playwright-e2e-mcp 0.1.1 → 0.1.3

package/README.md

@@ -19,17 +19,19 @@ with unique CSS selectors, and validate the replacement selector before re-runni
 
 ## Demo
 
-**Live endpoint** — a real `initialize` + `tools/list` round-trip against
-`https://playwright-e2e-mcp.vercel.app/api/mcp`:
+**Hosted endpoint** — what an `initialize` + `tools/list` round-trip against
+`https://playwright-e2e-mcp.vercel.app/api/mcp` returns for a client that sends the
+bearer token (without one, only `list-tests` and `get-failure` are listed):
 
-![Live endpoint: initialize handshake and all 8 tools](https://raw.githubusercontent.com/trajectiq-ai/E2E/main/docs/demo-endpoint.png)
+![Token-protected endpoint: initialize handshake and all 8 tools](https://raw.githubusercontent.com/trajectiq-ai/E2E/main/docs/demo-endpoint.png)
 
 **A real test run** — `run-test` served over stdio by `npx -y playwright-e2e-mcp`
 against the bundled `examples/sample-test.spec.ts` (actual output, unedited):
 
 ![run-test result: 4 passed, 0 failed, 5.1s](https://raw.githubusercontent.com/trajectiq-ai/E2E/main/docs/demo-run-test.png)
 
-Images are generated from real captured output with `node scripts/gen-demo-images.mjs`.
+Images are rendered with `node scripts/gen-demo-images.mjs`: the run-test card is real
+captured output; the endpoint card is an illustration of the authenticated listing.
 
 ## Install
 
@@ -40,7 +42,7 @@ and every other MCP client — pick whichever route fits:
 | --- | --- |
 | **npm (canonical, fastest)** | `npx -y playwright-e2e-mcp` |
 | **MCP Registry** (registry-aware clients discover it automatically) | `io.github.trajectiq-ai/E2E` — [listing](https://registry.modelcontextprotocol.io/) |
-| **Any client, no npm account needed** | `npx -y github:trajectiq-ai/E2E` |
+| **Any client, no npm account needed** | `npx -y github:trajectiq-ai/E2E#v0.1.3` (pin a release tag) |
 | **Claude Desktop, zero Node setup** | double-click the [`.mcpb` extension](https://github.com/trajectiq-ai/E2E/releases) |
 | **Remote-only clients (ChatGPT connectors)** | `https://playwright-e2e-mcp.vercel.app/api/mcp` |
 
@@ -66,7 +68,7 @@ Details and per-client config: [Installation](#installation) ·
 
 | Argument | Type | Description |
 | --- | --- | --- |
-| `projectRoot` | string | Project directory (default: server working directory) |
+| `projectRoot` | string | Project directory inside the configured root (default: server working directory) |
 | `testFiles` | string[] | Files/directories relative to the root; `file:line` supported. Omit to run everything |
 | `grep` | string | Only run tests whose title matches this regex |
 | `browser` | `chromium` \| `firefox` \| `webkit` | Playwright project to run (matched against config project names) |
@@ -77,7 +79,7 @@ Details and per-client config: [Installation](#installation) ·
 | `config` | string | `playwright.config` path **or 1-based index** when the project has several |
 | `retryOnFailure` | boolean | Auto-retry failures **once** before reporting them (default `true`; ignored when `retries` is set) |
 | `lastFailed` | boolean | Only re-run tests that failed in the previous run (Playwright `--last-failed`) — the fast fix → re-run loop |
-| `args` | string[] | Extra CLI flags (shell metacharacters are rejected) |
+| `args` | string[] | Extra Playwright flags from an allowlist (`--repeat-each=N`, `--max-failures=N`, `--update-snapshots`, `--shard=1/3`, `--trace=on`, …); values go after `=` and are checked, and flags that take a path, such as `--config` or `--output`, are rejected |
 
 Flakiness handling: by default the server injects `--retries=1` (unless the config
 already sets `retries`), so a test that passes on the retry is reported as **flaky**,
@@ -172,9 +174,9 @@ plain CSS.
 | --- | --- | --- |
 | `description` | string | What the test should cover (required) |
 | `pageUrl` | string | Page the test starts on (default: `baseURL` / `webServer.url` from config) |
-| `testDir` / `file` | string | Where to write the spec (default: detected `testDir` + `generated/<slug>.spec.ts`) |
+| `testDir` / `file` | string | Where to write the spec (default: detected `testDir` + `generated/<slug>.spec.ts`); `file` must end in `.spec.*` or `.test.*` |
 | `write` | boolean | Write the file to disk (default `true`) |
-| `overwrite` | boolean | Replace an existing file at the target path |
+| `overwrite` | boolean | Replace an existing spec at the target path; only specs this tool generated can be replaced |
 | `liveInspect` | boolean | Cross-check selectors against the live page (default on when a URL is known) |
 | `projectRoot` / `config` | string | As with the other tools |
 
