@rudderhq/server 0.5.2-canary.2 → 0.6.0

package/dist/services/mcp/pinned-fetch.test.js

@@ -0,0 +1,190 @@
+import { createServer as createHttpServer } from "node:http";
+import { createServer as createTcpServer, } from "node:net";
+import { afterEach, describe, expect, it } from "vitest";
+import { createSecureMcpFetch } from "./pinned-fetch.js";
+const openSockets = new Set();
+const openServers = new Set();
+function trackServer(server) {
+    openServers.add(server);
+    server.on("connection", (socket) => {
+        openSockets.add(socket);
+        socket.once("close", () => openSockets.delete(socket));
+    });
+    return server;
+}
+async function listen(server) {
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Missing test server address");
+    return address.port;
+}
+async function waitFor(condition, timeoutMs = 500) {
+    const deadline = Date.now() + timeoutMs;
+    while (!condition()) {
+        if (Date.now() >= deadline)
+            throw new Error("Timed out waiting for test condition");
+        await new Promise((resolve) => setTimeout(resolve, 5));
+    }
+}
+afterEach(async () => {
+    for (const socket of openSockets)
+        socket.destroy();
+    await Promise.all([...openServers].map((server) => new Promise((resolve) => server.close(() => resolve()))));
+    openServers.clear();
+    openSockets.clear();
+});
+describe("secure managed MCP pinned fetch deadlines", () => {
+    it("cancels a stalled request body when the total deadline expires", async () => {
+        let bodyCancelled = false;
+        const requestBody = new ReadableStream({
+            start(controller) {
+                controller.enqueue(new TextEncoder().encode("partial"));
+            },
+            cancel() {
+                bodyCancelled = true;
+            },
+        });
+        const fetchFn = createSecureMcpFetch({
+            allowedOrigins: [],
+            lookup: async () => [{ address: "93.184.216.34", family: 4 }],
+            totalTimeoutMs: 30,
+        });
+        await expect(fetchFn("https://mcp.example/request-body", {
+            method: "POST",
+            body: requestBody,
+            duplex: "half",
+        })).rejects.toThrow(/total timeout/i);
+        await waitFor(() => bodyCancelled);
+    });
+    it("aborts a stalled TLS connection at the connect deadline and closes its socket", async () => {
+        const server = trackServer(createTcpServer((socket) => socket.resume()));
+        const port = await listen(server);
+        const origin = `https://127.0.0.1:${port}`;
+        const safety = AbortSignal.timeout(500);
+        const fetchFn = createSecureMcpFetch({
+            allowedOrigins: [origin],
+            lookup: async () => [{ address: "127.0.0.1", family: 4 }],
+            connectTimeoutMs: 30,
+            headersTimeoutMs: 400,
+            bodyTimeoutMs: 400,
+            totalTimeoutMs: 400,
+        });
+        await expect(fetchFn(`${origin}/mcp`, { signal: safety }))
+            .rejects.toThrow(/connect timeout/i);
+        await waitFor(() => openSockets.size === 0);
+    });
+    it("aborts when a connected server does not send headers and closes its socket", async () => {
+        const server = trackServer(createHttpServer());
+        const port = await listen(server);
+        const origin = `http://127.0.0.1:${port}`;
+        const fetchFn = createSecureMcpFetch({
+            allowedOrigins: [origin],
+            lookup: async () => [{ address: "127.0.0.1", family: 4 }],
+            connectTimeoutMs: 200,
+            headersTimeoutMs: 30,
+            bodyTimeoutMs: 400,
+            totalTimeoutMs: 400,
+        });
+        await expect(fetchFn(`${origin}/mcp`, { signal: AbortSignal.timeout(500) }))
+            .rejects.toThrow(/headers timeout/i);
+        await waitFor(() => openSockets.size === 0);
+    });
+    it("aborts a stalled response body at the body deadline and closes its socket", async () => {
+        const server = trackServer(createHttpServer((_request, response) => {
+            response.writeHead(200, { "content-type": "text/plain" });
+            response.write("partial");
+        }));
+        const port = await listen(server);
+        const origin = `http://127.0.0.1:${port}`;
+        const fetchFn = createSecureMcpFetch({
+            allowedOrigins: [origin],
+            lookup: async () => [{ address: "127.0.0.1", family: 4 }],
+            connectTimeoutMs: 200,
+            headersTimeoutMs: 200,
+            bodyTimeoutMs: 30,
+            totalTimeoutMs: 400,
+        });
+        const response = await fetchFn(`${origin}/mcp`, {
+            signal: AbortSignal.timeout(500),
+        });
+        await expect(response.text()).rejects.toThrow(/body timeout/i);
+        await waitFor(() => openSockets.size === 0);
+    });
+    it("keeps one total deadline across response body consumption", async () => {
+        const server = trackServer(createHttpServer((_request, response) => {
+            response.writeHead(200, { "content-type": "text/plain" });
+            response.write("partial");
+        }));
+        const port = await listen(server);
+        const origin = `http://127.0.0.1:${port}`;
+        const fetchFn = createSecureMcpFetch({
+            allowedOrigins: [origin],
+            lookup: async () => [{ address: "127.0.0.1", family: 4 }],
+            connectTimeoutMs: 200,
+            headersTimeoutMs: 200,
+            bodyTimeoutMs: 400,
+            totalTimeoutMs: 30,
+        });
+        const response = await fetchFn(`${origin}/mcp`, {
+            signal: AbortSignal.timeout(500),
+        });
+        await expect(response.text()).rejects.toThrow(/total timeout/i);
+        await waitFor(() => openSockets.size === 0);
+    });
+    it("preserves caller aborts while cleaning up the active socket", async () => {
+        const server = trackServer(createHttpServer());
+        const port = await listen(server);
+        const origin = `http://127.0.0.1:${port}`;
+        const caller = new AbortController();
+        const fetchFn = createSecureMcpFetch({
+            allowedOrigins: [origin],
+            lookup: async () => [{ address: "127.0.0.1", family: 4 }],
+            connectTimeoutMs: 400,
+            headersTimeoutMs: 400,
+            bodyTimeoutMs: 400,
+            totalTimeoutMs: 400,
+        });
+        const pending = fetchFn(`${origin}/mcp`, { signal: caller.signal });
+        await waitFor(() => openSockets.size === 1);
+        caller.abort(new Error("caller cancelled"));
+        await expect(pending).rejects.toThrow(/caller cancelled/i);
+        await waitFor(() => openSockets.size === 0);
+    });
+});
+describe("secure managed MCP pinned fetch response cleanup", () => {
+    it("cancels a redirect response body before following the validated location", async () => {
+        let redirectClosed = false;
+        const server = trackServer(createHttpServer((request, response) => {
+            if (request.url === "/redirect") {
+                response.once("close", () => {
+                    redirectClosed = true;
+                });
+                response.writeHead(302, { location: "/final" });
+                response.write("ignored");
+                return;
+            }
+            response.end("done");
+        }));
+        const port = await listen(server);
+        const origin = `http://127.0.0.1:${port}`;
+        const fetchFn = createSecureMcpFetch({
+            allowedOrigins: [origin],
+            lookup: async () => [{ address: "127.0.0.1", family: 4 }],
+            connectTimeoutMs: 200,
+            headersTimeoutMs: 200,
+            bodyTimeoutMs: 200,
+            totalTimeoutMs: 500,
+        });
+        const response = await fetchFn(`${origin}/redirect`);
+        await expect(response.text()).resolves.toBe("done");
+        await waitFor(() => redirectClosed);
+    });
+});
+//# sourceMappingURL=pinned-fetch.test.js.map

