mcp-researchpowerpack 7.1.2 → 7.1.3

package/README.md

@@ -87,11 +87,12 @@ capability with a clear error at call time.
 | var | default | |
 |-----|---------|---|
 | `PORT` | `3000` | http port |
-| `HOST` | `127.0.0.1` | bind address; cloud runtimes that set `PORT` auto-switch to `0.0.0.0`. public binds require `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS` |
+| `HOST` | `127.0.0.1` | bind address; cloud runtimes that set `PORT` auto-switch to `0.0.0.0`. public binds require `ALLOWED_ORIGINS`, `MCP_URL`, `CSP_URLS`, or `FLY_APP_NAME` |
 | `ALLOWED_ORIGINS` | unset | comma-separated origins for host validation / cors; merged with `MCP_URL` and platform `CSP_URLS` when present |
 | `MCP_URL` | unset | public mcp url; contributes its origin to host validation and well-known resource urls |
 | `CSP_URLS` | unset | platform-provided comma-separated public origins; also contributes to host validation, including the derived mcp-use `--br-main` host |
-| `NODE_ENV` | unset | `production` also requires `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS`, even on a local bind |
+| `FLY_APP_NAME` | unset | Fly runtime app name; when present, `https://<app>.fly.dev` is added to host validation for Manufact's deploy verifier |
+| `NODE_ENV` | unset | `production` also requires `ALLOWED_ORIGINS`, `MCP_URL`, `CSP_URLS`, or `FLY_APP_NAME`, even on a local bind |
 | `DEBUG` | unset | `1` or `2` to bump mcp-use debug verbosity |
 
 ### providers

package/dist/index.js

@@ -5245,6 +5245,16 @@ function appendNormalizedOrigins(target, values, envName) {
     target.push(...expandMcpUseMainBranchOrigin(origin));
   }
 }
+function appendFlyAppOrigin(target) {
+  const flyAppName = process.env.FLY_APP_NAME?.trim();
+  if (!flyAppName) {
+    return;
+  }
+  if (!/^[a-z0-9][a-z0-9-]*$/i.test(flyAppName)) {
+    throw new Error(`FLY_APP_NAME must be a valid Fly app name. Received: ${flyAppName}`);
+  }
+  appendNormalizedOrigins(target, [`https://${flyAppName}.fly.dev`], "FLY_APP_NAME");
+}
 function resolveAllowedOrigins(baseUrl) {
   const origins = [];
   const explicitOrigins = parseCsvEnv(process.env.ALLOWED_ORIGINS);
@@ -5258,6 +5268,7 @@ function resolveAllowedOrigins(baseUrl) {
   if (cspUrls && cspUrls.length > 0) {
     appendNormalizedOrigins(origins, cspUrls, "CSP_URLS");
   }
+  appendFlyAppOrigin(origins);
   const uniqueOrigins = [...new Set(origins)];
   return uniqueOrigins.length > 0 ? uniqueOrigins : void 0;
 }
@@ -5340,7 +5351,7 @@ async function main() {
     startupLogger.info(`Host validation enabled for origins: ${allowedOriginList.join(", ")}`);
   } else if (isProduction || isPublicBindHost(host)) {
     startupLogger.error(
-      "Public or production HTTP binding requires ALLOWED_ORIGINS, MCP_URL, or CSP_URLS to be set. Without host validation, the server is vulnerable to DNS rebinding attacks. Set ALLOWED_ORIGINS, MCP_URL, or CSP_URLS to the public deployment URL or custom domain."
+      "Public or production HTTP binding requires ALLOWED_ORIGINS, MCP_URL, CSP_URLS, or FLY_APP_NAME to be set. Without host validation, the server is vulnerable to DNS rebinding attacks. Set ALLOWED_ORIGINS, MCP_URL, CSP_URLS, or FLY_APP_NAME to the public deployment URL or custom domain."
     );
     process.exit(1);
   } else {