premiere-pro-mcp 1.12.0 → 1.12.2

package/CHANGELOG.md

@@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.12.2] - 2026-08-22
+
+### Fixed
+
+- `set_effect_property` now accepts safely serialized string values as well as
+  numbers, unlocking MOGRT and graphic parameters that Premiere exposes as
+  JSON strings. Responses report parameter readback separately from render
+  verification.
+- An empty legacy QE effect catalog now returns a clear no-mutation capability
+  response rather than incorrectly reporting a requested effect as missing.
+  When connected, the documented UXP effect catalog and transaction workflow is
+  the supported alternative.
+
+## [1.12.1] - 2026-08-22
+
+### Fixed
+
+- Allowed Google Analytics collection requests to `www.google.com` in the
+  restrictive Content Security Policy, matching the current Google tag client.
+
 ## [1.12.0] - 2026-08-22
 
 ### Added

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-# Premiere Pro MCP
+# MCP for Adobe Premiere Pro
 
 [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fleancoderkavy%2Fpremiere-pro-mcp.svg)](https://mcptoplist.com/server/glama%2Fleancoderkavy%2Fpremiere-pro-mcp)
 
@@ -19,7 +19,7 @@
 
 ---
 
-![Premiere Pro MCP turns a structured AI request into an organized local editing workflow](landing/public/marketing/premiere-pro-mcp-campaign-hero-v1.png)
+![MCP for Adobe Premiere Pro turns a structured AI request into an organized local editing workflow](landing/public/marketing/premiere-pro-mcp-campaign-hero-v1.png)
 
 ## What is this?
 
@@ -31,16 +31,17 @@ An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that l
 
 The AI handles the entire workflow through 287 core tools spanning the supported ExtendScript, QE DOM, revisioned project-context retrieval, safe edit-planning, and connection-verification surfaces. A compatible, authenticated UXP panel adds 50 documented, capability-gated tools without replacing the production CEP bridge.
 
-### Latest release: 1.12.0
+### Latest release: 1.12.2
 
-- **MCP safety research:** ten documented recommendations now cover subscription streams,
-  contextual completions, workspace boundaries, resource metadata and canonical URIs.
-- **Trust boundaries:** the recommendations define prompt/resource-injection defenses, layered
-  end-to-end health checks, C2PA inspection limits, and UXP external-launch safeguards.
-- **Verification clarity:** semantic keyframe verification is scoped separately from implementation
-  and licensed Premiere Pro host confirmation.
+- **MOGRT text and graphics:** `set_effect_property` now accepts string-backed
+  parameters with safe serialization and readback status.
+- **Effect discovery clarity:** an empty legacy QE effect catalog now returns a
+  no-mutation capability response and directs connected hosts to the documented
+  UXP catalog/add workflow.
+- **Verification clarity:** property readback remains distinct from playback or
+  exported-frame verification in a licensed Premiere Pro host.
 
-See the [v1.12.0 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.12.0)
+See the [v1.12.2 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.12.2)
 for complete details. Live installation in Premiere Pro still requires host verification.
 
 ---
@@ -49,10 +50,10 @@ for complete details. Live installation in Premiere Pro still requires host veri
 
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.12.0/premiere-pro-mcp-1.12.0.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.12.2/premiere-pro-mcp-1.12.2.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.12.0/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
-4. Restart Premiere, open a project, then open **Window > Extensions > MCP Bridge**.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.12.2/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+4. Restart Premiere, open a project, then open **Window > Extensions > MCP for Adobe Premiere Pro**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
 The Claude bundle contains the local MCP server, so this route does not require Node.js. The Premiere connector is a separate required install. The first prompt is read-only and reports whether the server is installed, configured, connected, and live-verified.
@@ -259,7 +260,7 @@ Add to your VS Code MCP server configuration:
 
 1. Open (or restart) Premiere Pro
 2. The bridge starts automatically using the default temp directory (or its previously saved setting)
-3. Optionally go to **Window > Extensions > MCP Bridge** to confirm the green "Running" status or change the **Temp Directory** to match your MCP client config
+3. Optionally go to **Window > Extensions > MCP for Adobe Premiere Pro** to confirm the green "Running" status or change the **Temp Directory** to match your MCP client config
 4. Ask your AI assistant to run `get_capabilities`, then `ping`, with Premiere open.
 5. For a safe first request, ask: *"What is my current Premiere Pro project and active sequence? Do not make changes."*
 