package/dist/services/mcp/pinned-fetch.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-fetch.test.js","sourceRoot":"","sources":["../../../src/services/mcp/pinned-fetch.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,YAAY,IAAI,eAAe,GAGhC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AAEtC,SAAS,WAAW,CAAmB,MAAS;IAC9C,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QACjC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAc;IAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,SAAwB,EACxB,SAAS,GAAG,GAAG;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACpF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,KAAK,MAAM,MAAM,IAAI,WAAW;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACnD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAC9D,CAAC,CAAC;IACH,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,cAAc,CAAa;YACjD,KAAK,CAAC,UAAU;gBACd,UAAU,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM;gBACJ,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,EAAE;YAClB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC7D,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM;SACA,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,qBAAqB,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACzD,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,GAAG;YACrB,aAAa,EAAE,GAAG;YAClB,cAAc,EAAE,GAAG;SACpB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;aACvD,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACzD,gBAAgB,EAAE,GAAG;YACrB,gBAAgB,EAAE,EAAE;YACpB,aAAa,EAAE,GAAG;YAClB,cAAc,EAAE,GAAG;SACpB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aACzE,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACjE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACzD,gBAAgB,EAAE,GAAG;YACrB,gBAAgB,EAAE,GAAG;YACrB,aAAa,EAAE,EAAE;YACjB,cAAc,EAAE,GAAG;SACpB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,MAAM,EAAE;YAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACjE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACzD,gBAAgB,EAAE,GAAG;YACrB,gBAAgB,EAAE,GAAG;YACrB,aAAa,EAAE,GAAG;YAClB,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,MAAM,EAAE;YAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACzD,gBAAgB,EAAE,GAAG;YACrB,gBAAgB,EAAE,GAAG;YACrB,aAAa,EAAE,GAAG;YAClB,cAAc,EAAE,GAAG;SACpB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,MAAM,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAE5C,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChE,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC1B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAChD,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACzD,gBAAgB,EAAE,GAAG;YACrB,gBAAgB,EAAE,GAAG;YACrB,aAAa,EAAE,GAAG;YAClB,cAAc,EAAE,GAAG;SACpB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/mcp/provider-registry.d.ts

