@winstonsayno/mcp-gateway 1.1.0 → 1.3.0

package/CHANGELOG.md

@@ -9,6 +9,117 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-10-07
+
+MCP authorization (OAuth 2.1) and resumable streams.
+
+### Added
+- **`auth.strategy: oauth2`** — the gateway is an OAuth 2.1 protected resource per the MCP authorization spec
+  (2025-06-18):
+  - RFC 9728 *Protected Resource Metadata* at `/.well-known/oauth-protected-resource` and
+    `/.well-known/oauth-protected-resource/<mcp path>` (`resource`, `authorization_servers`, `scopes_supported`,
+    `bearer_methods_supported`, `resource_signing_alg_values_supported`).
+  - Bearer token validation: JWTs against `auth.oauth.jwksUrl` or the `jwks_uri` discovered from the issuer's RFC 8414 /
+    OpenID metadata (asymmetric algorithms only, `exp` required, `iss` and `aud` = resource URI per RFC 8707), or RFC
+    7662 token introspection for opaque tokens (client-secret basic auth, cached up to `cacheSeconds` / token expiry).
+  - RFC 6750 challenges: `401` + `WWW-Authenticate: Bearer resource_metadata="…"` (with `error="invalid_token"` when a
+    token was presented), `403` + `error="insufficient_scope", scope="…"` for missing `requiredScopes`.
+  - `mcp_servers` / `mcp_tools` claims scope OAuth clients like JWT clients; client ids are `oauth:<sub>`.
+  - `GET /api/v1/security` reports OAuth settings; new `oauth-no-resource` hint.
+- **Streamable HTTP resumability**: events on the `GET` SSE stream carry session-wide ids and are buffered per session
+  (`mcp.eventBufferSize`, default 256, `0` = off). Reconnecting with `Last-Event-ID` replays missed events, including
+  ones emitted while no stream was open (previously dropped).
+- `docs/configuration.md`: *OAuth 2.1* section and resumability notes.
+
+### Changed
+- `auth.strategy: oauth2` now requires `auth.oauth`; the old unused `auth.oauth2 { issuer, audience }` type was removed
+  (it was never accepted by the config loader).
+
+## [1.2.0] - 2026-10-07
+
+Security hardening and more of the MCP spec on `/mcp`. Every new protection that could reject traffic that 1.1
+accepted is **opt-in**; see *Upgrade notes*.
+
+### Security
+- **Hashed API keys**: `auth.apiKeys` entries (plain strings or `key`) may be `sha256:<64 hex>` digests, so the config
+  file never holds a usable key. Digest and plain form of a key share the same client id. New CLI commands
+  `mcp-gateway gen-key` (random `mgw_…` key + digest, `--bytes`, `--prefix`, `--json`) and
+  `mcp-gateway hash-key [key]` (reads stdin when no argument is given). Malformed `sha256:` values are a config error.
+- **Key expiry / disabling**: `expiresAt` (ISO 8601) and `disabled` on object keys → `401`; open `/mcp` sessions of
+  such keys end on the next reload. Keys expiring within 7 days produce a warning.
+- **JWT hardening** (`auth.jwt`): `issuer`, `audience` (string or list), `algorithms` allowlist, `clockToleranceSeconds`,
+  `requireExp`, `maxTokenAgeSeconds`; verification keys from `jwtSecret` (HS*), a PEM `publicKey` (RS/PS/ES/EdDSA) or
+  a `jwksUrl` (HTTPS, cached `jwksCacheSeconds`, refetch on unknown `kid`). HMAC and asymmetric algorithms are never
+  mixed (algorithm-confusion protection); exactly one key source must be configured.
+- **Security headers** (`security.headers`, default on): `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: no-referrer`, `Cross-Origin-Opener-Policy`, `Cross-Origin-Resource-Policy`, a deny-all CSP on API
+  responses and a dashboard CSP that allows exactly its inline script by SHA-256 hash. Optional `security.hsts`.
+- **Network guards**: `security.ipAllowlist` (IPv4 / IPv6 / CIDR, via `net.BlockList`), `security.allowedHosts` (Host
+  header allowlist with `*.domain` wildcards), `security.trustProxy` (Express "trust proxy": decides `req.ip` for rate
+  limits, lockout, allowlist and logs). Liveness / readiness probes stay reachable.