@@ -236,11 +238,12 @@ Requirements:
   (`npx playwright install chromium`)
 
 **No npm account needed** — install straight from GitHub (the `prepare` script
-builds `dist/` automatically on install):
+builds `dist/` automatically on install). Pin a release tag: an unpinned
+`github:trajectiq-ai/E2E` runs whatever is on the default branch at that moment.
 
 ```bash
-npx -y github:trajectiq-ai/E2E
-npm install -D github:trajectiq-ai/E2E @playwright/test   # or as a project dependency
+npx -y github:trajectiq-ai/E2E#v0.1.3
+npm install -D github:trajectiq-ai/E2E#v0.1.3 @playwright/test   # or as a project dependency
 npx playwright install chromium
 ```
 
@@ -248,7 +251,7 @@ Or grab the packaged tarball from the repo's **GitHub Releases** page and instal
 it locally:
 
 ```bash
-npm install -D https://github.com/trajectiq-ai/E2E/releases/download/v0.1.0/playwright-e2e-mcp-0.1.0.tgz
+npm install -D https://github.com/trajectiq-ai/E2E/releases/download/v0.1.3/playwright-e2e-mcp-0.1.3.tgz
 ```
 
 Listed in the **official [MCP Registry](https://registry.modelcontextprotocol.io/)** as
@@ -264,7 +267,7 @@ Listed in the **official [MCP Registry](https://registry.modelcontextprotocol.io
   "mcpServers": {
     "playwright-e2e": {
       "command": "npx",
-      "args": ["-y", "github:trajectiq-ai/E2E"],
+      "args": ["-y", "github:trajectiq-ai/E2E#v0.1.3"],
       "env": { "PW_MCP_PROJECT_ROOT": "/absolute/path/to/your/project" }
     }
   }
@@ -278,8 +281,8 @@ when the client launches it somewhere else (e.g. your home directory).
 **Codex / VS Code / Copilot CLIs:**
 
 ```bash
-codex mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E
-code --add-mcp '{"name":"playwright-e2e","command":"npx","args":["-y","github:trajectiq-ai/E2E"]}'
+codex mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.1.3
+code --add-mcp '{"name":"playwright-e2e","command":"npx","args":["-y","github:trajectiq-ai/E2E#v0.1.3"]}'
 ```
 
 Codex's defaults fight this server: the first launch clones the repo and runs
@@ -290,7 +293,7 @@ Codex's defaults fight this server: the first launch clones the repo and runs
 ```toml
 [mcp_servers.playwright-e2e]
 command = "npx"
-args = ["-y", "github:trajectiq-ai/E2E"]
+args = ["-y", "github:trajectiq-ai/E2E#v0.1.3"]
 startup_timeout_sec = 60
 tool_timeout_sec = 600
 ```
@@ -298,13 +301,14 @@ tool_timeout_sec = 600
 **Claude Desktop (one-click):** download and double-click the `.mcpb` Desktop
 Extension attached to the [latest release](https://github.com/trajectiq-ai/E2E/releases) —
 the bundle ships its own dependencies, so no Node setup is required. On install it
-prompts once for your **project root** (defaults to your home folder) and wires it
+asks you to pick your **project root** (required, no default: choose the project
+folder, not your home directory) and wires it
 into `PW_MCP_PROJECT_ROOT`, so the tools point at a real project from the first call.
 
 **Claude Code:**
 
 ```bash
-claude mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E
+claude mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.1.3
 ```
 
 **Gemini CLI / Qwen Code:** paste the `mcpServers` block above into
@@ -345,7 +349,7 @@ Streamable HTTP bridge for exactly that case:
 | --- | --- |
 | **Endpoint** | `https://playwright-e2e-mcp.vercel.app/api/mcp` |
 | **Transport** | MCP Streamable HTTP (`POST` JSON in, JSON or SSE out) |
-| **Auth** | none — the URL is public |
+| **Auth** | bearer token (`PW_MCP_HTTP_TOKEN`). The deployment at this URL requires it; a bridge started without the variable serves only the read-only tools |
 | **Source** | [`api/mcp.ts`](api/mcp.ts) → [`src/http.ts`](src/http.ts) |
 
 The bridge runs the *same* `createServer()` as the stdio transport; the SDK
@@ -353,47 +357,88 @@ serves every request with a fresh server instance, which is what a serverless
 function wants. `test/http-bridge.test.mjs` drives the real Node adapter over
 `node:http` so a broken bridge fails in CI, not in ChatGPT.
 
