@sei-js/mcp-server
Version:
Model Context Protocol (MCP) server for interacting with EVM-compatible networks
38 lines (37 loc) • 2.29 kB
JavaScript
/**
* Creates CORS middleware with secure defaults.
* By default, no CORS headers are set (same-origin only).
*/
export function createCorsMiddleware() {
return (req, res, next) => {
// Handle preflight - reject cross-origin by default
if (req.method === 'OPTIONS') {
return res.sendStatus(204);
}
next();
};
}
/**
* Validates that wallet mode is not used with HTTP transports
* Exits the process if unsafe configuration detected
*/
export function validateSecurityConfig(transportMode, walletMode) {
const isHttpTransport = transportMode === 'streamable-http' || transportMode === 'http-sse';
const isWalletEnabled = walletMode !== 'disabled';
if (isHttpTransport && isWalletEnabled) {
console.error('');
console.error('╔════════════════════════════════════════════════════════════════╗');
console.error('║ SECURITY ERROR ║');
console.error('╠════════════════════════════════════════════════════════════════╣');
console.error('║ Wallet mode cannot be used with HTTP transports! ║');
console.error('║ ║');
console.error('║ HTTP transports expose the server to cross-origin requests, ║');
console.error('║ allowing malicious websites to steal funds from your wallet. ║');
console.error('║ ║');
console.error('║ Use stdio transport instead (default, works with Claude): ║');
console.error('║ $ WALLET_MODE=private-key PRIVATE_KEY=... npx @sei-js/mcp-server');
console.error('╚════════════════════════════════════════════════════════════════╝');
console.error('');
process.exit(1);
}
}