@rudderhq/server 0.5.2-canary.2 → 0.6.0

package/dist/services/mcp/security-policy.js

@@ -0,0 +1,344 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { realpath as fsRealpath } from "node:fs/promises";
+import { BlockList, isIP } from "node:net";
+import path from "node:path";
+const DNS_LOOKUP_TIMEOUT_MS = 5_000;
+function parseCsv(value) {
+    if (!value)
+        return [];
+    return Array.from(new Set(value.split(",").map((item) => item.trim()).filter(Boolean)));
+}
+function parseStdioCommandAllowlist(value) {
+    if (!value?.trim())
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error("RUDDER_MCP_STDIO_COMMAND_ALLOWLIST must be a JSON array of argv arrays");
+    }
+    if (!Array.isArray(parsed)
+        || parsed.some((argv) => (!Array.isArray(argv)
+            || argv.length === 0
+            || argv.some((part) => typeof part !== "string" || part.length === 0)))) {
+        throw new Error("RUDDER_MCP_STDIO_COMMAND_ALLOWLIST must be a JSON array of non-empty argv arrays");
+    }
+    return Array.from(new Map(parsed.map((argv) => [JSON.stringify(argv), argv])).values());
+}
+function normalizeAllowlistedOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("RUDDER_MCP_HTTP_ALLOWLIST entries must be valid origins");
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:")
+        || url.username
+        || url.password
+        || url.pathname !== "/"
+        || url.search
+        || url.hash) {
+        throw new Error("RUDDER_MCP_HTTP_ALLOWLIST entries must contain only an HTTP(S) origin");
+    }
+    return url.origin;
+}
+export function parseMcpDeploymentPolicyEnv(env) {
+    return {
+        httpOrigins: parseCsv(env.RUDDER_MCP_HTTP_ALLOWLIST).map(normalizeAllowlistedOrigin),
+        stdioCommands: parseStdioCommandAllowlist(env.RUDDER_MCP_STDIO_COMMAND_ALLOWLIST),
+        stdioWorkingDirectories: parseCsv(env.RUDDER_MCP_STDIO_CWD_ALLOWLIST),
+        stdioEnvironmentNames: parseCsv(env.RUDDER_MCP_STDIO_ENV_ALLOWLIST),
+    };
+}
+export async function validateMcpStdioPolicy(input, policy, dependencies = {}) {
+    if (policy.deploymentMode === "local_trusted") {
+        return { command: input.command, cwd: input.cwd };
+    }
+    if (!path.isAbsolute(input.command)) {
+        throw new Error("Authenticated MCP STDIO executable must use an absolute path");
+    }
+    if (!input.cwd || !path.isAbsolute(input.cwd)) {
+        throw new Error("Authenticated MCP STDIO working directory must use an absolute path");
+    }
+    const resolveRealpath = dependencies.realpath ?? fsRealpath;
+    let executableRealpath;
+    let cwdRealpath;
+    try {
+        [executableRealpath, cwdRealpath] = await Promise.all([
+            resolveRealpath(input.command),
+            resolveRealpath(input.cwd),
+        ]);
+    }
+    catch {
+        throw new Error("MCP STDIO executable or working directory could not be resolved");
+    }
+    const requestedArgs = input.args ?? [];
+    let commandAllowed = false;
+    for (const allowedArgv of policy.stdioCommands) {
+        const [allowedExecutable, ...allowedArgs] = allowedArgv;
+        if (!allowedExecutable || !path.isAbsolute(allowedExecutable))
+            continue;
+        let allowedExecutableRealpath;
+        try {
+            allowedExecutableRealpath = await resolveRealpath(allowedExecutable);
+        }
+        catch {
+            continue;
+        }
+        if (allowedExecutableRealpath === executableRealpath
+            && allowedArgs.length === requestedArgs.length
+            && allowedArgs.every((value, index) => requestedArgs[index] === value)) {
+            commandAllowed = true;
+            break;