+**This deployment is token-protected.** `https://playwright-e2e-mcp.vercel.app`
+has `PW_MCP_HTTP_TOKEN` set, so a request without `Authorization: Bearer <token>`
+— including a ChatGPT connector created with authentication *None* — gets
+`401 {"error":"unauthorized"}`. Ask the operator for the token, or run your own
+bridge (below).
+
+**Open vs. token-protected.** With `PW_MCP_HTTP_TOKEN` set (at least 16
+characters; use a random value) all eight tools are served to clients that send
+`Authorization: Bearer <token>`, and every other request gets `401`. Without that
+variable anyone who reaches the URL can call the bridge, so it degrades to
+`list-tests` and `get-failure` in restricted mode: `list-tests` scans sources
+instead of running `playwright test --list` (which would execute the project's
+config), callers cannot pick another `projectRoot`, and nothing spawns a process,
+drives a browser or writes a file. Child processes started over HTTP get only an
+allowlisted environment. `PW_MCP_ALLOWED_HOSTS` (comma separated, `*` for any)
+limits the accepted `Host` header; without a token and without that variable,
+only `localhost` names and the deployment's own Vercel hostnames are accepted
+(DNS-rebinding protection).
+
 **Add it to ChatGPT:** Settings → Connectors → turn on **Advanced → Developer
-mode** → *Create custom connector* → paste the endpoint above → authentication
-**None**.
+mode** → *Create custom connector* → paste the endpoint above. Authentication
+**None** only works against a bridge with no token (read-only tools), so for this
+deployment choose the connector's **API key** authentication and send
+`Authorization: Bearer <token>` — or point the connector at your own deployment
+with `PW_MCP_HTTP_TOKEN` unset.
+
+To self-host the open, read-only variant, deploy this repo with
+`PW_MCP_HTTP_TOKEN` unset; nothing else changes.
 
 Codex can also take the remote transport instead of spawning `npx`, if you'd
-rather not ship Playwright to every machine:
+rather not ship Playwright to every machine. Point it at the token through an
+environment variable so the secret stays out of the config file:
 
 ```bash
-codex mcp add playwright-e2e-remote --url https://playwright-e2e-mcp.vercel.app/api/mcp
+export PW_MCP_HTTP_TOKEN=…   # ask the operator for the value
+codex mcp add playwright-e2e-remote --url https://playwright-e2e-mcp.vercel.app/api/mcp \
+  --bearer-token-env-var PW_MCP_HTTP_TOKEN
 ```
 
 **What to expect:** `list-tests` works and reports the specs bundled with the
-deployment. Tools that spawn a browser (`run-test`, `inspect-page`,
-`validate-selector`, `diagnose-flaky`, …) cannot download Chromium in a
-serverless function, so they return their normal `NO_PLAYWRIGHT` hint. Use the
-stdio install for real runs; the hosted endpoint is for discovery and for
-clients that cannot run local processes.
+deployment. Even with a token, tools that spawn a browser (`run-test`,
+`inspect-page`, `validate-selector`, `diagnose-flaky`, …) cannot download
+Chromium in a serverless function, so they return their normal `NO_PLAYWRIGHT`
+hint. Use the stdio install for real runs; the hosted endpoint is for discovery
+and for clients that cannot run local processes.
 
 ```bash
-# verify the handshake without any client
+# verify the handshake without any client (the live deployment needs the token;
+# drop the authorization header and it answers 401 instead)
 curl -X POST https://playwright-e2e-mcp.vercel.app/api/mcp \
   -H 'content-type: application/json' \
   -H 'accept: application/json, text/event-stream' \
+  -H "authorization: Bearer $PW_MCP_HTTP_TOKEN" \
   -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'
 ```
 
-Redeploy after a change:
-
-```bash
-npx vercel deploy --yes --prod --token="$VERCEL_TOKEN"
-```
+Redeploy after a change: merge to `main`. Vercel's Git integration deploys
+every push, so there is no token to manage and no CLI step — watch the
+`Vercel` commit status for the deployment result.
 
