@redocly/realm 0.138.0-next.15 → 0.138.0-next.17

package/dist/server/plugins/mcp/gateway-mcp/credential-validation.js

@@ -0,0 +1 @@
+const r=/[\r\n]/,s=255,i=/^bearer$/i;function a(t){for(let e=0;e<t.length;e+=1){const n=t.charCodeAt(e);if(n===0||n>255)return!0}return!1}function c(t,e){if(!e)return"Enter a value before saving.";if(r.test(e))return"The value contains a line break. Paste it as a single line and save again.";if(a(e))return"The value contains a character that cannot be sent in an HTTP header, such as a curly quote or an invisible character. Copy the value again as plain text and save.";if(t.kind==="cookie")return o(t.name,e);if((t.kind==="bearer"||t.kind==="oauth2ClientCredentials")&&i.test(e))return"Paste the token that follows the word Bearer, not only the word."}function o(t,e){if(e.includes(";")||e.toLowerCase().includes(`${t.toLowerCase()}=`))return`This looks like a whole cookie header. Paste only the value of the ${t} cookie, without the "${t}=" prefix and without any other name=value pairs.`}function h(t,e){if(!(!r.test(e)&&!a(e)))throw new Error(`The credential cannot be sent as the ${t} header value.`)}export{h as assertHeaderSafe,c as rejectCredential};

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -0,0 +1,76 @@
+import type { InputRequiredResult } from '@modelcontextprotocol/server';
+import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
+import type { UpstreamApiAuth, UpstreamAuthScheme } from './upstream-auth-scheme.js';
+import type { KvService } from '@redocly/config';
+export declare const CREDENTIALS_INPUT_REQUEST_KEY = "credentials";
+export type CredentialTarget = {
+    api: string;
+    name: string;
+    scheme: string;
+    schemeLabel?: string;
+    acceptedSchemes?: string[];
+};
+/**
+ * Why the prompt is being raised. `authFailure` is the automatic path behind an upstream 401;
+ * `requested` is the model calling the credentials tool on the user's behalf.
+ */
+export type CredentialElicitationReason = {
+    kind: 'authFailure';
+    status: number;
+    detail?: string;
+    otherApiNames?: string[];
+} | {
+    kind: 'requested';
+};
+type CredentialElicitationRequest = {
+    subject: string;
+    baseUrl: string;
+    target: CredentialTarget;
+    auth: UpstreamAuthScheme;
+    apiAuth?: UpstreamApiAuth;
+    kv: KvService;
+    hasExistingSecret: boolean;
+    reason: CredentialElicitationReason;
+};
+type AcceptedLinkScope = {
+    kv: KvService;
+    subject: string;
+    baseUrl: string;
+    apis: readonly string[];
+};
+export type AcceptedCredentialsLink = {
+    apiName: string;
+    url: string;
+};
+/** Concurrent prompts for one subject and scheme share the link the first one mints. */
+export declare function dedupeElicitation(key: string, run: () => Promise<string>): Promise<string>;
+export declare function supportsUrlElicitation(capabilities: {
+    elicitation?: {
+        url?: unknown;
+    };
+} | undefined): boolean;
+/** Only a 2026-07-28-era request carries `_meta` envelope keys, and it needs no session. */
+export declare function isStatelessRequest(mcpReq: {
+    envelope?: unknown;
+}): boolean;
+/** How the user answered the credentials prompt, read from a retried request. */
+export declare function credentialElicitationAnswer(inputResponses: Record<string, unknown> | undefined): 'accepted' | 'declined' | undefined;
+export declare function buildCredentialsAcceptedHint(apiName: string, url?: string): string;
+export declare function acceptedCredentialsLink(requestState: unknown, { kv, subject, baseUrl, apis }: AcceptedLinkScope): Promise<AcceptedCredentialsLink | undefined>;
+export declare function schemeLabelOf(schemes: Record<string, unknown>, scheme: string): string | undefined;
+/**
+ * The 2026-07-28-era credentials prompt: the tool call returns an input-required result the
+ * client fulfils and retries, with no push `elicitation/create` and no session behind it.
+ * `requestState` carries the link token, so the retry after an accepted prompt can repeat the link.
+ */
+export declare function buildUpstreamCredentialInputRequired(request: CredentialElicitationRequest): Promise<InputRequiredResult>;
+/** Fallback text for a client without URL-elicitation support. */
+export declare function buildUpstreamCredentialFallback(request: CredentialElicitationRequest): Promise<string>;
+/**
+ * Text for an authorization failure we deliberately do NOT prompt for: a stored secret the
+ * upstream rejected, a 401 that never carried a stored credential, or a 403/407 that is more
+ * likely a permissions problem than a missing key.
+ */
+export declare function buildCredentialsToolHint(event: UpstreamAuthRequiredEvent, schemeLabel?: string): string;
+export {};
+//# sourceMappingURL=elicitation.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -0,0 +1,5 @@
+import{inputRequired as d,inputResponse as I}from"@modelcontextprotocol/server";import{withPathPrefix as w}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as E}from"../../../constants/mcp.js";import{MANAGE_API_CREDENTIALS_TOOL_NAME as h}from"../constants.js";import{secretStore as l,ELICITATION_TTL_MINUTES as u}from"./secret-store.js";import{operationsForScheme as A,orderedSchemesOf as P}from"./upstream-auth-scheme.js";import{ANONYMOUS_SUBJECT_PREFIX as p}from"./subject.js";const m="credentials",c=new Map;function F(e,t){const n=c.get(e);if(n)return n;const i=t().finally(()=>{c.delete(e)});return c.set(e,i),i}function M(e){return!!e?.elicitation?.url}function D(e){return e.envelope!==void 0}function H(e){const t=I(e,m);if(t.kind==="elicit")return t.action==="accept"?"accepted":"declined"}function q(e,t){return[`The user accepted the prompt to add credentials for the "${e}" API.`,...t?["The credentials page:",t]:[],"",`Wait until the user says they saved the credentials, then retry the call that needed them. Do not call \`${h}\` again unless the user asks for a new link.`].join(`
+`)}async function B(e,{kv:t,subject:n,baseUrl:i,apis:r}){if(typeof e!="string")return;const s=await l.peekElicitation(t,e);if(!(s?.subject!==n||!r.includes(s.api)))return{apiName:s.name,url:$(i,e)}}function W(e,t){return Object.keys(e).length>1?t:void 0}async function Y(e){const{token:t,url:n}=await f(e);return d({inputRequests:{[m]:d.elicitUrl({message:C(e),url:n})},requestState:t})}async function z(e){const{url:t}=await f(e);return x(e,t,S(e.subject))}function G(e,t){const n=b(e);if(e.status===401&&!e.sentScheme)return[`The "${e.name}" API returned ${n}. No stored credential was sent with this request, so this result says nothing about the stored credentials.`,"","Do not replace them. Check whether this operation needs a different kind of credential or a different route."].join(`
+`);const i=e.status===401?`The "${e.name}" API rejected the stored ${t?`"${t}" `:""}credential (${n}).`:`The "${e.name}" API rejected the request with ${n}.`,r=t?`api: "${e.api}" and scheme: "${t}"`:`api: "${e.api}"`;return[i,"",`Do not retry the same call. Call \`${h}\` with ${r} to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
+`)}function b({status:e,detail:t}){return t?`HTTP ${e}: ${t}`:`HTTP ${e}`}async function f({kv:e,subject:t,baseUrl:n,target:i,auth:r,apiAuth:s}){const a=s?k(s):[],o=await l.createElicitation(e,{subject:t,api:i.api,name:i.name,scheme:i.scheme,...i.schemeLabel?{schemeLabel:i.schemeLabel}:{},auth:r,...a.length>1?{schemes:a}:{},...a.length>1&&i.acceptedSchemes?{acceptedSchemes:i.acceptedSchemes}:{}});return{token:o,url:$(n,o)}}function k(e){return P(e.schemes).map(t=>{const n=A(e,t),i=e.descriptions?.[t];return{name:t,...i?{label:i}:{},auth:e.schemes[t],...n.length>0?{operations:n}:{}}})}function S(e){return e.startsWith(p)?e.slice(p.length):void 0}function C({target:e,hasExistingSecret:t,reason:n}){const i=`The link works for ${u} minutes.`,r=O(e),s=n.kind==="authFailure"&&n.detail?` The API answered: ${n.detail}.`:"";return t?`Open this page in a browser to replace or remove the stored credentials for ${r}. They stay out of the chat. ${i}`:`${g(r)} needs credentials.${s} Open this page in a browser to paste them - they stay out of the chat. ${i}`}function O({name:e,schemeLabel:t}){return t?`the "${t}" scheme of the "${e}" API`:`the "${e}" API`}function g(e){return e.charAt(0).toUpperCase()+e.slice(1)}function $(e,t){const n=w(E);if(!e)return`${n}?token=${t}`;try{const i=new URL(n,e);return i.searchParams.set("token",t),i.toString()}catch{return`${e}${n}?token=${t}`}}function x({target:e,reason:t,hasExistingSecret:n},i,r){const a=[`**Stop and show the user this link. They have to open it in a browser to ${n?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",i,"",`The link is valid ${u} minutes and opens a form on this site. The site stores the credentials and adds them to API calls: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status}${t.detail?` (${t.detail})`:""} and needs credentials.`:n?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,...e.schemeLabel?[`The operation authenticates with its "${e.schemeLabel}" security scheme.`]:[],r?`Once the user confirms they saved them, retry the call that needed them with sessionHandle: "${r}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, retry the call that needed them - the credentials are applied server-side and never appear in the conversation."],o=t.kind==="authFailure"?t.otherApiNames??[]:[];if(o.length>0){const T=o.map(y=>`"${y}"`).join(", ");a.push("",`The remaining APIs (${T}) will prompt for credentials on subsequent calls.`)}return a.join(`
+`)}export{m as CREDENTIALS_INPUT_REQUEST_KEY,B as acceptedCredentialsLink,q as buildCredentialsAcceptedHint,G as buildCredentialsToolHint,z as buildUpstreamCredentialFallback,Y as buildUpstreamCredentialInputRequired,H as credentialElicitationAnswer,F as dedupeElicitation,D as isStatelessRequest,W as schemeLabelOf,M as supportsUrlElicitation};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -0,0 +1,22 @@
+import type { OpenAPIDefinition, OpenAPIMcp } from '@redocly/api-docs';
+import type { RedoclyConfig } from '@redocly/config';
+/** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs hidden. */
+export declare function isGatewayCapabilityEnabled(mcp?: RedoclyConfig['mcp']): boolean;
+/**
+ * Whether the API description allows agent calls: every documented API does unless its
+ * `info.x-mcp.apiCalls.hide` is set. Who may call it is decided per request by RBAC, and
+ * `mcp.apiCalls` config by `getCallableApis`.
+ */
+export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined): boolean;
+/**
+ * Whether an API docs page advertises the `/mcp` endpoint via an injected root-level x-mcp:
+ * the capability is on, the author has not provided their own x-mcp servers, and the API is
+ * both gateway-eligible and part of the Docs MCP catalog.
+ */
+export declare function shouldAdvertiseGatewayXMcp(definition: (OpenAPIDefinition & {
+    'x-mcp'?: {
+        servers?: unknown[];
+    };
+}) | undefined, relativePath: string, mcpConfig?: RedoclyConfig['mcp']): boolean;
+export declare function buildGatewayXMcp(url: string): OpenAPIMcp;
+//# sourceMappingURL=eligibility.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/eligibility.js