+        }
+    }
+    if (!commandAllowed) {
+        throw new Error("MCP STDIO command argv is not allowed by deployment policy");
+    }
+    const allowedCwdRealpaths = await Promise.all(policy.stdioWorkingDirectories.map(async (allowed) => {
+        if (!path.isAbsolute(allowed))
+            return null;
+        try {
+            return await resolveRealpath(allowed);
+        }
+        catch {
+            return null;
+        }
+    }));
+    if (!allowedCwdRealpaths.includes(cwdRealpath)) {
+        throw new Error("MCP STDIO working directory is not allowed by deployment policy");
+    }
+    const allowedEnvironmentNames = new Set(policy.stdioEnvironmentNames);
+    if (input.environmentNames.some((name) => !allowedEnvironmentNames.has(name))) {
+        throw new Error("MCP STDIO environment name is not allowed by deployment policy");
+    }
+    return {
+        command: executableRealpath,
+        cwd: cwdRealpath,
+    };
+}
+const blockedAddresses = new BlockList();
+const globallyRoutableIpv6 = new BlockList();
+globallyRoutableIpv6.addSubnet("2000::", 3, "ipv6");
+for (const [network, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.0.0.0", 24],
+    ["192.0.2.0", 24],
+    ["192.88.99.0", 24],
+    ["192.168.0.0", 16],
+    ["198.18.0.0", 15],
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4],
+    ["240.0.0.0", 4],
+]) {
+    blockedAddresses.addSubnet(network, prefix, "ipv4");
+}
+for (const [network, prefix] of [
+    ["::", 128],
+    ["::1", 128],
+    ["::", 96],
+    ["64:ff9b::", 96],
+    ["64:ff9b:1::", 48],
+    ["100::", 64],
+    // Conservative snapshot of the IANA IPv6 Special-Purpose Address Registry
+    // (last updated 2025-10-09). Only 2000::/3 is eligible above, and these
+    // special-purpose subranges remain denied until a deliberate registry review.
+    ["2001::", 23],
+    ["2001:2::", 48],
+    ["2001:db8::", 32],
+    ["2002::", 16],
+    ["2620:4f:8000::", 48],
+    ["3fff::", 20],
+    ["fc00::", 7],
+    ["fe80::", 10],
+    ["ff00::", 8],
+]) {
+    blockedAddresses.addSubnet(network, prefix, "ipv6");
+}
+function unwrapMappedIpv4(address) {
+    const match = address.toLowerCase().match(/^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
+    return match?.[1] ?? null;
+}
+function parseIpv6Words(address) {
+    let normalized = address.toLowerCase();
+    if (normalized.includes(".")) {
+        const lastColon = normalized.lastIndexOf(":");
+        const octets = normalized.slice(lastColon + 1).split(".").map(Number);
+        if (octets.length !== 4
+            || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+            return null;
+        }
+        normalized = `${normalized.slice(0, lastColon)}:${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;
+    }
+    const halves = normalized.split("::");
+    if (halves.length > 2)
+        return null;
+    const left = halves[0] ? halves[0].split(":") : [];
+    const right = halves[1] ? halves[1].split(":") : [];
+    const missing = 8 - left.length - right.length;
+    if ((halves.length === 1 && missing !== 0) || missing < 0)
+        return null;
+    const words = [
+        ...left,
+        ...Array.from({ length: missing }, () => "0"),
+        ...right,
+    ].map((word) => Number.parseInt(word, 16));
+    return words.length === 8 && words.every((word) => Number.isInteger(word))
+        ? words
+        : null;
+}
+function isIpv4TranslatedAddress(address) {
+    const words = parseIpv6Words(address);
+    // Node's BlockList normalizes this translated prefix as IPv4-mapped,
+    // so match its 96-bit IPv6 prefix explicitly without affecting IPv4.