@@ -275,11 +276,11 @@ From a clone of this repository:
 ```bash
 codex plugin marketplace add .
 codex plugin add premiere-pro@premiere-pro-mcp
-npx -y premiere-pro-mcp@1.12.0 --install-cep
+npx -y premiere-pro-mcp@1.12.2 --install-cep
 ```
 
 Restart Premiere Pro and start a new Codex session after installation. The plugin
-launches `premiere-pro-mcp@1.12.0` through `npx`; the separate CEP installation is
+launches `premiere-pro-mcp@1.12.2` through `npx`; the separate CEP installation is
 required because the MCP server communicates with the running Premiere host through
 the local bridge.
 
@@ -299,7 +300,7 @@ For Claude Code, add this repository as a marketplace and install the plugin:
 Then install the Premiere bridge and start a new Claude Code session:
 
 ```bash
-npx -y premiere-pro-mcp@1.12.0 --install-cep
+npx -y premiere-pro-mcp@1.12.2 --install-cep
 ```
 
 The Claude Code package lives in
@@ -453,7 +454,7 @@ argument, undo, confirmation, and live-host boundaries.
 
 ## Architecture
 
-![Local-first Premiere Pro MCP workflow from AI assistant through the MCP bridge to a verified Premiere result](landing/public/marketing/premiere-pro-mcp-workflow-v1.png)
+![Local-first MCP for Adobe Premiere Pro workflow from AI assistant through the MCP bridge to a verified Premiere result](landing/public/marketing/premiere-pro-mcp-workflow-v1.png)
 