 ## Configuration
 
 | Environment variable | Default | Purpose |
 | --- | --- | --- |
 | `PW_MCP_PROJECT_ROOT` | server cwd | Default project root for every tool |
-| `LOG_LEVEL` | `info` | `debug` \| `info` \| `warn` \| `error` \| `silent` |
-| `LOG_FORMAT` | `text` | `text` or `json` (structured) |
+| `PW_MCP_ALLOWED_ROOTS` | — | Extra directories a caller may pass as `projectRoot` (`:`-separated, `;` on Windows). Anything outside these and the default root is rejected |
+| `PW_MCP_HTTP_TOKEN` | — | HTTP bridge only: bearer token (16+ characters) that unlocks all tools (see above) |
+| `PW_MCP_ALLOWED_HOSTS` | localhost + Vercel hostnames when there is no token | HTTP bridge only: comma-separated `Host` allowlist; `*` accepts any |
+| `PW_MCP_PASSTHROUGH_ENV` | — | HTTP bridge only: comma-separated extra variables passed to test runs (e.g. `BASE_URL`) |
+| `PW_MCP_MAX_CHILDREN` | `4` | HTTP bridge only: how many test runs and browser probes may run at once |
+| `PW_MCP_BLOCK_PRIVATE_URLS` | off (on for the HTTP bridge) | `1` makes the URL tools refuse loopback, private-network and cloud-metadata addresses, including redirects and subresources |
+| `LOG_LEVEL` / `MCP_LOG_LEVEL` | `info` | `debug` \| `info` \| `warn` \| `error` \| `silent`; `LOG_LEVEL` wins when both are set |
+| `LOG_FORMAT` / `MCP_LOG_FORMAT` | `text` | `text`, or `json` (also `ndjson`) for one structured JSON object per line — ready for a log ingester |
+
+Logs always go to **stderr** — stdout is reserved for the MCP protocol. Unrecognized values
+fall back to the default, so a typo in `LOG_LEVEL` logs at `info` and one in `LOG_FORMAT`
+logs as text rather than silencing the server. With `LOG_FORMAT=json` each line is a single
+object (`time`, `level`, `message` plus context):
 
-Logs always go to **stderr** — stdout is reserved for the MCP protocol.
+```json
+{"time":"2026-10-07T08:00:00.000Z","level":"info","message":"server ready","name":"playwright-e2e-mcp"}
+```
 
 ## Typical workflow
 
@@ -430,15 +475,42 @@ Logs always go to **stderr** — stdout is reserved for the MCP protocol.
 | Syntax error in a spec | `SYNTAX_ERROR` with file:line; nothing crashes; `list-tests` falls back to a source scan |
 | MCP client disconnects | Per-request `AbortSignal` kills the run; stdin end triggers shutdown, and every tracked child tree is force-killed (`killActiveChildren`) |
 | Disk full | `ENOSPC` detected → `DISK_FULL` with a "free space" hint; logging never throws |
-| Malicious paths | `../../etc/passwd`, absolute paths outside the root, URLs and null bytes are rejected with `INVALID_PATH`; CLI args are shell-metacharacter-checked |
+| Malicious paths | `../../etc/passwd`, absolute paths outside the root, a `projectRoot` outside the allowed roots, symlinks that leave the root, URLs and null bytes are rejected with `INVALID_PATH`; extra CLI args must be allowlisted Playwright flags |
 
