mcp-google-multi 6.0.0-alpha.64 → 6.0.0-alpha.65

package/dist/arg-normalize.js

@@ -1,5 +1,5 @@
 import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
-import { sliceClean } from './trim.js';
+import { logSafe, sliceClean } from './trim.js';
 // The SDK synthesizes input-validation failures as isError RESULTS, skipping
 // the handler entirely: no handler of ours runs, so no envelope exists and the
 // client gets free text. The text is prose in both SDK eras (v1 prefixed it
@@ -115,8 +115,9 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     if (screened.unknown.length === 0 && screened.redundant.length === 0)
         return { action: 'forward', msg };
     const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
-    // Key names only; argument VALUES never reach the log.
-    log(`[args] ${tool}: undeclared ${echoNames(all)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    // Key names only; argument VALUES never reach the log. The names are the
+    // caller's, so they are escaped here and only here: the envelope is JSON.
+    log(`[args] ${tool}: undeclared ${logSafe(echoNames(all), 600)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
     try {
         // Only ever a DECLARED key or the literal placeholder, so the metrics
         // closed-vocabulary rule holds: the caller's key is never persisted.

package/dist/cimd-cache.d.ts

@@ -0,0 +1,38 @@
+export declare const CIMD_TTL_MS: number;
+/** The oldest validated document still served while the cap is full or the issuer cannot answer. */
+export declare const CIMD_MAX_STALE_MS: number;
+/** Fetches at once. A lookup can outlive the fetch that gave up on it, so ssrf-guard caps its own lookups apart. */
+export declare const CIMD_MAX_IN_FLIGHT = 4;
+export declare const CIMD_CACHE_MAX = 256;
+export type CimdDocument = Record<string, unknown>;
+type CimdError = {
+    error: 'E_CIMD_SSRF_BLOCKED' | 'E_CIMD_INVALID';
+};
+/** `fresh` is true only for the request whose fetch produced the document. */
+export type CimdResolution = {
+    doc: CimdDocument;
+    fresh: boolean;
+} | {
+    busy: true;
+} | CimdError;
+export interface CimdCacheDeps {
+    fetch: (clientId: string) => Promise<CimdDocument>;
+    now: () => number;
+    log: (line: string) => void;
+}
+export declare class CimdClientCache {
+    private readonly deps;
+    private readonly entries;
+    private readonly inFlight;
+    private busyLoggedAt;
+    private busySuppressed;
+    constructor(deps: CimdCacheDeps);
+    get size(): number;
+    /** `validate` runs once per fetch, in the request that started it, and every
+     * request waiting on that fetch gets the same answer. */
+    resolve(clientId: string, validate: (doc: CimdDocument) => boolean): Promise<CimdResolution>;
+    private fetchFor;
+    private store;
+    private noteBusy;
+}
+export {};

