@launchdarkly/mcp-server
Version:
The local [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server for [LaunchDarkly](https://launchdarkly.com/) federal and European Union (EU) environments.
48 lines • 2.23 kB
TypeScript
/**
* SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
* Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
* (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
* G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
* than the certificate covers both.
*/
export declare const BLOCKED_SPKI_SHA256: ReadonlySet<string>;
export declare const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
/** The subset of tls.PeerCertificate this check reads. */
export interface PeerCertificateLike {
raw?: Uint8Array | undefined;
fingerprint256?: string | undefined;
issuer?: {
CN?: string | string[] | undefined;
} | undefined;
issuerCertificate?: PeerCertificateLike | undefined;
}
export declare function isBlockedIssuerName(cn: string | string[] | undefined): boolean;
export declare function spkiSha256(raw: Uint8Array): string;
/**
* Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
* returns a description of the first blocked certificate, if any.
*/
export declare function findBlockedCertificate(cert: PeerCertificateLike): string | undefined;
/**
* A tls checkServerIdentity replacement: rejects blocked chains, then runs
* the runtime's normal hostname verification.
*/
export declare function checkServerIdentity(hostname: string, cert: PeerCertificateLike): Error | undefined;
/**
* Installs the blocklist for this process. On Node.js, global fetch (undici)
* and node:https read tls.checkServerIdentity when they connect. Bun's fetch
* ignores it, so on Bun global fetch is wrapped to pass the check through
* Bun's `tls` fetch option.
*/
export declare function installTlsBlocklist(): void;
export declare function isNodeVersionPatched(version: string): boolean;
export declare function isBunVersionPatched(version: string): boolean;
/**
* Returns a warning when the current runtime does not block the compromised
* eMudhra intermediates natively, or undefined when it does.
*/
export declare function unpatchedRuntimeWarning(versions?: {
node?: string | undefined;
bun?: string | undefined;
}): string | undefined;
//# sourceMappingURL=tls-blocklist.d.ts.map