@ory/mcp-server 0.10.0 → 0.11.0

package/README.md

@@ -78,6 +78,10 @@ CLI-backed tools accept optional `project` and `workspace` parameters; defaults
 
 Per-call parameters on `ory_api_request` (`base_url`, `api_key`) override the corresponding env vars.
 
+### Trusted hosts for `ory_api_request`
+
+The env-configured credential (`ORY_API_KEY` / `ORY_ACCESS_TOKEN`) is only attached automatically when the request targets a trusted Ory origin: the origin of the configured `ORY_PROJECT_URL` / `ORY_SDK_URL`, an Ory Network host (`*.projects.oryapis.com` / `*.oryapis.com`) or `api.console.ory.sh` over https, or localhost (any port, for the local-dev stack). If a caller-supplied `base_url` points anywhere else, the request is still sent but without the env credential, and the tool result notes that it was withheld — this prevents a prompt-injected agent from exfiltrating your admin API key to an arbitrary host. An explicitly passed `api_key` parameter or `authorization` header is always honored as-is.
+
 ## Links
 
 - [ory.com](https://ory.com)

package/dist/server.js

@@ -6,8 +6,43 @@
  * identities, OAuth2, relationships, projects, configuration, workspaces,
  * organizations, JWKs, event streams, and a generic REST API request.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOryMcpServer = createOryMcpServer;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const identities_js_1 = require("./tools/identities.js");
 const oauth2_js_1 = require("./tools/oauth2.js");
@@ -19,9 +54,21 @@ const organizations_js_1 = require("./tools/organizations.js");
 const jwk_js_1 = require("./tools/jwk.js");
 const event_streams_js_1 = require("./tools/event_streams.js");
 const api_js_1 = require("./tools/api.js");
-// Read version from package.json at build time via a constant.
-// This avoids dynamic require() issues in CJS/ESM interop.
-const VERSION = "0.1.0";
+// Read the version from this package's own package.json so the reported MCP
+// server version always matches the published package. Works from both the
+// compiled dist/ layout and ts-node/vitest src/ layout (../package.json in
+// either case); falls back to 0.0.0 if the file cannot be read.
+function readPackageVersion() {
+    try {
+        const pkgPath = path.join(__dirname, "..", "package.json");
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+const VERSION = readPackageVersion();
 function createOryMcpServer() {
     const server = new mcp_js_1.McpServer({
         name: "ory",

package/dist/tools/api.d.ts

@@ -1,2 +1,37 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+declare const HTTP_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE"];
+type HttpMethod = (typeof HTTP_METHODS)[number];
+interface ApiCallParams {
+    method: HttpMethod;
+    path: string;
+    base_url?: string;
+    body?: string;
+    headers?: Record<string, string>;
+    query?: Record<string, string>;
+    api_key?: string;
+}
+/**
+ * Credential-attachment guard.
+ *
+ * The env-configured admin credential (ORY_API_KEY / ORY_ACCESS_TOKEN) is only
+ * auto-attached when the request targets a trusted origin. Otherwise a
+ * prompt-injected caller could pass base_url="https://attacker.example" and
+ * exfiltrate the Ory Network admin token.
+ *
+ * Trusted origins:
+ * - The origin of the env-configured project URL (ORY_PROJECT_URL / ORY_SDK_URL).
+ * - Ory Network hosts over https: *.projects.oryapis.com / *.oryapis.com
+ *   (and oryapis.com itself) and api.console.ory.sh.
+ * - Loopback hosts (localhost / 127.0.0.1 / ::1) over http or https on any
+ *   port, for the local-dev Ory stack (e.g. http://localhost:4000).
+ */
+export declare function isTrustedOryOrigin(target: URL): boolean;
+export declare function executeApiCall(params: ApiCallParams): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
 export declare function registerApiTools(server: McpServer): void;
+export {};