package/dist/cimd-cache.js

@@ -0,0 +1,117 @@
+// H4 F6: GET /authorize is unauthenticated, and a client_id on an allowlisted
+// issuer with a path never seen before forces an outbound fetch. So the
+// fetches running at once are capped, one client_id is fetched once however
+// many requests wait on it, and only a document that passed validation is
+// kept. Errors are never cached (CIMD section 5.2), and a negative cache would
+// not help anyway: the attack varies the path, so its key never repeats.
+import { CimdHttpError, isTransientFetchError, SsrfBlockedError } from './ssrf-guard.js';
+import { logSafe } from './trim.js';
+export const CIMD_TTL_MS = 5 * 60_000;
+/** The oldest validated document still served while the cap is full or the issuer cannot answer. */
+export const CIMD_MAX_STALE_MS = 24 * 60 * 60_000;
+/** Fetches at once. A lookup can outlive the fetch that gave up on it, so ssrf-guard caps its own lookups apart. */
+export const CIMD_MAX_IN_FLIGHT = 4;
+export const CIMD_CACHE_MAX = 256;
+const BUSY_LOG_EVERY_MS = 60_000;
+export class CimdClientCache {
+    deps;
+    entries = new Map();
+    // One entry per running fetch, so its size is the number of permits taken.
+    inFlight = new Map();
+    busyLoggedAt = -Infinity;
+    busySuppressed = 0;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    /** `validate` runs once per fetch, in the request that started it, and every
+     * request waiting on that fetch gets the same answer. */
+    async resolve(clientId, validate) {
+        const entry = this.entries.get(clientId);
+        const age = entry ? this.deps.now() - entry.at : 0;
+        if (entry && age < CIMD_TTL_MS)
+            return { doc: entry.doc, fresh: false };
+        if (entry && age >= CIMD_MAX_STALE_MS)
+            this.entries.delete(clientId);
+        const running = this.inFlight.get(clientId);
+        if (running) {
+            const out = await running;
+            return 'doc' in out ? { doc: out.doc, fresh: false } : out;
+        }
+        if (this.inFlight.size >= CIMD_MAX_IN_FLIGHT) {
+            // A flood of fresh paths is exactly when the cap is full, and a client
+            // that signed in before must still be able to.
+            const stale = this.entries.get(clientId);
+            if (stale)
+                return { doc: stale.doc, fresh: false };
+            this.noteBusy();
+            return { busy: true };
+        }
+        return this.fetchFor(clientId, validate);
+    }
+    async fetchFor(clientId, validate) {
+        // Never rejects: neither core nor a host installs an unhandledRejection
+        // handler, and a waiter that stopped listening must not take the process down.
+        let settle;
+        this.inFlight.set(clientId, new Promise((r) => (settle = r)));
+        let out = { error: 'E_CIMD_INVALID' };
+        try {
+            const doc = await this.deps.fetch(clientId);
+            if (validate(doc)) {
+                this.store(clientId, doc);
+                out = { doc, fresh: true };
+            }
+            else {
+                this.entries.delete(clientId);
+            }
+        }
+        catch (e) {
+            out = { error: e instanceof SsrfBlockedError ? 'E_CIMD_SSRF_BLOCKED' : 'E_CIMD_INVALID' };
+            // A document that went bad is never served stale. An issuer that is down
+            // or overloaded says nothing about the document, so the last good one
+            // stays and answers this fetch's requests too (stale-if-error; the error
+            // itself is never stored).
+            const stale = this.entries.get(clientId);
+            if (!saysNothingAboutDocument(e))
+                this.entries.delete(clientId);
+            else if (stale && this.deps.now() - stale.at < CIMD_MAX_STALE_MS)
+                out = { doc: stale.doc, fresh: false };
+            // #13: the detail goes to the log only; the caller gets a generic answer.
+            this.deps.log(`CIMD fetch failed for ${logSafe(clientId, 128)}: ${logSafe(e instanceof Error ? e.message : 'non-Error rejection', 200)}`);
+        }
+        finally {
+            this.inFlight.delete(clientId);
+            settle(out);
+        }
+        return out;
+    }
+    store(clientId, doc) {
+        this.entries.delete(clientId);
+        while (this.entries.size >= CIMD_CACHE_MAX) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.entries.delete(oldest);
+        }
+        this.entries.set(clientId, { doc, at: this.deps.now() });
+    }
+    // Over-cap requests arrive at whatever rate the caller likes.
+    noteBusy() {
+        const now = this.deps.now();
+        if (now - this.busyLoggedAt < BUSY_LOG_EVERY_MS) {
+            this.busySuppressed++;
+            return;
+        }
+        const suppressed = this.busySuppressed;
+        this.busyLoggedAt = now;
+        this.busySuppressed = 0;
+        this.deps.log(`CIMD busy: in-flight cap reached${suppressed > 0 ? ` (n=${suppressed} suppressed)` : ''}`);
+    }
+}
+function saysNothingAboutDocument(e) {
+    if (isTransientFetchError(e))
+        return true;
+    return e instanceof CimdHttpError && (e.status === 408 || e.status === 429 || e.status >= 500);
+}

package/dist/http-transport.d.ts

@@ -2,6 +2,7 @@ import type { McpServer, Transport } from "@modelcontextprotocol/server";
 import { type IncomingMessage, type ServerResponse } from 'node:http';
 import type { HttpConfig } from './http-config.js';
 import { type ArgShape, type StrictArgOptions, type ValidationEnvelopeOptions } from './arg-normalize.js';
+export { logSafe } from './trim.js';
 export type AuthOutcome = {
     ok: true;
     sub?: string;
@@ -73,7 +74,9 @@ export declare function parseOwnerEmails(env?: NodeJS.ProcessEnv): string[];
  * connector calls /mcp server-to-server with no Origin, BV-4). */
 export declare function originAllowed(origin: string | undefined, allowed: string[]): boolean;
 export declare function hostAllowed(host: string | undefined, allowed: string[]): boolean;
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export declare function jsonRpcMethod(body: unknown): string;
 export declare class HttpTransportHost {
     private readonly opts;

package/dist/http-transport.js

@@ -5,6 +5,9 @@ import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 // loopback-owner authenticator so the local-HTTP model works before the AS lands.
 import { createServer } from 'node:http';
 import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
+import { logSafe } from './trim.js';
+// A host wrapping the log callbacks it hands core needs this, and trim has no package export.
+export { logSafe } from './trim.js';
 // A hung handler that keeps the connection open would otherwise hold the global
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
 // Drive exports, fan-out) still finish; the point is only to guarantee release.
@@ -37,12 +40,25 @@ export function hostAllowed(host, allowed) {
     const bare = host.replace(/:\d+$/, '');
     return allowed.includes(host) || allowed.includes(bare);
 }
-/** JSON-RPC method name(s) for an observability log line — no params, no PII. */
+const METHOD_NAME = /^[A-Za-z0-9_./$-]{1,64}$/;
+const BATCH_METHODS_SHOWN = 4;
+/** JSON-RPC method name(s) for an observability log line: no params, no PII.
+ * The method is the caller's: anything not shaped like a method name, which
+ * includes a value whose String() throws, is logged as `<invalid>`. */
 export function jsonRpcMethod(body) {
-    const one = (b) => b && typeof b === 'object' && 'method' in b ? String(b.method) : undefined;
-    if (Array.isArray(body))
-        return body.map(one).filter(Boolean).join(',') || 'batch';
-    return one(body) ?? 'unknown';
+    const one = (b) => {
+        if (!b || typeof b !== 'object' || !('method' in b))
+            return undefined;
+        const m = b.method;
+        return typeof m === 'string' && METHOD_NAME.test(m) ? m : '<invalid>';
+    };
+    if (!Array.isArray(body))
+        return one(body) ?? 'unknown';
+    const names = body.map(one).filter((n) => n !== undefined);
+    if (names.length === 0)
+        return 'batch';
+    const rest = names.length - BATCH_METHODS_SHOWN;
+    return rest > 0 ? `${names.slice(0, BATCH_METHODS_SHOWN).join(',')},+${rest}` : names.join(',');
 }
 /** setTimeout fires at once for a delay above this, so a longer grace would
  * cut every connection immediately. */
@@ -160,7 +176,7 @@ export class HttpTransportHost {
                 finally {
                     // A throwing log must not reach the destroy below: the answer is sent.
                     try {
-                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? e.message : 'non-Error throw'}`);
+                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
                     }
                     catch {
                         // nowhere left to report it
@@ -292,12 +308,12 @@ export class HttpTransportHost {
     frontGuard(req, res) {
         const { allowedHosts, allowedOrigins } = this.opts.config;
         if (!hostAllowed(req.headers.host, allowedHosts)) {
-            this.log(`403 host_rejected host=${req.headers.host ?? ''}`);
+            this.log(`403 host_rejected host=${logSafe(req.headers.host ?? '', 64)}`);
             this.fail(res, 403, 'host_rejected', 'Host not allowed (DNS-rebinding guard).');
             return false;
         }
         if (!originAllowed(req.headers.origin, allowedOrigins)) {
-            this.log(`403 origin_rejected origin=${req.headers.origin ?? ''}`);
+            this.log(`403 origin_rejected origin=${logSafe(req.headers.origin ?? '', 64)}`);
             this.fail(res, 403, 'origin_rejected', 'Origin not allowed.');
             return false;
         }

