@withone/mcp 2.3.1 → 2.3.2

package/README.md

@@ -166,6 +166,8 @@ If you used `one init`, the configuration below is already done for you. These e
 npx @withone/mcp
 ```
 
+Requires Node.js 22.23.4+, 24.22.1+ or 26.12.1+. Older Node trusts the compromised eMudhra CA certificates (October 2026), so a network attacker could intercept `ONE_SECRET`. On an older Node the server still starts, but every tool returns an error with the command that updates Node for how it was installed. If you can't update yet, `ONE_ALLOW_UNPATCHED_NODE=1` lets it call One anyway; you remain exposed while it is set.
+
 ### Claude Desktop / Cursor
 
 Add the following to your MCP config:

package/build/index.js

@@ -14,6 +14,7 @@ import { OneClient } from './client.js';
 import { isMethodAllowed, isActionAllowed, buildIntegrationsResponse, } from './helpers.js';
 import { findOneActions } from './find.js';
 import { ToolError, toolErrorResult } from './tool-error.js';
+import { unpatchedNodeRefusal } from './node-check.js';
 import { listOneIntegrationsToolConfig, findOneActionsToolConfig, executeOneActionToolConfig } from './schemas.js';
 import { createRequire } from 'node:module';
 const SERVER_NAME = "one-mcp-server";
@@ -38,6 +39,12 @@ const ONE_ACTION_IDS = process.env.ONE_ACTION_IDS
     ? process.env.ONE_ACTION_IDS.split(",").map(s => s.trim()).filter(Boolean)
     : ["*"];
 const ONE_KNOWLEDGE_AGENT = process.env.ONE_KNOWLEDGE_AGENT === "true";
+// eMudhra CA compromise: on a Node without the fix every tool answers this
+// instead of calling One (see node-check.ts).
+const NODE_REFUSAL = unpatchedNodeRefusal();
+if (NODE_REFUSAL) {
+    console.error(NODE_REFUSAL);
+}
 const oneClient = new OneClient({
     secret: ONE_SECRET,
     baseUrl: ONE_BASE_URL,
@@ -74,15 +81,21 @@ const server = new McpServer({
     version: SERVER_VERSION,
 });
 server.registerTool("list_one_integrations", listOneIntegrationsToolConfig, async (args) => {
+    if (NODE_REFUSAL)
+        return toolErrorResult(new ToolError(NODE_REFUSAL));
     await initializeOne();
     return await handleGetIntegrations(args);
 });
 server.registerTool("find_one_actions", findOneActionsToolConfig, async (args) => {
+    if (NODE_REFUSAL)
+        return toolErrorResult(new ToolError(NODE_REFUSAL));
     await initializeOne();
     return await handleFindOneActions(args);
 });
 if (!ONE_KNOWLEDGE_AGENT) {
     server.registerTool("execute_one_action", executeOneActionToolConfig, async (args) => {
+        if (NODE_REFUSAL)
+            return toolErrorResult(new ToolError(NODE_REFUSAL));
         await initializeOne();
         return await handleExecuteOneAction(args);
     });

package/build/node-check.js

@@ -0,0 +1,83 @@
+/**
+ * Node.js TLS guard
+ *
+ * Eight eMudhra/emSign intermediate CAs were created with 8-bit private keys
+ * (October 2026, RUSTSEC-2026-0381), so anyone can compute them and sign a
+ * certificate for any domain, including api.withone.ai. Node.js blocks them
+ * inside the TLS handshake from 22.23.4, 24.22.1 and 26.12.1
+ * (nodejs/node#66871). On any older Node, a network attacker can intercept
+ * this server's traffic and the ONE_SECRET it sends.
+ *
+ * An MCP server that exits at startup only shows up as "failed to start" in
+ * the client, so on an unpatched Node the server still starts but every tool
+ * returns this refusal, before any request, for the agent to pass on.