@@ -0,0 +1 @@
+import{MCP_PROTOCOL_VERSION as t}from"../constants.js";import{isApiIncludedInDocsMcp as i}from"../utils.js";import{isMcpGatewayEnabled as s}from"../utils/mode.js";import{isDefinitionHidden as a}from"../utils/xmcp-utils.js";function p(e){return s()&&!e?.hide&&!e?.docs?.hide}function n(e){return!a(e,"apiCalls")}function m(e,o,r){return p(r)&&!e?.["x-mcp"]?.servers?.length&&n(e?.info)&&i(o,e,r)}function f(e){return{protocolVersion:t,capabilities:{tools:{}},servers:[{url:e}],tools:[],resources:[],prompts:[]}}export{f as buildGatewayXMcp,p as isGatewayCapabilityEnabled,n as isGatewayEligible,m as shouldAdvertiseGatewayXMcp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.d.ts

@@ -0,0 +1,13 @@
+import type { OpenAPIServer } from '@redocly/api-docs';
+/**
+ * Build case-insensitive host matchers from an API's server URL templates. A server URL host
+ * may contain server-variable placeholders (e.g. a tenant `{subdomain}`); each placeholder
+ * expands to its `enum` values, or - when free-form - to one DNS label plus any fixed parent
+ * domain carried by the variable's `default`. So `{subdomain}.dealpos.com` matches
+ * `acme.dealpos.com`, and a whole-host `{subdomain}` defaulting to `acme.dealpos.net` matches
+ * `<tenant>.dealpos.net`, but neither matches `a.b.dealpos.com`, the bare parent domain, or an
+ * unrelated host.
+ */
+export declare function buildAllowedHostMatchers(servers?: readonly OpenAPIServer[]): RegExp[];
+export declare function isHostAllowed(host: string, matchers: readonly RegExp[]): boolean;
+//# sourceMappingURL=allowed-hosts.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.js

@@ -0,0 +1 @@
+const h=/\{(?<!\{[^}]*?\{)([^}]+)\}/g;function g(n=[]){const e=[];for(const t of n){const r=p(t);r&&e.push(r)}return e}function x(n,e){return e.some(t=>t.test(n))}function p(n){const e=m(n.url);if(!e)return null;let t="",r=0,o=!1;for(const l of e.matchAll(h)){const[i,f]=l,c=e.slice(r,l.index);c.includes(".")&&(o=!0),t+=s(c);const u=d(n.variables?.[f]);u.guaranteesDot&&(o=!0),t+=u.pattern,r=l.index+i.length}const a=e.slice(r);return a.includes(".")&&(o=!0),t+=s(a),o?new RegExp(`^${t}$`,"i"):null}function d(n){const e=n?.enum?.filter(Boolean);if(e&&e.length>0)return{pattern:`(?:${e.map(s).join("|")})`,guaranteesDot:e.every(r=>r.includes("."))};const t=n?.default?.split(".").slice(1).join(".");return t?{pattern:`[^.]+\\.${s(t)}`,guaranteesDot:!0}:{pattern:"[^.]+",guaranteesDot:!1}}function m(n){if(!n)return null;const t=n.replace(/^[a-z][a-z0-9+.-]*:\/\//i,"").split(/[/?#]/,1)[0];return t&&(t.includes("@")?t.slice(t.lastIndexOf("@")+1):t).replace(/:(?:\d+|\{[^}]+\})$/,"")||null}function s(n){return n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}export{g as buildAllowedHostMatchers,x as isHostAllowed};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.d.ts