 ## Security notes
 
 - **No shell**: Playwright is spawned as `node <playwright/cli.js> …` with an argument
-  array — no command interpolation.
-- **Path sandbox**: user paths are resolved lexically and must stay inside the project root.
+  array — no command interpolation. Extra `args` are limited to an allowlist of
+  Playwright flags, each with a checked value (`--flag=value`), so a caller cannot
+  swap in another `--config` or `--output` or hand git an option through
+  `--only-changed`. Paths with a segment starting with `-` are rejected, so a test
+  file name cannot be read as a flag.
+- **Path sandbox**: user paths must stay inside the project root, checked lexically
+  and again with symlinks resolved. A caller-supplied `projectRoot` must sit inside
+  `PW_MCP_PROJECT_ROOT` (or a `PW_MCP_ALLOWED_ROOTS` entry).
+- **Generated code**: `generate-e2e-test` only writes `*.spec.*` / `*.test.*` files,
+  only overwrites specs whose header it wrote itself, never writes through a symlink,
+  and escapes every value it puts into strings or comments.
+- **HTTP bridge**: read-only tools unless `PW_MCP_HTTP_TOKEN` is set; child processes
+  started over HTTP get only an allowlisted environment (`PATH`, `HOME`, temp dirs,
+  locale, `CI`, `PLAYWRIGHT_*`, `npm_config_*` without embedded credentials, plus
+  anything in `PW_MCP_PASSTHROUGH_ENV`), at most `PW_MCP_MAX_CHILDREN` run at once
+  (a disconnected client frees its slot immediately), and internal error messages
+  are not returned to clients. The allowlist only covers the child's own
+  environment: test code runs as the same OS user, so on Linux it could still read
+  the server's startup environment from `/proc`. That is why only token holders
+  can run project code; keep other secrets out of the bridge's environment, or run
+  it under a separate user.
+- **SSRF guard**: on the HTTP bridge (or with `PW_MCP_BLOCK_PRIVATE_URLS=1`) the URL tools
+  refuse hosts that resolve to loopback, private, link-local/metadata or reserved
+  addresses, and route the browser through a local proxy that applies the same check
+  to every redirect hop and subresource; IPv6 forms that embed an IPv4 address
+  (mapped, NAT64, 6to4, Teredo) are blocked too, and WebRTC UDP is disabled so a
+  page cannot reach the network around the proxy. It is off for stdio by default because
+  opening `http://localhost` dev servers is what these tools are for.
 - **Cleanup**: temp report/script files are written to the OS temp dir and removed;
-  child processes are tracked and killed on shutdown.
+  child processes are tracked and killed on shutdown. Trace decompression has one
+  size budget per archive, and PNGs are capped at 16,384 px per side and 50 M pixels.
 
 ## Development
 
@@ -459,8 +531,10 @@ Zod v4 standard schemas; every tool declares spec tool annotations.
 ```bash
 npm install
 npm run build   # tsc → dist/ (zero errors)
-npm test        # build + test/run-tests.mjs (70 unit tests, any Node ≥20)
+npm test        # build + test/run-tests.mjs (unit tests, any Node ≥20)
 npm run e2e     # build + e2e/run.mjs: live MCP ↔ Playwright integration suite
+npm run mcpb    # build + bundle dist/ into playwright-e2e-mcp-<version>.mcpb (+ .sha256)
+npm run mcpb:smoke   # ...then install that bundle in a temp dir, launch it and assert the handshake
 ```
 
 Tests cover the report parser (sample Playwright JSON, trace attachments), path utils
@@ -469,8 +543,12 @@ discovery, multiple configs, missing install, test-file scanning), the shared to
 helpers, the **trace reader** (synthetic trace.zip: error, failed action, DOM snapshot,
 `*.network` failed-request parsing, console error/warning events), the **image diff**
 (PNG round-trip, regions, color shift, dimension changes), the **change analyzer**
-(selector extraction, git + mtime paths) and the **flaky verdict logic**
-(failure signatures, CONSISTENTLY FAILING / FLAKY / NOT REPRODUCING / NO TESTS RAN).
+(selector extraction, git + mtime paths), the **flaky verdict logic**
+(failure signatures, CONSISTENTLY FAILING / FLAKY / NOT REPRODUCING / NO TESTS RAN),
+the **HTTP bridge** (token, restricted mode, Host allowlist), the **security
+regressions** (sandbox escapes, argument smuggling, symlink writes, code injection,
+SSRF ranges, env scrubbing, decode limits), the `.mcpb` manifest, the `.mcpb` zip
+extractor, and the MCP config files.
 
