virlow-mcp 3.11.4 → 3.11.6

package/README.md

@@ -175,10 +175,18 @@ connection to whatever client you point at it. So:
 - The listener binds `127.0.0.1` by default. `--host` will bind elsewhere and
   warns loudly, because anyone who can reach the port and holds the token can
   read your decrypted notes.
-- To reach it from outside, put your own tunnel in front of it
-  (`cloudflared`, `ssh -R`, Tailscale) rather than binding to `0.0.0.0`.
+- **It speaks plain HTTP, not HTTPS.** On loopback that is fine. Off loopback it
+  is not: your notes and the bearer token itself travel unencrypted, readable by
+  anyone on the path. The token authenticates the caller; it does not protect
+  the bytes.
+- So to reach it from outside, put a TLS-terminating tunnel in front of it
+  (`cloudflared`, `ssh -R`, Tailscale) rather than binding to `0.0.0.0`. That is
+  a confidentiality requirement, not a convenience.
 - Treat the token like a password. Delete the file to rotate it; the next start
   mints a new one.
+- While it is on loopback, requests must arrive addressed to `localhost` or
+  `127.0.0.1`. A web page cannot reach it by pointing a hostname it controls at
+  your loopback address — see the DNS rebinding note below.
 
 ## Which folders AI tools can see
 
@@ -270,7 +278,17 @@ transient details.
 - **Credentials never reach the AI.** Login, master password, and any 2FA code are typed
   into the local browser form (served on `127.0.0.1` with a random one-time nonce) and
   go straight from your browser to this process and the Virlow API. No tool call ever
-  carries a password, and the AI model never sees one.
+  carries a password, and the AI model never sees one. The page is served with a
+  content-security policy that permits no script at all, cannot be framed, and is
+  never cached.
+- **DNS rebinding.** Loopback is not the boundary it looks like: a web page can be
+  made to send requests to `127.0.0.1` that your browser treats as same-origin, by
+  pointing a hostname the attacker controls at your loopback address. Both local
+  listeners — the unlock form and `--http` — refuse any request that is not
+  addressed to `localhost` or `127.0.0.1`, which is what a rebound request always
+  fails. The `--http` listener applies this only while it is on loopback: `--host`
+  is a deliberate choice, and a tunnel in front of it legitimately rewrites the
+  address.
 - **Auto-lock.** The vault locks automatically after 4 hours of inactivity, and
   immediately on explicit `lock`. Locking discards the in-memory decryption key and all
   cached memories/notes; any further tool call fails until you `unlock` again. An

package/dist/cli.js

@@ -1238,6 +1238,39 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import * as http from "node:http";
+
+// src/local-origin.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+function withoutPort(host) {
+  return host.replace(/:\d+$/, "").toLowerCase();
+}
+function isLoopbackHost(hostHeader) {
+  if (hostHeader === void 0 || hostHeader === "") return false;
+  return LOOPBACK_HOSTS.has(withoutPort(hostHeader.trim()));
+}
+function isAllowedOrigin(originHeader) {
+  if (originHeader === void 0 || originHeader === "") return true;
+  try {
+    return LOOPBACK_HOSTS.has(new URL(originHeader).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+function rejectReason(headers, enforce) {
+  if (!enforce) return null;
+  if (!isLoopbackHost(headers.host)) return "non-loopback Host";
+  if (!isAllowedOrigin(headers.origin)) return "cross-site Origin";
+  return null;
+}
+var SECURITY_HEADERS = Object.freeze({
+  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+  "x-frame-options": "DENY",
+  "x-content-type-options": "nosniff",
+  "referrer-policy": "no-referrer",
+  "cache-control": "no-store"
+});
+
+// src/unlock.ts
 var UNLOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 var MAX_BAD_NONCE_ATTEMPTS = 3;
 async function performUnlock(api, vault, creds) {
@@ -1337,12 +1370,25 @@ function renderSuccess() {
 </html>`;
 }
 function escapeHtml(input) {
-  return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+function harden(res) {
+  for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
+    res.setHeader(name, value);
+  }
+}
+var MAX_BODY_BYTES = 64 * 1024;
 function readBody(req) {
   return new Promise((resolve, reject) => {
     let data = "";
+    let seen = 0;
     req.on("data", (chunk) => {
+      seen += chunk.byteLength;
+      if (seen > MAX_BODY_BYTES) {
+        reject(new Error("Request body too large"));
+        req.destroy();
+        return;
+      }
       data += chunk.toString("utf8");
     });
     req.on("end", () => resolve(data));
@@ -1402,8 +1448,16 @@ function startUnlockServer(api, vault, opts = {}) {
       });
     });
     async function handleRequest(req, res) {
+      if (rejectReason(req.headers, true) !== null) {
+        harden(res);
+        res.statusCode = 403;
+        res.setHeader("content-type", "text/plain");
+        res.end("Forbidden");
+        return;
+      }
       const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
       if (requestUrl.pathname !== "/unlock") {
+        harden(res);
         res.statusCode = 404;
         res.setHeader("content-type", "text/plain");
         res.end("Not found");
@@ -1412,6 +1466,7 @@ function startUnlockServer(api, vault, opts = {}) {
       const providedNonce = requestUrl.searchParams.get("nonce");
       if (providedNonce !== nonce) {
         badNonceAttempts += 1;
+        harden(res);
         res.statusCode = 403;
         res.setHeader("content-type", "text/plain");
         res.end("Forbidden");
@@ -1421,6 +1476,7 @@ function startUnlockServer(api, vault, opts = {}) {
         return;
       }
       if (req.method === "GET") {
+        harden(res);
         res.statusCode = 200;
         res.setHeader("content-type", "text/html; charset=utf-8");
         res.end(renderForm(nonce));
@@ -1437,18 +1493,21 @@ function startUnlockServer(api, vault, opts = {}) {
         };
         try {
           await performUnlock(api, vault, creds);
+          harden(res);
           res.statusCode = 200;
           res.setHeader("content-type", "text/html; charset=utf-8");
           res.end(renderSuccess());
           finishSuccess();
         } catch (err) {
           const message = err instanceof Error ? err.message : "Unlock failed";
+          harden(res);
           res.statusCode = 200;
           res.setHeader("content-type", "text/html; charset=utf-8");
           res.end(renderForm(nonce, message));
         }
         return;
       }
+      harden(res);
       res.statusCode = 404;
       res.setHeader("content-type", "text/plain");
       res.end("Not found");
@@ -1476,7 +1535,7 @@ function startUnlockServer(api, vault, opts = {}) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.11.4" : "dev";
+var VERSION = true ? "3.11.6" : "dev";
 
