@winstonsayno/mcp-gateway 1.1.0 → 1.2.0

package/dist/security/posture.js

@@ -0,0 +1,73 @@
+/**
+ * Secure-defaults check: warnings about risky configurations, logged at
+ * startup / reload, printed by `mcp-gateway validate` and returned by
+ * `GET /api/v1/security`.
+ *
+ * @module security/posture
+ */
+import { isIP } from 'net';
+import { normalizeApiKeys, isHashedKey, keyExpiry } from '../auth/middleware.js';
+export function isLoopbackHost(host) {
+    const h = host.replace(/^\[|\]$/g, '').toLowerCase();
+    if (h === 'localhost' || h === '::1')
+        return true;
+    return isIP(h) === 4 && h.startsWith('127.');
+}
+const DAY = 86_400_000;
+export function securityWarnings(config, now = Date.now()) {
+    const out = [];
+    const add = (id, message, level = 'warn') => out.push({ id, message, level });
+    const strategy = config.auth?.strategy ?? 'none';
+    const loopback = isLoopbackHost(config.host ?? '0.0.0.0');
+    const sec = config.security ?? {};
+    if (strategy === 'none' && !loopback) {
+        add('auth-disabled-public-bind', `Authentication is disabled while listening on ${config.host}: anyone who can reach this port can call every tool. ` +
+            'Set auth.strategy (api-key or jwt) or bind to 127.0.0.1.');
+    }
+    if (strategy === 'none' && loopback && !sec.dnsRebindingProtection && !sec.allowedHosts) {
+        add('dns-rebinding', 'Authentication is disabled and DNS-rebinding protection is off: a malicious web page could reach this local gateway ' +
+            'through a rebound DNS name. Enable security.dnsRebindingProtection or configure auth.');
+    }
+    const mcpOrigins = config.mcp?.allowedOrigins ?? config.corsOrigins;
+    if (config.mcp?.enabled !== false && (!mcpOrigins || mcpOrigins.includes('*')) && !sec.dnsRebindingProtection) {
+        add('mcp-any-origin', 'The /mcp endpoint accepts browser requests from any Origin. Set mcp.allowedOrigins (or corsOrigins), ' +
+            'or enable security.dnsRebindingProtection to allow only same-origin and loopback origins.');
+    }
+    if (strategy === 'api-key') {
+        const keys = normalizeApiKeys(config.auth?.apiKeys);
+        const plain = keys.filter((k) => !isHashedKey(k.key)).length;
+        if (plain > 0) {
+            add('plaintext-api-keys', `${plain} API key(s) are stored in plain text. Store "sha256:<hex>" digests instead (mcp-gateway hash-key).`, 'info');
+        }
+        const soon = keys.filter((k) => {
+            const exp = keyExpiry(k);
+            return exp !== undefined && exp > now && exp - now < 7 * DAY && !k.disabled;
+        });
+        if (soon.length > 0) {
+            add('api-keys-expiring', `${soon.length} API key(s) expire within 7 days: ${soon.map((k) => k.name ?? 'unnamed').join(', ')}.`);
+        }
+        const short = keys.filter((k) => !isHashedKey(k.key) && k.key.length < 24).length;
+        if (short > 0)
+            add('short-api-keys', `${short} API key(s) are shorter than 24 characters; use mcp-gateway gen-key.`, 'info');
+    }
+    if (strategy === 'jwt') {
+        const jwt = config.auth?.jwt ?? {};
+        if (!jwt.issuer || !jwt.audience) {
+            add('jwt-no-issuer-audience', 'JWT auth does not check "iss" / "aud": set auth.jwt.issuer and auth.jwt.audience.');
+        }
+        if (!jwt.requireExp)
+            add('jwt-no-exp', 'JWTs without an "exp" claim are accepted forever: set auth.jwt.requireExp: true.', 'info');
+    }
+    if (strategy !== 'none' && !sec.authLockout) {
+        add('no-auth-lockout', 'No brute-force protection: set security.authLockout: true to lock out IPs after repeated failures.', 'info');
+    }
+    if (sec.headers === false)
+        add('headers-disabled', 'Security headers are disabled (security.headers: false).');
+    if (sec.exposeErrorDetails)
+        add('error-details', 'security.exposeErrorDetails is on: internal error messages and stack traces reach clients.');
+    if (config.corsOrigins?.includes('*') && strategy !== 'none') {
+        add('cors-wildcard', 'corsOrigins contains "*": any web page may call the API with a key it holds. List your dashboard origins instead.');
+    }
+    return out;
+}
+//# sourceMappingURL=posture.js.map