+    return Boolean(words
+        && words.slice(0, 4).every((word) => word === 0)
+        && words[4] === 0xffff
+        && words[5] === 0);
+}
+export function isBlockedMcpNetworkAddress(address) {
+    const mappedIpv4 = unwrapMappedIpv4(address);
+    if (mappedIpv4)
+        return blockedAddresses.check(mappedIpv4, "ipv4");
+    const family = isIP(address);
+    if (family === 4)
+        return blockedAddresses.check(address, "ipv4");
+    if (family === 6) {
+        return (!globallyRoutableIpv6.check(address, "ipv6")
+            || isIpv4TranslatedAddress(address)
+            || blockedAddresses.check(address, "ipv6"));
+    }
+    return true;
+}
+function parseMcpTargetUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Managed MCP target URL is invalid");
+    }
+    if (url.username || url.password) {
+        throw new Error("Managed MCP target URL cannot include user information");
+    }
+    if (url.hash) {
+        throw new Error("Managed MCP target URL cannot include a fragment");
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error("Managed MCP supports only Streamable HTTP over HTTP(S), not legacy SSE");
+    }
+    return url;
+}
+const defaultLookup = async (hostname) => {
+    const results = await dnsLookup(hostname, { all: true, verbatim: true });
+    return results.map((result) => {
+        if (result.family !== 4 && result.family !== 6) {
+            throw new Error("Managed MCP DNS resolution returned an invalid address family");
+        }
+        return {
+            address: result.address,
+            family: result.family,
+        };
+    });
+};
+async function lookupWithTimeout(hostname, lookup, timeoutMs) {
+    let timer;
+    try {
+        return await Promise.race([
+            lookup(hostname),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error("Managed MCP DNS lookup timed out")), timeoutMs);
+            }),
+        ]);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === "Managed MCP DNS lookup timed out") {
+            throw error;
+        }
+        throw new Error("Managed MCP DNS resolution failed");
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+export async function resolveMcpHttpTarget(value, options) {
+    const url = parseMcpTargetUrl(value);
+    if (options.curatedOrigin && url.origin !== options.curatedOrigin) {
+        throw new Error("Managed MCP curated provider URL does not match its registry origin");
+    }
+    const allowedOrigins = new Set(options.allowedOrigins.map(normalizeAllowlistedOrigin));
+    const explicitlyAllowed = allowedOrigins.has(url.origin);
+    if (url.protocol !== "https:" && !explicitlyAllowed) {
+        throw new Error("Managed MCP target must use public HTTPS unless its exact origin is allowlisted");
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/gu, "");
+    const addresses = await lookupWithTimeout(hostname, options.lookup ?? defaultLookup, options.dnsTimeoutMs ?? DNS_LOOKUP_TIMEOUT_MS);
+    if (addresses.length === 0) {
+        throw new Error("Managed MCP DNS resolution returned no addresses");
+    }
+    if (addresses.some((answer) => isIP(answer.address) !== answer.family)) {
+        throw new Error("Managed MCP DNS answer is not a valid address for its family");
+    }
+    if (!explicitlyAllowed && addresses.some((answer) => isBlockedMcpNetworkAddress(answer.address))) {
+        throw new Error("Managed MCP target resolved to a blocked network address");
+    }
+    const selected = addresses[0];
+    return {
+        url,
+        resolvedAddress: selected.address,
+        hostHeader: url.host,
+        tlsServername: url.protocol === "https:" && isIP(hostname) === 0
+            ? hostname
+            : undefined,
+        useTls: url.protocol === "https:",
+    };
+}
+const forbiddenExactHeaders = new Set([
+    "authorization",
+    "connection",
+    "content-length",
+    "cookie",
+    "host",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "x-api-key",
+]);
+export function assertSafeMcpHeaders(headers) {
+    for (const name of Object.keys(headers)) {
+        const normalized = name.trim().toLowerCase();
+        if (forbiddenExactHeaders.has(normalized)
+            || normalized.startsWith("proxy-")
+            || normalized === "forwarded"
+            || normalized.startsWith("x-forwarded-")) {
+            throw new Error(`Managed MCP header "${name}" is controlled by Rudder`);
+        }
+    }
+}
+export function assertSafeMcpCredentialHeaders(headers) {
+    for (const name of Object.keys(headers)) {
+        const normalized = name.trim().toLowerCase();
+        if ((forbiddenExactHeaders.has(normalized)
+            && normalized !== "authorization"