 **Local (stdio):**
 
@@ -731,7 +732,7 @@ A live instance is running at **https://premiere-pro-mcp.fly.dev**.
 git clone https://github.com/leancoderkavy/premiere-pro-mcp.git
 cd premiere-pro-mcp
 fly apps create your-app-name
-# Required: add bearer token auth
+# Required: add bearer token auth. Use a unique, high-entropy secret per deployment.
 fly secrets set MCP_AUTH_TOKEN=your-secret-token
 fly deploy --remote-only
 ```
@@ -752,6 +753,7 @@ Then connect with:
 
 > **Note:** The file bridge still requires the CEP plugin to share the same `PREMIERE_TEMP_DIR`. For cloud deployments this means running a sync agent or using `fly proxy` / WireGuard to reach your local machine.
 > `detect_silence` can analyze only media paths available inside the server filesystem; a desktop-only path is not automatically available to a remote Fly machine.
+> For a shared or multi-user remote deployment, put a managed identity-aware edge in front of the server and replace the shared bearer secret with per-user authorization. The built-in limiter is intentionally process-local defense in depth, not a substitute for an edge/WAF or account system.
 
 ---
 
@@ -768,14 +770,24 @@ Then connect with:
 | `PREMIERE_CONTEXT_DIR` | Override the local project-context storage directory | OS application-data directory |
 | `PORT` | HTTP port (HTTP/SSE transport only) | `3000` |
 | `MCP_AUTH_TOKEN` | Bearer token required by the HTTP transport | unset |
-| `ALLOW_UNAUTHENTICATED` | Set to `1` to run HTTP without auth (unsafe; throwaway instances only) | unset |
+| `ALLOW_UNAUTHENTICATED` | Set to `1` only for local/test HTTP harnesses; it is rejected when `NODE_ENV=production` | unset |
+| `MCP_MAX_REQUEST_BYTES` | Maximum HTTP MCP request body size | `1048576` |
+| `MCP_HEADERS_TIMEOUT_MS` | Maximum time to receive request headers | `10000` |
+| `MCP_REQUEST_TIMEOUT_MS` | Maximum time to receive an HTTP request | `60000` |
+| `MCP_KEEP_ALIVE_TIMEOUT_MS` | Idle keep-alive socket timeout | `5000` |
+| `MCP_MAX_REQUESTS_PER_SOCKET` | Requests permitted on one keep-alive socket | `100` |
+| `MCP_MAX_CONCURRENT_REQUESTS` | In-flight authenticated MCP request ceiling | `8` |
+| `MCP_RATE_LIMIT_PER_MINUTE` | Per-credential token-bucket refill rate | `120` |
+| `MCP_RATE_LIMIT_BURST` | Per-credential short burst allowance | `30` |
+| `MCP_MAX_RATE_LIMIT_KEYS` | In-memory rate-limit identity ceiling | `2048` |
+| `MCP_TRUST_PROXY` | Set to `1` only behind a proxy that overwrites `X-Forwarded-For` | unset |
 | `POSTHOG_API_KEY` | PostHog project token; enables privacy-safe MCP usage telemetry | unset |
 | `POSTHOG_HOST` | PostHog ingestion host | `https://us.i.posthog.com` |
 | `POSTHOG_ENVIRONMENT` | Environment property attached to telemetry events | `production` |
 | `POSTHOG_DISTINCT_ID` | Optional stable anonymous server identifier | Fly machine ID or random boot ID |
 
 When PostHog is enabled, the server records `mcp_connection_attempt`,
-`mcp_request`, and `mcp_tool_call`. Events contain operational fields such as
+`mcp_request`, `mcp_request_rejected`, and `mcp_tool_call`. Events contain operational fields such as
 method, tool name, outcome, status code, and duration. Authentication tokens,
 IP addresses, MCP arguments, project paths, media names, and tool results are
 never sent. Person profiles are disabled for these events.
@@ -865,8 +877,14 @@ by default. Enable them only by setting
 
 - **Run it locally over stdio** unless you have a specific reason not to. That's the safe default.
 - **The HTTP transport (`http-server`) requires `MCP_AUTH_TOKEN`** and refuses to start
-  without it. It binds `0.0.0.0` and is remotely reachable, so never expose it publicly
-  without a strong token (set `ALLOW_UNAUTHENTICATED=1` only for a throwaway public instance).
+  without it in production. It binds `0.0.0.0` and is remotely reachable, so never expose it publicly
+  without a strong token and edge controls. `ALLOW_UNAUTHENTICATED=1` is limited to non-production local/test use.
+- **The HTTP transport admits only exact `/mcp` Streamable HTTP requests**, enforces
+  body/socket/request limits, and applies a bounded in-process per-credential rate and concurrency limit before
+  MCP request parsing or Premiere bridge work begins. It returns `413`, `429`, or `503` on containment failures. Configure an
+  upstream rate limit and request-size limit too; process-local counters do not protect a multi-machine deployment.
+- **The landing CSP uses a per-response nonce for scripts**, and its static assets use explicit cache policies.
+  Keep the server in front of the exported landing so those controls are not bypassed by a separate static host.