+ *
+ * @fileoverview Refuses to call One from a Node without the eMudhra fix
+ * @author One
+ */
+/** The first patch of each Node line that ships the blocklist. Odd lines (23, 25) are end-of-life and never got it. */
+const FIXED_IN = {
+    22: [23, 4],
+    24: [22, 1],
+    26: [12, 1],
+};
+/** The first Node line released after the fix, so it has it from .0. */
+const FIRST_LINE_WITH_FIX = 27;
+/** The line to move to from a Node line that never got the fix. */
+const RECOMMENDED_LINE = 24;
+export const REQUIRED_NODE = '22.23.4+, 24.22.1+ or 26.12.1+';
+/** Set to 1 to call One from an unpatched Node anyway. */
+export const ALLOW_UNPATCHED_ENV = 'ONE_ALLOW_UNPATCHED_NODE';
+function parseVersion(version) {
+    const [major, minor, patch] = version.split('.').map((part) => Number.parseInt(part, 10));
+    return [major, minor, patch ?? 0];
+}
+/** True when this Node version rejects chains through the compromised eMudhra intermediates. */
+export function nodeHasTlsFix(version = process.versions.node) {
+    const [major, minor, patch] = parseVersion(version);
+    if (!Number.isFinite(major))
+        return false;
+    if (major >= FIRST_LINE_WITH_FIX)
+        return true;
+    const fixed = FIXED_IN[major];
+    if (!fixed)
+        return false;
+    const [fixedMinor, fixedPatch] = fixed;
+    return minor > fixedMinor || (minor === fixedMinor && patch >= fixedPatch);
+}
+/**
+ * The command that updates Node for however it was installed, judged from the
+ * path of the running binary. A line that got the fix stays on its line; any
+ * other moves to the recommended one.
+ */
+export function upgradeCommand(version = process.versions.node, execPath = process.execPath) {
+    const [major] = parseVersion(version);
+    const line = FIXED_IN[major] ? major : RECOMMENDED_LINE;
+    const path = execPath.replace(/\\/g, '/');
+    if (/\/\.nvm\/versions\/node\//.test(path))
+        return `nvm install ${line} && nvm alias default ${line}`;
+    if (/\/AppData\/(Roaming|Local)\/nvm\//i.test(path))
+        return `nvm install ${line} && nvm use ${line}`;
+    if (/\/\.?volta\//i.test(path))
+        return `volta install node@${line}`;
+    if (/fnm/i.test(path))
+        return `fnm install ${line} && fnm default ${line}`;
+    const brew = path.match(/\/Cellar\/(node(?:@\d+)?)\//);
+    if (brew) {
+        const formula = brew[1] === 'node' || FIXED_IN[major] ? brew[1] : `node@${line}`;
+        return formula === brew[1] ? `brew upgrade ${formula}` : `brew install ${formula}`;
+    }
+    return `download Node.js ${line} from https://nodejs.org`;
+}
+/**
+ * What every tool answers on an unpatched Node, or null when it may call One:
+ * the Node has the fix, or ONE_ALLOW_UNPATCHED_NODE=1.