package/dist/oauth-as.js

@@ -8,7 +8,9 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { isIPv4 } from 'node:net';
 import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signReauthLink, verifyReauthLink, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
-import { fetchCimdDocument, SsrfBlockedError } from './ssrf-guard.js';
+import { fetchCimdDocument } from './ssrf-guard.js';
+import { CimdClientCache } from './cimd-cache.js';
+import { logSafe } from './trim.js';
 const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 // DCR (/register) is public + unauthenticated, so its in-memory store must be
 // bounded like every sibling store (the ReplayGuard cap) or a request loop
@@ -61,6 +63,10 @@ class SubjectCheckUnavailable extends Error {
 function subjectUnavailable(res) {
     return json(res, 503, { error: 'temporarily_unavailable', message: 'the sign-in could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
 }
+// Not invalid_client: clients and people read that as a permanent misconfiguration.
+function clientUnavailable(res) {
+    return json(res, 503, { error: 'temporarily_unavailable', message: 'the client could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
+}
 function redirect(res, location, extraHeaders = {}) {
     res.writeHead(302, { Location: location, ...extraHeaders });
     res.end();
@@ -210,8 +216,7 @@ export function buildAuthServer(config, deps = {}) {
         authorization_response_iss_parameter_supported: true,
         scopes_supported: ['mcp:use'],
     };
-    const cimdCache = new Map();
-    const CIMD_CACHE_TTL_MS = 5 * 60_000;
+    const cimdClients = new CimdClientCache({ fetch: cimd, now, log });
     async function validateClient(clientId) {
         const reg = registered.get(clientId);
         if (reg)
@@ -229,40 +234,27 @@ export function buildAuthServer(config, deps = {}) {
             return { error: 'E_CIMD_INVALID', message: 'invalid client' };
         }
         if (scheme !== 'https:' || !config.cimdIssuers.includes(issuerHost)) {
-            log(`CIMD rejected: client_id ${clientId} issuer not allowlisted`);
+            // The issuer and a length, never the path: an attacker picks the path freely.
+            log(`CIMD rejected: issuer=${logSafe(`${scheme}//${issuerHost}`, 80)} not allowlisted client_id_len=${clientId.length}`);
             return { error: 'E_CIMD_INVALID', message: 'invalid client' };
         }
-        let doc;
-        const cached = cimdCache.get(clientId);
-        if (cached && cached.exp > now()) {
-            doc = cached.doc;
-        }
-        else {
-            try {
-                doc = await cimd(clientId);
-            }
-            catch (e) {
-                // #13: never echo internal fetch details to the caller (blind-SSRF
-                // oracle); log server-side, return a generic message.
-                log(`CIMD fetch failed for ${clientId}: ${e.message}`);
-                const slug = e instanceof SsrfBlockedError ? 'E_CIMD_SSRF_BLOCKED' : 'E_CIMD_INVALID';
-                return { error: slug, message: 'invalid client' };
-            }
-            cimdCache.set(clientId, { doc, exp: now() + CIMD_CACHE_TTL_MS }); // #15
-        }
-        if (doc.client_id !== clientId)
-            return { error: 'E_CIMD_INVALID', message: 'invalid client' };
-        const uris = Array.isArray(doc.redirect_uris) ? doc.redirect_uris : [];
-        if (uris.length === 0)
-            return { error: 'E_CIMD_INVALID', message: 'invalid client' };
-        // C6 #14: warn on a localhost-only redirect set (loopback impersonation).
-        if (uris.every((u) => { try {
+        // #15: cached only once it validates; the cache logs a failed fetch.
+        const got = await cimdClients.resolve(clientId, (doc) => doc.client_id === clientId && Array.isArray(doc.redirect_uris) && doc.redirect_uris.length > 0);
+        if ('busy' in got)
+            return got;
+        // #13: never echo internal fetch details to the caller (blind-SSRF oracle).
+        if ('error' in got)
+            return { error: got.error, message: 'invalid client' };
+        const uris = got.doc.redirect_uris;
+        // C6 #14: warn on a localhost-only redirect set (loopback impersonation),
+        // once per fetch rather than on every sign-in the cache serves.
+        if (got.fresh && uris.every((u) => { try {
             return isLoopbackHostname(new URL(u).hostname);
         }
         catch {
             return false;
         } })) {
-            log(`client ${clientId} advertises only loopback redirect_uris`);
+            log(`client ${logSafe(clientId, 128)} advertises only loopback redirect_uris`);
         }
         return { redirect_uris: uris, dcr: false };
     }
@@ -366,6 +358,8 @@ export function buildAuthServer(config, deps = {}) {
         if (!clientId)
             return json(res, 400, { error: 'invalid_request', message: 'client_id required', iss: base }, issHeader);
         const client = await validateClient(clientId);
+        if ('busy' in client)
+            return clientUnavailable(res);
         if ('error' in client)
             return json(res, 400, { error: 'invalid_client', message: client.message, iss: base }, issHeader);
         // (2) exact redirect_uri match BEFORE minting anything (open-redirect defense)
@@ -446,7 +440,7 @@ export function buildAuthServer(config, deps = {}) {
         catch (e) {
             // The detail can name proxies and hosts; it goes to the log, not the browser.
             const detail = e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection';
-            log(`callback exchange failed flow=${st.flow}: ${detail.replace(/[\r\n]+/g, ' ')}`);
+            log(`callback exchange failed flow=${st.flow}: ${logSafe(detail, 300)}`);
             return errorPage(res, 400, 'invalid_grant', 'Google could not complete the sign-in; start again from your app');
         }
         if (st.flow === 'alias_add') {
@@ -464,17 +458,17 @@ export function buildAuthServer(config, deps = {}) {
             }
             catch (e) {
                 // Any rejection reason, even none, must still reach this answer.
-                log(`alias_add bind failed for "${st.alias}": ${e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection'}`);
+                log(`alias_add bind failed for "${logSafe(st.alias, 64)}": ${logSafe(e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection', 200)}`);
                 return errorPage(res, 500, 'E_ALIAS_ADD_FAILED', 'the account could not be saved; try the link again or ask for a fresh one');