 - The bridge temp directory is created private to your user (mode `0700`), and the server
   refuses to use one owned by another user — relevant on shared machines, where the CEP
   panel would otherwise execute any `cmd_*.jsx` staged there.

package/cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.12.0" ExtensionBundleName="MCP Bridge">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.12.2" ExtensionBundleName="MCP for Adobe Premiere Pro">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.12.0"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.12.0"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.12.2"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.12.2"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>
@@ -31,7 +31,7 @@
         </Lifecycle>
         <UI>
           <Type>Panel</Type>
-          <Menu>MCP Bridge</Menu>
+          <Menu>MCP for Adobe Premiere Pro</Menu>
           <Geometry>
             <Size>
               <Height>300</Height>

package/cep-plugin/index.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>MCP Bridge</title>
+  <title>MCP for Adobe Premiere Pro</title>
   <link rel="stylesheet" href="styles.css">
 </head>
 <body>
@@ -11,8 +11,8 @@
     <header class="panel-header">
       <div class="brand-mark" aria-hidden="true"><span>M</span></div>
       <div class="brand-copy">
-        <h1>MCP Bridge</h1>
-        <p>Premiere Pro connection</p>
+        <h1>MCP for Adobe Premiere Pro</h1>
+        <p>Local Premiere connection</p>
       </div>
       <div class="auto-start"><span></span>Auto-start</div>
     </header>
@@ -81,7 +81,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">Connector updates</span>
-        <strong id="updateTitle">Version 1.12.0</strong>
+        <strong id="updateTitle">Version 1.12.2</strong>
         <span id="updateDetail">Checking for updates…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" disabled>

package/cep-plugin/main.js

@@ -416,7 +416,7 @@ function handleUpdateClick() {
     }
   } catch (e) {}
 
-  log("MCP Bridge CEP plugin loaded");
+  log("MCP for Adobe Premiere Pro CEP connector loaded");
   setStatus("waiting", "Ready — click Start Bridge");
 
   // Always auto-start. The headless instance (StartOn ApplicationActivate) has no

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.12.0";
+  var CURRENT_VERSION = "1.12.2";
   var LATEST_RELEASE_API =
     "https://api.github.com/repos/leancoderkavy/premiere-pro-mcp/releases/latest";
   var RELEASES_URL =

package/dist/bridge/script-builder.js

@@ -115,6 +115,50 @@ function __findClip(nodeId) {
   return null;
 }
 
+// CEP's legacy QE path can enumerate a host's effect catalog before adding an
+// effect to a timeline clip. Recent Premiere builds can expose QE yet return an
+// empty catalog, so distinguish that host limitation from a misspelled effect
+// name. Calling addVideoEffect/addAudioEffect without a catalog entry is not a
+// safe fallback; an available UXP bridge has its own documented effect workflow.
+function __getQeEffectCatalog(kind) {
+  var label = kind === "audio" ? "audio" : "video";
+  if (typeof app === "undefined" || typeof app.enableQE !== "function") {
+    return { ok: false, error: "QE is unavailable in this Premiere build, so " + label + " effects cannot be enumerated or applied." };
+  }
+
+  try {
+    app.enableQE();
+  } catch (eEnable) {
+    return { ok: false, error: "Premiere could not enable QE for " + label + " effect discovery: " + eEnable.toString() };
+  }
+
+  if (typeof qe === "undefined" || !qe.project) {
+    return { ok: false, error: "QE did not expose a project after enableQE(), so " + label + " effects cannot be enumerated or applied." };
+  }
+
+  var getter = kind === "audio" ? qe.project.getAudioEffectList : qe.project.getVideoEffectList;
+  if (typeof getter !== "function") {
+    return { ok: false, error: "This Premiere QE build does not expose the " + label + " effect catalog API." };
+  }
+
+  var effects = null;
+  try {
+    effects = getter.call(qe.project);
+  } catch (eList) {
+    return { ok: false, error: "Premiere could not read its QE " + label + " effect catalog: " + eList.toString() };
+  }
+
+  var count = effects && typeof effects.numItems !== "undefined" ? Number(effects.numItems) : NaN;
+  if (isNaN(count) || count < 1) {
+    return {
+      ok: false,
+      error: "Premiere returned an empty legacy QE " + label + " effect catalog; no effect was applied. If the authenticated Premiere UXP bridge is connected, use manage_clip_effects_uxp with action 'catalog' and then 'add' instead. Existing clip components can still be inspected or edited."
+    };
+  }
+
+  return { ok: true, effects: effects, count: count };
+}
+
