@zackbart/connecta 0.7.0 → 0.7.1

package/src/connectors/remote-mcp.ts

@@ -1,7 +1,10 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import type {
+  FetchLike,
+  Transport,
+} from "@modelcontextprotocol/sdk/shared/transport.js";
 import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
 import { KvOAuthProvider } from "../auth/downstream-oauth.js";
 import { ConnectorCallError } from "../errors.js";
@@ -18,6 +21,8 @@ export type RemoteMcpAuth =
   | { type: "headers"; headers: Record<string, string> }
   | { type: "oauth" };
 
+export type RemoteMcpRedirectPolicy = "none" | "same-origin";
+
 export interface RemoteMcpOptions {
   url: string;
   /** Human-readable display name; the connector id remains the address prefix. */
@@ -37,6 +42,14 @@ export interface RemoteMcpOptions {
    */
   usageGuide?: string;
   auth?: RemoteMcpAuth;
+  /**
+   * Downstream HTTP redirect policy. Defaults to `"none"`: every redirect is
+   * rejected. `"same-origin"` follows at most five redirects while preserving
+   * standard 301/302/303/307/308 method semantics. Cross-origin redirects and
+   * HTTPS downgrades are always refused, so credentials never cross the
+   * configured request's origin.
+   */
+  redirects?: RemoteMcpRedirectPolicy;
   /**
    * Refuse to connect to a non-`https://` `url` at construction (default
    * false). Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`) are always
@@ -208,6 +221,127 @@ function isLoopbackHost(hostname: string): boolean {
   );
 }
 
+export const MAX_REMOTE_REDIRECT_HOPS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const BODY_HEADERS = [
+  "content-encoding",
+  "content-language",
+  "content-length",
+  "content-location",
+  "content-type",
+  "transfer-encoding",
+];
+
+export class RemoteMcpRedirectError extends ConnectorCallError {
+  constructor(connectorId: string, reason: string) {
+    super(
+      "connector_call_failed",
+      `Connector "${connectorId}" redirect policy rejected the downstream response: ${reason}.`,
+    );
+    this.name = "RemoteMcpRedirectError";
+  }
+}
+
+function redirectedInit(init: RequestInit, status: number): RequestInit {
+  const method = (init.method ?? "GET").toUpperCase();
+  const becomesGet =
+    (status === 303 && method !== "GET" && method !== "HEAD") ||
+    ((status === 301 || status === 302) && method === "POST");
+  if (!becomesGet) return init;
+  const headers = new Headers(init.headers);
+  for (const name of BODY_HEADERS) headers.delete(name);
+  return { ...init, method: "GET", body: undefined, headers };
+}
+
+/**
+ * Wrap fetch with explicit, bounded redirect handling.
+ *
+ * The starting URL of each fetch call is trusted by its caller (the configured
+ * MCP endpoint, or an OAuth URL discovered by the pinned SDK). Only Location
+ * values are policy-controlled here. No rejected target is ever fetched, so
+ * arbitrary static header names receive the same protection as Authorization.
+ */
+export function redirectSafeFetch(
+  connectorId: string,
+  policy: RemoteMcpRedirectPolicy = "none",
+  baseFetch: FetchLike = fetch,
+): FetchLike {
+  return async (input, initialInit = {}) => {
+    let current = new URL(input);
+    let init = initialInit;
+    const seen = new Set<string>([current.href]);
+    let hops = 0;
+
+    while (true) {
+      const response = await baseFetch(current, {
+        ...init,
+        redirect: "manual",
+      });
+      if (!REDIRECT_STATUSES.has(response.status)) return response;
+
+      const location = response.headers.get("location");
+      await response.body?.cancel().catch(() => {});
+      if (!location) {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          `HTTP ${response.status} carried no Location header`,
+        );
+      }
+      if (policy === "none") {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          `HTTP ${response.status} redirects are disabled`,
+        );
+      }
+      if (hops >= MAX_REMOTE_REDIRECT_HOPS) {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          `the redirect chain exceeded ${MAX_REMOTE_REDIRECT_HOPS} hops`,
+        );
+      }
+
+      let next: URL;
+      try {
+        next = new URL(location, current);
+      } catch {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          `HTTP ${response.status} carried an invalid Location header`,
+        );
+      }
+      if (current.protocol === "https:" && next.protocol !== "https:") {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          "an HTTPS-to-HTTP downgrade is not allowed",
+        );
+      }
+      if (next.origin !== current.origin) {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          "a cross-origin redirect is not allowed",
+        );
+      }
+      if (next.username || next.password) {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          "a redirect target containing URL credentials is not allowed",
+        );
+      }
+      if (seen.has(next.href)) {
+        throw new RemoteMcpRedirectError(
+          connectorId,
+          "the redirect chain loops",
+        );
+      }
+
+      seen.add(next.href);
+      hops++;
+      init = redirectedInit(init, response.status);
+      current = next;
+    }
+  };
+}
+
 interface ConnectionState {
   client: Client | null;
   transport: Transport | null;
@@ -324,30 +458,27 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
     return state.provider;
   };
 