 ### Integration suite (`npm run e2e`)
 

package/dist/http.d.ts

@@ -16,8 +16,26 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { McpHttpHandler } from '@modelcontextprotocol/server';
 /** Mirrors the SDK's default POST body bound, so oversized bodies die early. */
 export declare const MAX_BODY_BYTES: number;
+export interface McpHttpHandlerOptions {
+    /**
+     * Bearer token clients must send (`Authorization: Bearer <token>`).
+     * Defaults to PW_MCP_HTTP_TOKEN. With a token every tool is served;
+     * without one only READ_ONLY_TOOLS are, in restricted mode, so an open
+     * endpoint can never spawn processes, drive a browser or write files.
+     */
+    token?: string;
+    /**
+     * Hostnames accepted in the Host header (DNS-rebinding protection).
+     * Defaults to PW_MCP_ALLOWED_HOSTS (comma separated; `*` allows any).
+     * When unset and there is no token, only localhost names and the
+     * deployment's own Vercel hostnames are accepted.
+     */
+    allowedHosts?: string[];
+}
+/** Tokens shorter than this are refused: they can be guessed. */
+export declare const MIN_TOKEN_LENGTH = 16;
 /** Build the fetch-shaped MCP handler backed by a fresh server per request. */
-export declare function createMcpHttpHandler(): McpHttpHandler;
+export declare function createMcpHttpHandler(options?: McpHttpHandlerOptions): McpHttpHandler;
 /**
  * Serve one Node request through the MCP handler.
  *

package/dist/http.js

@@ -12,17 +12,90 @@
  * The stdio transport in server.ts is untouched; this is an additional way to
  * reach the same eight tools.
  */
-import { createMcpHandler } from '@modelcontextprotocol/server';
-import { createServer } from './server.js';
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { createMcpHandler, hostHeaderValidationResponse } from '@modelcontextprotocol/server';
+import { createServer, READ_ONLY_TOOLS } from './server.js';
+import { setMaxChildren, setScrubChildEnv } from './utils/playwright-runner.js';
+import { setBlockPrivateUrls } from './utils/url-policy.js';
 import { logger } from './utils/logger.js';
 /** Mirrors the SDK's default POST body bound, so oversized bodies die early. */
 export const MAX_BODY_BYTES = 4 * 1024 * 1024;
+/** Tokens shorter than this are refused: they can be guessed. */
+export const MIN_TOKEN_LENGTH = 16;
+/** Default Host allowlist for an open (token-less) bridge. */
+function defaultAllowedHosts() {
+    const vercel = [process.env.VERCEL_URL, process.env.VERCEL_BRANCH_URL, process.env.VERCEL_PROJECT_PRODUCTION_URL]
+        .map((host) => host?.trim().toLowerCase())
+        .filter((host) => Boolean(host));
+    return ['localhost', '127.0.0.1', '[::1]', ...vercel];
+}
+function envList(value) {
+    return (value ?? '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter((item) => item !== '');
+}
+/** Constant-time comparison of the presented bearer token (hashed, so length does not leak). */
+function tokenMatches(header, token) {
+    const match = /^Bearer\s+(.+)$/i.exec(header?.trim() ?? '');
+    if (!match)
+        return false;
+    const digest = (value) => createHash('sha256').update(value).digest();
+    return timingSafeEqual(digest(match[1].trim()), digest(token));
+}
+/** PW_MCP_MAX_CHILDREN as a positive integer; anything else means the default of 4. */
+function maxChildrenFromEnv() {
+    const value = Number(process.env.PW_MCP_MAX_CHILDREN ?? '');
+    return Number.isInteger(value) && value > 0 ? value : 4;
+}
+function jsonResponse(status, body, headers = {}) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', ...headers },
+    });
+}
 /** Build the fetch-shaped MCP handler backed by a fresh server per request. */
-export function createMcpHttpHandler() {
-    return createMcpHandler(() => createServer(), {
+export function createMcpHttpHandler(options = {}) {
+    const token = (options.token ?? process.env.PW_MCP_HTTP_TOKEN ?? '').trim();
+    if (token && token.length < MIN_TOKEN_LENGTH) {
+        throw new Error(`PW_MCP_HTTP_TOKEN must be at least ${MIN_TOKEN_LENGTH} characters (use a random value).`);
+    }
+    const configuredHosts = options.allowedHosts ?? envList(process.env.PW_MCP_ALLOWED_HOSTS);
+    const allowedHosts = configuredHosts.includes('*')
+        ? []
+        : configuredHosts.length > 0 || token
+            ? configuredHosts
+            : defaultAllowedHosts();
+    // Children spawned on behalf of HTTP callers must not see deployment
+    // secrets, and URL tools must not reach the deployment's private network.
+    setScrubChildEnv(true);
+    setMaxChildren(maxChildrenFromEnv());
+    setBlockPrivateUrls(true);
+    if (!token) {
+        logger.warn('PW_MCP_HTTP_TOKEN is not set; serving read-only tools only', { tools: READ_ONLY_TOOLS });
+    }
+    const inner = createMcpHandler((context) => createServer({
+        ...(token ? {} : { tools: READ_ONLY_TOOLS, restricted: true }),
+        // Lets tools stop their children when the HTTP client disconnects.
+        requestSignal: context?.requestInfo?.signal,
+    }), {
         legacy: 'stateless',
         onerror: (error) => logger.error('mcp http handler error', { error }),
     });
+    return {
+        ...inner,
+        fetch: async (request, requestOptions) => {
+            if (allowedHosts.length > 0) {
+                const rejected = hostHeaderValidationResponse(request, allowedHosts);
+                if (rejected)
+                    return rejected;
+            }
+            if (token && !tokenMatches(request.headers.get('authorization'), token)) {
+                return jsonResponse(401, { error: 'unauthorized' }, { 'www-authenticate': 'Bearer' });
+            }
+            return inner.fetch(request, requestOptions);
+        },
+    };
 }
 /** A failure that maps onto an HTTP status before any response is written. */
 class RequestError extends Error {
@@ -59,17 +132,18 @@ async function readBody(req) {
         const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         size += buf.byteLength;
         if (size > MAX_BODY_BYTES) {
-            req.destroy();
+            // Stop reading; the caller answers 413 and then closes the connection.
+            req.pause();
             throw new RequestError(413, 'request body too large');
         }
         chunks.push(buf);
     }
     return Buffer.concat(chunks, size);
 }
-function buildRequest(req, method, body) {
+function buildRequest(req, method, body, signal) {
     const protocol = (firstHeader(req.headers['x-forwarded-proto']) ?? 'http').split(',')[0].trim();
     const host = firstHeader(req.headers.host) ?? 'localhost';
-    const init = { method, headers: toHeaders(req.headers) };
+    const init = { method, headers: toHeaders(req.headers), signal };
     if (body && body.byteLength > 0)
         init.body = body;
     return new Request(`${protocol}://${host}${req.url ?? '/'}`, init);
@@ -93,11 +167,18 @@ function waitDrain(res) {
  * mid-stream failure closes the socket so the client stops waiting.
  */
 export async function handleNodeRequest(handler, req, res) {
+    // Abort the request (and the tool's children) when the client goes away
+    // before the response is complete, so its child slot is freed at once.
+    const disconnect = new AbortController();
+    res.once('close', () => {
+        if (!res.writableFinished)
+            disconnect.abort();
+    });
     let response;
     try {
         const method = (req.method ?? 'GET').toUpperCase();
         const body = method === 'GET' || method === 'HEAD' ? undefined : await readBody(req);
-        response = await handler.fetch(buildRequest(req, method, body));
+        response = await handler.fetch(buildRequest(req, method, body, disconnect.signal));
     }
     catch (err) {
         const status = err instanceof RequestError ? err.status : 500;
@@ -107,7 +188,15 @@ export async function handleNodeRequest(handler, req, res) {
         if (!res.headersSent && !res.writableEnded) {
             res.statusCode = status;
             res.setHeader('content-type', 'application/json');
-            res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
+            // Only our own RequestError messages are meant for clients; anything
+            // else may carry paths or internals, so it stays in the server log.
+            const message = err instanceof RequestError ? err.message : 'internal server error';
+            if (status === 413)
+                res.setHeader('connection', 'close');
+            res.end(JSON.stringify({ error: message }), () => {
+                if (status === 413)
+                    req.destroy();
+            });
         }
         else if (!res.writableEnded) {
             res.destroy();