+            && normalized !== "x-api-key")
+            || normalized.startsWith("proxy-")
+            || normalized === "forwarded"
+            || normalized.startsWith("x-forwarded-")) {
+            throw new Error(`Managed MCP credential header "${name}" is controlled by Rudder`);
+        }
+    }
+}
+//# sourceMappingURL=security-policy.js.map

package/dist/services/mcp/security-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.js","sourceRoot":"","sources":["../../../src/services/mcp/security-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAoCpC,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CACvB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC5D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAyB;IAC3D,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;WACnB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACvB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;eACjB,IAAI,CAAC,MAAM,KAAK,CAAC;eACjB,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CACtE,CAAC,EACF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CAAE,MAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;WACpD,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;WACpB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAuC;IAEvC,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACpF,aAAa,EAAE,0BAA0B,CAAC,GAAG,CAAC,kCAAkC,CAAC;QACjF,uBAAuB,EAAE,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC;QACrE,qBAAqB,EAAE,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAKC,EACD,MAAgC,EAChC,eAEI,EAAE;IAEN,IAAI,MAAM,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,IAAI,UAAU,CAAC;IAC5D,IAAI,kBAA0B,CAAC;IAC/B,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpD,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9B,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC/C,MAAM,CAAC,iBAAiB,EAAE,GAAG,WAAW,CAAC,GAAG,WAAW,CAAC;QACxD,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAAE,SAAS;QACxE,IAAI,yBAAiC,CAAC;QACtC,IAAI,CAAC;YACH,yBAAyB,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,yBAAyB,KAAK,kBAAkB;eAC7C,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;eAC3C,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,EACtE,CAAC;YACD,cAAc,GAAG,IAAI,CAAC;YACtB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,WAAW;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,SAAS,EAAE,CAAC;AACzC,MAAM,oBAAoB,GAAG,IAAI,SAAS,EAAE,CAAC;AAC7C,oBAAoB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACpD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,cAAc,EAAE,EAAE,CAAC;IACpB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACR,EAAE,CAAC;IACX,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,IAAI,EAAE,EAAE,CAAC;IACV,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,OAAO,EAAE,EAAE,CAAC;IACb,0EAA0E;IAC1E,wEAAwE;IACxE,8EAA8E;IAC9E,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,UAAU,EAAE,EAAE,CAAC;IAChB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,gBAAgB,EAAE,EAAE,CAAC;IACtB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;CACL,EAAE,CAAC;IACX,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtE,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;eAChB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,EAC/E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAChD,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAC/B,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI;QACP,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;QAC7C,GAAG,KAAK;KACT,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,qEAAqE;IACrE,qEAAqE;IACrE,OAAO,OAAO,CACZ,KAAK;WACF,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;WAC7C,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;WACnB,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,CACL,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;eACzC,uBAAuB,CAAC,OAAO,CAAC;eAChC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAiB,KAAK,EAAE,QAAQ,EAAE,EAAE;IACrD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,MAAoB,EACpB,SAAiB;IAEjB,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,MAAM,CAAC,QAAQ,CAAC;YAChB,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAC3D,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,kCAAkC,EAAE,CAAC;YACnF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,OAKC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACvF,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,QAAQ,EACR,OAAO,CAAC,MAAM,IAAI,aAAa,EAC/B,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAC9C,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,iBAAiB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;IAC/B,OAAO;QACL,GAAG;QACH,eAAe,EAAE,QAAQ,CAAC,OAAO;QACjC,UAAU,EAAE,GAAG,CAAC,IAAI;QACpB,aAAa,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9D,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,IACE,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC;eAClC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;eAC/B,UAAU,KAAK,WAAW;eAC1B,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,2BAA2B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,OAA+B;IAC5E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,IACE,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC;eACjC,UAAU,KAAK,eAAe;eAC9B,UAAU,KAAK,WAAW,CAAC;eAC7B,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;eAC/B,UAAU,KAAK,WAAW;eAC1B,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,2BAA2B,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/services/mcp/security-policy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=security-policy.test.d.ts.map

package/dist/services/mcp/security-policy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.test.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/security-policy.test.ts"],"names":[],"mappings":""}

package/dist/services/mcp/security-policy.test.js

@@ -0,0 +1,226 @@
+import { describe, expect, it, vi } from "vitest";
+import { assertSafeMcpHeaders, parseMcpDeploymentPolicyEnv, resolveMcpHttpTarget, validateMcpStdioPolicy, } from "./security-policy.js";
+describe("managed MCP deployment policy", () => {
+    it("parses instance-admin allowlists from dedicated environment fields", () => {
+        expect(parseMcpDeploymentPolicyEnv({
+            RUDDER_MCP_HTTP_ALLOWLIST: "http://127.0.0.1:7788, https://internal.example",
+            RUDDER_MCP_STDIO_COMMAND_ALLOWLIST: ' [["/usr/local/bin/acme-mcp","--stdio"],["/usr/local/bin/node","/opt/mcp/server.mjs"]] ',
+            RUDDER_MCP_STDIO_CWD_ALLOWLIST: "/srv/mcp,/opt/mcp",
+            RUDDER_MCP_STDIO_ENV_ALLOWLIST: "SAFE_TOKEN,READ_ONLY_FLAG",
+        })).toEqual({
+            httpOrigins: ["http://127.0.0.1:7788", "https://internal.example"],
+            stdioCommands: [
+                ["/usr/local/bin/acme-mcp", "--stdio"],
+                ["/usr/local/bin/node", "/opt/mcp/server.mjs"],
+            ],
+            stdioWorkingDirectories: ["/srv/mcp", "/opt/mcp"],
+            stdioEnvironmentNames: ["SAFE_TOKEN", "READ_ONLY_FLAG"],
+        });
+    });
+    it("allows arbitrary STDIO only for local trusted deployments", async () => {
+        await expect(validateMcpStdioPolicy({
+            command: "arbitrary-command",
+            args: ["-e", "arbitrary-code"],
+            cwd: "/anywhere",
+            environmentNames: ["ANY_SECRET"],
+        }, {
+            deploymentMode: "local_trusted",
+            stdioCommands: [],
+            stdioWorkingDirectories: [],
+            stdioEnvironmentNames: [],
+        })).resolves.toEqual({
+            command: "arbitrary-command",
+            cwd: "/anywhere",
+        });
+        await expect(validateMcpStdioPolicy({
+            command: "/usr/local/bin/acme-mcp",
+            args: ["--stdio"],
+            cwd: "/srv/mcp",
+            environmentNames: ["SAFE_TOKEN"],
+        }, {
+            deploymentMode: "authenticated",
+            stdioCommands: [["/usr/local/bin/acme-mcp", "--stdio"]],
+            stdioWorkingDirectories: ["/srv/mcp"],
+            stdioEnvironmentNames: ["SAFE_TOKEN"],
+        }, {
+            realpath: async (value) => value,
+        })).resolves.toEqual({
+            command: "/usr/local/bin/acme-mcp",
+            cwd: "/srv/mcp",
+        });
+        await expect(validateMcpStdioPolicy({
+            command: "/usr/local/bin/acme-mcp",
+            args: ["--stdio", "--exec", "arbitrary-code"],
+            cwd: "/srv/mcp",
+            environmentNames: ["SAFE_TOKEN"],
+        }, {
+            deploymentMode: "authenticated",
+            stdioCommands: [["/usr/local/bin/acme-mcp", "--stdio"]],
+            stdioWorkingDirectories: ["/srv/mcp"],
+            stdioEnvironmentNames: ["SAFE_TOKEN"],
+        }, {
+            realpath: async (value) => value,
+        })).rejects.toThrow(/command/i);
+    });
+    it("requires authenticated commands to use absolute real paths for executable and cwd", async () => {
+        const aliases = new Map([
+            ["/allowed/acme", "/opt/bin/acme"],
+            ["/requested/acme", "/opt/bin/acme"],
+            ["/allowed/workspace", "/srv/real-workspace"],
+            ["/requested/workspace", "/srv/real-workspace"],
+        ]);
+        const realpath = async (value) => aliases.get(value) ?? value;
+        await expect(validateMcpStdioPolicy({
+            command: "/requested/acme",
+            args: ["--stdio"],
+            cwd: "/requested/workspace",