package/dist/security/posture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/security/posture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAAG,UAAU,CAAC;AAEvB,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,OAAe,EAAE,QAAyB,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAElC,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,GAAG,CACD,2BAA2B,EAC3B,iDAAiD,MAAM,CAAC,IAAI,wDAAwD;YAClH,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACxF,GAAG,CACD,eAAe,EACf,sHAAsH;YACpH,uFAAuF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC;IACpE,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC9G,GAAG,CACD,gBAAgB,EAChB,uGAAuG;YACrG,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,GAAG,CACD,oBAAoB,EACpB,GAAG,KAAK,oGAAoG,EAC5G,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,qCAAqC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QAClF,IAAI,KAAK,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,EAAE,GAAG,KAAK,sEAAsE,EAAE,MAAM,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,wBAAwB,EAAE,mFAAmF,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,GAAG,CAAC,YAAY,EAAE,kFAAkF,EAAE,MAAM,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5C,GAAG,CAAC,iBAAiB,EAAE,oGAAoG,EAAE,MAAM,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,GAAG,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;IAC/G,IAAI,GAAG,CAAC,kBAAkB;QAAE,GAAG,CAAC,eAAe,EAAE,4FAA4F,CAAC,CAAC;IAC/I,IAAI,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,EAAE,mHAAmH,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/security/redact.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Secret redaction for logs, the request / audit log and API output.
+ *
+ * Two layers:
+ *  - value patterns: well-known token shapes (Bearer tokens, JWTs, OpenAI /
+ *    Anthropic / GitHub / Slack / AWS / Google keys, `password=…` style pairs,
+ *    credentials in URLs) are masked wherever they appear in a string;
+ *  - key names: in objects, values under keys that look secret
+ *    (`authorization`, `token`, `password`, `api_key`, `cookie`, …) are masked.
+ *
+ * Extra patterns come from `security.redactPatterns` (`configureRedaction`).
+ *
+ * @module security/redact
+ */
+export declare const REDACTED = "***";
+/** Object keys whose values are always masked. */
+export declare const SECRET_KEY_RE: RegExp;
+/** Set the extra patterns from `security.redactPatterns` (invalid ones throw). */
+export declare function configureRedaction(patterns: readonly string[] | undefined): void;
+/** Validate a list of patterns; returns the first error message, if any. */
+export declare function invalidRedactPattern(patterns: readonly string[] | undefined): string | undefined;
+/** Mask secrets inside a string. */
+export declare function redactString(value: string): string;
+/** Whether an object key names a secret. */
+export declare function isSecretKey(key: string): boolean;
+/** Deep copy of `value` with secret keys masked and secret-looking strings redacted. */
+export declare function redactValue<T>(value: T, depth?: number): T;
+/**
+ * Mask secrets in a command line (stdio server `args`): values following
+ * `--token`, `--api-key`, … flags, `--token=…` assignments and anything that
+ * matches a value pattern.
+ */
+export declare function redactArgs(args: readonly string[]): string[];
+//# sourceMappingURL=redact.d.ts.map

package/dist/security/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/security/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAE9B,kDAAkD;AAClD,eAAO,MAAM,aAAa,QACyQ,CAAC;AA2BpS,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAEhF;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAShG;AAED,oCAAoC;AACpC,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWlD;AAED,4CAA4C;AAC5C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,SAAI,GAAG,CAAC,CAYrD;AAKD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAgB5D"}