+- **DNS-rebinding protection** (`security.dnsRebindingProtection`): Host must be a loopback name / the bind address
+  (or `allowedHosts`), and `/mcp` accepts browser `Origin`s only when same-origin, loopback or explicitly listed.
+- **Size limits**: `security.maxBodyBytes` (default 10 MiB as before, now configurable for REST and `/mcp`) and
+  `security.maxToolArgumentsBytes` for `tools/call`, `prompts/get` and `completion/complete` arguments (`413` on REST,
+  `-32602` on `/mcp`).
+- **Brute-force lockout** (`security.authLockout`): after `maxFailures` (10) failed authentications from one IP within
+  `windowSeconds` (300), the IP gets `429` + `Retry-After` for `lockoutSeconds` (900) on every authenticated route,
+  including `/mcp` and `/api/v1/events`.
+- **Secret redaction**: log lines and metadata, recorded `errorMessage`s (request log, audit log, `/requests`,
+  `/stats`, `/events`, dashboard) mask Bearer / Basic tokens, JWTs, common provider keys (OpenAI, Anthropic, GitHub,
+  GitLab, Slack, AWS, Google), `password=` / `token=` / `api_key=` pairs, URL credentials and values under
+  secret-looking keys. `GET /servers` now also masks secret-looking stdio `args` (`--token x`, `--api-key=x`). Extra
+  patterns via `security.redactPatterns`.
+- **Secure-defaults check**: startup warnings / hints (auth off on a public bind, DNS rebinding, `/mcp` open to any
+  origin, plain-text / short / expiring keys, JWT without iss / aud / exp, no lockout, `corsOrigins: ["*"]` with auth,
+  headers disabled, error details exposed). `mcp-gateway validate` prints them; `--strict` exits with code 2.
+- `GET /api/v1/security`: auth strategy, warnings, key hygiene counts and upcoming expiries, JWT settings, effective
+  security settings and lockout state — never key material; scoped clients get `403`. The dashboard's *Connect*
+  page shows it as a *Security posture* card (demo mock updated).
+- `SECURITY.md`: hardening table and scope; `docs/deployment.md` security checklist extended.
+
+### Fixed (security)
+- Unexpected errors (500) no longer return their message and stack trace whenever `NODE_ENV` was not `production`
+  (the default for `npm i -g` installs). They are shown only with `NODE_ENV=development` or the new
+  `security.exposeErrorDetails: true`. Deliberate `GatewayError` details are unchanged.
+
+### Added (MCP)
+- **Progress notifications**: a single `tools/call` with `params._meta.progressToken` from a client that accepts
+  `text/event-stream` is forwarded with a gateway-generated token; upstream `notifications/progress` are mapped back
+  and the reply becomes an SSE stream (progress events, then the result). Plain JSON otherwise.
+- **Logging**: `logging` capability, `logging/setLevel` per session; upstream `notifications/message` are forwarded to
+  sessions in scope at or above their level (`logger: "<serverId>/<logger>"`), and upstream servers announcing
+  `logging` are set to the most verbose level any session requested (re-applied after reconnects).
+- **Completion**: `completions` capability and `completion/complete` routed by prompt (exposed name translated back)
+  or resource template / URI; servers without the capability answer an empty completion.
+- **Resource subscriptions**: `resources.subscribe` capability, `resources/subscribe` / `resources/unsubscribe`
+  (routed like `resources/read`; `-32601` when the owning server does not support subscriptions) and
+  `notifications/resources/updated` forwarding. One upstream subscription per (server, URI) is shared and
+  reference-counted across sessions, released when the last session unsubscribes or ends, and restored after an
+  upstream reconnect.
+- Proxy: `RequestOptions.onProgress`, `connected` and `notification` events.
+- Library exports: `hashApiKey`, `isHashedKey`, `buildJwtVerifier`, `HMAC_ALGORITHMS`, `ASYMMETRIC_ALGORITHMS`,
+  `redactString`, `redactValue`, `redactArgs`, `configureRedaction`, `securityWarnings`, `AuthLockout`,
+  `createIpMatcher`, `hostAllowed`, `dashboardCsp`, `inlineScriptHashes`, `LOG_LEVELS`; types `SecurityConfig`,
+  `JwtConfig`, `AuthLockoutConfig`, `SecurityWarning`, `McpLogLevel`, `RequestOptions`, `ProgressUpdate`.
+
+### Changed
+- `auth.jwtSecret` is no longer required for `strategy: jwt` when `auth.jwt.publicKey` or `auth.jwt.jwksUrl` is set.