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,EAAE;QAC5C,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,YAAa,SAAQ,KAAK;IACrB,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAwB;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;QAC9E,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC;QACvB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;YAC1B,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAwB;IAClF,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAC1D,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClD,OAAO,IAAI,OAAO,CAAC,GAAG,QAAQ,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,GAAmB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,GAAoB,EACpB,GAAmB;IAEnB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrF,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,uDAAuD;QACvD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,gBAAgB,IAAI,QAAQ,CAAC,IAAI;YAAE,OAAO;QACpE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM;YACR,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,GAAG,CAAC,GAAG,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE9F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAmB9C,iEAAiE;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,8DAA8D;AAC9D,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;SAC9G,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACzC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,gGAAgG;AAChG,SAAS,YAAY,CAAC,MAAqB,EAAE,KAAa;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IACtF,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,uFAAuF;AACvF,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAa,EAAE,UAAkC,EAAE;IACvF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,UAAiC,EAAE;IACtE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,gBAAgB,mCAAmC,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK;YACnC,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC5B,qEAAqE;IACrE,0EAA0E;IAC1E,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,cAAc,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAC5B,CAAC,OAAO,EAAE,EAAE,CACV,YAAY,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9D,mEAAmE;QACnE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM;KAC5C,CAAC,EACJ;QACE,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC;KAC7E,CACF,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE;YACvC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACrE,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;gBACxE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,YAAa,SAAQ,KAAK;IACrB,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAwB;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;QAC9E,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC;QACvB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;YAC1B,uEAAuE;YACvE,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAwB,EAAE,MAAmB;IACvG,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAC1D,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9E,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClD,OAAO,IAAI,OAAO,CAAC,GAAG,QAAQ,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,GAAmB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,GAAoB,EACpB,GAAmB;IAEnB,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrF,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,OAAO,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YACpF,IAAI,MAAM,KAAK,GAAG;gBAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE;gBAC/C,IAAI,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,uDAAuD;QACvD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,gBAAgB,IAAI,QAAQ,CAAC,IAAI;YAAE,OAAO;QACpE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM;YACR,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,GAAG,CAAC,GAAG,EAAE,CAAC;AACpC,CAAC"}