@@ -0,0 +1,77 @@
+import type { McpConnectionAccessMode, McpConnectionProvider } from "@rudderhq/shared";
+export type McpProviderScopeSelection = "none" | "project" | "workspace";
+export interface McpProviderDefinition {
+    endpoint: string | null;
+    readOnlyEndpoint?: string;
+    requiresOAuth: boolean;
+    scopeSelection: McpProviderScopeSelection;
+    defaultAccessMode: McpConnectionAccessMode;
+    featureGroups?: {
+        mode: "provider_default";
+        excluded: string[];
+    };
+    scopeIdentity?: {
+        toolNames: readonly string[];
+        arguments: Record<string, unknown>;
+        containers: readonly ("workspace" | "organization")[];
+    };
+}
+/**
+ * Provider-specific MCP endpoint and onboarding behavior lives here so runtime
+ * adapters consume only provider-neutral Rudder proxy bindings.
+ */
+export declare const MCP_PROVIDER_REGISTRY: {
+    readonly supabase: {
+        readonly endpoint: "https://mcp.supabase.com/mcp";
+        readonly requiresOAuth: true;
+        readonly scopeSelection: "project";
+        readonly defaultAccessMode: "read_only";
+        readonly featureGroups: {
+            readonly mode: "provider_default";
+            readonly excluded: ["storage"];
+        };
+    };
+    readonly linear: {
+        readonly endpoint: "https://mcp.linear.app/mcp";
+        readonly readOnlyEndpoint: "https://mcp.linear.app/mcp/readonly";
+        readonly requiresOAuth: true;
+        readonly scopeSelection: "workspace";
+        readonly defaultAccessMode: "read_write";
+        readonly scopeIdentity: {
+            readonly toolNames: readonly ["get_user"];
+            readonly arguments: {
+                readonly query: "me";
+            };
+            readonly containers: readonly ["workspace", "organization"];
+        };
+    };
+    readonly notion: {
+        readonly endpoint: "https://mcp.notion.com/mcp";
+        readonly requiresOAuth: true;
+        readonly scopeSelection: "workspace";
+        readonly defaultAccessMode: "provider_default";
+        readonly scopeIdentity: {
+            readonly toolNames: readonly ["notion-fetch"];
+            readonly arguments: {
+                readonly id: "self";
+            };
+            readonly containers: readonly ["workspace", "organization"];
+        };
+    };
+    readonly custom: {
+        readonly endpoint: null;
+        readonly requiresOAuth: false;
+        readonly scopeSelection: "none";
+        readonly defaultAccessMode: "provider_default";
+    };
+};
+export interface ResolvedCuratedMcpEndpoint {
+    href: string;
+    transport: "streamable_http";
+}
+export declare function resolveCuratedMcpEndpoint(input: {
+    provider: McpConnectionProvider;
+    accessMode: McpConnectionAccessMode;
+    externalScope: string | null;
+}): ResolvedCuratedMcpEndpoint;
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/services/mcp/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC;AAEzE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,yBAAyB,CAAC;IAC1C,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,aAAa,CAAC,EAAE;QACd,IAAI,EAAE,kBAAkB,CAAC;QACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,UAAU,EAAE,SAAS,CAAC,WAAW,GAAG,cAAc,CAAC,EAAE,CAAC;KACvD,CAAC;CACH;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCuC,CAAC;AAE1E,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,qBAAqB,CAAC;IAChC,UAAU,EAAE,uBAAuB,CAAC;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,0BAA0B,CAoC7B"}

