@socketsecurity/mcp 0.0.14 → 0.0.16

package/index.js

@@ -235,15 +235,31 @@ if (useHttp) {
             return;
         }
         const origin = req.headers.origin;
+        const isLocalhostOrigin = (originUrl) => {
+            try {
+                const url = new URL(originUrl);
+                return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+            }
+            catch {
+                return false;
+            }
+        };
         const allowedOrigins = [
-            'http://localhost:3000',
-            'http://127.0.0.1:3000',
             'https://mcp.socket.dev',
             'https://mcp.socket-staging.dev'
         ];
-        const isValidOrigin = origin && allowedOrigins.includes(origin);
+        const host = req.headers.host || '';
+        const allowedHosts = allowedOrigins.map(o => new URL(o).hostname);
+        const isAllowedHost = host === `localhost:${port}` ||
+            host === `127.0.0.1:${port}` ||
+            host === 'localhost' ||
+            host === '127.0.0.1' ||
+            allowedHosts.includes(host);
+        const isValidOrigin = origin
+            ? (isLocalhostOrigin(origin) || allowedOrigins.includes(origin))
+            : isAllowedHost;
         if (!isValidOrigin) {
-            logger.warn(`Rejected request from invalid origin: ${origin}`);
+            logger.warn(`Rejected request from invalid origin: ${origin || 'missing'} (host: ${host})`);
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
                 jsonrpc: '2.0',
@@ -252,9 +268,11 @@ if (useHttp) {
             }));
             return;
         }
-        res.setHeader('Access-Control-Allow-Origin', origin);
-        res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
+        if (origin) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
+        }
         if (req.method === 'OPTIONS') {
             res.writeHead(200);
             res.end();
@@ -268,6 +286,8 @@ if (useHttp) {
                     try {
                         const jsonData = JSON.parse(body);
                         if (jsonData && jsonData.method === 'initialize') {
+                            const clientInfo = jsonData.params?.clientInfo;
+                            logger.info(`Client connected: ${clientInfo?.name || 'unknown'} v${clientInfo?.version || 'unknown'} from ${origin || host}`);
                             if (httpTransport) {
                                 try {
                                     httpTransport.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/mcp",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "type": "module",
   "main": "./index.js",
   "bin": {