mcp-proxy 6.5.0 → 6.5.2

package/jsr.json

@@ -3,5 +3,5 @@
   "include": ["src/index.ts", "src/bin/mcp-proxy.ts"],
   "license": "MIT",
   "name": "@punkpeye/mcp-proxy",
-  "version": "6.5.0"
+  "version": "6.5.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proxy",
-  "version": "6.5.0",
+  "version": "6.5.2",
   "main": "dist/index.mjs",
   "scripts": {
     "build": "tsdown",

package/src/startHTTPServer.test.ts

@@ -667,6 +667,36 @@ it("does not require auth for /ping endpoint", async () => {
   await httpServer.close();
 });
 
+it("responds with 400 to a malformed request target instead of crashing", async () => {
+  const port = await getRandomPort();
+
+  const httpServer = await startHTTPServer({
+    createServer: async () => {
+      return new Server({ name: "test", version: "1.0.0" }, { capabilities: {} });
+    },
+    port,
+  });
+
+  // `//` is not a valid URL target; sent via http.request so it isn't
+  // normalized away. Before the fix this threw inside the request listener
+  // and crashed the process.
+  const statusCode = await new Promise<number>((resolve, reject) => {
+    const request = http.request(
+      { host: "localhost", path: "//", port },
+      (res) => {
+        res.resume();
+        resolve(res.statusCode ?? 0);
+      },
+    );
+    request.on("error", reject);
+    request.end();
+  });
+
+  expect(statusCode).toBe(400);
+
+  await httpServer.close();
+});
+
 it("does not require auth for OPTIONS requests", async () => {
   const port = await getRandomPort();
   const apiKey = "test-api-key-999";

package/src/startHTTPServer.ts

@@ -688,7 +688,14 @@ const handleStreamRequest = async <T extends ServerLike>({
         }
       | undefined = sessionId ? activeTransports[sessionId] : undefined;
 
-    if (!sessionId) {
+    if (!sessionId) {  
+      // Return METHOD_NOT_ALLOWED so stateless clients' transport stops reconnecting
+      if (stateless) {
+        res.writeHead(405, { Allow: "POST" }).end("Method Not Allowed");
+
+        return true;
+      }
+
       res.writeHead(400).end("No sessionId");
 
       return true;
@@ -944,7 +951,15 @@ export const startHTTPServer = async <T extends ServerLike>({
     // and would otherwise short-circuit the MCP protocol handlers.
     // Use a fixed base because `host` may be "::" (IPv6 any), which is not a
     // valid URL authority. We only need pathname here.
-    const requestUrl = new URL(req.url || "", "http://localhost");
+    // A malformed request target (e.g. "//") makes `new URL` throw, which
+    // would crash the process from this listener, so reject it with 400.
+    let requestUrl: URL;
+    try {
+      requestUrl = new URL(req.url || "", "http://localhost");
+    } catch {
+      res.writeHead(400).end("Bad Request");
+      return;
+    }
     const isMcpEndpoint =
       (sseEndpoint && requestUrl.pathname === sseEndpoint) ||
       (streamEndpoint && requestUrl.pathname === streamEndpoint);