package/dist/services/mcp/provider-registry.js

@@ -0,0 +1,80 @@
+/**
+ * Provider-specific MCP endpoint and onboarding behavior lives here so runtime
+ * adapters consume only provider-neutral Rudder proxy bindings.
+ */
+export const MCP_PROVIDER_REGISTRY = {
+    supabase: {
+        endpoint: "https://mcp.supabase.com/mcp",
+        requiresOAuth: true,
+        scopeSelection: "project",
+        defaultAccessMode: "read_only",
+        featureGroups: {
+            mode: "provider_default",
+            excluded: ["storage"],
+        },
+    },
+    linear: {
+        endpoint: "https://mcp.linear.app/mcp",
+        readOnlyEndpoint: "https://mcp.linear.app/mcp/readonly",
+        requiresOAuth: true,
+        scopeSelection: "workspace",
+        defaultAccessMode: "read_write",
+        scopeIdentity: {
+            toolNames: ["get_user"],
+            arguments: { query: "me" },
+            containers: ["workspace", "organization"],
+        },
+    },
+    notion: {
+        endpoint: "https://mcp.notion.com/mcp",
+        requiresOAuth: true,
+        scopeSelection: "workspace",
+        defaultAccessMode: "provider_default",
+        scopeIdentity: {
+            toolNames: ["notion-fetch"],
+            arguments: { id: "self" },
+            containers: ["workspace", "organization"],
+        },
+    },
+    custom: {
+        endpoint: null,
+        requiresOAuth: false,
+        scopeSelection: "none",
+        defaultAccessMode: "provider_default",
+    },
+};
+export function resolveCuratedMcpEndpoint(input) {
+    if (input.provider === "custom") {
+        throw new Error("Custom MCP endpoints come from validated connection configuration");
+    }
+    const definition = MCP_PROVIDER_REGISTRY[input.provider];
+    if (input.provider === "supabase") {
+        const projectRef = input.externalScope?.trim();
+        if (!projectRef) {
+            throw new Error("Supabase MCP connections require a selected project");
+        }
+        if (input.accessMode !== "read_only" && input.accessMode !== "read_write") {
+            throw new Error("Supabase MCP connections require read_only or read_write access");
+        }
+        const endpoint = new URL(definition.endpoint);
+        endpoint.searchParams.set("project_ref", projectRef);
+        endpoint.searchParams.set("read_only", String(input.accessMode === "read_only"));
+        return { href: endpoint.href, transport: "streamable_http" };
+    }
+    if (input.provider === "linear") {
+        if (input.accessMode !== "read_only" && input.accessMode !== "read_write") {
+            throw new Error("Linear MCP connections require read_only or read_write access");
+        }
+        return {
+            href: input.accessMode === "read_only"
+                ? MCP_PROVIDER_REGISTRY.linear.readOnlyEndpoint
+                : MCP_PROVIDER_REGISTRY.linear.endpoint,
+            transport: "streamable_http",
+        };
+    }
+    if (input.accessMode !== "provider_default") {
+        throw new Error("Notion MCP connections use provider_default access");
+    }
+    return { href: definition.endpoint, transport: "streamable_http" };
+}
+//# sourceMappingURL=provider-registry.js.map