-  // NOTE: StreamableHTTPClientTransport speaks over fetch, which transparently
-  // follows 3xx redirects. A malicious or compromised downstream MCP could
-  // redirect to an internal address (e.g. http://169.254.169.254/…) and fetch
-  // would re-issue the request — potentially carrying static auth headers. The
-  // scheme check above only guards the first hop; a fully robust guard (manual
-  // redirect handling + per-hop re-validation + stripping auth headers cross-
-  // origin) lives in the SDK transport and is deferred to a future non-patch
-  // release rather than reimplemented here.
   const buildTransport = (
     ctx: ConnectorContext,
     state: ConnectionState,
   ): Transport => {
     if (opts._transportFactory) return opts._transportFactory(ctx);
     const url = new URL(opts.url);
+    const guardedFetch = redirectSafeFetch(id, opts.redirects);
     if (opts.auth?.type === "oauth") {
       return new StreamableHTTPClientTransport(url, {
         authProvider: getProvider(ctx, state),
+        fetch: guardedFetch,
       });
     }
     const headers =
       opts.auth?.type === "headers" ? opts.auth.headers : undefined;
     return new StreamableHTTPClientTransport(
       url,
-      headers ? { requestInit: { headers } } : undefined,
+      {
+        ...(headers ? { requestInit: { headers } } : {}),
+        fetch: guardedFetch,
+      },
     );
   };
 

package/src/execute.ts

@@ -3,6 +3,9 @@ import { z } from "zod";
 import { compactSchema, rankTools, summarizeDescription } from "./catalog.js";
 import { recordToolActivity, type ActivityRequestContext } from "./activity.js";
 import {
+  assertDiscoveryResultSize,
+  discoveryAddresses,
+  discoverySearchLimit,
   errorResult,
   jsonResult,
   serializeResultText,
@@ -369,7 +372,7 @@ export async function buildSandboxProviders(
         }
         matches.sort((a, b) => b.score - a.score || a.order - b.order);
         const offset = Math.max(0, Math.trunc(args.offset ?? 0));
-        const limit = Math.max(1, Math.trunc(args.limit ?? 25));
+        const limit = discoverySearchLimit(args.limit);
         const page = matches.slice(offset, offset + limit).map((match) => {
           const input = match.tool.inputSchema ?? { type: "object" };
           return {
@@ -404,7 +407,7 @@ export async function buildSandboxProviders(
           offset + page.length < matches.length
             ? offset + page.length
             : undefined;
-        return {
+        const result = {
           tools: page,
           total: matches.length,
           offset,
@@ -412,6 +415,11 @@ export async function buildSandboxProviders(
           hasMore: nextOffset !== undefined,
           ...(nextOffset !== undefined ? { nextOffset } : {}),
         };
+        assertDiscoveryResultSize(
+          result,
+          "Request a smaller limit, omit fullDescriptions, or use compact schemas.",
+        );
+        return result;
       },
       describe: async (raw: unknown) => {
         const args = (raw ?? {}) as {
@@ -419,12 +427,10 @@ export async function buildSandboxProviders(
           format?: "compact" | "json";
           fullDescriptions?: boolean;
         };
-        if (!Array.isArray(args.addresses)) {
-          throw new Error("addresses must be an array");
-        }
+        const addresses = discoveryAddresses(args.addresses);
         const format = args.format ?? "compact";
-        return {
-          tools: args.addresses.map((rawAddress) => {
+        const result = {
+          tools: addresses.map((rawAddress) => {
             const address = String(rawAddress);
             const resolved = registry.resolveAddress(address);
             if (!resolved) {
@@ -457,6 +463,11 @@ export async function buildSandboxProviders(
             };
           }),
         };
+        assertDiscoveryResultSize(
+          result,
+          'Split the address list or use format: "compact".',
+        );
+        return result;
       },
     },
   });