             }
             if (refusal) {
                 // The slug lands in a text/plain body; keep it a bare identifier.
                 const slug = typeof refusal.slug === 'string' && /^[A-Za-z0-9_]+$/.test(refusal.slug) ? refusal.slug : 'access_denied';
                 const message = typeof refusal.message === 'string' && refusal.message ? refusal.message : 'the account could not be linked';
-                log(`alias_add refused for "${st.alias}": ${slug}`);
+                log(`alias_add refused for "${logSafe(st.alias, 64)}": ${logSafe(slug, 64)}`);
                 return errorPage(res, 403, slug, message);
             }
-            log(`callback ok flow=alias_add alias=${st.alias}`);
+            log(`callback ok flow=alias_add alias=${logSafe(st.alias, 64)}`);
             res.writeHead(200, { 'Content-Type': 'text/html' });
             res.end(`<!doctype html><meta charset=utf-8><p>Connected "${escapeHtml(st.alias)}". You can close this window and retry your request.</p>`);
             return true;
@@ -490,7 +484,7 @@ export function buildAuthServer(config, deps = {}) {
             const gotEmail = (exchanged.email ?? '').toLowerCase();
             const expected = (deps.aliasEmail?.(st.alias) ?? '').toLowerCase();
             if (!expected || !gotEmail || gotEmail !== expected) {
-                log(`alias_reauth identity mismatch for "${st.alias}" (got ${gotEmail || 'none'})`);
+                log(`alias_reauth identity mismatch for "${logSafe(st.alias, 64)}" (got ${logSafe(gotEmail || 'none', 254)})`);
                 return errorPage(res, 403, 'access_denied', 'the Google account you signed in with is not the one configured for this alias');
             }
             // A completion without a refresh token (a Google URL built without
@@ -498,7 +492,7 @@ export function buildAuthServer(config, deps = {}) {
             // dies within the hour. Keep the stored token instead.
             const refreshToken = exchanged.tokens.refresh_token;
             if (typeof refreshToken !== 'string' || refreshToken === '') {
-                log(`alias_reauth for "${st.alias}" returned no refresh token; stored token kept`);
+                log(`alias_reauth for "${logSafe(st.alias, 64)}" returned no refresh token; stored token kept`);
                 return errorPage(res, 400, 'E_REAUTH_INCOMPLETE', 'Google did not return a long-lived token, so the stored one was kept. Open the re-auth link again and approve access.');
             }
             const granted = typeof exchanged.tokens.scope === 'string' ? exchanged.tokens.scope : undefined;
@@ -508,13 +502,13 @@ export function buildAuthServer(config, deps = {}) {
             // for an hour and the Google URL's scope is not signed, so a narrower
             // grant is not necessarily the account holder's choice.
             if (missing.length > 0 && deps.hasToken?.(st.alias)) {
-                log(`alias_reauth for "${st.alias}" granted ${missing.length} fewer scope(s); stored token kept`);
+                log(`alias_reauth for "${logSafe(st.alias, 64)}" granted ${missing.length} fewer scope(s); stored token kept`);
                 res.writeHead(400, { 'Content-Type': 'text/html' });
                 res.end(`<!doctype html><meta charset=utf-8><p>E_SCOPE_NOT_GRANTED: Google did not grant ${missing.length} requested scope(s): ${listed}, so the stored access for "${escapeHtml(st.alias)}" was kept. Ask for a fresh re-auth link and leave every box ticked.</p>`);
                 return true;
             }
             deps.writeToken?.(st.alias, exchanged.tokens);
-            log(`callback ok flow=alias_reauth alias=${st.alias}`);
+            log(`callback ok flow=alias_reauth alias=${logSafe(st.alias, 64)}`);
             // With no stored token a partial grant still beats none; say what is missing.
             const gap = missing.length
                 ? `<p>Google did not grant ${missing.length} requested scope(s): ${listed}. Ask for a fresh re-auth link and leave every box ticked to restore them.</p>`
@@ -577,7 +571,7 @@ export function buildAuthServer(config, deps = {}) {
                     active = deps.subjectActive(code.sub);
                 }
                 catch (e) {
-                    log(`token deferred grant=authorization_code: subject check failed: ${e instanceof Error ? e.message : 'non-Error throw'}`);
+                    log(`token deferred grant=authorization_code: subject check failed: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
                     return subjectUnavailable(res);
                 }
                 if (!active) {
@@ -612,7 +606,7 @@ export function buildAuthServer(config, deps = {}) {
             catch (e) {
                 if (!(e instanceof SubjectCheckUnavailable))
                     throw e;
-                log(`token deferred grant=refresh_token: subject check failed: ${e.cause instanceof Error ? e.cause.message : 'non-Error throw'}`);
+                log(`token deferred grant=refresh_token: subject check failed: ${e.cause instanceof Error ? logSafe(e.cause.message, 200) : 'non-Error throw'}`);
                 return subjectUnavailable(res);
             }
             if (!next)
@@ -633,9 +627,18 @@ export function buildAuthServer(config, deps = {}) {
         catch {
             return json(res, 400, { error: 'invalid_client_metadata', message: 'a JSON body with redirect_uris is required' });
         }
-        const redirectUris = Array.isArray(parsed.redirect_uris) ? parsed.redirect_uris.map(String) : [];
+        // Shape first: a throw here is an unauthenticated 500 per request, and a
+        // `null` body has no properties while String() throws on {"toString":1}.
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return json(res, 400, { error: 'invalid_client_metadata', message: 'a JSON body with redirect_uris is required' });
+        }
+        const raw = parsed.redirect_uris;
+        const redirectUris = Array.isArray(raw) ? raw : [];
         if (redirectUris.length === 0)
             return json(res, 400, { error: 'invalid_client_metadata', message: 'redirect_uris required' });
+        if (!redirectUris.every((u) => typeof u === 'string')) {
+            return json(res, 400, { error: 'invalid_client_metadata', message: 'every redirect_uri must be a string' });
+        }
         if (redirectUris.length > DCR_MAX_REDIRECT_URIS || redirectUris.some((u) => u.length > DCR_MAX_URI_LEN)) {
             return json(res, 400, { error: 'invalid_client_metadata', message: 'too many or oversized redirect_uris' });
         }