+            environmentNames: [],
+        }, {
+            deploymentMode: "authenticated",
+            stdioCommands: [["/allowed/acme", "--stdio"]],
+            stdioWorkingDirectories: ["/allowed/workspace"],
+            stdioEnvironmentNames: [],
+        }, { realpath })).resolves.toEqual({
+            command: "/opt/bin/acme",
+            cwd: "/srv/real-workspace",
+        });
+        await expect(validateMcpStdioPolicy({
+            command: "node",
+            args: ["/opt/mcp/server.mjs"],
+            cwd: "/requested/workspace",
+            environmentNames: [],
+        }, {
+            deploymentMode: "authenticated",
+            stdioCommands: [["/usr/local/bin/node", "/opt/mcp/server.mjs"]],
+            stdioWorkingDirectories: ["/allowed/workspace"],
+            stdioEnvironmentNames: [],
+        }, { realpath })).rejects.toThrow(/absolute/i);
+    });
+});
+describe("managed MCP outbound target policy", () => {
+    it("permits public HTTPS and pins the validated address with SNI and Host metadata", async () => {
+        const lookup = vi.fn().mockResolvedValue([
+            { address: "93.184.216.34", family: 4 },
+        ]);
+        await expect(resolveMcpHttpTarget("https://mcp.example/tools", {
+            lookup,
+            allowedOrigins: [],
+        })).resolves.toMatchObject({
+            url: new URL("https://mcp.example/tools"),
+            resolvedAddress: "93.184.216.34",
+            hostHeader: "mcp.example",
+            tlsServername: "mcp.example",
+        });
+    });
+    it("rejects mixed public/private DNS answers instead of filtering to the public result", async () => {
+        const lookup = vi.fn().mockResolvedValue([
+            { address: "93.184.216.34", family: 4 },
+            { address: "127.0.0.1", family: 4 },
+        ]);
+        await expect(resolveMcpHttpTarget("https://rebind.example/mcp", {
+            lookup,
+            allowedOrigins: [],
+        })).rejects.toThrow(/blocked network address/i);
+    });
+    it("allows only globally routable IPv6 outside IANA special-purpose ranges", async () => {
+        await expect(resolveMcpHttpTarget("https://public-v6.example/mcp", {
+            lookup: async () => [{ address: "2606:4700:4700::1111", family: 6 }],
+            allowedOrigins: [],
+        })).resolves.toMatchObject({ resolvedAddress: "2606:4700:4700::1111" });
+        for (const address of [
+            "4000::1",
+            "fec0::1",
+            "2001:20::1",
+            "3fff::1",
+            "5f00::1",
+        ]) {
+            await expect(resolveMcpHttpTarget("https://reserved-v6.example/mcp", {
+                lookup: async () => [{ address, family: 6 }],
+                allowedOrigins: [],
+            })).rejects.toThrow(/blocked network address/i);
+        }
+        await expect(resolveMcpHttpTarget("https://reserved-v6.example/mcp", {
+            lookup: async () => [{ address: "4000::1", family: 6 }],
+            allowedOrigins: ["https://reserved-v6.example"],
+        })).resolves.toMatchObject({ resolvedAddress: "4000::1" });
+    });
+    it("rejects non-IP and address-family-mismatched DNS answers even for allowlisted origins", async () => {
+        for (const answer of [
+            { address: "localhost", family: 4 },
+            { address: "127.0.0.1", family: 6 },
+        ]) {
+            await expect(resolveMcpHttpTarget("http://internal.example/mcp", {
+                lookup: async () => [answer],
+                allowedOrigins: ["http://internal.example"],
+            })).rejects.toThrow(/DNS answer/i);
+        }
+    });
+    it("blocks NAT64 and IPv4-compatible address encodings of private targets", async () => {
+        for (const address of [
+            "64:ff9b::7f00:1",
+            "64:ff9b:1::7f00:1",
+            "::7f00:1",
+            "::ffff:0:127.0.0.1",
+            "2002:7f00:1::",
+        ]) {
+            await expect(resolveMcpHttpTarget("https://encoded.example/mcp", {
+                lookup: async () => [{ address, family: 6 }],
+                allowedOrigins: [],
+            })).rejects.toThrow(/blocked network address/i);
+        }
+    });
+    it("rejects HTTP, localhost, private targets, userinfo, and fragments without an exact origin allowlist", async () => {
+        const lookup = vi.fn().mockResolvedValue([
+            { address: "127.0.0.1", family: 4 },
+        ]);
+        for (const value of [
+            "http://127.0.0.1:7788/mcp",
+            "https://localhost/mcp",
+            "https://user:password@example.com/mcp",
+            "https://example.com/mcp#secret",
+        ]) {
+            await expect(resolveMcpHttpTarget(value, {