package/src/index.ts

@@ -574,7 +574,11 @@ export type {
   CredentialHealthRecord,
 } from "./credential-health.js";
 
-export type { RemoteMcpOptions, RemoteMcpAuth } from "./connectors/remote-mcp.js";
+export type {
+  RemoteMcpOptions,
+  RemoteMcpAuth,
+  RemoteMcpRedirectPolicy,
+} from "./connectors/remote-mcp.js";
 export type { ApiOptions, ApiTool } from "./connectors/api.js";
 export type {
   Connector,

package/src/meta-tools.ts

@@ -65,12 +65,126 @@ function msg(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
 }
 
-const DEFAULT_SEARCH_LIMIT = 25;
+export const DEFAULT_SEARCH_LIMIT = 25;
+/**
+ * A discovery page is for choosing the next tool, not exporting the catalog.
+ * One hundred leaves room for broad browsing while keeping each deliberate
+ * page far below the catalog sizes Connecta supports.
+ */
+export const MAX_SEARCH_LIMIT = 100;
+/** Same one-request work bound for address-based discovery. */
+export const MAX_DESCRIBE_ADDRESSES = 100;
+/**
+ * Final UTF-8 ceiling for a generated search/describe response. The count
+ * limits are the ordinary guard; this catches unusually large full schemas or
+ * descriptions that make even a bounded page expensive.
+ */
+export const MAX_DISCOVERY_RESULT_BYTES = 256_000;
 const enc = new TextEncoder();
 const dec = new TextDecoder();
 
 type ErrorDetails = CallErrorDetails;
 
