
     send(message) {
-      write(`data: ${JSON.stringify(message)}\n\n`)
+      const encoded = encodeJson(message, maxFrameBytes)
+      const id = "id" in message ? message.id : null
+      const payload = encoded ?? JSON.stringify(rpcError(id ?? null, -32000, "response too large"))
+      const frame = `data: ${payload}\n\n`
+      write(
+        TEXT_ENCODER.encode(frame).byteLength <= maxFrameBytes
+          ? frame
+          : `data: ${JSON.stringify(rpcError(id ?? null, -32000, "response too large"))}\n\n`,
+      )
     },
     comment(value = "") {
       write(`: ${value.replace(/[\r\n]/g, "")}\n\n`)
@@ -205,16 +342,16 @@ function eventStreamResponse(
   })
 }
 
-function parseContentLength(value: string): number | undefined {
-  if (value.length === 0) return undefined
-  let length = 0
-  for (let i = 0; i < value.length; i++) {
-    const digit = value.charCodeAt(i) - 48
-    if (digit < 0 || digit > 9) return undefined
-    length = length * 10 + digit
-    if (length > Number.MAX_SAFE_INTEGER) return Number.POSITIVE_INFINITY
-  }
-  return length
+/** Validate the HTTP envelope before any method-specific access or authorization callback. */
+function parseHttpMessage(value: unknown): JsonRpcRequest | undefined {
+  return isJsonRpcRequest(value) ? value : undefined
+}
+
+function unauthorizedResponse(id: JsonRpcRequest["id"], headers: Record<string, string>): Response {
+  return Response.json(rpcError(id ?? null, MCP_ERROR.UNAUTHORIZED, "unauthorized"), {
+    status: 403,
+    headers,
+  })
 }
 
 async function readJsonBounded(
@@ -223,7 +360,7 @@ async function readJsonBounded(
 ): Promise<{ ok: true; value: unknown } | { ok: false; status: 400 | 413 }> {
   const declared = request.headers.get("content-length")
   if (declared !== null) {
-    const length = parseContentLength(declared)
+    const length = parseTransportContentLength(declared)
     if (length === undefined) return { ok: false, status: 400 }
     if (length > maxBytes) return { ok: false, status: 413 }
   }
@@ -231,33 +368,31 @@ async function readJsonBounded(
   const body = request.body
   if (body === null) return { ok: false, status: 400 }
 
-  const reader = body.getReader()
-  const chunks: Uint8Array[] = []
-  let total = 0
-  for (;;) {
-    const { done, value } = await reader.read()
-    if (done) break
-    total += value.byteLength
-    if (total > maxBytes) {
-      await reader.cancel()
-      return { ok: false, status: 413 }
-    }
-    chunks.push(value)
+  const read = await readBoundedTransportBytes(body, maxBytes)
+  if (!read.ok) return { ok: false, status: read.reason === "too-large" ? 413 : 400 }
+  try {
+    return { ok: true, value: JSON.parse(TEXT_DECODER.decode(read.bytes)) as unknown }
+  } catch {
+    return { ok: false, status: 400 }
   }
+}
 
-  const bytes = new Uint8Array(total)
-  let offset = 0
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset)
-    offset += chunk.byteLength
-  }
+function encodeJson(value: unknown, maxBytes: number): string | undefined {
   try {
-    return { ok: true, value: JSON.parse(TEXT_DECODER.decode(bytes)) as unknown }
+    const encoded = JSON.stringify(value)
+    if (typeof encoded !== "string") return undefined
+    if (TEXT_ENCODER.encode(encoded).byteLength > maxBytes) return undefined
+    return encoded
   } catch {
-    return { ok: false, status: 400 }
+    return undefined
   }
 }
 
+function boundedResponse(response: JsonRpcResponse, maxBytes: number): JsonRpcResponse {
+  if (encodeJson(response, maxBytes) !== undefined) return response
+  return rpcError(response.id, -32000, "response too large")
+}
+
 const SENTINEL_PREFIX = "=?base64?"
 const SENTINEL_SUFFIX = "?="
 