+ */
+export function unpatchedNodeRefusal(version = process.versions.node, execPath = process.execPath, env = process.env) {
+    if (nodeHasTlsFix(version) || env[ALLOW_UNPATCHED_ENV] === '1')
+        return null;
+    return (`The One MCP server is running on Node.js v${version}, which trusts the compromised eMudhra ` +
+        `certificates, so a network attacker could intercept its traffic and the user's One API key. ` +
+        `It will not call One until Node.js is updated to ${REQUIRED_NODE} (Node 18, 20, 23 and 25 never got the fix). ` +
+        `Don't retry: ask the user to run \`${upgradeCommand(version, execPath)}\`, then restart their MCP client.`);
+}

package/build/node-check.test.js

@@ -0,0 +1,50 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { nodeHasTlsFix, unpatchedNodeRefusal, upgradeCommand } from './node-check.js';
+describe('nodeHasTlsFix', () => {
+    it('knows the first fixed patch of each supported line', () => {
+        assert.equal(nodeHasTlsFix('22.23.4'), true);
+        assert.equal(nodeHasTlsFix('22.23.3'), false);
+        assert.equal(nodeHasTlsFix('22.24.0'), true);
+        assert.equal(nodeHasTlsFix('24.22.1'), true);
+        assert.equal(nodeHasTlsFix('24.22.0'), false);
+        assert.equal(nodeHasTlsFix('26.12.1'), true);
+        assert.equal(nodeHasTlsFix('26.12.0'), false);
+    });
+    it('treats end-of-life lines as unfixed and later lines as fixed', () => {
+        for (const v of ['18.20.8', '20.19.5', '23.11.1', '25.9.0']) {
+            assert.equal(nodeHasTlsFix(v), false, v);
+        }
+        assert.equal(nodeHasTlsFix('27.0.0'), true);
+        assert.equal(nodeHasTlsFix('garbage'), false);
+    });
+});
+describe('upgradeCommand', () => {
+    it('keeps a fixed line and moves an end-of-life one to 24', () => {
+        assert.equal(upgradeCommand('22.10.0', '/Users/me/.nvm/versions/node/v22.10.0/bin/node'), 'nvm install 22 && nvm alias default 22');
+        assert.equal(upgradeCommand('20.19.5', '/Users/me/.nvm/versions/node/v20.19.5/bin/node'), 'nvm install 24 && nvm alias default 24');
+    });
+    it('matches each version manager by the binary path', () => {
+        assert.equal(upgradeCommand('20.19.5', 'C:\\Users\\me\\AppData\\Roaming\\nvm\\v20.19.5\\node.exe'), 'nvm install 24 && nvm use 24');
+        assert.equal(upgradeCommand('20.19.5', '/Users/me/.volta/tools/image/node/20.19.5/bin/node'), 'volta install node@24');
+        assert.equal(upgradeCommand('20.19.5', '/Users/me/.local/share/fnm/node-versions/v20.19.5/installation/bin/node'), 'fnm install 24 && fnm default 24');
+        assert.equal(upgradeCommand('26.1.0', '/opt/homebrew/Cellar/node/26.1.0/bin/node'), 'brew upgrade node');
+        assert.equal(upgradeCommand('20.19.5', '/opt/homebrew/Cellar/node@20/20.19.5/bin/node'), 'brew install node@24');
+        assert.equal(upgradeCommand('20.19.5', '/usr/local/bin/node'), 'download Node.js 24 from https://nodejs.org');
+    });
+});
+describe('unpatchedNodeRefusal', () => {
+    it('is null on a patched Node', () => {
+        assert.equal(unpatchedNodeRefusal('24.22.1', '/usr/local/bin/node', {}), null);
+    });
+    it('tells the agent the version, the fix and the command to give the user', () => {
+        const refusal = unpatchedNodeRefusal('20.19.5', '/Users/me/.nvm/versions/node/v20.19.5/bin/node', {}) ?? '';
+        assert.match(refusal, /Node\.js v20\.19\.5/);
+        assert.match(refusal, /22\.23\.4\+, 24\.22\.1\+ or 26\.12\.1\+/);
+        assert.match(refusal, /`nvm install 24 && nvm alias default 24`/);
+        assert.match(refusal, /Don't retry/);
+    });
+    it('steps aside when ONE_ALLOW_UNPATCHED_NODE=1', () => {
+        assert.equal(unpatchedNodeRefusal('20.19.5', '/usr/local/bin/node', { ONE_ALLOW_UNPATCHED_NODE: '1' }), null);
+    });
+});

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@withone/mcp",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "A Model Context Protocol Server for One",
   "type": "module",
   "bin": {
-    "mcp": "./build/index.js"
+    "mcp": "build/index.js"
   },
   "files": [
     "build"
@@ -35,7 +35,10 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/withoneai/mcp"
+    "url": "git+https://github.com/withoneai/mcp.git"
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "mcpName": "ai.withone/mcp"
 }