+- `initialize` on `/mcp` now also announces `logging`, `completions` and `resources.subscribe` (clients ignore
+  capabilities they do not use).
+- JWT verification failures are logged with the client IP.
+
+### Upgrade notes
+- No configuration changes are required. New behaviour that is on by default: security headers (disable with
+  `security.headers: false`), secret redaction in logs / recorded error messages, hidden 500 error details, and the
+  extra capabilities on `/mcp`.
+- If you embedded the dashboard in an `<iframe>` on another origin, set `security.headers: false` (the new
+  `frame-ancestors 'none'` / `X-Frame-Options: DENY` block that).
+- Tests or tooling that relied on 500 responses carrying `error.message` / `details` outside production need
+  `NODE_ENV=development` or `security.exposeErrorDetails: true`.
+- Everything else (`ipAllowlist`, `allowedHosts`, `dnsRebindingProtection`, `authLockout`, `maxToolArgumentsBytes`,
+  `hsts`, `trustProxy`, JWT checks, key expiry) is opt-in.
+
 ## [1.1.0] - 2026-10-07
 
 ### Added

package/README.md

@@ -21,6 +21,8 @@ Route · Authenticate · Rate-limit · Monitor — all your [Model Context Proto
 
 ---
 
+> **Live demo:** try the dashboard with simulated traffic — <https://harrisoncn.github.io/mcp-gateway/> (runs entirely in your browser).
+
 ## The Problem
 
 As [MCP](https://modelcontextprotocol.io) becomes the standard protocol for AI agents to interact with tools, teams are running **dozens of MCP servers** — filesystem, GitHub, databases, Slack, search, and more. Managing them is chaos:
@@ -63,10 +65,11 @@ As [MCP](https://modelcontextprotocol.io) becomes the standard protocol for AI a
 ## Features
 
 - **Unified API endpoint** — one URL for all your MCP tools, auto-routed by tool name
-- **MCP endpoint for clients** — `/mcp` speaks MCP Streamable HTTP (2025-06-18 / 2025-03-26), so Claude Code, Cursor or any MCP client sees every upstream tool through one server, with the same auth, limits and metrics
+- **MCP endpoint for clients** — `/mcp` speaks MCP Streamable HTTP (2025-06-18 / 2025-03-26), so Claude Code, Cursor or any MCP client sees every upstream tool through one server, with the same auth, limits and metrics — including progress notifications, cancellation, logging, completions and resource subscriptions
 - **Every MCP transport** — `stdio`, `streamable-http` (current spec), legacy `sse` (HTTP+SSE) and `websocket` upstream servers, with per-server headers for upstream auth
 - **Automatic reconnect** — crashed or disconnected servers are reconnected with exponential backoff + jitter; state is visible in `/servers`, `/health`, the dashboard and Prometheus
-- **Authentication** — API key (constant-time compare), JWT (HS256/384/512), or no-auth; misconfiguration fails closed
+- **Authentication** — API keys (constant-time compare, storable as `sha256:` digests, with expiry), JWT (HMAC secret, PEM public key or JWKS URL; issuer / audience / exp checks), or no-auth; misconfiguration fails closed
+- **Hardening** — security headers + hash-based CSP, IP allowlist, Host / Origin checks against DNS rebinding, body and argument size limits, brute-force lockout, secret redaction in logs and history, startup security warnings (`mcp-gateway validate --strict`)
 - **Rate limiting** — per-key sliding-window counter, with standard `X-RateLimit-*` headers
 - **Per-key scopes** — restrict an API key (or a JWT via claims) to some servers / tools and give it its own rate limit; enforced on REST and `/mcp`
 - **Concurrency limits** — per-server `maxConcurrency`, queued requests count against `timeout`
@@ -199,9 +202,9 @@ What the endpoint does:
 
 | | |
 |---|---|
-| `POST /mcp` | JSON-RPC: `initialize`, `ping`, `tools/list` (paginated), `tools/call`, `resources/list`, `resources/templates/list`, `resources/read`, `prompts/list`, `prompts/get`, notifications (incl. `notifications/cancelled`). Batches are accepted. Responses are `application/json`. |
-| `GET /mcp` | SSE stream for server→client notifications: `notifications/tools/list_changed`, `notifications/resources/list_changed` and `notifications/prompts/list_changed` are sent when the aggregated list a session sees changes (a server announces changes, connects, is removed by hot reload, …). |