package/dist/ssrf-guard.d.ts

@@ -1,6 +1,12 @@
 export declare class SsrfBlockedError extends Error {
     constructor(message: string);
 }
+/** A non-2xx answer, kept apart so the cache can tell an issuer that is
+ * overloaded for now from one that says the document is gone. */
+export declare class CimdHttpError extends SsrfBlockedError {
+    readonly status: number;
+    constructor(status: number);
+}
 /** True if an IPv4 literal is in a blocked (private/link-local/loopback/etc) range. */
 export declare function isBlockedIPv4(ip: string): boolean;
 /** True if an IPv6 literal is blocked. */
@@ -10,28 +16,35 @@ export interface SsrfDeps {
     /** Injectable resolver (defaults to dns.lookup all-addresses) for tests. */
     resolveAll?: (host: string) => Promise<string[]>;
 }
+/** The most lookups started here that may be unsettled at once, abandoned ones included; process-wide, as the libuv threadpool is. */
+export declare const MAX_UNSETTLED_LOOKUPS = 4;
 /**
  * Assert a URL is safe to fetch server-side: HTTPS scheme, and every address
- * the host resolves to is public. Throws SsrfBlockedError otherwise, and
- * returns the resolved IPs.
+ * the host resolves to is public. Throws SsrfBlockedError otherwise, except
+ * that a resolver error with a transient code (a lookup that could not answer
+ * this time) is rethrown as is. Returns the resolved IPs.
  *
  * NOTE: this checks the host's addresses but does NOT pin them — the caller
  * fetches by hostname, so undici re-resolves at connect time (a check-time vs
  * connect-time TOCTOU / short-TTL rebind window). We deliberately do not pin
  * (CDN IPs rotate). The real anti-SSRF control is the caller-side issuer
  * allowlist (oauth-as validateClient rejects any non-allowlisted host BEFORE
- * fetching), so an attacker can't steer the fetch at an arbitrary hostname;
- * this public-range check is defense-in-depth on top of that.
+ * fetching, and fetchCimdDocument follows no redirect, so no hop leaves it),
+ * so an attacker can't steer the fetch at an arbitrary hostname; this
+ * public-range check is defense-in-depth on top of that.
  */
 export declare function assertPublicHttpsUrl(rawUrl: string, deps?: SsrfDeps): Promise<{
     url: URL;
     addresses: string[];
 }>;
 export interface CimdFetchOptions {
+    /** Default 5120: CIMD section 8.7 recommends at most 5 KB. */
     maxBytes?: number;
+    /** One attempt's cap, never past what is left of deadlineMs (default 5000). */
     timeoutMs?: number;
-    maxRedirects?: number;
-    /** Transient-network-error retries per hop (default 2 → up to 3 attempts). */
+    /** One budget for every attempt, DNS lookups and backoff included (default 8000). */
+    deadlineMs?: number;
+    /** Transient-network-error retries (default 1, so at most 2 attempts). */
     retries?: number;
     /** Base backoff between retries in ms; grows linearly per attempt (default 200). */
     retryBackoffMs?: number;
@@ -40,9 +53,10 @@ export interface CimdFetchOptions {
     sleepImpl?: (ms: number) => Promise<void>;
     ssrf?: SsrfDeps;
 }
+export declare function isTransientFetchError(e: unknown): boolean;
 /**
- * SSRF-guarded fetch of a CIMD client-metadata document (JSON). Every hop
- * (including redirects) is HTTPS + public-IP checked; response is size- and
- * time-capped. Returns the parsed JSON object.
+ * SSRF-guarded fetch of a CIMD client-metadata document (JSON): HTTPS and
+ * public-IP checked, no redirect followed, size-capped, and every attempt
+ * inside one deadline. Returns the parsed JSON object.
  */
 export declare function fetchCimdDocument(rawUrl: string, opts?: CimdFetchOptions): Promise<Record<string, unknown>>;