+                lookup,
+                allowedOrigins: [],
+            })).rejects.toThrow();
+        }
+        await expect(resolveMcpHttpTarget("http://127.0.0.1:7788/mcp", {
+            lookup,
+            allowedOrigins: ["http://127.0.0.1:7788"],
+        })).resolves.toMatchObject({ resolvedAddress: "127.0.0.1" });
+    });
+    it("pins curated provider origins and rejects a mismatched registry URL before DNS", async () => {
+        const lookup = vi.fn().mockResolvedValue([
+            { address: "93.184.216.34", family: 4 },
+        ]);
+        await expect(resolveMcpHttpTarget("https://attacker.example/mcp", {
+            lookup,
+            allowedOrigins: [],
+            curatedOrigin: "https://mcp.notion.com",
+        })).rejects.toThrow(/curated/i);
+        expect(lookup).not.toHaveBeenCalled();
+    });
+});
+describe("managed MCP header policy", () => {
+    it("rejects hop-by-hop, routing, cookie, forwarding, framing, and authorization headers", () => {
+        for (const name of [
+            "Host",
+            "Connection",
+            "Proxy-Authorization",
+            "Forwarded",
+            "X-Forwarded-For",
+            "Cookie",
+            "Content-Length",
+            "Transfer-Encoding",
+            "Authorization",
+        ]) {
+            expect(() => assertSafeMcpHeaders({ [name]: "secret-value" })).toThrow(/header/i);
+        }
+    });
+    it("never includes a rejected header value in its public error", () => {
+        expect(() => assertSafeMcpHeaders({
+            Authorization: "Bearer super-secret-value",
+        })).toThrowError(expect.not.stringContaining("super-secret-value"));
+    });
+});
+//# sourceMappingURL=security-policy.test.js.map

package/dist/services/mcp/security-policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.test.js","sourceRoot":"","sources":["../../../src/services/mcp/security-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,2BAA2B,CAAC;YACjC,yBAAyB,EAAE,iDAAiD;YAC5E,kCAAkC,EAChC,yFAAyF;YAC3F,8BAA8B,EAAE,mBAAmB;YACnD,8BAA8B,EAAE,2BAA2B;SAC5D,CAAC,CAAC,CAAC,OAAO,CAAC;YACV,WAAW,EAAE,CAAC,uBAAuB,EAAE,0BAA0B,CAAC;YAClE,aAAa,EAAE;gBACb,CAAC,yBAAyB,EAAE,SAAS,CAAC;gBACtC,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;aAC/C;YACD,uBAAuB,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;YACjD,qBAAqB,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,CAAC,sBAAsB,CAAC;YAClC,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAC9B,GAAG,EAAE,WAAW;YAChB,gBAAgB,EAAE,CAAC,YAAY,CAAC;SACjC,EAAE;YACD,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,EAAE;YACjB,uBAAuB,EAAE,EAAE;YAC3B,qBAAqB,EAAE,EAAE;SAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,mBAAmB;YAC5B,GAAG,EAAE,WAAW;SACjB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,sBAAsB,CAAC;YAClC,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,GAAG,EAAE,UAAU;YACf,gBAAgB,EAAE,CAAC,YAAY,CAAC;SACjC,EAAE;YACD,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,CAAC,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;YACvD,uBAAuB,EAAE,CAAC,UAAU,CAAC;YACrC,qBAAqB,EAAE,CAAC,YAAY,CAAC;SACtC,EAAE;YACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK;SACjC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,yBAAyB;YAClC,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,sBAAsB,CAAC;YAClC,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,CAAC;YAC7C,GAAG,EAAE,UAAU;YACf,gBAAgB,EAAE,CAAC,YAAY,CAAC;SACjC,EAAE;YACD,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,CAAC,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;YACvD,uBAAuB,EAAE,CAAC,UAAU,CAAC;YACrC,qBAAqB,EAAE,CAAC,YAAY,CAAC;SACtC,EAAE;YACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK;SACjC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;YACtB,CAAC,eAAe,EAAE,eAAe,CAAC;YAClC,CAAC,iBAAiB,EAAE,eAAe,CAAC;YACpC,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;YAC7C,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAEtE,MAAM,MAAM,CAAC,sBAAsB,CAAC;YAClC,OAAO,EAAE,iBAAiB;YAC1B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,GAAG,EAAE,sBAAsB;YAC3B,gBAAgB,EAAE,EAAE;SACrB,EAAE;YACD,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YAC7C,uBAAuB,EAAE,CAAC,oBAAoB,CAAC;YAC/C,qBAAqB,EAAE,EAAE;SAC1B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACjC,OAAO,EAAE,eAAe;YACxB,GAAG,EAAE,qBAAqB;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,sBAAsB,CAAC;YAClC,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,qBAAqB,CAAC;YAC7B,GAAG,EAAE,sBAAsB;YAC3B,gBAAgB,EAAE,EAAE;SACrB,EAAE;YACD,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,CAAC,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;YAC/D,uBAAuB,EAAE,CAAC,oBAAoB,CAAC;YAC/C,qBAAqB,EAAE,