 function __getAllClips(seq) {
   if (!seq) seq = app.project.activeSequence;
   if (!seq) return [];

package/dist/http-admission.d.ts

@@ -0,0 +1,79 @@
+import type http from "node:http";
+export declare const MCP_HTTP_METHODS: readonly ["GET", "POST", "DELETE"];
+export interface HttpAuthConfiguration {
+    authToken?: string;
+    allowUnauthenticated: boolean;
+}
+export interface HttpAdmissionSettings {
+    maxRequestBytes: number;
+    headersTimeoutMs: number;
+    requestTimeoutMs: number;
+    keepAliveTimeoutMs: number;
+    maxRequestsPerSocket: number;
+    maxConcurrentRequests: number;
+    rateLimitPerMinute: number;
+    rateLimitBurst: number;
+    maxRateLimitKeys: number;
+    trustProxy: boolean;
+}
+export interface AdmissionMetrics {
+    activeRequests: number;
+    trackedRateLimitKeys: number;
+}
+export type AdmissionDecision = {
+    accepted: true;
+    release: () => void;
+} | {
+    accepted: false;
+    reason: "rate_limited" | "at_capacity";
+    statusCode: 429 | 503;
+    retryAfterSeconds: number;
+};
+/**
+ * Reads the public-HTTP containment settings. Invalid values fail startup so a
+ * typo cannot silently turn a request or socket bound into an unlimited one.
+ */
+export declare function readHttpAdmissionSettings(env: NodeJS.ProcessEnv): HttpAdmissionSettings;
+/**
+ * A network-reachable editor control plane must never start unauthenticated in
+ * production. The override remains available only for local development and
+ * test harnesses where it does not create a public deployment.
+ */
+export declare function readHttpAuthConfiguration(env: NodeJS.ProcessEnv): HttpAuthConfiguration;
+export declare function getRequestPathname(rawUrl: string | undefined): string | undefined;
+export declare function isSupportedMcpMethod(method: string | undefined): boolean;
+export declare function requestContentLength(req: Pick<http.IncomingMessage, "headers">): number | undefined;
+export declare function exceedsRequestBodyLimit(req: Pick<http.IncomingMessage, "headers">, maxRequestBytes: number): boolean;
+export declare class RequestBodyTooLargeError extends Error {
+    constructor();
+}
+/**
+ * Reads an MCP request body with a hard byte cap before it reaches the transport.
+ * This avoids attaching a second live data listener beside the transport, which
+ * can otherwise race and consume a fast chunked body before the transport does.
+ */
+export declare function readBoundedRequestBody(req: http.IncomingMessage, maxRequestBytes: number): Promise<Buffer>;
+export declare function isAuthorizedBearer(req: Pick<http.IncomingMessage, "headers">, authToken: string | undefined): boolean;
+/**
+ * The edge is authoritative by default. Honor X-Forwarded-For only after an
+ * operator explicitly declares the proxy trusted; otherwise it is attacker
+ * input and must not be used as a rate-limit identity.
+ */
+export declare function rateLimitIdentity(req: Pick<http.IncomingMessage, "headers" | "socket">, authorizedCredential: string | undefined, trustProxy: boolean): string;
+/**
+ * Bounded, process-local protection for a single machine. It deliberately does
+ * not log or export identities. An edge/WAF remains necessary for fleet-wide
+ * protection across restarts and multiple instances.
+ */
+export declare class HttpAdmissionController {
+    private readonly settings;
+    private readonly clock;
+    private readonly buckets;
+    private activeRequests;
+    constructor(settings: Pick<HttpAdmissionSettings, "maxConcurrentRequests" | "rateLimitPerMinute" | "rateLimitBurst" | "maxRateLimitKeys">, clock?: () => number);
+    acquire(identity: string): AdmissionDecision;
+    metrics(): AdmissionMetrics;
+    private getOrCreateBucket;
+    private pruneIdleBuckets;
+}
+//# sourceMappingURL=http-admission.d.ts.map

package/dist/http-admission.js

@@ -0,0 +1,231 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+export const MCP_HTTP_METHODS = ["GET", "POST", "DELETE"];
+const ONE_MINUTE_MS = 60_000;
+function readBoundedInteger(env, name, fallback, minimum, maximum) {
+    const raw = env[name];
+    if (raw === undefined || raw === "")
+        return fallback;
+    if (!/^\d+$/.test(raw)) {
+        throw new Error(`${name} must be an integer between ${minimum} and ${maximum}`);
+    }
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`${name} must be an integer between ${minimum} and ${maximum}`);
+    }
+    return value;
+}
+/**
+ * Reads the public-HTTP containment settings. Invalid values fail startup so a
+ * typo cannot silently turn a request or socket bound into an unlimited one.
+ */
+export function readHttpAdmissionSettings(env) {