-| Resources & prompts | Resource URIs are passed through unchanged; when two servers list the same URI the lowest server id wins. `resources/read` is routed by exact URI, then by resource template, then to the only server with resources. Prompt names follow `toolNaming` like tools. `resources/subscribe` is not offered. |
+| `POST /mcp` | JSON-RPC: `initialize`, `ping`, `tools/list` (paginated), `tools/call`, `resources/list`, `resources/templates/list`, `resources/read`, `resources/subscribe` / `unsubscribe`, `prompts/list`, `prompts/get`, `logging/setLevel`, `completion/complete`, notifications (incl. `notifications/cancelled`). Batches are accepted. Responses are `application/json`; a single `tools/call` with `_meta.progressToken` switches to an SSE reply when the upstream reports progress (`notifications/progress`, then the result). |
+| `GET /mcp` | SSE stream for server→client notifications: `notifications/tools/list_changed`, `notifications/resources/list_changed` and `notifications/prompts/list_changed` are sent when the aggregated list a session sees changes (a server announces changes, connects, is removed by hot reload, …); `notifications/resources/updated` for subscribed URIs; upstream `notifications/message` at or above the session's `logging/setLevel` level (`logger` = `<serverId>/<logger>`). |
+| Resources & prompts | Resource URIs are passed through unchanged; when two servers list the same URI the lowest server id wins. `resources/read` is routed by exact URI, then by resource template, then to the only server with resources. Prompt names follow `toolNaming` like tools. `resources/subscribe` is routed the same way; sessions share one upstream subscription per URI, restored after reconnects. `completion/complete` is routed by prompt name or resource template. |
 | `DELETE /mcp` | Ends the session. |
 | Sessions | `initialize` returns `Mcp-Session-Id`; later requests must send it (`400` if missing, `404` if unknown or expired). A session is bound to the API key / JWT subject that created it. Idle sessions expire after `mcp.sessionIdleTimeoutSeconds`. |
 | Tool names | `toolNaming: auto` (default) keeps a tool's name unless two servers expose the same name; then every copy becomes `<serverId>__<tool>`. `prefix` always uses `<serverId>__<tool>`. Ordering is deterministic (server id, then tool name). In `auto` mode the prefixed form is also accepted by `tools/call`. |
@@ -289,14 +292,16 @@ host: 0.0.0.0                 # Bind address (env: MCP_GATEWAY_HOST)
 logLevel: info                # debug | info | warn | error
 
 auth:
-  strategy: api-key           # none | api-key | jwt   (oauth2 is not implemented and is rejected)
+  strategy: api-key           # none | api-key | jwt | oauth2 (OAuth 2.1 resource server, see docs/configuration.md)
   apiKeys:
     - "your-secret-key"       # full access
+    - "sha256:…"              # a key stored as its digest (mcp-gateway gen-key / hash-key)
     - key: "${APP_KEY}"       # scoped key (see "Per-key scopes")
       name: app
       servers: ["github"]
       tools: ["read_*"]
       rateLimit: { limit: 30, windowSeconds: 60 }
+      expiresAt: "2027-01-01" # optional expiry; disabled: true switches a key off
   protect:
     health: false             # true → /api/v1/health requires auth
     metrics: false            # true → /api/v1/metrics requires auth (configure your scraper)
@@ -323,6 +328,12 @@ monitor:
   prometheus: true            # Enable Prometheus /metrics
   retentionHours: 24          # Metrics retention
 
+security:                     # hardening (see docs/configuration.md#security)
+  authLockout: true           # 429 for IPs with repeated auth failures
+  dnsRebindingProtection: false  # true for a local gateway without auth
+  ipAllowlist: ["10.0.0.0/8"]
+  maxToolArgumentsBytes: 262144
+
 corsOrigins:
   - "https://your-app.com"
 
@@ -568,6 +579,27 @@ await gateway.start();
 process.on('SIGTERM', () => gateway.stop());
 ```
 
+## What's New in v1.3
+
+| Feature | Description |
+|---------|-------------|
+| **OAuth 2.1 (MCP authorization)** | `auth.strategy: oauth2`: RFC 9728 protected-resource metadata, JWT validation via (discovered) JWKS or RFC 7662 introspection, audience binding (RFC 8707), `WWW-Authenticate` challenges, `requiredScopes` |
+| **Resumable streams** | `Last-Event-ID` replay on `GET /mcp` from a per-session event buffer (`mcp.eventBufferSize`) |
+
+Details: [CHANGELOG](CHANGELOG.md).