@@ -0,0 +1,26 @@
+import type { GatewayFetchOutcome } from './fetch-telemetry.js';
+type GatewayFetchAuditRecord = {
+    rawUrl: string;
+    method: string;
+    host: string;
+    outcome: GatewayFetchOutcome;
+    durationMs: number;
+    injectedSecretValues: readonly string[];
+    credentialQueryParams?: readonly string[];
+    path?: string;
+    api?: string;
+    status?: number;
+    injectedScheme?: string;
+    requestHeaders?: Record<string, string>;
+    requestBody?: string;
+    responseHeaders?: Record<string, string>;
+    responseBody?: string;
+};
+/**
+ * One outbound gateway fetch. `host`, `method` and `path` repeat the `mcpServer.gatewayFetch`
+ * telemetry event verbatim so a Grafana row joins onto this line; `url_sha256` identifies the
+ * request itself, since the telemetry event's `path` is deliberately normalized.
+ */
+export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, credentialQueryParams, path, api, status, injectedScheme, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
+export {};
+//# sourceMappingURL=fetch-audit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.js

@@ -0,0 +1 @@
+import{auditHeaderNames as n,auditInput as b,auditOutputDigest as l,auditSha256 as y,auditUrl as A,logAuditRecord as D}from"../../audit/audit-log.js";function q({rawUrl:e,method:u,host:i,outcome:r,durationMs:o,injectedSecretValues:t,credentialQueryParams:_,path:h,api:f,status:m,injectedScheme:p,requestHeaders:c,requestBody:d,responseHeaders:g,responseBody:s}){const a=s===void 0?void 0:l(s);D("Record gateway fetch",{url_sha256:y(e),host:i,method:u,path:h,api:f,outcome:r,status:m,injected_scheme:p,duration_ms:o,url:A(e,t,_),request_header_names:n(c),request_body:d===void 0?void 0:b(d,t),response_header_names:n(g),response_sha256:a?.sha256,response_bytes:a?.bytes})}export{q as logGatewayFetchAudit};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.d.ts