+export class DiscoveryPolicyError extends Error {
+  constructor(
+    readonly code: "invalid_args" | "result_too_large",
+    message: string,
+  ) {
+    super(message);
+    this.name = "DiscoveryPolicyError";
+  }
+}
+
+/** Validate before ranking so a huge page request does no proportional work. */
+export function discoverySearchLimit(value: unknown): number {
+  if (value === undefined) return DEFAULT_SEARCH_LIMIT;
+  if (
+    typeof value !== "number" ||
+    !Number.isInteger(value) ||
+    value < 1 ||
+    value > MAX_SEARCH_LIMIT
+  ) {
+    throw new DiscoveryPolicyError(
+      "invalid_args",
+      `limit must be a whole number from 1 through ${MAX_SEARCH_LIMIT}. Page through larger catalogs with offset.`,
+    );
+  }
+  return value;
+}
+
+/** Validate the raw list so duplicate addresses consume the same bound. */
+export function discoveryAddresses(value: unknown): unknown[] {
+  if (!Array.isArray(value)) {
+    throw new DiscoveryPolicyError(
+      "invalid_args",
+      "addresses must be an array.",
+    );
+  }
+  if (value.length > MAX_DESCRIBE_ADDRESSES) {
+    throw new DiscoveryPolicyError(
+      "invalid_args",
+      `addresses must contain at most ${MAX_DESCRIBE_ADDRESSES} entries. Split a larger list across describe_tools calls.`,
+    );
+  }
+  return value;
+}
+
+/** Serialize once and count the exact bytes jsonResult would emit. */
+function boundedDiscoveryText(
+  value: unknown,
+  hint: string,
+): string {
+  const text = JSON.stringify(value, null, 2);
+  if (text === undefined) {
+    throw new TypeError("Discovery result is not JSON-serializable.");
+  }
+  const bytes = enc.encode(text).length;
+  if (bytes > MAX_DISCOVERY_RESULT_BYTES) {
+    throw new DiscoveryPolicyError(
+      "result_too_large",
+      `Discovery result is ${bytes} UTF-8 bytes, over the ${MAX_DISCOVERY_RESULT_BYTES}-byte ceiling. ${hint}`,
+    );
+  }
+  return text;
+}
+
+/** Apply the same final result guard to code-mode discovery helpers. */
+export function assertDiscoveryResultSize(
+  value: unknown,
+  hint: string,
+): void {
+  boundedDiscoveryText(value, hint);
+}
+
+function discoveryErrorResult(error: DiscoveryPolicyError): ToolResult {
+  const result = jsonResult({
+    error: {
+      code: error.code,
+      message: error.message,
+      retryable: false,
+    },
+  });
+  result.isError = true;
+  return result;
+}
+
+function discoveryResult(value: unknown, hint: string): ToolResult {
+  try {
+    const text = boundedDiscoveryText(value, hint);
+    return {
+      content: [{ type: "text", text }],
+      ...(value !== null && typeof value === "object" && !Array.isArray(value)
+        ? { structuredContent: value as Record<string, unknown> }
+        : {}),
+    };
+  } catch (err) {
+    if (err instanceof DiscoveryPolicyError) {
+      return discoveryErrorResult(err);
+    }
+    throw err;
+  }
+}
+
 /**
  * The longest the engine will park a synchronous inbound request in *waiting
  * alone*. The engine already treats ~15 s as the outer bound of one reasonable
@@ -939,7 +1053,15 @@ export function createMetaTools(
 
     async searchTools(args: SearchArgs): Promise<ToolResult> {
       const q = args.query ?? "";
-      const limit = Math.max(1, Math.trunc(args.limit ?? DEFAULT_SEARCH_LIMIT));
+      let limit: number;
+      try {
+        limit = discoverySearchLimit(args.limit);
+      } catch (err) {
+        if (err instanceof DiscoveryPolicyError) {
+          return discoveryErrorResult(err);
+        }
+        throw err;
+      }
       const offset = Math.max(0, Math.trunc(args.offset ?? 0));
       const conns = args.connector
         ? [registry.getConnector(args.connector)].filter(
@@ -1050,17 +1172,28 @@ export function createMetaTools(
         offset + page.length < matches.length
           ? offset + page.length
           : undefined;
-      return jsonResult({
-        connectors: groups,
-        total: matches.length,
-        offset,
-        limit,
-        hasMore: nextOffset !== undefined,
-        ...(nextOffset !== undefined ? { nextOffset } : {}),
-      });
+      return discoveryResult(
+        {
+          connectors: groups,
+          total: matches.length,
+          offset,
+          limit,
+          hasMore: nextOffset !== undefined,
+          ...(nextOffset !== undefined ? { nextOffset } : {}),
+        },
+        "Request a smaller limit, omit fullDescriptions, or use compact schemas.",
+      );
     },
 
     async describeTools(args: DescribeArgs): Promise<ToolResult> {
+      try {
+        discoveryAddresses(args.addresses);
+      } catch (err) {
+        if (err instanceof DiscoveryPolicyError) {
+          return discoveryErrorResult(err);
+        }
+        throw err;
+      }
       const format = args.format ?? "compact";
       const resolved = args.addresses.map((address) => ({
         address,
@@ -1131,7 +1264,10 @@ export function createMetaTools(
           ...(tool.annotations ? { annotations: tool.annotations } : {}),
         };
       });
-      return jsonResult({ tools: out });
+      return discoveryResult(
+        { tools: out },
+        'Split the address list or use format: "compact".',
+      );
     },
 