+    const rateLimitPerMinute = readBoundedInteger(env, "MCP_RATE_LIMIT_PER_MINUTE", 120, 1, 10_000);
+    const rateLimitBurst = readBoundedInteger(env, "MCP_RATE_LIMIT_BURST", 30, 1, rateLimitPerMinute);
+    return {
+        maxRequestBytes: readBoundedInteger(env, "MCP_MAX_REQUEST_BYTES", 1_048_576, 1_024, 10_485_760),
+        headersTimeoutMs: readBoundedInteger(env, "MCP_HEADERS_TIMEOUT_MS", 10_000, 1_000, 60_000),
+        requestTimeoutMs: readBoundedInteger(env, "MCP_REQUEST_TIMEOUT_MS", 60_000, 1_000, 300_000),
+        keepAliveTimeoutMs: readBoundedInteger(env, "MCP_KEEP_ALIVE_TIMEOUT_MS", 5_000, 1_000, 60_000),
+        maxRequestsPerSocket: readBoundedInteger(env, "MCP_MAX_REQUESTS_PER_SOCKET", 100, 1, 10_000),
+        maxConcurrentRequests: readBoundedInteger(env, "MCP_MAX_CONCURRENT_REQUESTS", 8, 1, 128),
+        rateLimitPerMinute,
+        rateLimitBurst,
+        maxRateLimitKeys: readBoundedInteger(env, "MCP_MAX_RATE_LIMIT_KEYS", 2_048, 16, 100_000),
+        trustProxy: env.MCP_TRUST_PROXY === "1",
+    };
+}
+/**
+ * A network-reachable editor control plane must never start unauthenticated in
+ * production. The override remains available only for local development and
+ * test harnesses where it does not create a public deployment.
+ */
+export function readHttpAuthConfiguration(env) {
+    const authToken = env.MCP_AUTH_TOKEN?.trim();
+    if (authToken)
+        return { authToken, allowUnauthenticated: false };
+    if (env.ALLOW_UNAUTHENTICATED === "1" && env.NODE_ENV !== "production") {
+        return { allowUnauthenticated: true };
+    }
+    throw new Error("MCP_AUTH_TOKEN is required for the HTTP transport. " +
+        "ALLOW_UNAUTHENTICATED=1 is permitted only outside NODE_ENV=production.");
+}
+export function getRequestPathname(rawUrl) {
+    if (!rawUrl)
+        return undefined;
+    try {
+        return new URL(rawUrl, "http://localhost").pathname;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isSupportedMcpMethod(method) {
+    return MCP_HTTP_METHODS.some((allowed) => allowed === method);
+}
+export function requestContentLength(req) {
+    const header = req.headers["content-length"];
+    const value = Array.isArray(header) ? header[0] : header;
+    if (value === undefined)
+        return undefined;
+    if (!/^\d+$/.test(value))
+        return Number.NaN;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : Number.NaN;
+}
+export function exceedsRequestBodyLimit(req, maxRequestBytes) {
+    const contentLength = requestContentLength(req);
+    return contentLength !== undefined && (!Number.isFinite(contentLength) || contentLength > maxRequestBytes);
+}
+export class RequestBodyTooLargeError extends Error {
+    constructor() {
+        super("Request body too large");
+        this.name = "RequestBodyTooLargeError";
+    }
+}
+/**
+ * Reads an MCP request body with a hard byte cap before it reaches the transport.
+ * This avoids attaching a second live data listener beside the transport, which
+ * can otherwise race and consume a fast chunked body before the transport does.
+ */
+export function readBoundedRequestBody(req, maxRequestBytes) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let receivedBytes = 0;
+        const cleanup = () => {
+            req.off("data", onData);
+            req.off("end", onEnd);
+            req.off("error", onError);
+            req.off("aborted", onAborted);
+        };
+        const onData = (chunk) => {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+            receivedBytes += buffer.length;
+            if (receivedBytes <= maxRequestBytes) {
+                chunks.push(buffer);
+                return;
+            }
+            cleanup();
+            // Drain rather than destroy so the caller can reliably send its 413.
+            req.resume();
+            reject(new RequestBodyTooLargeError());
+        };
+        const onEnd = () => {
+            cleanup();
+            resolve(Buffer.concat(chunks));
+        };
+        const onError = (error) => {
+            cleanup();
+            reject(error);
+        };
+        const onAborted = () => {
+            cleanup();
+            reject(new Error("Request aborted"));
+        };
+        req.on("data", onData);
+        req.once("end", onEnd);
+        req.once("error", onError);
+        req.once("aborted", onAborted);
+    });
+}
+export function isAuthorizedBearer(req, authToken) {
+    if (!authToken)
+        return true;
+    const header = req.headers.authorization;
+    const value = Array.isArray(header) ? header[0] : header ?? "";
+    if (!value.startsWith("Bearer "))
+        return false;
+    const provided = Buffer.from(value.slice(7));
+    const expected = Buffer.from(authToken);