@@ -0,0 +1,47 @@
+import { Agent, type Dispatcher } from 'undici';
+import type { SandboxFetch } from '../../codemode/types.js';
+import type { UpstreamAuthRequiredEvent } from '../upstream-auth.js';
+import type { StoredSecret } from '../secret-store.js';
+import { type ApiCallOperation } from '../api-call-operations.js';
+export declare function getDefaultAgent(): Agent;
+export type FetchBridgeRoute = {
+    pattern: RegExp;
+    method: string;
+    schemes: readonly string[];
+};
+export type FetchBridgeApi = {
+    slug: string;
+    name: string;
+    matchers: readonly RegExp[];
+    secrets?: Readonly<Record<string, StoredSecret>>;
+    defaultScheme?: string;
+    routes?: readonly FetchBridgeRoute[];
+    credentialHeaders?: readonly string[];
+    credentialQueryParams?: readonly string[];
+    schemePriority?: readonly string[];
+    /**
+     * The documented operations agents may reach on this API's hosts; see `apiCallOperationsOf`.
+     * Undefined puts no path restriction on the API.
+     */
+    operations?: readonly ApiCallOperation[];
+};
+type FetchBridgeOptions = {
+    allowedHosts: readonly RegExp[];
+    apis?: readonly FetchBridgeApi[];
+    authorization?: string;
+    onAuthRequired?: (event: UpstreamAuthRequiredEvent) => void;
+    fetchImpl?: typeof fetch;
+    dispatcher?: Dispatcher;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+    maxFetchesPerExec?: number;
+    beforeSend?: () => Promise<void>;
+    clientIp?: string;
+    /** Upper-case methods that may reach the network (`mcp.apiCalls.allowedHttpMethods`); undefined allows all. */
+    allowedHttpMethods?: readonly string[];
+};
+/** Build the host-side `fetch` the gateway sandbox calls. */
+export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, maxFetchesPerExec, beforeSend, clientIp, allowedHttpMethods, }: FetchBridgeOptions): SandboxFetch;
+export declare function readCappedBody(response: Response, maxBytes: number): Promise<string>;
+export {};
+//# sourceMappingURL=fetch-bridge.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -0,0 +1 @@
+import{Agent as ie}from"undici";import{envConfig as le}from"../../../../config/env-config.js";import{logger as K}from"../../../../tools/notifiers/logger.js";import{auditHeaderNames as de}from"../../audit/audit-log.js";import{assertUrlAllowed as X}from"./ssrf-guard.js";import{createSsrfSafeLookup as ue}from"../../../../web-server/utils/ssrf-safe-lookup.js";import{SsrfBlockedError as J}from"../../../../web-server/utils/ssrf-blocklist.js";import{GatewayFetchBlockedError as p,GatewayFetchSystemError as fe,GatewayFetchUserError as S}from"./fetch-errors.js";import{redactHeaders as he,redactSecretValuesFromHeaders as me,redactSecretsFromString as _,secretEchoForms as pe}from"./redact.js";import{extractUpstreamDetail as we}from"./upstream-detail.js";import{normalizeFetchPath as ye}from"./normalize-path.js";import{reportGatewayFetch as Z}from"./fetch-telemetry.js";import{logGatewayFetchAudit as q}from"./fetch-audit.js";import{matchingApiCallOperations as Se}from"../api-call-operations.js";import{operationHttpMethod as be}from"../route-pattern.js";const ee="x-forwarded-for",ge=3e4,Ae=1024*1024,Ee=/%2f|%5c/i,ve=new Set([401,403,407]),$e=["authorization","proxy-authorization","cookie","x-api-key"];let x;function ke(){if(!x){const e=le.isDevelopMode;e&&K.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),x=new ie({connect:{lookup:ue({allowLoopback:e})}})}return x}function nt({allowedHosts:e,apis:t=[],authorization:r,onAuthRequired:n,fetchImpl:c=fetch,dispatcher:d=ke(),timeoutMs:f=ge,maxResponseBytes:b=Ae,maxFetchesPerExec:i,beforeSend:oe,clientIp:ae,allowedHttpMethods:P}){const O=[...e,...t.flatMap(a=>a.matchers)],se=[...new Set(t.map(a=>a.name).filter(Boolean))].join(", "),j=t.flatMap(a=>Object.values(a.secrets??{})),w=[...r?[{header:"Authorization",value:r}]:[],...j].flatMap(pe),ce=j.map(a=>a.header),I=t.flatMap(a=>a.credentialQueryParams??[]);let N=0,B=!1;return async a=>{const l=be(a.method??"GET"),D=Date.now();let G,A,E,v={},$,U,H;try{if(i!==void 0){const o=Math.max(0,i);if(N+=1,N>o)throw new S(`Outbound fetch budget exceeded (max ${o} fetches per execute); split the work across calls`)}if(P&&!P.includes(l))throw new p(`${l} is not allowed: this project permits only ${P.join(", ")} API calls`,te(a.url));const s=Re(a.url,O,se);if(G=s.hostname,A=ye(s.pathname),Ee.test(s.pathname))throw new p(`${l} ${s.pathname} is refused: the path holds an encoded path separator (%2F or %5C), which could reach an operation other than the documented one`,s.hostname);const y=t.filter(o=>o.matchers.some(T=>T.test(s.hostname))),m=y.flatMap(o=>o.operations?Se(o.operations,s.pathname,l).map(T=>({api:o,callable:T.callable,visible:T.visible,variables:T.variables})):[{api:o,callable:!0,visible:!0,variables:Number.POSITIVE_INFINITY}]),k=Math.min(...m.map(o=>o.variables)),M=m.filter(o=>o.variables===k);if(y.length>0&&(m.length===0||M.some(o=>!o.visible)))throw new p(`${l} ${s.pathname} is not a documented operation of ${y.map(o=>o.name).join(", ")}; \`fetch\` calls only the operations the API description documents`,s.hostname);const V=M.find(o=>!o.callable);if(V)throw new p(`${l} ${s.pathname} is not callable: this operation of ${V.api.name} is excluded from agent calls`,s.hostname);const h=new Set(M.map(o=>o.api)).size===1?M[0].api:void 0;E=h?.slug;const z=He(a.securityScheme,h),F=z?[z]:h?Pe(h,s.pathname,l):void 0,C=h&&F?Ue(h,F):void 0,Q=C?h?.secrets?.[C]:void 0,L=Q??(r?{header:"Authorization",value:r}:void 0);v=je({callerHeaders:a.headers,injected:L,clientIp:ae});const W=xe(a.headers,s,y,L);if(W&&(L||B))throw new S(Oe(W,!!L));await oe?.(),B||=!!L,$=Q?C:void 0;const Y=new AbortController;H=setTimeout(()=>Y.abort(),f);const u=await c(s,{method:l,headers:v,body:a.body,redirect:"manual",signal:Y.signal,dispatcher:d});U=u.status;let R="";try{R=await Fe(u,b)}finally{if(ve.has(u.status)&&h&&n){const o=we(R,u.headers.get("content-type"),w);n({api:h.slug,name:h.name,status:u.status,...C?{scheme:C}:{},...F?.length?{schemes:[...F]}:{},...$?{sentScheme:$}:{},...o?{detail:o}:{}})}}let g=me(Ie(u.headers),w);if(Te(u.status)){g=he(g,ce);const{location:o}=g;o&&!De(o,s,O)&&delete g.location}return Z({host:s.hostname,method:l,outcome:"success",durationMs:Date.now()-D,path:A,api:E,status:u.status,bytes:Buffer.byteLength(R,"utf8")}),q({rawUrl:s.href,method:l,host:s.hostname,outcome:"success",durationMs:Date.now()-D,injectedSecretValues:w,credentialQueryParams:I,path:A,api:E,status:u.status,injectedScheme:$,requestHeaders:v,requestBody:a.body,responseHeaders:g,responseBody:R}),{status:u.status,statusText:_(u.statusText,w),ok:u.ok,headers:g,bodyText:_(R,w)}}catch(s){const{outcome:y,userSafe:m}=Le(s),k=G??(m instanceof p?m.host:void 0)??te(a.url)??"invalid-url";throw Z({host:k,method:l,outcome:y,durationMs:Date.now()-D,path:A,api:E,status:U}),q({rawUrl:a.url,method:l,host:k,outcome:y,durationMs:Date.now()-D,injectedSecretValues:w,credentialQueryParams:I,path:A,api:E,status:U,injectedScheme:$,requestHeaders:v,requestBody:a.body}),m||(K.error(`Gateway MCP fetch failed [${l} ${k}]: ${_(Me(s),w)} headers=${de(v)}`),new fe("Upstream fetch failed due to an internal error"))}finally{H!==void 0&&clearTimeout(H)}}}function Ce(e){let t=e;for(let r=0;r<5&&t instanceof Error;r++){if(t instanceof S||t instanceof J)return t;t=t.cause}}function Le(e){const t=Ce(e);return{outcome:t instanceof p||t instanceof J?"blocked":t?"user_error":"system_error",userSafe:t}}function Re(e,t,r){try{return X(e,t)}catch(n){throw n instanceof p&&r?new p(`${n.message}. \`fetch\` reaches only the documented hosts of the callable APIs (${r}); other documented APIs can be read through the tools but not called.`,n.host):n}}function te(e){try{return new URL(e).hostname||void 0}catch{return}}function Te(e){return e>=300&&e<400}function De(e,t,r){try{return!!X(new URL(e,t).href,r)}catch{return!1}}function Me(e){if(!(e instanceof Error))return String(e);const t=e.cause;return t instanceof Error?`${e.message}: ${t.message}`:e.message}async function Fe(e,t){const r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw re(t,r);if(!e.body)return"";const n=e.body.getReader(),c=new TextDecoder;let d=0,f="";try{for(;;){const{done:b,value:i}=await n.read();if(b)break;if(d+=i.byteLength,d>t)throw re(t,d);f+=c.decode(i,{stream:!0})}return f+c.decode()}finally{await n.cancel().catch(()=>{})}}function re(e,t){return new S(`Response is too large (over ${e} bytes, got ${t}); request less data`)}function Pe(e,t,r){const n=e.routes?.find(c=>c.method===r&&c.pattern.test(t));return n?n.schemes:_e(e)}function Ue(e,t){const r=t.filter(n=>e.secrets?.[n]);return r.length===0?t[0]:r.reduce((n,c)=>{const d=e.secrets?.[n]?.savedAt??0;return(e.secrets?.[c]?.savedAt??0)>d?c:n})}function He(e,t){if(e==null)return;if(typeof e!="string")throw new S("securityScheme must be a security scheme name (a string)");if(!t)throw new S("securityScheme cannot be applied: the URL host does not identify exactly one callable API");const r=t.schemePriority??[];if(r.length>0&&!r.includes(e))throw new S(`Unknown securityScheme "${e}" for ${t.name}; valid values: ${r.join(", ")}`);return e}function _e(e){const t=Object.keys(e.secrets??{});if(t.length===0)return e.defaultScheme?[e.defaultScheme]:[];const r=(e.schemePriority??[]).filter(n=>t.includes(n));return[...r,...t.filter(n=>!r.includes(n))]}function xe(e,t,r,n){const c=ne([...$e,...r.flatMap(i=>i.credentialHeaders??[]),...n?[n.header]:[]]),d=Object.keys(e??{}).find(i=>c.has(i.toLowerCase()));if(d)return{kind:"header",name:d};const f=ne(r.flatMap(i=>i.credentialQueryParams??[])),b=[...t.searchParams.keys()].find(i=>f.has(i.toLowerCase()));return b?{kind:"query parameter",name:b}:void 0}function ne(e){return new Set(e.map(t=>t.toLowerCase()))}function Oe({kind:e,name:t},r){return r?`Remove the "${t}" ${e}: this request already sends the stored credential.`:`Remove the "${t}" ${e}: this script already sent a stored credential, so it cannot also send its own.`}function je({callerHeaders:e,injected:t,clientIp:r}){const n={};for(const[c,d]of Object.entries(e??{})){const f=c.toLowerCase();f==="host"||f==="content-length"||f!==ee&&(n[c]=d)}return r&&(n[ee]=r),t&&(n[t.header]=t.value),n}function Ie(e){const t={};return e.forEach((r,n)=>{t[n.toLowerCase()]=r}),t}export{nt as buildFetchBridge,ke as getDefaultAgent,Fe as readCappedBody};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-errors.d.ts

@@ -0,0 +1,11 @@
+export declare class GatewayFetchUserError extends Error {
+    constructor(message: string);
+}
+export declare class GatewayFetchBlockedError extends GatewayFetchUserError {
+    readonly host?: string;
+    constructor(message: string, host?: string);
+}
+export declare class GatewayFetchSystemError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=fetch-errors.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-errors.js

@@ -0,0 +1 @@
+class s extends Error{constructor(r){super(r),this.name="GatewayFetchUserError"}}class o extends s{host;constructor(r,t){super(r),this.name="GatewayFetchBlockedError",this.host=t}}class a extends Error{constructor(r){super(r),this.name="GatewayFetchSystemError"}}export{o as GatewayFetchBlockedError,a as GatewayFetchSystemError,s as GatewayFetchUserError};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-telemetry.d.ts