package/dist/services/mcp/provider-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.js","sourceRoot":"","sources":["../../../src/services/mcp/provider-registry.ts"],"names":[],"mappings":"AAwBA;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE;QACR,QAAQ,EAAE,8BAA8B;QACxC,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,SAAS;QACzB,iBAAiB,EAAE,WAAW;QAC9B,aAAa,EAAE;YACb,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;KACF;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,4BAA4B;QACtC,gBAAgB,EAAE,qCAAqC;QACvD,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,WAAW;QAC3B,iBAAiB,EAAE,YAAY;QAC/B,aAAa,EAAE;YACb,SAAS,EAAE,CAAC,UAAU,CAAC;YACvB,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YAC1B,UAAU,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC;SAC1C;KACF;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,4BAA4B;QACtC,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,WAAW;QAC3B,iBAAiB,EAAE,kBAAkB;QACrC,aAAa,EAAE;YACb,SAAS,EAAE,CAAC,cAAc,CAAC;YAC3B,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACzB,UAAU,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC;SAC1C;KACF;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,MAAM;QACtB,iBAAiB,EAAE,kBAAkB;KACtC;CACsE,CAAC;AAO1E,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACrD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,UAAU,KAAK,WAAW;gBACpC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,gBAAgB;gBAC/C,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ;YACzC,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AACrE,CAAC"}

package/dist/services/mcp/provider-registry.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider-registry.test.d.ts.map

package/dist/services/mcp/provider-registry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.test.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/provider-registry.test.ts"],"names":[],"mappings":""}

package/dist/services/mcp/provider-registry.test.js

@@ -0,0 +1,80 @@
+import { describe, expect, it } from "vitest";
+import { MCP_PROVIDER_REGISTRY, resolveCuratedMcpEndpoint, } from "./provider-registry.js";
+describe("managed MCP provider registry", () => {
+    it("keeps curated endpoint and onboarding behavior in one server-only registry", () => {
+        expect(MCP_PROVIDER_REGISTRY).toMatchObject({
+            supabase: {
+                endpoint: "https://mcp.supabase.com/mcp",
+                requiresOAuth: true,
+                scopeSelection: "project",
+                defaultAccessMode: "read_only",
+                featureGroups: {
+                    mode: "provider_default",
+                    excluded: ["storage"],
+                },
+            },
+            linear: {
+                endpoint: "https://mcp.linear.app/mcp",
+                readOnlyEndpoint: "https://mcp.linear.app/mcp/readonly",
+                requiresOAuth: true,
+                scopeSelection: "workspace",
+                defaultAccessMode: "read_write",
+                scopeIdentity: {
+                    toolNames: ["get_user"],
+                    arguments: { query: "me" },
+                    containers: ["workspace", "organization"],
+                },
+            },
+            notion: {
+                endpoint: "https://mcp.notion.com/mcp",
+                requiresOAuth: true,
+                scopeSelection: "workspace",
+                defaultAccessMode: "provider_default",
+                scopeIdentity: {
+                    toolNames: ["notion-fetch"],
+                    arguments: { id: "self" },
+                    containers: ["workspace", "organization"],
+                },
+            },
+            custom: {
+                endpoint: null,
+                requiresOAuth: false,
+                scopeSelection: "none",
+            },
+        });
+    });
+    it("requires a Supabase project and pins read-only by default", () => {
+        expect(() => resolveCuratedMcpEndpoint({
+            provider: "supabase",
+            accessMode: "read_only",
+            externalScope: null,
+        })).toThrow(/project/i);
+        const resolved = resolveCuratedMcpEndpoint({
+            provider: "supabase",
+            accessMode: "read_only",
+            externalScope: "project-alpha",
+        });
+        expect(resolved.href).toBe("https://mcp.supabase.com/mcp?project_ref=project-alpha&read_only=true");
+        expect(resolved.transport).toBe("streamable_http");
+    });
+    it("selects Linear read/write and read-only endpoints without provider logic in adapters", () => {
+        expect(resolveCuratedMcpEndpoint({
+            provider: "linear",
+            accessMode: "read_write",
+            externalScope: "workspace-a",
+        }).href).toBe("https://mcp.linear.app/mcp");
+        expect(resolveCuratedMcpEndpoint({
+            provider: "linear",
+            accessMode: "read_only",
+            externalScope: "workspace-a",
+        }).href).toBe("https://mcp.linear.app/mcp/readonly");
+    });
+    it("rejects custom providers because their URL comes from validated connection config", () => {
+        expect(() => resolveCuratedMcpEndpoint({
+            provider: "custom",
+            accessMode: "provider_default",
+            externalScope: null,
+        })).toThrow(/custom/i);
+    });
+});
+//# sourceMappingURL=provider-registry.test.js.map