EAAE;SAC1B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACvC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAU,EAAE;SACjD,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM;YACN,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzB,GAAG,EAAE,IAAI,GAAG,CAAC,2BAA2B,CAAC;YACzC,eAAe,EAAE,eAAe;YAChC,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACvC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAU,EAAE;YAChD,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAU,EAAE;SAC7C,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,oBAAoB,CAAC,4BAA4B,EAAE;YAC9D,MAAM;YACN,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,MAAM,CAAC,oBAAoB,CAAC,+BAA+B,EAAE;YACjE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACpE,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAExE,KAAK,MAAM,OAAO,IAAI;YACpB,SAAS;YACT,SAAS;YACT,YAAY;YACZ,SAAS;YACT,SAAS;SACV,EAAE,CAAC;YACF,MAAM,MAAM,CAAC,oBAAoB,CAAC,iCAAiC,EAAE;gBACnE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC5C,cAAc,EAAE,EAAE;aACnB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,CAAC,oBAAoB,CAAC,iCAAiC,EAAE;YACnE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACvD,cAAc,EAAE,CAAC,6BAA6B,CAAC;SAChD,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,KAAK,MAAM,MAAM,IAAI;YACnB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAU,EAAE;YAC5C,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAU,EAAE;SAC7C,EAAE,CAAC;YACF,MAAM,MAAM,CAAC,oBAAoB,CAAC,6BAA6B,EAAE;gBAC/D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC5B,cAAc,EAAE,CAAC,yBAAyB,CAAC;aAC5C,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,KAAK,MAAM,OAAO,IAAI;YACpB,iBAAiB;YACjB,mBAAmB;YACnB,UAAU;YACV,oBAAoB;YACpB,eAAe;SAChB,EAAE,CAAC;YACF,MAAM,MAAM,CAAC,oBAAoB,CAAC,6BAA6B,EAAE;gBAC/D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC5C,cAAc,EAAE,EAAE;aACnB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACvC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAU,EAAE;SAC7C,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI;YAClB,2BAA2B;YAC3B,uBAAuB;YACvB,uCAAuC;YACvC,gCAAgC;SACjC,EAAE,CAAC;YACF,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;gBACvC,MAAM;gBACN,cAAc,EAAE,EAAE;aACnB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM;YACN,cAAc,EAAE,CAAC,uBAAuB,CAAC;SAC1C,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACvC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAU,EAAE;SACjD,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,oBAAoB,CAAC,8BAA8B,EAAE;YAChE,MAAM;YACN,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,wBAAwB;SACxC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,KAAK,MAAM,IAAI,IAAI;YACjB,MAAM;YACN,YAAY;YACZ,qBAAqB;YACrB,WAAW;YACX,iBAAiB;YACjB,QAAQ;YACR,gBAAgB;YAChB,mBAAmB;YACnB,eAAe;SAChB,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC;YAChC,aAAa,EAAE,2BAA2B;SAC3C,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/mcp/tool-discovery.d.ts

@@ -0,0 +1,49 @@
+export declare const MCP_TOOL_DISCOVERY_LIMITS: {
+    readonly maxTools: 500;
+    readonly maxToolNameCharacters: 128;
+    readonly maxDescriptionCharacters: 4000;
+    readonly maxSchemaBytes: number;
+    readonly maxSchemaDepth: 32;
+};
+export interface RawMcpDiscoveredTool {
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
+}
+export interface NormalizedMcpDiscoveredTool {
+    externalToolName: string;
+    rudderToolName: string;
+    description: string | null;
+    rawInputSchema: Record<string, unknown>;
+    inputSchema: Record<string, unknown>;
+    rawOutputSchema: Record<string, unknown> | null;
+    outputSchema: Record<string, unknown> | null;
+}
+export interface McpToolDiscoveryFilter {
+    toolAllowlist?: string[];
+    toolDenylist?: string[];
+}
+export declare function managedMcpRuntimeServerName(connectionName: string): string;
+export declare function normalizeMcpDiscoveredTools(connectionName: string, tools: RawMcpDiscoveredTool[], filter?: McpToolDiscoveryFilter): NormalizedMcpDiscoveredTool[];
+export interface ExistingMcpToolCatalogEntry {
+    externalToolName: string;
+    enabled: boolean;
+    status?: string;
+}
+export interface ReconciledMcpToolCatalogEntry {
+    externalToolName: string;
+    enabled: boolean;
+    status: "active" | "removed";
+    isNew: boolean;
+}
+export declare function reconcileMcpToolCatalog(existing: ExistingMcpToolCatalogEntry[], current: Array<{
+    externalToolName: string;
+}>): ReconciledMcpToolCatalogEntry[];
+export declare function reconcileMcpBindingToolNames(input: {
+    initialBinding: boolean;
+    previouslyKnownToolNames: string[];
+    previouslyEnabledToolNames: string[];
+    currentToolNames: string[];
+}): string[];
+//# sourceMappingURL=tool-discovery.d.ts.map