@@ -0,0 +1,14 @@
+export type GatewayFetchOutcome = 'success' | 'blocked' | 'user_error' | 'system_error';
+type GatewayFetchEvent = {
+    host: string;
+    method: string;
+    outcome: GatewayFetchOutcome;
+    durationMs: number;
+    path?: string;
+    api?: string;
+    status?: number;
+    bytes?: number;
+};
+export declare function reportGatewayFetch({ host, method, outcome, durationMs, path, api, status, bytes, }: GatewayFetchEvent): void;
+export {};
+//# sourceMappingURL=fetch-telemetry.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-telemetry.js

@@ -0,0 +1 @@
+import{telemetry as m}from"../../../../telemetry/index.js";import{logger as c}from"../../../../tools/notifiers/logger.js";import{McpServerType as u}from"../../constants.js";import{serverAttributes as $}from"../../utils/telemetry-attributes.js";function g({host:f,method:i,outcome:o,durationMs:t,path:e,api:r,status:n,bytes:d}){try{m.sendMcpGatewayFetchPerformedMessage([{...$(u.Docs),host:f,method:i,outcome:o,...e!==void 0&&{path:e},...r!==void 0&&{api:r},...n!==void 0&&{status:n},...d!==void 0&&{bytes:d},duration_ms:t}])}catch{}c.info(`Gateway MCP fetch [${i} ${f}] outcome=${o}`+(e!==void 0?` path=${e}`:"")+(r!==void 0?` api=${r}`:"")+(n!==void 0?` status=${n}`:"")+(d!==void 0?` bytes=${d}`:"")+` durationMs=${t}`)}export{g as reportGatewayFetch};

package/dist/server/plugins/mcp/gateway-mcp/fetch/normalize-path.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Reduce a request path to something safe to report: no query string (it carries tokens), no
+ * identifiers (they explode cardinality and can be customer data), bounded length.
+ */
+export declare function normalizeFetchPath(pathname: string): string;
+//# sourceMappingURL=normalize-path.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/normalize-path.js

@@ -0,0 +1 @@
+const A=200,a=12,c=/^\d+$/,i=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,E=/^[0-9a-f]{16,}$/i,_=/^[a-z]{2,6}_[A-Za-z0-9]{8,}$/,f=/^(?=.*\d)[A-Za-z0-9._~-]{20,}$/;function r(t){return t&&(c.test(t)||i.test(t)||E.test(t)||_.test(t)||f.test(t)?"{id}":t)}function M(t){if(!t||t==="/")return"/";const o=t.split("/"),s=o.slice(0,13).map(r);o.length>13&&s.push("...");const n=s.join("/")||"/";return n.length>200?`${n.slice(0,200)}...`:n}export{M as normalizeFetchPath};

package/dist/server/plugins/mcp/gateway-mcp/fetch/redact.d.ts

@@ -0,0 +1,15 @@
+export declare const REDACTED = "\u00AB[redacted]\u00BB";
+/**
+ * Every form in which an upstream can echo an injected credential: the full header value, the
+ * token without its auth scheme, the decoded `user:password` of a Basic value, and the cookie
+ * value without its name, each also JSON-escaped and URL-encoded. Parts under 8 characters are
+ * left out so they do not redact unrelated text.
+ */
+export declare function secretEchoForms({ header, value }: {
+    header: string;
+    value: string;
+}): string[];
+export declare function redactSecretsFromString(text: string, secretValues: readonly string[]): string;
+export declare function redactSecretValuesFromHeaders(headers: Record<string, string>, secretValues: readonly string[]): Record<string, string>;
+export declare function redactHeaders(headers: Record<string, string>, extraSensitiveNames?: readonly string[]): Record<string, string>;
+//# sourceMappingURL=redact.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/redact.js

@@ -0,0 +1 @@
+const i="\xAB[redacted]\xBB",f=["authorization","proxy-authorization","cookie","set-cookie"],m=8,a=/^([A-Za-z][\w-]*) +(\S+)$/;function p({header:t,value:e}){if(!e.trim())return[];const n=u(t,e).filter(r=>r.trim().length>=8);return[...new Set([e,...n].flatMap(E))]}function u(t,e){if(t.toLowerCase()==="cookie"){const c=e.indexOf("=");return c>0?[e.slice(c+1)]:[]}const n=a.exec(e);if(!n)return[];const[,r,o]=n,s=r.toLowerCase()==="basic"?d(o):void 0;return s?[o,s]:[o]}function d(t){const e=Buffer.from(t,"base64").toString("utf8");return Buffer.from(e,"utf8").toString("base64")===t&&e.includes(":")?e:void 0}function E(t){const e=JSON.stringify(t).slice(1,-1);return[t,e,e.replace(/\//g,"\\/"),encodeURIComponent(t)]}function l(t,e){const n=e.filter(o=>o.trim()).sort((o,s)=>s.length-o.length);let r=t;for(const o of n)r=r.split(o).join(i);return r}function S(t,e){const n={};for(const[r,o]of Object.entries(t))n[r]=l(o,e);return n}function x(t,e=[]){const n=new Set([...f,...e].map(o=>o.toLowerCase())),r={};for(const[o,s]of Object.entries(t))r[o]=n.has(o.toLowerCase())?i:s;return r}export{i as REDACTED,x as redactHeaders,S as redactSecretValuesFromHeaders,l as redactSecretsFromString,p as secretEchoForms};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Validate an outbound request URL against an API's host allow-list before the gateway fetches it.
+ *
+ * Returns the parsed URL on success; throws with a clear message otherwise.
+ */
+export declare function assertUrlAllowed(rawUrl: string, matchers: readonly RegExp[]): URL;
+/** True for localhost or any literal IP in a blocked (private/reserved/loopback/link-local/…) range. */
+export declare function isBlockedAddress(host: string): boolean;
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.js

@@ -0,0 +1 @@
+import{isIP as d}from"node:net";import{isHostAllowed as h}from"./allowed-hosts.js";import{isBlockedIp as w}from"../../../../web-server/utils/ssrf-blocklist.js";import{GatewayFetchBlockedError as p,GatewayFetchUserError as r}from"./fetch-errors.js";import{findUnresolvedPlaceholders as a,unresolvedPlaceholderMessage as i}from"./url-placeholders.js";function v(o,t){let e;try{e=new URL(o)}catch{throw new r(`Invalid URL: ${o}`)}if(e.protocol!=="http:"&&e.protocol!=="https:")throw new r(`Only http(s) URLs are allowed, got ${e.protocol}`);if(e.username||e.password)throw new r("URLs must not contain embedded credentials");const n=a(e.hostname);if(n.length>0)throw new r(i(n));const s=c(e.hostname);if(f(s)||!h(s,t))throw new p(`Host "${s}" is not allowed`,s);const l=a(e.pathname);if(l.length>0)throw new r(i(l));return e}function f(o){const t=c(o.toLowerCase()).split("%")[0];return t==="localhost"||t.endsWith(".localhost")?!0:d(t)!==0?w(t):!1}function c(o){return o.replace(/^\[|\]$/g,"")}export{v as assertUrlAllowed,f as isBlockedAddress};

package/dist/server/plugins/mcp/gateway-mcp/fetch/upstream-detail.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The upstream's own explanation of an auth failure: `title` and `detail` of a `problem+json`
+ * body, a `message`/`error` string of a plain JSON body, or a short text body. Whitespace is
+ * collapsed, injected secrets are redacted, and the result is capped so it fits in a hint.
+ */
+export declare function extractUpstreamDetail(bodyText: string, contentType: string | null, injectedSecretValues: readonly string[]): string | undefined;
+//# sourceMappingURL=upstream-detail.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/upstream-detail.js