package/dist/ssrf-guard.js

@@ -1,8 +1,9 @@
 // B13 / C11: SSRF guard for every server-side fetch (the CIMD client_id doc).
 // D4 decision (dependencies-and-bv §2.2): a small AUDITED private-range check,
 // no dependency — HTTPS-only, resolve-then-check ALL addresses (anti-rebind),
-// and cap redirects / size / time. Blocks 10/8, 172.16/12, 192.168/16, 127/8,
-// 169.254/16, 0/8, multicast, ::1, fc00::/7, fe80::/10, and v4-mapped forms.
+// no redirects followed, and capped size and time. Blocks 10/8, 172.16/12,
+// 192.168/16, 127/8, 169.254/16, 0/8, multicast, ::1, fc00::/7, fe80::/10, and
+// v4-mapped forms.
 import { lookup } from 'node:dns/promises';
 import { isIPv4, isIPv6, BlockList } from 'node:net';
 export class SsrfBlockedError extends Error {
@@ -11,6 +12,16 @@ export class SsrfBlockedError extends Error {
         this.name = 'SsrfBlockedError';
     }
 }
+/** A non-2xx answer, kept apart so the cache can tell an issuer that is
+ * overloaded for now from one that says the document is gone. */
+export class CimdHttpError extends SsrfBlockedError {
+    status;
+    constructor(status) {
+        super(`CIMD fetch failed: HTTP ${status}`);
+        this.name = 'CimdHttpError';
+        this.status = status;
+    }
+}
 /** True if an IPv4 literal is in a blocked (private/link-local/loopback/etc) range. */
 export function isBlockedIPv4(ip) {
     const parts = ip.split('.').map(Number);
@@ -61,25 +72,45 @@ export function isBlockedIp(ip) {
         return isBlockedIPv6(ip);
     return true; // unparseable → block
 }
+/** The most lookups started here that may be unsettled at once, abandoned ones included; process-wide, as the libuv threadpool is. */
+export const MAX_UNSETTLED_LOOKUPS = 4;
+let unsettledLookups = 0;
+/** The lookup cap refused to start one: transient for the cache, but never retried, since the hung lookups it waits on outlast any backoff. */
+class LookupBusyError extends Error {
+    code = 'EAI_AGAIN';
+}
 async function defaultResolveAll(host) {
     // A bare IP literal needs no DNS; check it directly.
     if (isIPv4(host) || isIPv6(host))
         return [host];
-    const results = await lookup(host, { all: true });
-    return results.map((r) => r.address);
+    // getaddrinfo keeps its thread until it returns, even once no attempt waits
+    // on it, so a new lookup past the cap would only queue behind the hung ones.
+    if (unsettledLookups >= MAX_UNSETTLED_LOOKUPS) {
+        throw new LookupBusyError(`DNS lookup for ${host} not started: ${MAX_UNSETTLED_LOOKUPS} earlier lookups have not returned`);
+    }
+    unsettledLookups++;
+    try {
+        const results = await lookup(host, { all: true });
+        return results.map((r) => r.address);
+    }
+    finally {
+        unsettledLookups--;
+    }
 }
 /**
  * Assert a URL is safe to fetch server-side: HTTPS scheme, and every address
- * the host resolves to is public. Throws SsrfBlockedError otherwise, and
- * returns the resolved IPs.
+ * the host resolves to is public. Throws SsrfBlockedError otherwise, except
+ * that a resolver error with a transient code (a lookup that could not answer
+ * this time) is rethrown as is. Returns the resolved IPs.
  *
  * NOTE: this checks the host's addresses but does NOT pin them — the caller
  * fetches by hostname, so undici re-resolves at connect time (a check-time vs
  * connect-time TOCTOU / short-TTL rebind window). We deliberately do not pin
  * (CDN IPs rotate). The real anti-SSRF control is the caller-side issuer
  * allowlist (oauth-as validateClient rejects any non-allowlisted host BEFORE
- * fetching), so an attacker can't steer the fetch at an arbitrary hostname;
- * this public-range check is defense-in-depth on top of that.
+ * fetching, and fetchCimdDocument follows no redirect, so no hop leaves it),
+ * so an attacker can't steer the fetch at an arbitrary hostname; this
+ * public-range check is defense-in-depth on top of that.
  */
 export async function assertPublicHttpsUrl(rawUrl, deps = {}) {
     let url;
@@ -98,6 +129,11 @@ export async function assertPublicHttpsUrl(rawUrl, deps = {}) {
         addresses = await resolveAll(url.hostname);
     }
     catch (e) {
+        // A resolver that could not answer this time says nothing about the host,
+        // so the fetch may retry it; a name that does not exist stays a block.
+        const code = e?.code;
+        if (typeof code === 'string' && TRANSIENT_CODES.has(code))
+            throw e;
         throw new SsrfBlockedError(`DNS resolution failed for ${url.hostname}: ${e.message}`);
     }
     if (addresses.length === 0)
@@ -124,7 +160,7 @@ const TRANSIENT_CODES = new Set([
     'UND_ERR_CONNECT_TIMEOUT',
     'UND_ERR_SOCKET',
 ]);
-function isTransientFetchError(e) {
+export function isTransientFetchError(e) {
     if (e instanceof SsrfBlockedError)
         return false; // deterministic security/shape reject
     const name = e?.name;
@@ -140,73 +176,76 @@ function isTransientFetchError(e) {
         return true;
     return false;
 }
+// dns.lookup cannot be cancelled, so an attempt stops waiting on it instead.
+function untilAborted(work, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        void work.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
 /**
- * SSRF-guarded fetch of a CIMD client-metadata document (JSON). Every hop
- * (including redirects) is HTTPS + public-IP checked; response is size- and
- * time-capped. Returns the parsed JSON object.