@@ -332,7 +467,12 @@ export async function respondMcpHttp(
 ): Promise<Response> {
   const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES
   assertByteLimit(maxBodyBytes)
-  const cors = corsFor(request, options.allowedOrigins)
+  const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES
+  assertResponseLimit(maxResponseBytes)
+  if (!hostAllowed(request, options.allowedHosts)) {
+    return Response.json(rpcError(null, -32600, "host not allowed"), { status: 403 })
+  }
+  const cors = corsFor(request, options.allowedOrigins, options.allowAnyOrigin === true)
   if (cors === null) {
     // Origin present but not allowlisted: reject before the body is ever read (DNS-rebinding guard). No
     // `id` (no request parsed) and no CORS headers - a disallowed origin gets nothing to work with.
@@ -352,6 +492,7 @@ export async function respondMcpHttp(
           await stream.closed
         },
         SSE_KEEP_ALIVE_MS,
+        maxResponseBytes,
       )
     }
     return new Response(
@@ -376,14 +517,31 @@ export async function respondMcpHttp(
     }
     return Response.json(rpcError(null, -32700, "parse error"), { status: 400, headers: cors })
   }
-  const message = parsed.value as JsonRpcRequest
+  const message = parseHttpMessage(parsed.value)
+  if (message === undefined)
+    return Response.json(rpcError(null, -32600, "Invalid Request"), {
+      status: 400,
+      headers: cors,
+    })
   if (options.authorizeMessage !== undefined) {
-    const authorized = await options.authorizeMessage(message, request)
+    let authorized = false
+    try {
+      authorized = await options.authorizeMessage(message, request)
+    } catch {
+      // Authorization is an application boundary. Fail closed without reflecting verifier or
+      // credential-store diagnostics to an unauthenticated caller.
+      return unauthorizedResponse(message.id, cors)
+    }
     if (!authorized) {
-      return Response.json(rpcError(message.id ?? null, MCP_ERROR.UNAUTHORIZED, "unauthorized"), {
-        status: 403,
-        headers: cors,
-      })
+      return unauthorizedResponse(message.id, cors)
+    }
+  }
+  let state: McpProtocolState | undefined = options.state
+  if (options.resolveState !== undefined) {
+    try {
+      state = await options.resolveState(request, message)
+    } catch {
+      return unauthorizedResponse(message.id, cors)
     }
   }
   const bodyVersion = modernVersionOf(message.params)
@@ -397,20 +555,27 @@ export async function respondMcpHttp(
   }
   const dispatch = (stream?: EventStreamControl): Promise<JsonRpcResponse | null> =>
     handleRpc(message, tools, serverInfo, options.features ?? {}, {
+      ...(state === undefined ? {} : { state }),
       signal: stream?.signal ?? request.signal,
       ...(stream !== undefined ? { sendNotification: stream.send } : {}),
     })
   if (acceptsEventStream(request)) {
-    return eventStreamResponse(request, headers, async (stream) => {
-      const response = await dispatch(stream)
-      if (response !== null) stream.send(response)
-      stream.close()
-    })
+    return eventStreamResponse(
+      request,
+      headers,
+      async (stream) => {
+        const response = await dispatch(stream)
+        if (response !== null) stream.send(response)
+        stream.close()
+      },
+      0,
+      maxResponseBytes,
+    )
   }
   const response = await dispatch()
   // A notification (no id) yields null - acknowledge with 202 Accepted and no body (Streamable-HTTP).
   if (response === null) return new Response(null, { status: 202, headers })
   // Modern requests carry spec HTTP statuses (400 version/header, 404 unknown method); legacy stays 200.
   const status = bodyVersion !== undefined ? modernErrorStatus(response) : 200
-  return Response.json(response, { status, headers })
+  return Response.json(boundedResponse(response, maxResponseBytes), { status, headers })
 }

package/src/protocol.ts

@@ -38,6 +38,9 @@ export const MCP_ERROR = {
 } as const
 const META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion"
 const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo"
+const MAX_RPC_ID_LENGTH = 128
+const MAX_RPC_METHOD_LENGTH = 128
+const MAX_CANCEL_REASON_LENGTH = 512
 
