mcp-local-tunnel 1.2.0 → 1.2.1

package/README.md

@@ -110,6 +110,7 @@ Only `mode` and `auth.issuer` are required. Everything else has sensible default
 | `host` | No | Host to bind to. Defaults to `"::"`. |
 | `issuerUrl` | No | Public URL of this server. Required when behind a reverse proxy. |
 | `secret` | No | Signing key for tokens. Random if not set. Set a fixed value to survive restarts. |
+| `allowedRedirectUris` | No | Hosted client redirect URIs that get a code without confirmation (loopback and native app URIs always do). Others see a page naming where their access is going first. Defaults to well-known hosted client callbacks (Claude, ChatGPT, Cursor; see `src/redirect-uri.ts`); setting this replaces the defaults. A trailing `*` matches any suffix. |
 
 A full relay example:
 

package/dist/pages.d.ts

@@ -1,2 +1,3 @@
 export declare const renderSuccessPage: (message: string) => string;
+export declare const renderRedirectConfirmPage: (clientRedirectUrl: string, untrustedHost: string) => string;
 export declare const renderErrorPage: (message: string) => string;

package/dist/pages.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.renderErrorPage = exports.renderSuccessPage = void 0;
+exports.renderErrorPage = exports.renderRedirectConfirmPage = exports.renderSuccessPage = void 0;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- CJS module, can't use import.meta
 const pkg = require('../package.json');
 const { version } = pkg;
@@ -48,6 +48,20 @@ ${footerHtml}
 </body>
 </html>`;
 exports.renderSuccessPage = renderSuccessPage;
+const renderRedirectConfirmPage = (clientRedirectUrl, untrustedHost) => `${pageHead('Confirm access', `h1 { margin-bottom: 8px; }
+  .msg { font-size: 13px; color: var(--subtle); margin-bottom: 28px; }
+  .msg strong { color: var(--fg); }
+  .btn { display: inline-block; font: inherit; font-size: 12px; font-weight: 600; padding: 8px 20px; border-radius: 4px; border: none; cursor: pointer; text-decoration: none; background: var(--btn-bg); color: var(--btn-fg); }
+  .btn:hover { background: var(--btn-hover); }`)}
+<body>
+<h1>MCP Local Tunnel</h1>
+<p class="msg">This will give <strong>${escapeHtml(untrustedHost)}</strong> access to your local MCP servers.</p>
+<p class="msg">Only continue if you started this sign-in yourself and you recognise this address. If someone sent you a link, close this page.</p>
+<a class="btn" href="${escapeHtml(clientRedirectUrl)}">continue to ${escapeHtml(untrustedHost)}</a>
+${footerHtml}
+</body>
+</html>`;
+exports.renderRedirectConfirmPage = renderRedirectConfirmPage;
 const renderErrorPage = (message) => `${pageHead('Authentication failed', `${CENTER_CSS}
   .msg-err { color: var(--error); }`)}
 <body>

package/dist/redirect-uri.d.ts

@@ -0,0 +1,8 @@
+/**
+ * We accept any redirect_uri without registration, and an attacker can start a flow with their
+ * own redirect_uri and PKCE pair. So only hand codes to redirect URIs a remote attacker can't
+ * receive; ask the user to confirm anything else.
+ */
+export declare const DEFAULT_ALLOWED_REDIRECT_URIS: string[];
+export type RedirectUriVerdict = 'allowed' | 'needs_consent' | 'invalid';
+export declare function checkRedirectUri(redirectUri: string, allowedRedirectUris?: string[]): RedirectUriVerdict;

package/dist/redirect-uri.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * We accept any redirect_uri without registration, and an attacker can start a flow with their
+ * own redirect_uri and PKCE pair. So only hand codes to redirect URIs a remote attacker can't
+ * receive; ask the user to confirm anything else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ALLOWED_REDIRECT_URIS = void 0;
+exports.checkRedirectUri = checkRedirectUri;
+// A trailing * matches any suffix
+exports.DEFAULT_ALLOWED_REDIRECT_URIS = [
+    'https://claude.ai/api/mcp/auth_callback',
+    'https://claude.com/api/mcp/auth_callback',
+    'https://chatgpt.com/connector_platform_oauth_redirect',
+    'https://chatgpt.com/connector/oauth/*',
+    'https://www.cursor.com/agents/mcp/oauth/callback',
+];
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+// eslint-disable-next-line no-script-url
+const BLOCKED_SCHEMES = new Set(['javascript:', 'data:', 'file:', 'blob:', 'about:', 'vbscript:', 'filesystem:']);
+function checkRedirectUri(redirectUri, allowedRedirectUris = exports.DEFAULT_ALLOWED_REDIRECT_URIS) {
+    let url;
+    try {
+        url = new URL(redirectUri);
+    }
+    catch {
+        return 'invalid';
+    }
+    if (BLOCKED_SCHEMES.has(url.protocol) || url.hash) {
+        return 'invalid';
+    }
+    // Native app schemes and loopback only reach the user's own machine
+    if ((url.protocol !== 'http:' && url.protocol !== 'https:') || LOOPBACK_HOSTNAMES.has(url.hostname)) {
+        return 'allowed';
+    }
+    const target = `${url.origin}${url.pathname}`;
+    const isAllowed = allowedRedirectUris.some((allowed) => (allowed.endsWith('*') ? target.startsWith(allowed.slice(0, -1)) : target === allowed));
+    return isAllowed ? 'allowed' : 'needs_consent';
+}