package/dist/security/redact.js

@@ -0,0 +1,115 @@
+/**
+ * Secret redaction for logs, the request / audit log and API output.
+ *
+ * Two layers:
+ *  - value patterns: well-known token shapes (Bearer tokens, JWTs, OpenAI /
+ *    Anthropic / GitHub / Slack / AWS / Google keys, `password=…` style pairs,
+ *    credentials in URLs) are masked wherever they appear in a string;
+ *  - key names: in objects, values under keys that look secret
+ *    (`authorization`, `token`, `password`, `api_key`, `cookie`, …) are masked.
+ *
+ * Extra patterns come from `security.redactPatterns` (`configureRedaction`).
+ *
+ * @module security/redact
+ */
+export const REDACTED = '***';
+/** Object keys whose values are always masked. */
+export const SECRET_KEY_RE = /^(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api[-_]?key|apikey|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|client[-_]?secret|password|passwd|pwd|private[-_]?key|credentials?|session[-_]?token|mcp-session-id)$|(?:token|secret|password|api[-_]?key)$/i;
+const BUILTIN_PATTERNS = [
+    // Authorization header values
+    [/\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/gi, (_m, scheme) => `${scheme} ${REDACTED}`],
+    // JWTs
+    [/\beyJ[A-Za-z0-9_-]{5,}\.eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]*/g, () => REDACTED],
+    // Provider API keys
+    [/\b(?:sk|pk|rk)-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{16,}/g, () => REDACTED],
+    [/\bgh[pousr]_[A-Za-z0-9]{20,}/g, () => REDACTED],
+    [/\bgithub_pat_[A-Za-z0-9_]{20,}/g, () => REDACTED],
+    [/\bxox[abposr]-[A-Za-z0-9-]{10,}/g, () => REDACTED],
+    [/\bAKIA[0-9A-Z]{16}\b/g, () => REDACTED],
+    [/\bAIza[0-9A-Za-z_-]{35}\b/g, () => REDACTED],
+    [/\bglpat-[A-Za-z0-9_-]{20,}/g, () => REDACTED],
+    [/\bmgw_[A-Za-z0-9_-]{16,}/g, () => REDACTED],
+    // key=value / key: value pairs (query strings, CLI flags, error messages)
+    [
+        /\b((?:access[_-]?|refresh[_-]?|id[_-]?|auth[_-]?)?token|api[_-]?key|apikey|secret|client[_-]?secret|password|passwd|pwd)(["']?\s*[:=]\s*["']?)([^\s"'&,;}]{3,})/gi,
+        (_m, k, sep) => `${k}${sep}${REDACTED}`,
+    ],
+    // user:password@ in URLs
+    [/(\b[a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s/@]+)@/gi, (_m, scheme) => `${scheme}${REDACTED}@`],
+];
+let extraPatterns = [];
+/** Set the extra patterns from `security.redactPatterns` (invalid ones throw). */
+export function configureRedaction(patterns) {
+    extraPatterns = (patterns ?? []).map((p) => new RegExp(p, 'g'));
+}
+/** Validate a list of patterns; returns the first error message, if any. */
+export function invalidRedactPattern(patterns) {
+    for (const p of patterns ?? []) {
+        try {
+            new RegExp(p, 'g');
+        }
+        catch (err) {
+            return `${p}: ${err instanceof Error ? err.message : String(err)}`;
+        }
+    }
+    return undefined;
+}
+/** Mask secrets inside a string. */
+export function redactString(value) {
+    let out = value;
+    for (const [re, fn] of BUILTIN_PATTERNS) {
+        re.lastIndex = 0;
+        out = out.replace(re, fn);
+    }
+    for (const re of extraPatterns) {
+        re.lastIndex = 0;
+        out = out.replace(re, REDACTED);
+    }
+    return out;
+}
+/** Whether an object key names a secret. */
+export function isSecretKey(key) {
+    return SECRET_KEY_RE.test(key);
+}
+/** Deep copy of `value` with secret keys masked and secret-looking strings redacted. */
+export function redactValue(value, depth = 0) {
+    if (depth > 20)
+        return value;
+    if (typeof value === 'string')
+        return redactString(value);
+    if (Array.isArray(value))
+        return value.map((v) => redactValue(v, depth + 1));
+    if (value && typeof value === 'object' && !(value instanceof Date)) {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = isSecretKey(k) && v !== undefined && v !== null && v !== '' ? REDACTED : redactValue(v, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+const SECRET_FLAG_RE = /^--?(?:[a-z0-9-]*?(?:token|secret|password|passwd|api[-_]?key|apikey|auth|credential)s?)$/i;
+const SECRET_FLAG_ASSIGN_RE = /^(--?[a-z0-9-]*?(?:token|secret|password|passwd|api[-_]?key|apikey|auth|credential)s?)=(.+)$/i;
+/**
+ * Mask secrets in a command line (stdio server `args`): values following
+ * `--token`, `--api-key`, … flags, `--token=…` assignments and anything that
+ * matches a value pattern.
+ */
+export function redactArgs(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        const assign = SECRET_FLAG_ASSIGN_RE.exec(a);
+        if (assign) {
+            out.push(`${assign[1]}=${REDACTED}`);
+            continue;
+        }
+        out.push(redactString(a));
+        if (SECRET_FLAG_RE.test(a) && i + 1 < args.length && !args[i + 1].startsWith('-')) {
+            out.push(REDACTED);
+            i++;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/security/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/security/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAE9B,kDAAkD;AAClD,MAAM,CAAC,MAAM,aAAa,GACxB,iSAAiS,CAAC;AAEpS,MAAM,gBAAgB,GAA2D;IAC/E,8BAA8B;IAC9B,CAAC,mDAAmD,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;IAC9F,OAAO;IACP,CAAC,+DAA+D,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IACjF,oBAAoB;IACpB,CAAC,+DAA+D,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IACjF,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IACjD,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IACnD,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IACpD,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IACzC,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IAC9C,CAAC,6BAA6B,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IAC/C,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;IAC7C,0EAA0E;IAC1E;QACE,mKAAmK;QACnK,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,QAAQ,EAAE;KACxC;IACD,yBAAyB;IACzB,CAAC,qDAAqD,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,QAAQ,GAAG,CAAC;CACjG,CAAC;AAEF,IAAI,aAAa,GAAa,EAAE,CAAC;AAEjC,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,QAAuC;IACxE,aAAa,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,QAAuC;IAC1E,KAAK,MAAM,CAAC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACxC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAA+C,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAI,KAAQ,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAM,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAM,CAAC;IAClF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAAG,4FAA4F,CAAC;AACpH,MAAM,qBAAqB,GAAG,+FAA+F,CAAC;AAE9H;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnB,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,KAAK,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAkBpD,YAAY,EAAE,QAAQ,EAAE,CAAC;AAEzB,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAoB;IAEjC,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI;IAI/B,OAAO,CAAC,GAAG;IAkBX,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI3D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI3D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAG7D;AAUD,eAAO,MAAM,MAAM,QAAe,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,KAAK,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAkBpD,YAAY,EAAE,QAAQ,EAAE,CAAC;AAEzB,qBAAa,MAAM;IACjB,OAAO,CAAC,KAAK,CAAoB;IAEjC,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI;IAI/B,OAAO,CAAC,GAAG;IAmBX,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI3D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAI3D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAG7D;AAUD,eAAO,MAAM,MAAM,QAAe,CAAC"}