 /** The MIME type a UI resource MUST use so a host recognizes it as an MCP App widget (SEP-1865). */
 export const UI_MIME = "text/html;profile=mcp-app"
@@ -177,15 +180,86 @@ export interface McpProtocolOptions {
   readonly state?: McpProtocolState
   readonly signal?: AbortSignal
   readonly sendNotification?: (notification: JsonRpcNotification) => void
+  /**
+   * Answer a throwing tool with its error message, not only "Tool execution failed". Only for a
+   * transport whose caller already has the project, such as a local stdio server: paths, SQL
+   * diagnostics and provider responses end up in error messages, so a remote caller never sees them.
+   */
+  readonly exposeToolErrors?: boolean
 }
 
+const MAX_TOOL_ERROR_CHARS = 16_384
+
 export function createMcpProtocolState(): McpProtocolState {
   return { activeRequests: new Map() }
 }
 
 function requestKey(id: unknown): string | undefined {
   if (typeof id === "string") return `s:${id}`
-  return typeof id === "number" && Number.isFinite(id) ? `n:${id}` : undefined
+  return typeof id === "number" && Number.isSafeInteger(id) ? `n:${id}` : undefined
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+}
+
+/** Validate a JSON-RPC request/notification before any transport or method-specific access. */
+export function isJsonRpcRequest(value: unknown): value is JsonRpcRequest {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false
+  const record = value as Record<string, unknown>
+  if (Object.hasOwn(record, "result") || Object.hasOwn(record, "error")) return false
+  if (Object.hasOwn(record, "jsonrpc") && record.jsonrpc !== "2.0") return false
+  if (
+    typeof record.method !== "string" ||
+    record.method.length === 0 ||
+    record.method.length > MAX_RPC_METHOD_LENGTH
+  )
+    return false
+  if (Object.hasOwn(record, "id")) {
+    const id = record.id
+    if (
+      id !== null &&
+      typeof id !== "string" &&
+      !(typeof id === "number" && Number.isSafeInteger(id))
+    )
+      return false
+    if (typeof id === "string" && id.length > MAX_RPC_ID_LENGTH) return false
+  }
+  return (
+    !Object.hasOwn(record, "params") ||
+    (record.params !== null && typeof record.params === "object" && !Array.isArray(record.params))
+  )
+}
+
+/** Validate a JSON-RPC response received by a transport-side client hook. Responses are not accepted
+ * by {@link handleRpc}; this guard exists for the stdio roots/list answer, which is the one server-
+ * initiated request response the CLI consumes itself. */
+export function isJsonRpcResponse(value: unknown): value is JsonRpcResponse {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false
+  const record = value as Record<string, unknown>
+  if (record.jsonrpc !== "2.0") return false
+  if (Object.hasOwn(record, "method") || Object.hasOwn(record, "params")) return false
+  if (
+    record.id !== null &&
+    typeof record.id !== "string" &&
+    !(typeof record.id === "number" && Number.isSafeInteger(record.id))
+  )
+    return false
+  if (typeof record.id === "string" && record.id.length > MAX_RPC_ID_LENGTH) return false
+  const hasResult = Object.hasOwn(record, "result")
+  const hasError = Object.hasOwn(record, "error")
+  if (hasResult === hasError) return false
+  if (!hasError) return true
+  const error = record.error
+  if (error === null || typeof error !== "object" || Array.isArray(error)) return false
+  const errorRecord = error as Record<string, unknown>
+  return (
+    typeof errorRecord.code === "number" &&
+    Number.isSafeInteger(errorRecord.code) &&
+    typeof errorRecord.message === "string" &&
+    errorRecord.message.length > 0 &&
+    errorRecord.message.length <= MAX_RPC_METHOD_LENGTH
+  )
 }
 
 function metaObject(
@@ -213,7 +287,9 @@ function progressTokenOf(params: Record<string, unknown> | undefined): ProgressT
 
 function cancellationReason(params: Record<string, unknown> | undefined): string | undefined {
   const reason = params?.reason
-  return typeof reason === "string" && reason.length > 0 ? reason : undefined
+  return typeof reason === "string" && reason.length > 0
+    ? reason.slice(0, MAX_CANCEL_REASON_LENGTH)
+    : undefined
 }
 
