actual-mcp-server 0.25.0 → 0.25.1

package/README.md

@@ -169,4 +169,4 @@ MIT, see [LICENSE](LICENSE). Built on [Actual Budget](https://actualbudget.org/)
 
 ---
 
-**Version:** 0.25.0 | **Tool Count:** 84 (verified LibreChat-compatible)
+**Version:** 0.25.1 | **Tool Count:** 84 (verified LibreChat-compatible)

package/dist/src/lib/authPosture.js

@@ -87,35 +87,54 @@ export function findWeakTokenVars(env, { oidcEnabled }) {
 }
 /** #612: the hostnames every open-mode server accepts, in the SDK's bracketed form. */
 const LOOPBACK_HOSTNAMES = ['localhost', '127.0.0.1', '[::1]'];
+/**
+ * The hostname the SDK compares for `host` (a bind address or advertised name):
+ * lowercased, IPv6 bracketed and canonical. `undefined` for an empty or wildcard
+ * value, which names no single host.
+ */
+function canonicalHostname(host) {
+    const h = host?.trim().toLowerCase();
+    if (!h || h === '0.0.0.0' || h === '::' || h === '[::]')
+        return undefined;
+    const bracketed = h.includes(':') && !h.startsWith('[') ? `[${h}]` : h;
+    // The SDK compares the URL-parsed Host, which is the canonical form
+    // ([2001:db8:0:0::5] arrives as [2001:db8::5]), so store the same form.
+    try {
+        return new URL(`http://${bracketed}`).hostname;
+    }
+    catch {
+        return bracketed;
+    }
+}
 /**
  * #612: the Host (and, in open mode, Origin) hostnames the HTTP server accepts, or
  * `null` to skip the check. DNS rebinding protection: a hostile page can rebind its
  * own name to 127.0.0.1, but cannot make the browser send a Host it does not own.
  *
- * - Open mode (no bearer token, no OIDC): the loopback names, `allowedHosts`, and the
+ * - Open mode (no bearer token, no OIDC): the loopback names, `allowedHosts`, the
  *   bind address itself when it is a concrete, non-wildcard address (an IP-literal
- *   Host cannot come out of rebinding). An IPv6 bind is added bracketed and canonical.
+ *   Host cannot come out of rebinding), and (#615) the advertised host, the address
+ *   the server prints as its own URL (MCP_BRIDGE_PUBLIC_HOST or the detected LAN
+ *   IP): an operator-controlled name or an IP literal, never one a hostile page can
+ *   make the browser send. Not on a loopback bind, which the LAN cannot reach.
+ *   IPv6 values are added bracketed and canonical.
  * - Authenticated: `null` when `allowedHosts` is empty (unchanged behaviour), else
- *   `allowedHosts` plus the loopback names.
+ *   `allowedHosts` plus the loopback names. The bind and advertised hosts are not
+ *   added: an operator list stays exact.
  *
  * Pure: `allowedHosts` is the already-validated MCP_ALLOWED_HOSTS list.
  */
-export function resolveAllowedHosts({ openMode, allowedHosts, bindHost, }) {
+export function resolveAllowedHosts({ openMode, allowedHosts, bindHost, advertisedHost, }) {
     if (!openMode && allowedHosts.length === 0)
         return null;
     const hosts = new Set([...LOOPBACK_HOSTNAMES, ...allowedHosts]);
-    if (openMode && bindHost) {
-        const h = bindHost.trim().toLowerCase();
-        if (h && h !== '0.0.0.0' && h !== '::' && h !== '[::]') {
-            const bracketed = h.includes(':') && !h.startsWith('[') ? `[${h}]` : h;
-            // The SDK compares the URL-parsed Host, which is the canonical form
-            // ([2001:db8:0:0::5] arrives as [2001:db8::5]), so store the same form.
-            let canonical = bracketed;
-            try {
-                canonical = new URL(`http://${bracketed}`).hostname;
-            }
-            catch { /* keep as typed */ }
-            hosts.add(canonical);
+    if (openMode) {
+        // A loopback bind is unreachable from the LAN, so the advertised (LAN) host is
+        // left out there: adding it would only widen which Origins may call localhost.
+        const advertised = isLoopbackHost(bindHost) ? undefined : advertisedHost;
+        for (const h of [canonicalHostname(bindHost), canonicalHostname(advertised)]) {
+            if (h)
+                hosts.add(h);
         }
     }
     return [...hosts];

package/dist/src/server/httpServer.js

@@ -94,7 +94,21 @@ advertisedUrl) {
     // #612: DNS rebinding protection, mounted first so it covers every route (/health,
     // /metrics, /.well-known/* and OPTIONS included). It reads req.headers.host only,
     // never X-Forwarded-Host or req.hostname, so a proxy header cannot bypass it.
-    const allowedHosts = resolveAllowedHosts({ openMode, allowedHosts: config.MCP_ALLOWED_HOSTS, bindHost });
+    // #615: the host this server prints as its own URL is accepted too (open mode only).
+    let advertisedHost;
+    try {
+        advertisedHost = advertisedUrl ? new URL(advertisedUrl).hostname : undefined;
+    }
+    catch {
+        logger.warn(`[HTTP] Advertised URL ${advertisedUrl} does not parse; its host is not accepted. Check MCP_BRIDGE_PUBLIC_HOST (a bare host or IP, no scheme or port).`);
+    }
+    // MCP_BRIDGE_PUBLIC_HOST=https://nas.lan parses to the hostname "https": say so rather than
+    // accept it silently. A scheme or path always carries a "/"; a port already fails the parse.
+    const publicHost = process.env.MCP_BRIDGE_PUBLIC_HOST?.trim().toLowerCase();
+    if (advertisedHost && publicHost?.includes('/')) {
+        logger.warn(`[HTTP] MCP_BRIDGE_PUBLIC_HOST (${publicHost}) did not parse to a host name (got ${advertisedHost}). Set a bare host or IP, no scheme or port.`);
+    }
+    const allowedHosts = resolveAllowedHosts({ openMode, allowedHosts: config.MCP_ALLOWED_HOSTS, bindHost, advertisedHost });
     if (allowedHosts) {
         const rejectHost = (req, reason, value) => logger.warn('[HTTP] Rejected request: hostname not allowed (DNS rebinding protection, #612)', {
             header: reason, hostname: value.slice(0, 253), path: req.path,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "mcpName": "io.github.agigante80/actual-mcp-server",
   "engines": {
     "node": ">=22.0.0",