@@ -0,0 +1 @@
+import{redactSecretsFromString as c}from"./redact.js";const o=200;function l(t,e,r){const i=f(e)?u(t):t;if(!i)return;const n=c(i.replace(/\s+/g," ").trim(),r);if(n)return n.length>o?`${n.slice(0,o-1)}\u2026`:n}function f(t){return/[/+]json\b/i.test(t??"")}function u(t){let e;try{e=JSON.parse(t)}catch{return}if(typeof e!="object"||e===null||Array.isArray(e))return;const r=[e.title,e.detail].filter(s);return r.length>0?r.join(": "):[e.message,e.error].find(s)}function s(t){return typeof t=="string"&&t.trim()!==""}export{l as extractUpstreamDetail};

package/dist/server/plugins/mcp/gateway-mcp/fetch/url-placeholders.d.ts

@@ -0,0 +1,5 @@
+/** Collect the placeholder names one part of a URL still carries. */
+export declare function findUnresolvedPlaceholders(urlPart: string): string[];
+/** The refusal a caller reads when it left a placeholder in the URL. */
+export declare function unresolvedPlaceholderMessage(names: readonly string[]): string;
+//# sourceMappingURL=url-placeholders.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/url-placeholders.js

@@ -0,0 +1 @@
+const o=/\{(?<!\{[^}/]*?\{)([^}/]+)\}/g,t=/^[A-Za-z_][A-Za-z0-9_]*$/;function n(e){const a=e.replace(/%7B/gi,"{").replace(/%7D/gi,"}"),l=new Set;for(const[,r]of a.matchAll(o))t.test(r)&&l.add(r);return[...l]}function s(e){const a=e.length>1?"placeholders":"placeholder",l=e.map(r=>`"${r}"`).join(", ");return`Unresolved ${a} ${l} in the URL. This is not a credentials problem. Replace every placeholder with a real value. Use the server variable default, or ask the user.`}export{n as findUnresolvedPlaceholders,s as unresolvedPlaceholderMessage};

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.d.ts

@@ -0,0 +1,5 @@
+import type { McpToolContext } from '../types.js';
+import type { SandboxFetch } from '../codemode/types.js';
+import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
+export declare function buildExecuteHostFetch(context: McpToolContext, onAuthRequired?: (event: UpstreamAuthRequiredEvent) => void): Promise<SandboxFetch>;
+//# sourceMappingURL=fetch-capability.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.js

@@ -0,0 +1 @@
+import{isDefined as l}from"../../../../utils/guards/is-defined.js";import{filterApiDescriptionByAccess as c,readApiDescriptionFromFs as u}from"../docs-mcp/tools/openapi/utils.js";import{isDefinitionHidden as d}from"../utils/xmcp-utils.js";import{getAllowedHttpMethods as m}from"./allowed-http-methods.js";import{getCallableApis as f,getExcludedOperations as h}from"./callable-apis.js";import{apiCallOperationsOf as p}from"./api-call-operations.js";import{buildAllowedHostMatchers as n}from"./fetch/allowed-hosts.js";import{buildFetchBridge as w}from"./fetch/fetch-bridge.js";import{GatewayFetchUserError as b}from"./fetch/fetch-errors.js";import{sendFetchCount as g}from"./rate-limit/fetch-limiter/fetch-count-client.js";import{credentialHeadersOf as v,orderedSchemesOf as y,resolveUpstreamApiAuth as P}from"./upstream-auth-scheme.js";async function z(e,t){const i=await Promise.all(f(e).map(async r=>{const a=await F(e,r.relativePath),o=a?.visible;if(o&&d(o.info,"apiCalls"))return;const s=await P(e,r.relativePath,async()=>o);return{slug:r.relativePath,name:r.name,matchers:n(r.servers??[]),secrets:e.upstreamSecrets?.[r.relativePath],defaultScheme:s.defaultScheme,routes:s.routes,credentialHeaders:v(s.schemes),credentialQueryParams:s.credentialQueryParams,schemePriority:y(s.schemes),operations:a?.visible?p(a.full,a.visible,r.servers??[],h(e,r.relativePath)):[]}}));return w({allowedHosts:n([]),apis:i.filter(l),authorization:e.upstreamAuthorization,onAuthRequired:t,maxFetchesPerExec:e.gatewayFetchBudgetPerExec,beforeSend:A(e),clientIp:e.clientIp,allowedHttpMethods:m(e.config?.mcp)})}function A(e){const{fetchCountRequest:t,internalBaseUrl:i}=e;if(!(!t||!i))return async()=>{const r=await g(i,t);if(r)throw new b(r)}}async function F(e,t){try{const i=await u(t,e.outdir||"");if(!i)return;const r=c(i,{user:e.user,rbac:e.config?.access?.rbac||{},requiresLogin:!!e.config?.access?.requiresLogin});return{full:i,visible:r}}catch{return}}export{z as buildExecuteHostFetch};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-client.d.ts

@@ -0,0 +1,4 @@
+import type { FetchCountRequest } from '../../../types.js';
+/** The refusal when a limit is reached; when the check itself fails, the fetch is allowed. */
+export declare function sendFetchCount(serverBaseUrl: string, { caller, secret }: FetchCountRequest): Promise<string | undefined>;
+//# sourceMappingURL=fetch-count-client.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-client.js

@@ -0,0 +1 @@
+import{withPathPrefix as i}from"@redocly/theme/core/utils";import{ServerRoutes as a}from"../../../../../../constants/api.js";import{logger as e}from"../../../../../tools/notifiers/logger.js";const c=5e3;async function d(r,{caller:n,secret:o}){try{const t=await fetch(`${r}${i(a.MCP_FETCH_COUNT)}`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${o}`},body:JSON.stringify({caller:n}),signal:AbortSignal.timeout(c)});if(t.status===429)return await t.text();t.ok||e.warn(`Fetch limit check answered ${t.status}; the fetch was allowed uncounted`);return}catch(t){e.warn(`Fetch limit check failed; the fetch was allowed uncounted: ${String(t)}`);return}}export{d as sendFetchCount};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-secret.d.ts

@@ -0,0 +1,4 @@
+/** The secret of this server process; only its own execute workers receive it. */
+export declare function fetchCountSecret(): string;
+export declare function isFetchCountSecret(value: string | null | undefined): boolean;
+//# sourceMappingURL=fetch-count-secret.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-secret.js

@@ -0,0 +1 @@
+import{randomBytes as o,timingSafeEqual as f}from"node:crypto";const n=o(32).toString("base64url");function i(){return n}function u(t){if(typeof t!="string")return!1;const e=Buffer.from(t),r=Buffer.from(n);return e.length===r.length&&f(e,r)}export{i as fetchCountSecret,u as isFetchCountSecret};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count.d.ts

@@ -0,0 +1,11 @@
+import type { FetchCountRequest } from '../../../types.js';
+import type { FetchCounterRepository } from './fetch-counter-repository.js';
+import type { GatewayFetchLimits } from './fetch-limits.js';
+type FetchLimits = Pick<GatewayFetchLimits, 'ratePerMin' | 'quotaPerDay'>;
+/**
+ * Counts one fetch atomically and returns the refusal when a window is full. A signed-in user
+ * is counted by subject, an anonymous caller by IP; a caller with neither is not counted.
+ */
+export declare function applyFetchCount(store: FetchCounterRepository, caller: FetchCountRequest['caller'], limits: FetchLimits, now: number): Promise<string | undefined>;
+export {};
+//# sourceMappingURL=fetch-count.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count.js

