mcp-researchpowerpack 7.1.1 → 7.1.3

package/README.md

@@ -87,11 +87,12 @@ capability with a clear error at call time.
 | var | default | |
 |-----|---------|---|
 | `PORT` | `3000` | http port |
-| `HOST` | `127.0.0.1` | bind address; cloud runtimes that set `PORT` auto-switch to `0.0.0.0`. public binds require `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS` |
+| `HOST` | `127.0.0.1` | bind address; cloud runtimes that set `PORT` auto-switch to `0.0.0.0`. public binds require `ALLOWED_ORIGINS`, `MCP_URL`, `CSP_URLS`, or `FLY_APP_NAME` |
 | `ALLOWED_ORIGINS` | unset | comma-separated origins for host validation / cors; merged with `MCP_URL` and platform `CSP_URLS` when present |
 | `MCP_URL` | unset | public mcp url; contributes its origin to host validation and well-known resource urls |
-| `CSP_URLS` | unset | platform-provided comma-separated public origins; also contributes to host validation |
-| `NODE_ENV` | unset | `production` also requires `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS`, even on a local bind |
+| `CSP_URLS` | unset | platform-provided comma-separated public origins; also contributes to host validation, including the derived mcp-use `--br-main` host |
+| `FLY_APP_NAME` | unset | Fly runtime app name; when present, `https://<app>.fly.dev` is added to host validation for Manufact's deploy verifier |
+| `NODE_ENV` | unset | `production` also requires `ALLOWED_ORIGINS`, `MCP_URL`, `CSP_URLS`, or `FLY_APP_NAME`, even on a local bind |
 | `DEBUG` | unset | `1` or `2` to bump mcp-use debug verbosity |
 
 ### providers

package/dist/index.js

@@ -5228,19 +5228,47 @@ function normalizeOrigin(value, envName) {
     throw new Error(`${envName} must contain absolute URLs with protocol. Received: ${value}`);
   }
 }
+function expandMcpUseMainBranchOrigin(origin) {
+  const parsed = new URL(origin);
+  const hostname = parsed.hostname.toLowerCase();
+  const suffix = ".run.mcp-use.com";
+  if (!hostname.endsWith(suffix) || hostname.includes("--br-")) {
+    return [origin];
+  }
+  const slug = hostname.slice(0, -suffix.length);
+  const branchOrigin = `${parsed.protocol}//${slug}--br-main${suffix}${parsed.port ? `:${parsed.port}` : ""}`;
+  return [origin, branchOrigin];
+}
+function appendNormalizedOrigins(target, values, envName) {
+  for (const value of values) {
+    const origin = normalizeOrigin(value, envName);
+    target.push(...expandMcpUseMainBranchOrigin(origin));
+  }
+}
+function appendFlyAppOrigin(target) {
+  const flyAppName = process.env.FLY_APP_NAME?.trim();
+  if (!flyAppName) {
+    return;
+  }
+  if (!/^[a-z0-9][a-z0-9-]*$/i.test(flyAppName)) {
+    throw new Error(`FLY_APP_NAME must be a valid Fly app name. Received: ${flyAppName}`);
+  }
+  appendNormalizedOrigins(target, [`https://${flyAppName}.fly.dev`], "FLY_APP_NAME");
+}
 function resolveAllowedOrigins(baseUrl) {
   const origins = [];
   const explicitOrigins = parseCsvEnv(process.env.ALLOWED_ORIGINS);
   if (explicitOrigins && explicitOrigins.length > 0) {
-    origins.push(...explicitOrigins.map((origin) => normalizeOrigin(origin, "ALLOWED_ORIGINS")));
+    appendNormalizedOrigins(origins, explicitOrigins, "ALLOWED_ORIGINS");
   }
   if (baseUrl) {
-    origins.push(normalizeOrigin(baseUrl, "MCP_URL"));
+    appendNormalizedOrigins(origins, [baseUrl], "MCP_URL");
   }
   const cspUrls = parseCsvEnv(process.env.CSP_URLS);
   if (cspUrls && cspUrls.length > 0) {
-    origins.push(...cspUrls.map((origin) => normalizeOrigin(origin, "CSP_URLS")));
+    appendNormalizedOrigins(origins, cspUrls, "CSP_URLS");
   }
+  appendFlyAppOrigin(origins);
   const uniqueOrigins = [...new Set(origins)];
   return uniqueOrigins.length > 0 ? uniqueOrigins : void 0;
 }
@@ -5323,7 +5351,7 @@ async function main() {
     startupLogger.info(`Host validation enabled for origins: ${allowedOriginList.join(", ")}`);
   } else if (isProduction || isPublicBindHost(host)) {
     startupLogger.error(
-      "Public or production HTTP binding requires ALLOWED_ORIGINS, MCP_URL, or CSP_URLS to be set. Without host validation, the server is vulnerable to DNS rebinding attacks. Set ALLOWED_ORIGINS, MCP_URL, or CSP_URLS to the public deployment URL or custom domain."
+      "Public or production HTTP binding requires ALLOWED_ORIGINS, MCP_URL, CSP_URLS, or FLY_APP_NAME to be set. Without host validation, the server is vulnerable to DNS rebinding attacks. Set ALLOWED_ORIGINS, MCP_URL, CSP_URLS, or FLY_APP_NAME to the public deployment URL or custom domain."
     );
     process.exit(1);
   } else {