 function linkAbortSignal(parent: AbortSignal | undefined, child: AbortController): () => void {
@@ -294,6 +370,7 @@ export async function handleRpc(
   features: McpServerFeatures = {},
   options: McpProtocolOptions = {},
 ): Promise<JsonRpcResponse | null> {
+  if (!isJsonRpcRequest(message)) return rpcError(null, -32600, "Invalid Request")
   const { id, method, params } = message
   const isNotification = id === undefined
   const rid = id ?? null
@@ -416,7 +493,10 @@ export async function handleRpc(
       const name = params?.name
       const tool = tools.find((t) => t.name === name)
       if (!tool) return rpcError(rid, -32602, `unknown tool: ${String(name)}`)
-      const args = (params?.arguments as Record<string, unknown>) ?? {}
+      const suppliedArguments = params?.arguments
+      if (suppliedArguments !== undefined && !record(suppliedArguments))
+        return rpcError(rid, -32602, "tool arguments must be an object")
+      const args = suppliedArguments ?? {}
       const controller = new AbortController()
       const key = requestKey(id)
       if (key !== undefined && state.activeRequests.has(key)) {
@@ -458,15 +538,23 @@ export async function handleRpc(
         if (controller.signal.aborted) throw new DOMException("cancelled", "AbortError")
         reportProgress(1, 1)
         return reply(toolCallResult(result, tool))
-      } catch (err) {
+      } catch (error) {
         if (controller.signal.aborted) {
           return reply({
             content: [{ type: "text", text: abortMessage(controller.signal) }],
             isError: true,
           })
         }
-        const msg = err instanceof Error ? err.message : String(err)
-        return reply({ content: [{ type: "text", text: `Error: ${msg}` }], isError: true })
+        // Handler errors are application-internal data. Never reflect their messages to a remote
+        // MCP caller: paths, SQL diagnostics, provider responses, and secrets commonly end up there.
+        const detail =
+          options.exposeToolErrors === true && error instanceof Error && error.message !== ""
+            ? `: ${error.message.slice(0, MAX_TOOL_ERROR_CHARS)}`
+            : ""
+        return reply({
+          content: [{ type: "text", text: `Tool execution failed${detail}` }],
+          isError: true,
+        })
       } finally {
         cleanupAbort()
         if (key !== undefined && state.activeRequests.get(key) === controller) {
@@ -526,15 +614,18 @@ export async function handleRpc(
       const name = params?.name
       const prompt = prompts.find((p) => p.name === name)
       if (!prompt) return rpcError(rid, -32602, `unknown prompt: ${String(name)}`)
-      const args = (params?.arguments as Record<string, unknown>) ?? {}
+      const suppliedArguments = params?.arguments
+      if (suppliedArguments !== undefined && !record(suppliedArguments))
+        return rpcError(rid, -32602, "prompt arguments must be an object")
+      const args = suppliedArguments ?? {}
       try {
         return reply({
           description: prompt.description,
           messages: await prompt.handler(args),
         })
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err)
-        return rpcError(rid, -32000, msg)
+      } catch {
+        // Prompt handlers have the same trust boundary as tools; expose only a stable protocol error.
+        return rpcError(rid, -32000, "Prompt execution failed")
       }
     }
     default:

package/src/react.ts

@@ -82,6 +82,8 @@ export async function reactWidget(opts: ReactWidgetOptions): Promise<McpWidget>
     ...(opts.description !== undefined ? { description: opts.description } : {}),
     ...(opts.title !== undefined ? { title: opts.title } : {}),
     ...(opts.head !== undefined ? { head: opts.head } : {}),
-    html: `<div id="root"></div>\n<script>${safe}</script>`,
+    // `safe` is a Bun-generated JavaScript bundle with every HTML script end-tag escaped before it is
+    // placed in this inline script. The widget test asserts the generated document remains intact.
+    html: `<div id="root"></div>\n<script>${safe}</script>`, // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
   })
 }