+ * SSRF-guarded fetch of a CIMD client-metadata document (JSON): HTTPS and
+ * public-IP checked, no redirect followed, size-capped, and every attempt
+ * inside one deadline. Returns the parsed JSON object.
  */
 export async function fetchCimdDocument(rawUrl, opts = {}) {
-    const maxBytes = opts.maxBytes ?? 64 * 1024;
+    const maxBytes = opts.maxBytes ?? 5120;
     const timeoutMs = opts.timeoutMs ?? 5000;
-    const maxRedirects = opts.maxRedirects ?? 3;
-    const retries = opts.retries ?? 2;
+    const deadline = Date.now() + (opts.deadlineMs ?? 8000);
+    const retries = opts.retries ?? 1;
     const backoffMs = opts.retryBackoffMs ?? 200;
     const doFetch = opts.fetchImpl ?? fetch;
     const sleep = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    let current = rawUrl;
-    for (let hop = 0; hop <= maxRedirects; hop++) {
-        let redirectTo = null;
-        let doc = null;
-        // Retry transient connection failures IN PLACE. Each attempt re-runs the
-        // resolve-then-check so a retry can never skip the anti-rebind guard, and
-        // the timer is per-attempt (armed across the body read, #10).
-        for (let attempt = 0;; attempt++) {
-            await assertPublicHttpsUrl(current, opts.ssrf);
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), timeoutMs);
+    // Retry fast transient failures IN PLACE. Each attempt re-runs the
+    // resolve-then-check so a retry can never skip the anti-rebind guard, and
+    // the timer is per-attempt (armed across the lookup and the body read, #10).
+    for (let attempt = 0;; attempt++) {
+        const controller = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, Math.max(0, Math.min(timeoutMs, deadline - Date.now())));
+        try {
+            await untilAborted(assertPublicHttpsUrl(rawUrl, opts.ssrf), controller.signal);
+            const res = await doFetch(rawUrl, { redirect: 'manual', signal: controller.signal, headers: { accept: 'application/json' } });
+            // CIMD section 5: a redirect is never followed. Only this URL passed the
+            // issuer allowlist, and a document behind a redirect could claim its client_id.
+            if (res.status >= 300 && res.status < 400)
+                throw new SsrfBlockedError('CIMD redirect refused');
+            if (!res.ok)
+                throw new CimdHttpError(res.status);
+            const text = await readCapped(res, maxBytes, controller);
+            let parsed;
             try {
-                const res = await doFetch(current, { redirect: 'manual', signal: controller.signal, headers: { accept: 'application/json' } });
-                if (res.status >= 300 && res.status < 400) {
-                    const loc = res.headers.get('location');
-                    if (!loc)
-                        throw new SsrfBlockedError('redirect without a Location header');
-                    redirectTo = loc;
-                    break;
-                }
-                if (!res.ok)
-                    throw new SsrfBlockedError(`CIMD fetch failed: HTTP ${res.status}`);
-                const text = await readCapped(res, maxBytes, controller);
-                let parsed;
-                try {
-                    parsed = JSON.parse(text);
-                }
-                catch {
-                    throw new SsrfBlockedError('CIMD document is not valid JSON');
-                }
-                if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-                    throw new SsrfBlockedError('CIMD document is not a JSON object');
-                }
-                doc = parsed;
-                break;
+                parsed = JSON.parse(text);
             }
-            catch (e) {
-                if (attempt < retries && isTransientFetchError(e)) {
-                    await sleep(backoffMs * (attempt + 1));
-                    continue;
-                }
-                throw e;
+            catch {
+                throw new SsrfBlockedError('CIMD document is not valid JSON');
             }
-            finally {
-                clearTimeout(timer);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                throw new SsrfBlockedError('CIMD document is not a JSON object');
+            }
+            return parsed;
+        }
+        catch (e) {
+            // A refused status throws with the body unread, and only an abort hands
+            // that connection back; the controller is this attempt's alone.
+            controller.abort();
+            const wait = backoffMs * (attempt + 1);
+            // A timed-out attempt may leave a lookup hung on the threadpool, ours or
+            // fetch's own at connect time, and a retry would start another beside it.
+            if (!timedOut && !(e instanceof LookupBusyError) && attempt < retries && isTransientFetchError(e) && deadline - Date.now() > wait) {
+                await sleep(wait);
+                continue;
             }
+            throw e;
         }
-        if (redirectTo !== null) {
-            current = new URL(redirectTo, current).toString();
-            continue;
+        finally {
+            clearTimeout(timer);
         }
-        return doc;
     }
-    throw new SsrfBlockedError(`too many redirects (> ${maxRedirects})`);
 }
 /** Read a response body, aborting the moment it exceeds maxBytes (never buffers
  * an oversized body). Falls back to a capped arrayBuffer when there is no