+
+## What's New in v1.2
+
+| Feature | Description |
+|---------|-------------|
+| **Hashed & expiring keys** | `auth.apiKeys` entries can be `sha256:<hex>` digests (`mcp-gateway gen-key`, `hash-key`) and carry `expiresAt` / `disabled` |
+| **JWT hardening** | `auth.jwt`: `issuer`, `audience`, `algorithms` (HMAC / asymmetric never mixed), `clockToleranceSeconds`, `requireExp`, `maxTokenAgeSeconds`, PEM `publicKey` or cached `jwksUrl` (works with OAuth 2.0 / OIDC providers) |
+| **`security` block** | headers + dashboard CSP, `hsts`, `trustProxy`, `ipAllowlist`, `allowedHosts`, `dnsRebindingProtection`, `maxBodyBytes`, `maxToolArgumentsBytes`, `authLockout`, `redactPatterns` — all hot reloadable |
+| **Secure-defaults check** | startup warnings, `validate --strict`, `GET /api/v1/security` and a *Security posture* card in the dashboard |
+| **More of MCP on `/mcp`** | `notifications/progress` (SSE replies), `logging/setLevel` + forwarded `notifications/message`, `completion/complete`, `resources/subscribe` / `unsubscribe` + `notifications/resources/updated` |
+
+Details and upgrade notes: [CHANGELOG](CHANGELOG.md#120---2026-10-07).
+
 ## What's New in v1.0
 
 | Feature | Description |
@@ -617,8 +649,12 @@ unknown fields). Deep imports, log format, the dashboard and the audit database
 | JS / Kotlin clients, OpenAI / Anthropic tool schemas | ✅ Done (v1.0) |
 | Resources & prompts passthrough, persistent audit log | ✅ Done (v1.0) |
 | Stable API, docs, container image | ✅ Done (v1.0) |
+| Security hardening (hashed keys, JWKS, lockout, DNS-rebinding guard, CSP) | ✅ Done (v1.2) |
+| Progress, logging, completions, resource subscriptions on `/mcp` | ✅ Done (v1.2) |
 | Redis-backed rate limiting | 📋 Planned |
-| OAuth2 / OIDC auth | 📋 Planned |
+| OAuth 2.1 / OIDC auth (MCP authorization spec) | ✅ Done (v1.3) |
+| Streamable HTTP resumability (`Last-Event-ID`) | ✅ Done (v1.3) |
+| Forwarding sampling / elicitation / roots requests to downstream clients | 📋 Planned |
 | Tool-level access control | ✅ Done via per-key scopes (v0.6) |
 | Request replay & debugging | 📋 Planned (history is available via the audit log) |
 | Multi-tenant mode | 📋 Planned |

package/dashboard/README.md

@@ -70,3 +70,7 @@ servers and tools.
 |---|---|
 | ![Onboarding](../docs/images/dashboard-onboarding-try-tool.png) | ![Playground (中文)](../docs/images/dashboard-playground-zh.png) |
 | ![Light theme](../docs/images/dashboard-overview-light.png) | ![Mobile](../docs/images/dashboard-mobile-zh.png) |
+
+## Demo build
+
+`demo/mock.js` replaces `fetch` for the gateway API with an in-browser simulation (servers, tools, request stream, SSE events). The GitHub Pages workflow (`.github/workflows/pages.yml`) injects it before the dashboard script and publishes the result to <https://harrisoncn.github.io/mcp-gateway/>. It is not shipped in the npm package or Docker image.