@@ -0,0 +1 @@
+import{logger as u}from"../../../../../tools/notifiers/logger.js";const d=[{seconds:60,limitOf:"ratePerMin",per:"minute"},{seconds:86400,limitOf:"quotaPerDay",per:"day"}];function a(c,r,i){const n=Math.floor(i/1e3);return d.map(e=>{const t=Math.floor(n/e.seconds);return{key:["mcp","fetch-rl",c,String(e.seconds),String(t)],per:e.per,limit:r[e.limitOf],retryAfterSeconds:Math.max(1,(t+1)*e.seconds-n),ttlInSeconds:e.seconds}})}async function l(c,r){const i=await c.getMany(r.map(e=>e.key)),n=r.filter((e,t)=>(i[t]?.value?.count??0)>=e.limit);return n.length>0?n.reduce((e,t)=>e.retryAfterSeconds>=t.retryAfterSeconds?e:t):r.reduce((e,t)=>e.retryAfterSeconds<=t.retryAfterSeconds?e:t)}async function y(c,r,i,n){const e=r.subject??(r.ip&&`ip:${r.ip}`);if(!e)return;const t=a(e,i,n);try{if(await c.incrementBelowLimits(t))return;const{limit:o,per:s,retryAfterSeconds:f}=await l(c,t);return`Outbound fetch limit reached (${o} fetches per ${s}); retry in ${f}s`}catch(o){u.warn(`Fetch limit store failed; the fetch was allowed uncounted: ${String(o)}`);return}}export{y as applyFetchCount};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-counter-repository.d.ts

@@ -0,0 +1,13 @@
+import type { KvKey } from '@redocly/config';
+import type { RepositoryInstanceOptions } from '../../../../../providers/database/types.js';
+import { KvRepository } from '../../../../../persistence/kv/repositories/kv-repository.js';
+export declare class FetchCounterRepository extends KvRepository {
+    static create(options: RepositoryInstanceOptions): Promise<FetchCounterRepository>;
+    /** Adds one to every slot in one statement unless a slot is at its limit; tells whether it did. */
+    incrementBelowLimits(slots: readonly {
+        key: KvKey;
+        limit: number;
+        ttlInSeconds: number;
+    }[]): Promise<boolean>;
+}
+//# sourceMappingURL=fetch-counter-repository.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-counter-repository.js

@@ -0,0 +1,13 @@
+import{sql as t}from"drizzle-orm";import{createDatabaseRepositoryInstance as s}from"../../../../../providers/database/instance-cache-resolver.js";import{KvRepository as u}from"../../../../../persistence/kv/repositories/kv-repository.js";import{createKvDbRecord as _}from"../../../../../persistence/kv/mappers/create-kv-db-record.js";class o extends u{static create(a){return s(a,"fetch counter",o)}async incrementBelowLimits(a){const d=t.join(a.map(({key:c,limit:n,ttlInSeconds:r})=>{const e=_({key:c,value:{count:1},ttlInSeconds:r});return t`(${e.encodedKey}, ${e.value}, ${e.expiresAt}, ${e.createdAt}, ${e.updatedAt}, ${n})`}),t`, `);return(await this.databaseClient.dbClient.all(t`
+      WITH slot (encoded_key, value, expires_at, created_at, updated_at, max_count) AS (VALUES ${d})
+      INSERT INTO kv (encoded_key, value, expires_at, created_at, updated_at)
+      SELECT encoded_key, value, expires_at, created_at, updated_at FROM slot
+      WHERE NOT EXISTS (
+        SELECT 1 FROM slot AS s JOIN kv ON kv.encoded_key = s.encoded_key
+        WHERE json_extract(kv.value, '$.count') >= s.max_count
+      )
+      ON CONFLICT (encoded_key) DO UPDATE SET
+        value = json_object('count', json_extract(kv.value, '$.count') + 1),
+        updated_at = excluded.updated_at
+      RETURNING encoded_key
+    `)).length>0}}export{o as FetchCounterRepository};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-limits.d.ts

@@ -0,0 +1,7 @@
+export type GatewayFetchLimits = {
+    ratePerMin: number;
+    quotaPerDay: number;
+    budgetPerExec: number;
+};
+export declare function resolveGatewayFetchLimits(): GatewayFetchLimits;
+//# sourceMappingURL=fetch-limits.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-limits.js

@@ -0,0 +1 @@
+import{FEATURE as e,GATEWAY_FETCH_LIMIT_DEFAULTS as t}from"../../../../../../constants/common.js";import{readEntitlementNumber as r}from"../../../../../utils/entitlements/read-entitlement-number.js";function i(){return{ratePerMin:r(e.gatewayFetchRatePerMin,t.ratePerMin),quotaPerDay:r(e.gatewayFetchQuotaPerDay,t.quotaPerDay),budgetPerExec:r(e.gatewayFetchBudgetPerExec,t.budgetPerExec)}}export{i as resolveGatewayFetchLimits};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/apply-edge-rate-limit.d.ts

@@ -0,0 +1,3 @@
+import type { Store } from '../../../../../store.js';
+export declare function applyEdgeRateLimit(request: Request, store: Store): Promise<Response | undefined>;
+//# sourceMappingURL=apply-edge-rate-limit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/apply-edge-rate-limit.js

@@ -0,0 +1 @@
+import{envConfig as o}from"../../../../../config/env-config.js";import{isRealmOrReef as s}from"../../../../../utils/is-realm-or-reef.js";import{KvRepository as m}from"../../../../../persistence/kv/repositories/kv-repository.js";import{logger as p}from"../../../../../tools/notifiers/logger.js";import{ipRateLimitKey as f}from"../utils/ip-key.js";import{checkEdgeRateLimit as c}from"./edge-limiter.js";import{resolveMcpRequestLimits as d}from"./request-limits.js";import{reportMcpRateLimited as l}from"./rate-limit-telemetry.js";async function w(n,a){if(!s())return;const i=f(n);if(!i)return;let e,r;try{const t=await m.create({baseDbDir:a.serverOutDir,sqldRemoteDatabaseUrl:o.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:o.SQLD_REMOTE_DATABASE_AUTH_TOKEN});r=d(),e=await c({kv:t,ip:i,limits:r,now:Date.now()})}catch(t){p.warn(`gateway rate-limit init error, failing open: ${String(t)}`);return}if(!e.allowed)return l({scope:e.scope,retryAfterSeconds:e.retryAfterSeconds,limit:e.scope==="rate"?r.ratePerMin:r.quotaPerDay}),new Response(JSON.stringify({jsonrpc:"2.0",error:{code:-32029,message:`Rate limit exceeded (${e.scope}); retry after ${e.retryAfterSeconds}s`},id:null}),{status:429,headers:{"Content-Type":"application/json","Retry-After":String(e.retryAfterSeconds)}})}export{w as applyEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/edge-limiter.d.ts

@@ -0,0 +1,16 @@
+import type { KvRepository } from '../../../../../persistence/kv/repositories/kv-repository.js';
+import type { McpRequestLimits } from './request-limits.js';
+export type EdgeDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    retryAfterSeconds: number;
+    scope: 'rate' | 'quota';
+};
+export declare function checkEdgeRateLimit(params: {
+    kv: KvRepository;
+    ip: string;
+    limits: McpRequestLimits;
+    now: number;
+}): Promise<EdgeDecision>;
+//# sourceMappingURL=edge-limiter.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/edge-limiter.js