package/dist/relay-server.js

@@ -11,6 +11,7 @@ const express_1 = __importDefault(require("express"));
 const ws_1 = require("ws");
 const relay_mcp_server_js_1 = require("./relay-mcp-server.js");
 const pages_js_1 = require("./pages.js");
+const redirect_uri_js_1 = require("./redirect-uri.js");
 const getString = (value) => typeof value === 'string' ? value : undefined;
 const createRelayApp = (config, provider, oidcClient, connectionManager) => {
     const app = (0, express_1.default)();
@@ -34,6 +35,10 @@ const createRelayApp = (config, provider, oidcClient, connectionManager) => {
             res.status(400).json({ error: 'invalid_request', error_description: 'code_challenge_method must be S256' });
             return;
         }
+        if ((0, redirect_uri_js_1.checkRedirectUri)(redirectUri, config.allowedRedirectUris) === 'invalid') {
+            res.status(400).json({ error: 'invalid_request', error_description: 'Invalid redirect_uri' });
+            return;
+        }
         const client = { client_id: clientId, redirect_uris: [redirectUri] };
         const authParams = {
             scopes: scope ? scope.split(' ') : [],
@@ -79,6 +84,13 @@ const createRelayApp = (config, provider, oidcClient, connectionManager) => {
             const callbackUrl = `${getBaseUrl()}/callback`;
             const { userId } = await oidcClient.exchangeCode(code, callbackUrl, pending.upstreamCodeVerifier);
             const { redirectUrl } = provider.completeAuthorization(pending, userId);
+            // The redirect_uri is attacker-controllable (see redirect-uri.ts), so name it before handing over the code
+            if ((0, redirect_uri_js_1.checkRedirectUri)(pending.redirectUri, config.allowedRedirectUris) === 'needs_consent') {
+                res.set('X-Frame-Options', 'DENY');
+                res.set('Content-Security-Policy', 'frame-ancestors \'none\'');
+                res.type('html').send((0, pages_js_1.renderRedirectConfirmPage)(redirectUrl, new URL(pending.redirectUri).host));
+                return;
+            }
             res.redirect(redirectUrl);
         }
         catch (err) {

package/dist/types.d.ts

@@ -24,6 +24,7 @@ export declare const RelayConfigSchema: z.ZodObject<{
     host: z.ZodOptional<z.ZodString>;
     issuerUrl: z.ZodOptional<z.ZodURL>;
     secret: z.ZodOptional<z.ZodString>;
+    allowedRedirectUris: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export declare const AgentConfigSchema: z.ZodObject<{
     mode: z.ZodLiteral<"agent">;
@@ -48,6 +49,7 @@ export declare const ConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     host: z.ZodOptional<z.ZodString>;
     issuerUrl: z.ZodOptional<z.ZodURL>;
     secret: z.ZodOptional<z.ZodString>;
+    allowedRedirectUris: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     mode: z.ZodLiteral<"agent">;
     relay: z.ZodString;

package/dist/types.js

@@ -21,6 +21,11 @@ exports.RelayConfigSchema = zod_1.z.object({
     host: zod_1.z.string().optional(),
     issuerUrl: zod_1.z.url().optional(),
     secret: zod_1.z.string().optional(),
+    /**
+     * Hosted client redirect URIs trusted without a confirmation step (loopback and native app URIs always are).
+     * Defaults to well-known hosted client callbacks (Claude, ChatGPT, Cursor; see `src/redirect-uri.ts`); setting this replaces the defaults. A trailing `*` matches any suffix.
+     */
+    allowedRedirectUris: zod_1.z.array(zod_1.z.string()).optional(),
 });
 exports.AgentConfigSchema = zod_1.z.object({
     mode: zod_1.z.literal('agent'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-local-tunnel",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Expose local MCP servers to remote clients without opening ports.",
   "license": "MIT",
   "author": "Adam Jones (domdomegg)",