package/dist/index.js

@@ -33,9 +33,17 @@ async function main() {
             'Usage: playwright-e2e-mcp [--version] [--help]',
             '',
             'Connects over stdio (MCP). Configuration via environment:',
-            '  PW_MCP_PROJECT_ROOT   default project root (default: cwd)',
-            '  LOG_LEVEL             debug | info | warn | error | silent (default: info)',
-            '  LOG_FORMAT            text | json (default: text)',
+            '  PW_MCP_PROJECT_ROOT        default project root (default: cwd)',
+            '  PW_MCP_ALLOWED_ROOTS       extra roots callers may pass as projectRoot',
+            '  PW_MCP_BLOCK_PRIVATE_URLS  1 = URL tools refuse private/loopback/metadata addresses',
+            '  LOG_LEVEL / MCP_LOG_LEVEL  debug | info | warn | error | silent (default: info)',
+            '  LOG_FORMAT / MCP_LOG_FORMAT  text | json (default: text)',
+            '',
+            'HTTP bridge only (api/mcp.ts, src/http.ts):',
+            '  PW_MCP_HTTP_TOKEN          bearer token (16+ chars) that unlocks all tools',
+            '  PW_MCP_ALLOWED_HOSTS       Host allowlist, comma separated (* = any)',
+            '  PW_MCP_PASSTHROUGH_ENV     extra variables passed to test runs',
+            '  PW_MCP_MAX_CHILDREN        concurrent runs (default: 4)',
             '',
         ].join('\n'));
         return;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;YACE,4EAA4E;YAC5E,EAAE;YACF,gDAAgD;YAChD,EAAE;YACF,2DAA2D;YAC3D,6DAA6D;YAC7D,8EAA8E;YAC9E,qDAAqD;YACrD,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;YACE,4EAA4E;YAC5E,EAAE;YACF,gDAAgD;YAChD,EAAE;YACF,2DAA2D;YAC3D,kEAAkE;YAClE,0EAA0E;YAC1E,uFAAuF;YACvF,mFAAmF;YACnF,4DAA4D;YAC5D,EAAE;YACF,6CAA6C;YAC7C,8EAA8E;YAC9E,wEAAwE;YACxE,kEAAkE;YAClE,2DAA2D;YAC3D,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/server.d.ts

@@ -14,7 +14,20 @@ export interface CreateServerOptions {
     projectRoot?: string;
     /** Share a store across servers (tests). */
     store?: ToolStore;
+    /** Register only these tools (default: all). Used by the hosted HTTP bridge. */
+    tools?: readonly string[];
+    /** Unauthenticated HTTP mode: see ToolContext.restricted. */
+    restricted?: boolean;
+    /** Aborted when the HTTP client goes away; combined with the MCP request signal. */
+    requestSignal?: AbortSignal;
 }
+/**
+ * Tools that neither drive a browser nor write files. The HTTP bridge
+ * serves only these unless it is protected by a token, and runs them in
+ * restricted mode, where list-tests scans sources instead of spawning
+ * Playwright (which would execute the project's config and spec files).
+ */
+export declare const READ_ONLY_TOOLS: readonly string[];
 export declare function resolveDefaultProjectRoot(): string;
 export declare function createServer(options?: CreateServerOptions): McpServer;
 /** Close the server, kill orphaned children, and exit. */