package/dist/tools/api.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTrustedOryOrigin = isTrustedOryOrigin;
+exports.executeApiCall = executeApiCall;
 exports.registerApiTools = registerApiTools;
 const zod_1 = require("zod");
 const logger_js_1 = require("../logger.js");
@@ -9,8 +11,51 @@ const MAX_RESPONSE_SIZE = 5 * 1024 * 1024; // 5 MB
 function resolveBaseUrl(explicit) {
     return explicit ?? process.env.ORY_PROJECT_URL ?? process.env.ORY_SDK_URL ?? null;
 }
-function resolveApiKey(explicit) {
-    return explicit ?? process.env.ORY_API_KEY ?? process.env.ORY_ACCESS_TOKEN;
+function resolveEnvApiKey() {
+    return process.env.ORY_API_KEY ?? process.env.ORY_ACCESS_TOKEN;
+}
+/**
+ * Credential-attachment guard.
+ *
+ * The env-configured admin credential (ORY_API_KEY / ORY_ACCESS_TOKEN) is only
+ * auto-attached when the request targets a trusted origin. Otherwise a
+ * prompt-injected caller could pass base_url="https://attacker.example" and
+ * exfiltrate the Ory Network admin token.
+ *
+ * Trusted origins:
+ * - The origin of the env-configured project URL (ORY_PROJECT_URL / ORY_SDK_URL).
+ * - Ory Network hosts over https: *.projects.oryapis.com / *.oryapis.com
+ *   (and oryapis.com itself) and api.console.ory.sh.
+ * - Loopback hosts (localhost / 127.0.0.1 / ::1) over http or https on any
+ *   port, for the local-dev Ory stack (e.g. http://localhost:4000).
+ */
+function isTrustedOryOrigin(target) {
+    const hostname = target.hostname.toLowerCase();
+    // Loopback (local-dev stack) — any port, http or https.
+    if ((target.protocol === "http:" || target.protocol === "https:") &&
+        (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]")) {
+        return true;
+    }
+    // Ory Network / Ory Console API hosts — https only.
+    if (target.protocol === "https:") {
+        if (hostname === "oryapis.com" || hostname.endsWith(".oryapis.com"))
+            return true;
+        if (hostname === "api.console.ory.sh")
+            return true;
+    }
+    // Same origin as the env-configured project URL.
+    for (const configured of [process.env.ORY_PROJECT_URL, process.env.ORY_SDK_URL]) {
+        if (!configured)
+            continue;
+        try {
+            if (new URL(configured).origin === target.origin)
+                return true;
+        }
+        catch {
+            // Ignore malformed configured URLs.
+        }
+    }
+    return false;
 }
 function buildUrl(baseUrl, path, query) {
     const trimmedBase = baseUrl.replace(/\/+$/, "");
@@ -34,14 +79,35 @@ async function executeApiCall(params) {
             isError: true,
         };
     }
-    const apiKey = resolveApiKey(params.api_key);
     const url = buildUrl(baseUrl, params.path, params.query);
+    const targetUrl = new URL(url);
     const headers = {
         accept: "application/json",
         ...(params.headers ?? {}),
     };
-    if (apiKey && !headers.authorization && !headers.Authorization) {
-        headers.authorization = `Bearer ${apiKey}`;
+    let credentialNote;
+    if (!headers.authorization && !headers.Authorization) {
+        if (params.api_key) {
+            // Explicitly caller-supplied credential — always honored.
+            headers.authorization = `Bearer ${params.api_key}`;
+        }
+        else {
+            const envKey = resolveEnvApiKey();
+            if (envKey) {
+                if (isTrustedOryOrigin(targetUrl)) {
+                    headers.authorization = `Bearer ${envKey}`;
+                }
+                else {
+                    credentialNote =
+                        `Note: the env-configured Ory credential (ORY_API_KEY / ORY_ACCESS_TOKEN) was NOT attached because ` +
+                            `${targetUrl.origin} is not a trusted Ory host (project URL origin, *.oryapis.com, api.console.ory.sh, or localhost). ` +
+                            `Pass 'api_key' or an 'authorization' header explicitly to authenticate against this host.`;
+                    (0, logger_js_1.log)("warn", "withholding env credential for untrusted host", {
+                        origin: targetUrl.origin,
+                    });
+                }
+            }
+        }
     }
     if (params.body && !headers["content-type"] && !headers["Content-Type"]) {
         headers["content-type"] = "application/json";
@@ -96,10 +162,14 @@ async function executeApiCall(params) {
             statusText: response.statusText,
             body: text,
         };
+        const content = [
+            { type: "text", text: JSON.stringify(summary, null, 2) },
+        ];
+        if (credentialNote) {
+            content.push({ type: "text", text: credentialNote });
+        }
         return {
-            content: [
-                { type: "text", text: JSON.stringify(summary, null, 2) },
-            ],
+            content,
             isError: !response.ok,
         };
     }
@@ -139,7 +209,9 @@ function registerApiTools(server) {
             base_url: zod_1.z
                 .string()
                 .optional()
-                .describe("Override the base URL. Defaults to ORY_PROJECT_URL or ORY_SDK_URL env var."),
+                .describe("Override the base URL. Defaults to ORY_PROJECT_URL or ORY_SDK_URL env var. " +
+                "The env-configured API key is only attached automatically when the URL targets a trusted Ory host " +
+                "(the configured project URL origin, *.oryapis.com, api.console.ory.sh over https, or localhost)."),
             query: zod_1.z
                 .record(zod_1.z.string(), zod_1.z.string())
                 .optional()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/mcp-server",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "MCP server exposing the Ory CLI and Ory Network REST API as tools for AI agents to manage identities, OAuth2 clients, permissions, projects, and configuration",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",