 // src/server.ts
 function textResult(text) {
@@ -1931,20 +1990,27 @@ async function handleWithFreshTransport(server, req, res) {
 async function startHttpServer(opts) {
   const host = opts.host ?? "127.0.0.1";
   const mcpPath = opts.path ?? "/mcp";
+  const enforceLocal = host === "127.0.0.1" || host === "::1" || host === "localhost";
   const httpServer = createServer2((req, res) => {
     const url = new URL(req.url ?? "/", `http://${host}`);
+    if (rejectReason(req.headers, enforceLocal) !== null) {
+      res.writeHead(403, { ...SECURITY_HEADERS, "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "forbidden" }));
+      return;
+    }
     if (url.pathname === "/health") {
-      res.writeHead(200, { "content-type": "application/json" });
+      res.writeHead(200, { ...SECURITY_HEADERS, "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
       return;
     }
     if (url.pathname !== mcpPath) {
-      res.writeHead(404).end();
+      res.writeHead(404, SECURITY_HEADERS).end();
       return;
     }
     const provided = bearerFrom(req.headers.authorization);
     if (provided === null || !tokenMatches(provided, opts.token)) {
       res.writeHead(401, {
+        ...SECURITY_HEADERS,
         "content-type": "application/json",
         "www-authenticate": "Bearer"
       });
@@ -2010,7 +2076,7 @@ async function main() {
     );
     if (host !== "127.0.0.1") {
       process.stderr.write(
-        "virlow-mcp: WARNING \u2014 bound to a non-loopback address. Anyone who can reach this port and holds the token can read your decrypted notes.\n"
+        "virlow-mcp: WARNING \u2014 bound to a non-loopback address. Anyone who can reach this port and holds the token can read your decrypted notes.\nvirlow-mcp: WARNING \u2014 this listener speaks plain HTTP, not HTTPS. Off loopback, your notes and the bearer token travel unencrypted. Put a TLS-terminating tunnel in front of it (cloudflared, ssh -R, Tailscale) rather than exposing this port directly.\n"
       );
     }
     process.stderr.write(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "virlow-mcp",
-  "version": "3.11.4",
+  "version": "3.11.6",
   "description": "Local MCP server for Virlow Secure Notes: end-to-end-encrypted AI memories and notes for Cursor, Claude, Codex, and any MCP client.",
   "license": "MIT",
   "type": "module",
@@ -34,9 +34,9 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0",
-    "@batalabs/virlow-crypto": "3.11.4",
-    "@batalabs/virlow-memory": "3.11.4",
-    "@batalabs/virlow-mcp-core": "3.11.4"
+    "@batalabs/virlow-crypto": "3.11.6",
+    "@batalabs/virlow-memory": "3.11.6",
+    "@batalabs/virlow-mcp-core": "3.11.6"
   },
   "scripts": {
     "build": "node build.mjs",