@@ -0,0 +1 @@
+import{checkAndIncrement as c}from"../utils/window-counter.js";const s=60,d=86400;async function w(i){const{kv:e,ip:t,limits:o,now:r}=i;await e.sync();const n=await c({kv:e,ip:t,windowSeconds:s,limit:o.ratePerMin,now:r});if(!n.allowed)return{allowed:!1,retryAfterSeconds:n.retryAfterSeconds,scope:"rate"};const a=await c({kv:e,ip:t,windowSeconds:d,limit:o.quotaPerDay,now:r});return a.allowed?{allowed:!0}:{allowed:!1,retryAfterSeconds:a.retryAfterSeconds,scope:"quota"}}export{w as checkEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/rate-limit-telemetry.d.ts

@@ -0,0 +1,8 @@
+type RateLimitedEvent = {
+    scope: 'rate' | 'quota';
+    retryAfterSeconds: number;
+    limit: number;
+};
+export declare function reportMcpRateLimited({ scope, retryAfterSeconds, limit }: RateLimitedEvent): void;
+export {};
+//# sourceMappingURL=rate-limit-telemetry.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/rate-limit-telemetry.js

@@ -0,0 +1 @@
+import{telemetry as o}from"../../../../../telemetry/index.js";import{logger as i}from"../../../../../tools/notifiers/logger.js";import{McpServerType as m}from"../../../constants.js";import{serverAttributes as p}from"../../../utils/telemetry-attributes.js";function d({scope:e,retryAfterSeconds:r,limit:t}){try{o.sendMcpRateLimitedMessage([{...p(m.Docs),scope:e,retry_after_seconds:r,limit:t}])}catch{}i.warn(`Gateway MCP rate limited [scope=${e}] retryAfterSeconds=${r} limit=${t}`)}export{d as reportMcpRateLimited};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/request-limits.d.ts

@@ -0,0 +1,6 @@
+export type McpRequestLimits = {
+    ratePerMin: number;
+    quotaPerDay: number;
+};
+export declare function resolveMcpRequestLimits(): McpRequestLimits;
+//# sourceMappingURL=request-limits.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/request-limits.js

@@ -0,0 +1 @@
+import{FEATURE as e,MCP_REQUEST_LIMIT_DEFAULTS as r}from"../../../../../../constants/common.js";import{readEntitlementNumber as t}from"../../../../../utils/entitlements/read-entitlement-number.js";function i(){return{ratePerMin:t(e.mcpRequestRatePerMin,r.ratePerMin),quotaPerDay:t(e.mcpRequestQuotaPerDay,r.quotaPerDay)}}export{i as resolveMcpRequestLimits};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/utils/ip-key.d.ts

@@ -0,0 +1,2 @@
+export declare function ipRateLimitKey(req: Request): string | undefined;
+//# sourceMappingURL=ip-key.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/utils/ip-key.js

@@ -0,0 +1 @@
+import{isIP as l}from"node:net";import{getFeedbackClientIp as a}from"../../../../../web-server/utils/feedback-ip.js";import{extractMappedIpv4 as c}from"../../../../../web-server/utils/ssrf-blocklist.js";function I(t){const n=a(t);if(n)return f(n)}function f(t){if(l(t)===6){const n=c(t);return n||`${u(t)}::/64`}return t}function u(t){const n=t.split("%")[0],[e,i=""]=n.split("::"),r=e?e.split(":"):[],o=i?i.split(":"):[],s=8-r.length-o.length;return[...r,...Array(Math.max(0,s)).fill("0"),...o].slice(0,4).map(p=>parseInt(p||"0",16).toString(16)).join(":")}export{I as ipRateLimitKey};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/utils/window-counter.d.ts

@@ -0,0 +1,15 @@
+import type { KvRepository } from '../../../../../persistence/kv/repositories/kv-repository.js';
+export type WindowCheck = {
+    allowed: false;
+    retryAfterSeconds: number;
+} | {
+    allowed: true;
+};
+export declare function checkAndIncrement(params: {
+    kv: KvRepository;
+    ip: string;
+    windowSeconds: number;
+    limit: number;
+    now: number;
+}): Promise<WindowCheck>;
+//# sourceMappingURL=window-counter.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/utils/window-counter.js

@@ -0,0 +1 @@
+import{logger as d}from"../../../../../tools/notifiers/logger.js";function g(e,t,r){return["mcp","request-rl",e,String(t),String(r)]}async function S(e){const{kv:t,ip:r,windowSeconds:n,limit:l,now:w}=e,o=Math.floor(w/1e3),c=Math.floor(o/n),i=g(r,n,c);try{const s=(await t.get(i))?.count??0;if(s>=l){const u=(c+1)*n-o;return{allowed:!1,retryAfterSeconds:Math.max(1,u)}}return await t.set(i,{count:s+1},{ttlInSeconds:n}),{allowed:!0}}catch(a){return d.warn(`gateway rate-limit store error, failing open: ${String(a)}`),{allowed:!0}}}export{S as checkAndIncrement};

package/dist/server/plugins/mcp/gateway-mcp/route-pattern.d.ts

@@ -0,0 +1,18 @@
+import type { OpenAPIServer } from '@redocly/api-docs';
+/** Regex for request pathnames of the OpenAPI `path` below the base path that `prefix` matches. */
+export declare function pathPattern(prefix: string, path: string): RegExp | undefined;
+/**
+ * Regex group matching any of the servers' base paths: required when every server has one,
+ * optional when some server has none, `''` when none has one.
+ */
+export declare function basePathPrefix(servers: readonly OpenAPIServer[]): string;
+/** Number of `{variable}` segments in an OpenAPI path; fewer means a more specific path. */
+export declare function pathVariableCount(path: string): number;
+/**
+ * Identity of an OpenAPI path template for comparison: variable names and a trailing slash do not
+ * change which requests the path matches, so `/users/{id}/` and `/users/{userId}` are equal.
+ */
+export declare function pathTemplateKey(path: string): string;
+/** The upper-case HTTP method sent for an OpenAPI operation key or a request method; `x-query` sends `QUERY`. */
+export declare function operationHttpMethod(key: string): string;
+//# sourceMappingURL=route-pattern.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/route-pattern.js

@@ -0,0 +1 @@
+const r=/\{(?<!\{[^}]*?\{)[^}]*\}/g;function u(e,t){if(t.startsWith("/"))return new RegExp(`^${e}${a(t)}/?$`)}function s(e){const t=e.map(c=>p(c.url)),n=[...new Set(t.filter(Boolean).map(a))];if(n.length===0)return"";const o=`(?:${n.join("|")})`;return t.every(Boolean)?o:`${o}?`}function l(e){return e.match(r)?.length??0}function f(e){return e.replace(r,"{}").replace(/(?<!\/)\/+$/,"")||"/"}function h(e){const t=e.toUpperCase();return t==="X-QUERY"?"QUERY":t}function a(e){return e.split(r).map(i).join("[^/]+").replace(/(?<!\/)\/+$/,"")}function p(e){if(!e)return"";const t=e.replace(/^[a-z][a-z0-9+.-]*:\/\//i,""),n=t.indexOf("/");return n===-1?"":t.slice(n).split(/[?#]/)[0].replace(/(?<!\/)\/+$/,"")}function i(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}export{s as basePathPrefix,h as operationHttpMethod,u as pathPattern,f as pathTemplateKey,l as pathVariableCount};