package/dashboard/index.html

@@ -196,6 +196,12 @@ main { max-width: 1320px; margin: 0 auto; padding: 20px 16px 96px; }
 .kv b { font-size: 13.5px; font-variant-numeric: tabular-nums; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; display: block; }
 .srv .err { color: var(--bad); font-size: 12px; overflow-wrap: anywhere; }
 .chips { display: flex; flex-wrap: wrap; gap: 6px; }
+.sec-card { margin-top: 14px; }
+.sec-card .kv { margin-bottom: 12px; }
+.sec-list { list-style: none; margin: 0; padding: 0; display: grid; gap: 8px; }
+.sec-list li { display: flex; gap: 10px; align-items: flex-start; font-size: 13px; line-height: 1.45; color: var(--text); }
+.sec-list li .badge { flex: none; margin-top: 1px; }
+@media (max-width: 560px) { .sec-card .kv { grid-template-columns: repeat(2, 1fr); } }
 .chip { font-family: var(--mono); font-size: 11.5px; padding: 3px 8px; border-radius: 7px; background: var(--surface-2); border: 1px solid var(--border); cursor: pointer; transition: border-color .2s, transform .15s var(--ease); }
 .chip:hover { border-color: var(--accent); }
 .chip:active { transform: scale(.95); }
@@ -478,6 +484,7 @@ tbody tr:hover { background: var(--surface-2); }
   <section class="view" id="view-connect" role="tabpanel" aria-labelledby="tab-connect">
     <div class="page-head"><div><h1 data-i18n="cnTitle">Connect a client</h1><p data-i18n="cnSub">Point any MCP client at this gateway</p></div></div>
     <div class="card" id="connectCard"></div>
+    <div class="card sec-card" id="securityCard" hidden></div>
   </section>
 </main>
 
@@ -567,6 +574,7 @@ const I18N = {
     via: 'Via', kind: 'Kind', any: 'Any', ok: 'OK', failed: 'Failed', apply: 'Apply', reset: 'Reset', time: 'Time', duration: 'Duration',
     prev: '← Newer', next: 'Older →', page: 'Page {n}', srcAudit: 'Persistent audit log', srcMemory: 'In-memory log',
     cnTitle: 'Connect a client', cnSub: 'Point any MCP client at this gateway',
+    secTitle: 'Security posture', secOk: 'No issues', secIssues: '{n} to review', secAuth: 'Auth', secKeys: 'Hashed keys', secLockout: 'Lockout', secRebind: 'DNS-rebinding guard', secHeaders: 'Security headers', secLocked: 'Locked IPs', secOn: 'on', secOff: 'off', secWarn: 'warning', secHint: 'hint', secNone: 'Nothing to report.',
     ob1Eye: 'Step 1 · Connect', ob1Title: 'Welcome to your MCP gateway',
     ob1Lead: "One endpoint for every MCP server — with auth, rate limits and live metrics. Let's get you connected in under a minute.",
     hero1: 'Many servers', hero1s: 'stdio, SSE, WebSocket, HTTP', hero2: 'One secure door', hero2s: 'keys, scopes, limits', hero3: 'Live insight', hero3s: 'latency, errors, usage',
@@ -611,6 +619,7 @@ const I18N = {
     via: '通道', kind: '类型', any: '全部', ok: '成功', failed: '失败', apply: '应用', reset: '重置', time: '时间', duration: '耗时',
     prev: '← 较新', next: '较早 →', page: '第 {n} 页', srcAudit: '持久化审计日志', srcMemory: '内存日志',
     cnTitle: '接入客户端', cnSub: '让任意 MCP 客户端连接到本网关',
+    secTitle: '安全状态', secOk: '无问题', secIssues: '{n} 项待处理', secAuth: '认证', secKeys: '已哈希的密钥', secLockout: '失败锁定', secRebind: 'DNS 重绑定防护', secHeaders: '安全响应头', secLocked: '已锁定 IP', secOn: '开', secOff: '关', secWarn: '警告', secHint: '建议', secNone: '暂无可报告的问题。',
     ob1Eye: '第 1 步 · 连接', ob1Title: '欢迎使用 MCP 网关',
     ob1Lead: '一个入口接入所有 MCP 服务器——自带鉴权、限流与实时监控。一分钟内即可完成连接。',
     hero1: '多个服务器', hero1s: 'stdio、SSE、WebSocket、HTTP', hero2: '统一安全入口', hero2s: '密钥、权限范围、限流', hero3: '实时洞察', hero3s: '延迟、错误、用量',
@@ -672,7 +681,7 @@ const fmtNum = (v, d = 0) => (v == null || !isFinite(v) ? '—' : v >= 1e6 ? (v
 const fmtTime = (ts) => new Date(ts).toLocaleTimeString(lang === 'zh' ? 'zh-CN' : undefined, { hour12: false });
 const fmtDateTime = (ts) => new Date(ts).toLocaleString(lang === 'zh' ? 'zh-CN' : undefined, { hour12: false, month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit', second: '2-digit' });
