@socketsecurity/mcp 0.0.13 → 0.0.15

package/index.js

@@ -210,37 +210,6 @@ if (useHttp) {
     logger.info(`Starting HTTP server on port ${port}`);
     let httpTransport = null;
     const httpServer = createServer(async (req, res) => {
-        const origin = req.headers.origin;
-        const allowedOrigins = [
-            'http://localhost:3000',
-            'http://127.0.0.1:3000',
-            'https://mcp.socket.dev',
-            'https://mcp.socket-staging.dev'
-        ];
-        const isValidOrigin = origin && allowedOrigins.includes(origin);
-        if (!isValidOrigin) {
-            logger.warn(`Rejected request from invalid origin: ${origin}`);
-            res.writeHead(403, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                error: { code: -32000, message: 'Forbidden: Invalid origin' },
-                id: null
-            }));
-            return;
-        }
-        if (origin && isValidOrigin) {
-            res.setHeader('Access-Control-Allow-Origin', origin);
-        }
-        else {
-            res.setHeader('Access-Control-Allow-Origin', 'http://localhost:3000');
-        }
-        res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
-        if (req.method === 'OPTIONS') {
-            res.writeHead(200);
-            res.end();
-            return;
-        }
         let url;
         try {
             url = new URL(req.url, `http://localhost:${port}`);
@@ -265,6 +234,48 @@ if (useHttp) {
             }));
             return;
         }
+        const origin = req.headers.origin;
+        const isLocalhostOrigin = (originUrl) => {
+            try {
+                const url = new URL(originUrl);
+                return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+            }
+            catch {
+                return false;
+            }
+        };
+        const allowedOrigins = [
+            'https://mcp.socket.dev',
+            'https://mcp.socket-staging.dev'
+        ];
+        const host = req.headers.host || '';
+        const isLocalhostHost = host === `localhost:${port}` ||
+            host === `127.0.0.1:${port}` ||
+            host === 'localhost' ||
+            host === '127.0.0.1';
+        const isValidOrigin = origin
+            ? (isLocalhostOrigin(origin) || allowedOrigins.includes(origin))
+            : isLocalhostHost;
+        if (!isValidOrigin) {
+            logger.warn(`Rejected request from invalid origin: ${origin || 'missing'} (host: ${host})`);
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                error: { code: -32000, message: 'Forbidden: Invalid origin' },
+                id: null
+            }));
+            return;
+        }
+        if (origin) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
+        }
+        if (req.method === 'OPTIONS') {
+            res.writeHead(200);
+            res.end();
+            return;
+        }
         if (url.pathname === '/') {
             if (req.method === 'POST') {
                 let body = '';
@@ -273,6 +284,8 @@ if (useHttp) {
                     try {
                         const jsonData = JSON.parse(body);
                         if (jsonData && jsonData.method === 'initialize') {
+                            const clientInfo = jsonData.params?.clientInfo;
+                            logger.info(`Client connected: ${clientInfo?.name || 'unknown'} v${clientInfo?.version || 'unknown'} from ${origin || host}`);
                             if (httpTransport) {
                                 try {
                                     httpTransport.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/mcp",
-  "version": "0.0.13",
+  "version": "0.0.15",
   "type": "module",
   "main": "./index.js",
   "bin": {