package/dist/utils/logger.js

@@ -1,6 +1,7 @@
 /**
  * Minimal structured logger for mcp-gateway
  */
+import { redactString, redactValue } from '../security/redact.js';
 const LEVELS = {
     debug: 0,
     info: 1,
@@ -26,8 +27,9 @@ export class Logger {
         const color = process.stdout.isTTY ? COLORS[level] : '';
         const reset = process.stdout.isTTY ? RESET : '';
         const prefix = `${color}[${level.toUpperCase().padEnd(5)}]${reset}`;
-        const metaStr = meta ? ` ${safeStringify(meta)}` : '';
-        const output = `${ts} ${prefix} ${message}${metaStr}`;
+        // Secrets (tokens, keys, passwords) are masked before anything is written.
+        const metaStr = meta ? ` ${safeStringify(redactValue(meta))}` : '';
+        const output = `${ts} ${prefix} ${redactString(message)}${metaStr}`;
         if (level === 'error' || level === 'warn') {
             process.stderr.write(output + '\n');
         }

package/dist/utils/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,MAAM,GAA6B;IACvC,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,MAAM,GAA6B;IACvC,KAAK,EAAE,UAAU,EAAE,OAAO;IAC1B,IAAI,EAAE,UAAU,EAAG,OAAO;IAC1B,IAAI,EAAE,UAAU,EAAG,SAAS;IAC5B,KAAK,EAAE,UAAU,EAAE,MAAM;CAC1B,CAAC;AAEF,MAAM,KAAK,GAAG,SAAS,CAAC;AAIxB,MAAM,OAAO,MAAM;IACT,KAAK,GAAa,MAAM,CAAC;IAEjC,QAAQ,CAAC,KAAe;QACtB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAA8B;QAC1E,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QAE/C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtD,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,MAAM,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QAEtD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIlE,MAAM,MAAM,GAA6B;IACvC,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,MAAM,GAA6B;IACvC,KAAK,EAAE,UAAU,EAAE,OAAO;IAC1B,IAAI,EAAE,UAAU,EAAG,OAAO;IAC1B,IAAI,EAAE,UAAU,EAAG,SAAS;IAC5B,KAAK,EAAE,UAAU,EAAE,MAAM;CAC1B,CAAC;AAEF,MAAM,KAAK,GAAG,SAAS,CAAC;AAIxB,MAAM,OAAO,MAAM;IACT,KAAK,GAAa,MAAM,CAAC;IAEjC,QAAQ,CAAC,KAAe;QACtB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAA8B;QAC1E,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QAE/C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QACpE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;QAEpE,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC"}

package/dist/utils/types.d.ts

@@ -114,6 +114,52 @@ export interface GatewayConfig {
     mcp?: McpEndpointConfig;
     /** Persistent audit log of requests (optional SQLite) */
     audit?: AuditConfig;
+    /** Hardening options (headers, body limits, IP allowlist, DNS-rebinding protection, lockout, redaction). */
+    security?: SecurityConfig;
+}
+export interface AuthLockoutConfig {
+    /** Failed authentications from one IP within `windowSeconds` that trigger a lockout (default 10). */
+    maxFailures?: number;
+    /** Window for counting failures (default 300). */
+    windowSeconds?: number;
+    /** How long a locked-out IP gets `429` (default 900). */
+    lockoutSeconds?: number;
+}
+export interface SecurityConfig {
+    /** Send security headers (nosniff, frame-ancestors, Referrer-Policy, CSP) on every response (default true). */
+    headers?: boolean;
+    /** Also send `Strict-Transport-Security` (only behind HTTPS; default false). */
+    hsts?: boolean | {
+        maxAgeSeconds?: number;
+        includeSubDomains?: boolean;
+    };
+    /**
+     * Express "trust proxy" setting: false (default), true, a hop count, or a
+     * list of trusted proxy addresses / CIDRs. Controls `req.ip` (rate limits,
+     * lockout, IP allowlist, logs).
+     */
+    trustProxy?: boolean | number | string | string[];
+    /** Only these client IPs / CIDRs may call the gateway (liveness / readiness probes stay open). */
+    ipAllowlist?: string[];