package/dist/trim.d.ts

@@ -6,6 +6,11 @@ export interface CappedText {
 }
 export declare function capText(text: string, maxChars: number, offset?: number): CappedText;
 export declare function sliceClean(text: string, max: number): string;
+/** An untrusted value made fit for one log line: never throws, at most `max`
+ * characters of it (then `...(len=N)`), each unsafe character as a literal
+ * `\uXXXX`. Backslash stays as is, so a value already through here comes back
+ * unchanged and a clean short value keeps its exact text. */
+export declare function logSafe(value: unknown, max: number): string;
 /** Largest prefix whose JSON encoding (the wrapping quotes included) fits
  * `maxEncoded`. Slicing raw characters overshoots whenever the text contains
  * quotes or backslashes, which JSON.stringify doubles: the escape hatch's

package/dist/trim.js

@@ -11,6 +11,26 @@ export function sliceClean(text, max) {
     const sliced = text.slice(0, max);
     return /[\uD800-\uDBFF]$/.test(sliced) ? sliced.slice(0, -1) : sliced;
 }
+// C0, DEL and C1 (NEL, 8-bit CSI and OSC) can end a line or drive a terminal;
+// the line and paragraph separators end a line for many readers; the bidi and
+// invisible format controls make a line read differently from its bytes.
+const LOG_UNSAFE = /[\p{Cc}\u061c\u200e\u200f\u202a-\u202e\u2028\u2029\u2066-\u2069]/gu;
+/** An untrusted value made fit for one log line: never throws, at most `max`
+ * characters of it (then `...(len=N)`), each unsafe character as a literal
+ * `\uXXXX`. Backslash stays as is, so a value already through here comes back
+ * unchanged and a clean short value keeps its exact text. */
+export function logSafe(value, max) {
+    let text;
+    try {
+        text = String(value);
+    }
+    catch {
+        return '<unprintable>';
+    }
+    const cut = text.length > max ? sliceClean(text, max) : text;
+    const escaped = cut.replace(LOG_UNSAFE, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+    return cut === text ? escaped : `${escaped}...(len=${text.length})`;
+}
 /** Largest prefix whose JSON encoding (the wrapping quotes included) fits
  * `maxEncoded`. Slicing raw characters overshoots whenever the text contains
  * quotes or backslashes, which JSON.stringify doubles: the escape hatch's

package/dist/usage-metrics.js

@@ -36,7 +36,7 @@ const ARG_KEY_RE = /^[A-Za-z][A-Za-z0-9_.]{0,63}$/;
 /** Union of every `error:` slug literal emitted anywhere in src/ (kept honest
  * by a set-equality grep test). Anything outside buckets to `other`. */
 export const KNOWN_ERROR_SLUGS = new Set([
-    'E_ALIAS_EXISTS', 'E_CIMD_INVALID', 'E_ENV_ACCOUNTS_MODE', 'E_MCP_TOKEN_INVALID',
+    'E_ALIAS_EXISTS', 'E_CIMD_INVALID', 'E_CIMD_SSRF_BLOCKED', 'E_ENV_ACCOUNTS_MODE', 'E_MCP_TOKEN_INVALID',
     'E_NO_DEFAULT_ACCOUNT', 'E_UNKNOWN_BUNDLE', 'E_VALIDATION', 'ambiguous',
     'api_not_enabled', 'auth_required', 'bad_request', 'binary', 'binary_unsupported',
     'confirmation_declined', 'diagnose_failed', 'discovery_unavailable', 'dispatch_timeout',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.64",
+  "version": "6.0.0-alpha.65",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",