package/dist/services/mcp/provider-registry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.test.js","sourceRoot":"","sources":["../../../src/services/mcp/provider-registry.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAEhC,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,qBAAqB,CAAC,CAAC,aAAa,CAAC;YAC1C,QAAQ,EAAE;gBACR,QAAQ,EAAE,8BAA8B;gBACxC,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,SAAS;gBACzB,iBAAiB,EAAE,WAAW;gBAC9B,aAAa,EAAE;oBACb,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,CAAC,SAAS,CAAC;iBACtB;aACF;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,4BAA4B;gBACtC,gBAAgB,EAAE,qCAAqC;gBACvD,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,WAAW;gBAC3B,iBAAiB,EAAE,YAAY;gBAC/B,aAAa,EAAE;oBACb,SAAS,EAAE,CAAC,UAAU,CAAC;oBACvB,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;oBAC1B,UAAU,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC;iBAC1C;aACF;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,4BAA4B;gBACtC,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,WAAW;gBAC3B,iBAAiB,EAAE,kBAAkB;gBACrC,aAAa,EAAE;oBACb,SAAS,EAAE,CAAC,cAAc,CAAC;oBAC3B,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACzB,UAAU,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC;iBAC1C;aACF;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,KAAK;gBACpB,cAAc,EAAE,MAAM;aACvB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC;YACrC,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAExB,MAAM,QAAQ,GAAG,yBAAyB,CAAC;YACzC,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,eAAe;SAC/B,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CACxB,uEAAuE,CACxE,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,CAAC,yBAAyB,CAAC;YAC/B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,YAAY;YACxB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC5C,MAAM,CAAC,yBAAyB,CAAC;YAC/B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC;YACrC,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/mcp/security-policy.d.ts

@@ -0,0 +1,48 @@
+import type { DeploymentMode } from "@rudderhq/shared";
+export interface McpDeploymentAllowlists {
+    httpOrigins: string[];
+    stdioCommands: string[][];
+    stdioWorkingDirectories: string[];
+    stdioEnvironmentNames: string[];
+}
+export interface McpStdioDeploymentPolicy {
+    deploymentMode: DeploymentMode;
+    stdioCommands: string[][];
+    stdioWorkingDirectories: string[];
+    stdioEnvironmentNames: string[];
+}
+export interface ValidatedMcpStdioTarget {
+    command: string;
+    cwd: string | undefined;
+}
+export interface McpDnsAnswer {
+    address: string;
+    family: 4 | 6;
+}
+export type McpDnsLookup = (hostname: string) => Promise<McpDnsAnswer[]>;
+export interface ResolvedMcpHttpTarget {
+    url: URL;
+    resolvedAddress: string;
+    hostHeader: string;
+    tlsServername?: string;
+    useTls: boolean;
+}
+export declare function parseMcpDeploymentPolicyEnv(env: Record<string, string | undefined>): McpDeploymentAllowlists;
+export declare function validateMcpStdioPolicy(input: {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    environmentNames: string[];
+}, policy: McpStdioDeploymentPolicy, dependencies?: {
+    realpath?: (value: string) => Promise<string>;
+}): Promise<ValidatedMcpStdioTarget>;
+export declare function isBlockedMcpNetworkAddress(address: string): boolean;
+export declare function resolveMcpHttpTarget(value: string, options: {
+    allowedOrigins: string[];
+    curatedOrigin?: string;
+    lookup?: McpDnsLookup;
+    dnsTimeoutMs?: number;
+}): Promise<ResolvedMcpHttpTarget>;
+export declare function assertSafeMcpHeaders(headers: Record<string, string>): void;
+export declare function assertSafeMcpCredentialHeaders(headers: Record<string, string>): void;
+//# sourceMappingURL=security-policy.d.ts.map

package/dist/services/mcp/security-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/security-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAQvD,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;IAC1B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;IAC1B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;AAEzE,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,GAAG,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB;AAoDD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,uBAAuB,CAOzB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,EACD,MAAM,EAAE,wBAAwB,EAChC,YAAY,GAAE;IACZ,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1C,GACL,OAAO,CAAC,uBAAuB,CAAC,CAmElC;AAgGD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAanE;AA4DD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACP,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,qBAAqB,CAAC,CAsChC;AAkBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAY1E;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAcpF"}