+    /** Accepted `Host` header values (hostnames, `host:port`, `*.example.com`). Unset = any (unless `dnsRebindingProtection`). */
+    allowedHosts?: string[];
+    /**
+     * DNS-rebinding protection (default false): `Host` must be in
+     * `allowedHosts` (default: localhost names + the bind address), and `/mcp`
+     * accepts browser requests only from the same origin or loopback origins
+     * unless `mcp.allowedOrigins` / `corsOrigins` list others.
+     */
+    dnsRebindingProtection?: boolean;
+    /** Maximum JSON request body in bytes (default 10 MiB). */
+    maxBodyBytes?: number;
+    /** Maximum size of a tool call's / prompt's `arguments` as JSON, in bytes (default 0 = no limit). */
+    maxToolArgumentsBytes?: number;
+    /** Lock out IPs after repeated authentication failures (off unless set; `true` = defaults). */
+    authLockout?: boolean | AuthLockoutConfig;
+    /** Extra regular expressions whose matches are masked in logs, the request log / audit log and API output. */
+    redactPatterns?: string[];
+    /** Include error messages / stack traces of unexpected 500s in responses (default false; NODE_ENV=development also enables it). */
+    exposeErrorDetails?: boolean;
 }
 /**
  * How tool names are exposed on `/mcp`:
@@ -148,8 +194,10 @@ export interface AuthConfig {
      * restrict the key to some servers / tools and give it its own rate limit.
      */
     apiKeys?: Array<string | ApiKeyConfig>;
-    /** For jwt: secret or public key */
+    /** For jwt: HMAC secret (HS256/384/512). Not needed when `jwt.jwksUrl` or `jwt.publicKey` is set. */
     jwtSecret?: string;
+    /** For jwt: verification options (issuer, audience, algorithms, JWKS, clock skew). */
+    jwt?: JwtConfig;
     /**
      * Endpoints that are public by default and can be put behind auth.
      * The dashboard page itself is a static shell; when auth is on it asks for
@@ -167,9 +215,40 @@ export interface AuthConfig {
         audience: string;
     };
 }
+export interface JwtConfig {
+    /** Required `iss` claim (string or list). */
+    issuer?: string | string[];
+    /** Required `aud` claim (string or list; the token must contain one of them). */
+    audience?: string | string[];
+    /**
+     * Accepted `alg` values. Default: HS256/384/512 with `jwtSecret`,
+     * RS/PS/ES 256-512 + EdDSA with `publicKey` / `jwksUrl`. Mixing HMAC and
+     * asymmetric algorithms is rejected (algorithm confusion).
+     */
+    algorithms?: string[];
+    /** Allowed clock skew for `exp` / `nbf` / `iat` (seconds, default 0). */
+    clockToleranceSeconds?: number;
+    /** Fetch verification keys from a JWKS endpoint (cached, refreshed on unknown `kid`). */
+    jwksUrl?: string;
+    /** How long fetched JWKS are cached (seconds, default 600). */
+    jwksCacheSeconds?: number;
+    /** PEM-encoded public key (SPKI) or X.509 certificate for RS/PS/ES/EdDSA tokens. */
+    publicKey?: string;
+    /** Reject tokens without an `exp` claim (default false). */
+    requireExp?: boolean;
+    /** Reject tokens whose `iat` is older than this (seconds). */
+    maxTokenAgeSeconds?: number;
+}
 export interface ApiKeyConfig {
-    /** The secret key (supports ${VAR} via env overrides in the config file). */
+    /**
+     * The secret key (supports ${VAR} via env overrides in the config file), or
+     * its SHA-256 digest as `sha256:<64 hex chars>` (see `mcp-gateway hash-key`).
+     */
     key: string;
+    /** Reject the key from this moment on (ISO 8601 date / date-time). */
+    expiresAt?: string;
+    /** Temporarily reject the key without removing it. */
+    disabled?: boolean;
     /** Label used in client ids, logs and metrics instead of the key fingerprint (unique). */
     name?: string;
     /** Server ids this key may use (glob patterns). Absent = all servers. */