     async callTool(args: CallArgs): Promise<ToolResult> {
@@ -1327,10 +1463,8 @@ export function createMetaTools(
 
 const LIST_DESC =
   "List connectors with status, cached tool count, and recent real-call health. Use probe=false for a fast inventory; use probe=true (default) only to diagnose live health or authorization.";
-const SEARCH_DESC =
-  'Start here when a tool address is unknown. Exact/name matches rank above description matches; an empty query browses all. includeSchemas="compact" usually removes the describe_tools round trip.';
-const DESCRIBE_DESC =
-  'Inspect known tool addresses when search_tools did not include a sufficient schema. Returns descriptions, input/output schemas, and behavior annotations; format "compact" is the default.';
+const SEARCH_DESC = `Start here when a tool address is unknown. Exact/name matches rank above description matches; an empty query browses all. Pages contain at most ${MAX_SEARCH_LIMIT} tools. includeSchemas="compact" usually removes the describe_tools round trip.`;
+const DESCRIBE_DESC = `Inspect up to ${MAX_DESCRIBE_ADDRESSES} known tool addresses when search_tools did not include a sufficient schema. Returns descriptions, input/output schemas, and behavior annotations; format "compact" is the default.`;
 const CALL_DESC =
   'Use for one tool explicitly annotated readOnlyHint: true. For 2–10 independent read-only calls use batch_call; for dependent steps or data reduction use execute_code when available. Unannotated, write-capable, and destructive tools are refused and require call_destructive_tool. fields selects JSON dot-paths, resultMode "value" unwraps results, timeoutMs sets a deadline, safe maxRetries are annotation-gated, diagnostics adds timing, and large results page through get_result.';
 const CALL_DESTRUCTIVE_DESC =
@@ -1444,7 +1578,7 @@ export function registerMetaTools(
       inputSchema: {
         query: z.string().optional(),
         connector: z.string().optional(),
-        limit: z.number().int().positive().optional(),
+        limit: z.number().int().positive().max(MAX_SEARCH_LIMIT).optional(),
         offset: z.number().int().nonnegative().optional(),
         fullDescriptions: z.boolean().optional(),
         includeSchemas: z.enum(["compact", "json"]).optional(),
@@ -1459,7 +1593,7 @@ export function registerMetaTools(
     {
       description: describedFor(registry, DESCRIBE_DESC, "describe"),
       inputSchema: {
-        addresses: z.array(z.string()),
+        addresses: z.array(z.string()).max(MAX_DESCRIBE_ADDRESSES),
         format: z.enum(["compact", "json"]).optional(),
         fullDescriptions: z.boolean().optional(),
       },

package/src/server.ts

@@ -1088,7 +1088,15 @@ export function createFetchHandler(
       // Canonicalize the legacy bookmark while upgrading it so an old /ui URL
       // reaches the new Connections entry point in one permanent redirect.
       const targetPath = path === "/ui" ? "/" : url.pathname;
-      const target = new URL(`${targetPath}${url.search}`, publicUrl);
+      // Assign the path and query onto the configured URL instead of resolving
+      // attacker-controlled text against it. A pathname beginning with `//`
+      // (including a backslash form normalized by URL parsing) is an authority
+      // when passed to `new URL(value, base)` and would otherwise replace the
+      // deployment host.
+      const target = new URL(publicUrl);
+      target.pathname = targetPath;
+      target.search = url.search;
+      target.hash = "";
       return withSecurityHeaders(
         new Response(null, {
           status: 308,

package/src/version.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.7.0";
+export const CONNECTA_VERSION = "0.7.1";