+    if (provided.length !== expected.length)
+        return false;
+    return timingSafeBufferEqual(provided, expected);
+}
+function timingSafeBufferEqual(left, right) {
+    return timingSafeEqual(left, right);
+}
+function hashedIdentity(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 32);
+}
+/**
+ * The edge is authoritative by default. Honor X-Forwarded-For only after an
+ * operator explicitly declares the proxy trusted; otherwise it is attacker
+ * input and must not be used as a rate-limit identity.
+ */
+export function rateLimitIdentity(req, authorizedCredential, trustProxy) {
+    if (authorizedCredential)
+        return `credential:${hashedIdentity(authorizedCredential)}`;
+    const forwarded = req.headers["x-forwarded-for"];
+    const forwardedValue = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+    const remoteAddress = trustProxy && forwardedValue
+        ? forwardedValue.split(",")[0].trim()
+        : req.socket?.remoteAddress ?? "unknown";
+    return `ip:${hashedIdentity(remoteAddress || "unknown")}`;
+}
+/**
+ * Bounded, process-local protection for a single machine. It deliberately does
+ * not log or export identities. An edge/WAF remains necessary for fleet-wide
+ * protection across restarts and multiple instances.
+ */
+export class HttpAdmissionController {
+    settings;
+    clock;
+    buckets = new Map();
+    activeRequests = 0;
+    constructor(settings, clock = Date.now) {
+        this.settings = settings;
+        this.clock = clock;
+    }
+    acquire(identity) {
+        const now = this.clock();
+        this.pruneIdleBuckets(now);
+        const bucket = this.getOrCreateBucket(identity, now);
+        if (!bucket) {
+            return { accepted: false, reason: "rate_limited", statusCode: 429, retryAfterSeconds: 60 };
+        }
+        const elapsed = Math.max(0, now - bucket.updatedAt);
+        const refill = elapsed * (this.settings.rateLimitPerMinute / ONE_MINUTE_MS);
+        bucket.tokens = Math.min(this.settings.rateLimitBurst, bucket.tokens + refill);
+        bucket.updatedAt = now;
+        if (bucket.tokens < 1) {
+            const missing = 1 - bucket.tokens;
+            const retryAfterSeconds = Math.max(1, Math.ceil((missing / this.settings.rateLimitPerMinute) * 60));
+            return { accepted: false, reason: "rate_limited", statusCode: 429, retryAfterSeconds };
+        }
+        if (this.activeRequests >= this.settings.maxConcurrentRequests) {
+            return { accepted: false, reason: "at_capacity", statusCode: 503, retryAfterSeconds: 1 };
+        }
+        bucket.tokens -= 1;
+        this.activeRequests += 1;
+        let released = false;
+        return {
+            accepted: true,
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                this.activeRequests = Math.max(0, this.activeRequests - 1);
+            },
+        };
+    }
+    metrics() {
+        return { activeRequests: this.activeRequests, trackedRateLimitKeys: this.buckets.size };
+    }
+    getOrCreateBucket(identity, now) {
+        const existing = this.buckets.get(identity);
+        if (existing)
+            return existing;
+        if (this.buckets.size >= this.settings.maxRateLimitKeys)
+            return undefined;
+        const bucket = { tokens: this.settings.rateLimitBurst, updatedAt: now };
+        this.buckets.set(identity, bucket);
+        return bucket;
+    }
+    pruneIdleBuckets(now) {
+        const maxIdleMs = Math.max(ONE_MINUTE_MS, Math.ceil((this.settings.rateLimitBurst / this.settings.rateLimitPerMinute) * ONE_MINUTE_MS) * 2);
+        for (const [identity, bucket] of this.buckets) {
+            if (now - bucket.updatedAt > maxIdleMs)
+                this.buckets.delete(identity);
+        }
+    }
+}
+//# sourceMappingURL=http-admission.js.map

package/dist/http-security.d.ts

@@ -1,4 +1,8 @@
 import type http from "node:http";
+export interface HttpSecurityHeaderOptions {
+    scriptNonce?: string;
+}
+export declare function buildContentSecurityPolicy(options?: HttpSecurityHeaderOptions): string;
 export declare const HTTP_SECURITY_HEADERS: Readonly<{
     "Content-Security-Policy": string;
     "Strict-Transport-Security": "max-age=31536000; includeSubDomains";
@@ -8,5 +12,5 @@ export declare const HTTP_SECURITY_HEADERS: Readonly<{
     "Permissions-Policy": "camera=(), microphone=(), geolocation=()";
     "Cross-Origin-Opener-Policy": "same-origin";
 }>;
-export declare function applyHttpSecurityHeaders(res: http.ServerResponse): void;
+export declare function applyHttpSecurityHeaders(res: http.ServerResponse, options?: HttpSecurityHeaderOptions): void;
 //# sourceMappingURL=http-security.d.ts.map