eve/dist/src/internal/mcp/http-security.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{isLoopbackHostname}from"#shared/network-address.js";function validateMcpHttpRequest(e){let t=validateMcpHttpRequestBase(e);if(t!==void 0)return t;let n=new URL(e.url),r=e.headers.get(`origin`);if(r===null||r.length===0)return;let i;try{i=new URL(r)}catch{return securityError(`Invalid Origin header.`)}if(i.origin!==n.origin)return securityError(`Invalid Origin: ${i.origin}`)}function validateMcpMetadataRequest(e){return validateMcpHttpRequestBase(e)}function validateMcpHttpRequestBase(e){let t;try{t=new URL(e.url)}catch{return securityError(`Invalid MCP request URL.`,400)}if(t.protocol!==`https:`&&!(t.protocol===`http:`&&isLoopbackHostname(t.hostname)))return securityError(`MCP endpoints require HTTPS except on loopback.`);let n=validateHostHeader(e,t);if(n!==void 0)return n}function validateHostHeader(e,t){let n=e.headers.get(`host`);if(n===null||n.length===0)return securityError(`Missing Host header`);let r;try{r=new URL(`${t.protocol}//${n}`)}catch{return securityError(`Invalid Host header`)}if(r.username!==``||r.password!==``||r.pathname!==`/`||r.search!==``||r.hash!==``||r.host!==t.host)return securityError(`Invalid Host header: ${n}`)}function securityError(e,t=403){return Response.json({error:{code:-32e3,message:e},id:null,jsonrpc:`2.0`},{headers:{"content-type":`application/json`},status:t})}export{validateMcpHttpRequest,validateMcpMetadataRequest};