package/dist/utils/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,KAAK,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAChF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;IACpE,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,qCAAqC;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,uCAAuC;IACvC,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAID,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,+BAA+B;IAC/B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6BAA6B;IAC7B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mBAAmB;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,wDAAwD;IACxD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB;IACpB,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,yDAAyD;IACzD,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAID;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,CAAC;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;IACvC,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QACR,6FAA6F;QAC7F,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,sFAAsF;QACtF,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,iIAAiI;IACjI,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAID,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAID,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;IAC1C,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAID,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,KAAK,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAChF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;IACpE,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,qCAAqC;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,uCAAuC;IACvC,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAID,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,+BAA+B;IAC/B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6BAA6B;IAC7B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mBAAmB;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,4DAA4D;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,wDAAwD;IACxD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB;IACpB,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,yDAAyD;IACzD,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAID,MAAM,WAAW,iBAAiB;IAChC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,+GAA+G;IAC/G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gFAAgF;IAChF,IAAI,CAAC,EAAE,OAAO,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACzE;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAClD,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8HAA8H;IAC9H,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qGAAqG;IACrG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+FAA+F;IAC/F,WAAW,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAC1C,8GAA8G;IAC9G,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mIAAmI;IACnI,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAID;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,CAAC;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;IACvC,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QACR,6FAA6F;QAC7F,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,sFAAsF;QACtF,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,iIAAiI;IACjI,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAID,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAID,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;IAC1C,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAID,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@winstonsayno/mcp-gateway",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "A lightweight, open-source gateway for managing, routing, and monitoring multiple MCP (Model Context Protocol) servers.",
   "keywords": [
     "mcp",