 const statusCls = (s) => ({ online: 'ok', degraded: 'warn', reconnecting: 'info', offline: 'bad' })[s] || '';
-const ORIGIN = location.origin;
+const ORIGIN = window.__MCP_GATEWAY_DEMO__ ? 'http://localhost:4000' : location.origin;
 const ICON = {
   overview: '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M3 13h4l3-8 4 14 3-6h4"/></svg>',
   servers: '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="4" width="18" height="6" rx="2"/><rect x="3" y="14" width="18" height="6" rx="2"/><path d="M7 7h.01M7 17h.01"/></svg>',
@@ -828,7 +837,7 @@ function go(view, push = true) {
   if (view === 'servers') loadServers();
   if (view === 'playground') renderPlayground($('#pgMain'), 'main');
   if (view === 'history') loadHistory();
-  if (view === 'connect') renderSnippets($('#connectCard'), 'main');
+  if (view === 'connect') { renderSnippets($('#connectCard'), 'main'); loadSecurity(); }
   if (view === 'overview') requestAnimationFrame(renderCharts);
 }
 window.addEventListener('hashchange', () => go(location.hash.slice(1), false));
@@ -1537,6 +1546,36 @@ document.addEventListener('keydown', (e) => {
   }
 });
 
+// ─── Security posture (Connect page) ─────────────────────────────────────────
+async function loadSecurity() {
+  try { state.security = await api('/security'); }
+  catch { state.security = null; }  // older gateway, scoped key or no access: hide the card
+  renderSecurity();
+}
+function renderSecurity() {
+  const card = $('#securityCard');
+  const s = state.security;
+  if (!s || !Array.isArray(s.warnings)) { card.hidden = true; return; }
+  card.hidden = false;
+  const warns = s.warnings.filter((w) => w.level === 'warn').length;
+  const onOff = (v) => esc(v ? t('secOn') : t('secOff'));
+  const k = s.apiKeys || { total: 0, hashed: 0 };
+  const facts = [
+    [t('secAuth'), esc(s.authStrategy)],
+    [t('secKeys'), k.total ? `${k.hashed}/${k.total}` : '—'],
+    [t('secLockout'), onOff(s.settings?.authLockout)],
+    [t('secRebind'), onOff(s.settings?.dnsRebindingProtection)],
+    [t('secHeaders'), onOff(s.settings?.headers)],
+    [t('secLocked'), s.lockout ? String(s.lockout.lockedClients) : '—'],
+  ];
+  card.innerHTML =
+    `<h2><span>${esc(t('secTitle'))}</span><span class="badge ${warns ? 'warn' : 'ok'}" style="margin-left:auto">${esc(warns ? t('secIssues').replace('{n}', warns) : t('secOk'))}</span></h2>` +
+    `<div class="kv">${facts.map(([a, b]) => `<div><span>${esc(a)}</span><b>${b}</b></div>`).join('')}</div>` +
+    (s.warnings.length
+      ? `<ul class="sec-list">${s.warnings.map((w) => `<li><span class="badge ${w.level === 'warn' ? 'warn' : 'info'}">${esc(w.level === 'warn' ? t('secWarn') : t('secHint'))}</span><span>${esc(w.message)}</span></li>`).join('')}</ul>`
+      : `<div class="empty">${esc(t('secNone'))}</div>`);
+}
+
 // ─── Language ────────────────────────────────────────────────────────────────
 $('#langBtn').addEventListener('click', () => transition(() => {
   lang = lang === 'zh' ? 'en' : 'zh';
@@ -1545,7 +1584,7 @@ $('#langBtn').addEventListener('click', () => transition(() => {
   if (state.servers.length) renderServers();
   delete $('#pgMain').dataset.built; delete $('#obPg').dataset.built;
   if (state.view === 'playground') renderPlayground($('#pgMain'), 'main');
-  if (state.view === 'connect') renderSnippets($('#connectCard'), 'main');
+  if (state.view === 'connect') { renderSnippets($('#connectCard'), 'main'); renderSecurity(); }
   if (state.view === 'history') loadHistory();
   if (!$('#ob').hidden) showStep(obState.step);
 }));

package/dist/auth/middleware.d.ts

@@ -10,16 +10,33 @@
  *  - The client id attached to a request is a hash fingerprint of the key,
  *    never a prefix of the key itself (prefixes were leaking into logs and the
  *    /requests endpoint, and keys sharing a prefix shared a rate-limit bucket).
+ *  - Keys may be stored as SHA-256 digests (`sha256:<hex>`), so the config
+ *    file never holds a usable key. A digest key and its plain form produce
+ *    the same client id.
+ *  - Keys can expire (`expiresAt`) or be switched off (`disabled`).
+ *  - JWTs: HMAC secret, PEM public key or JWKS URL; algorithm allowlist that
+ *    never mixes HMAC and asymmetric algorithms; optional issuer / audience /
+ *    exp / max-age checks and clock tolerance.
  */
+import { type KeyObject } from 'crypto';
 import type { Request, RequestHandler } from 'express';
+import { type JWTVerifyGetKey, type JWTVerifyOptions } from 'jose';
 import type { ApiKeyConfig, AuthConfig } from '../utils/types.js';
 import { type AccessScope } from './scopes.js';
+import { type TokenInfo } from './oauth.js';
 export type AuthedRequest = Request & {
     clientId?: string;
     jwtPayload?: unknown;
     /** Servers / tools / rate limit this client is restricted to (absent = unrestricted). */
     scope?: AccessScope;
+    /** Validated OAuth access token (strategy `oauth2`). */
+    oauth?: TokenInfo;
 };
+export interface AuthMiddlewareOptions {
+    /** Path of the MCP endpoint (OAuth resource URI / metadata). Default `/mcp`. */
+    mcpPath?: () => string;
+    fetch?: typeof fetch;
+}
 /** An auth middleware that can also look up the current scope of a known client id (api keys). */
 export type AuthMiddleware = RequestHandler & {
     /**
@@ -34,10 +51,30 @@ export type AuthMiddleware = RequestHandler & {
 };
 /** Normalise `auth.apiKeys` entries (plain strings or objects). */
 export declare function normalizeApiKeys(keys: AuthConfig['apiKeys']): ApiKeyConfig[];
-export declare function createAuthMiddleware(config?: AuthConfig): AuthMiddleware;
+export declare const HMAC_ALGORITHMS: string[];
+export declare const ASYMMETRIC_ALGORITHMS: string[];
+/** Whether a configured key is a `sha256:<hex>` digest rather than the key itself. */
+export declare function isHashedKey(key: string): boolean;
+/** `sha256:<hex>` digest of a key, the form to store in the config file. */
+export declare function hashApiKey(key: string): string;
+/** Expiry of a key entry as epoch ms (undefined = never; NaN for an unparsable date). */
+export declare function keyExpiry(entry: ApiKeyConfig): number | undefined;
+/** Why a key is currently unusable, or undefined when it is active. */
+export declare function keyInactiveReason(entry: ApiKeyConfig, now?: number): 'disabled' | 'expired' | undefined;
+export declare function createAuthMiddleware(config?: AuthConfig, options?: AuthMiddlewareOptions): AuthMiddleware;
 export declare function fingerprint(key: string): string;
 /** Constant-time membership check against a pre-hashed key list. */
 export declare function matchesAnyKey(candidate: string, keyDigests: Buffer[]): boolean;
 /** Constant-time lookup: index of the matching key digest, or -1. */
 export declare function matchKeyIndex(candidate: string, keyDigests: Buffer[]): number;
+export interface JwtVerifier {
+    key: Uint8Array | KeyObject | JWTVerifyGetKey;
+    options: JWTVerifyOptions;
+}
+/**
+ * Key source + verification options for the `jwt` strategy. Throws on
+ * misconfiguration (missing / conflicting key sources, algorithms that do not
+ * fit the key type, non-HTTPS JWKS URL).
+ */
+export declare function buildJwtVerifier(config: AuthConfig): JwtVerifier;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,OAAO,EAA0B,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/E,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;CAC3F,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,YAAY,EAAE,CAI5E;AAaD,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,cAAc,CAmCxE;AAMD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAE9E;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ7E"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAgD,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AACtF,OAAO,KAAK,EAAE,OAAO,EAA0B,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAiC,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,MAAM,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAa,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yFAAyF;IACzF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,wDAAwD;IACxD,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;CAC3F,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,YAAY,EAAE,CAI5E;AAWD,eAAO,MAAM,eAAe,UAA8B,CAAC;AAC3D,eAAO,MAAM,qBAAqB,UAKjC,CAAC;AAIF,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAGjE;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,SAAa,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAK3G;AAED,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA+B7G;AAYD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAE9E;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ7E;AAsDD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAC9C,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAyDhE"}