d0b2b4914d* feat: add DNS rebinding protection conformance tests Add a new server conformance scenario to verify that localhost MCP servers properly validate Host headers to prevent DNS rebinding attacks. Checks: - localhost-host-rebinding-rejected: Verifies server returns 403 for non-localhost Host headers (e.g., evil.example.com) - localhost-host-valid-accepted: Verifies server accepts requests with valid localhost Host headers Also updates the everything-server example to use createMcpExpressApp() which includes DNS rebinding protection by default. Closes #103 Co-Authored-By: Claude <noreply@anthropic.com> * feat: add negative test case for DNS rebinding protection Add a minimal MCP server that intentionally omits DNS rebinding protection to serve as a negative test case. This server is expected to FAIL the dns-rebinding-protection scenario. Also update README to document the negative test case. Co-Authored-By: Claude <noreply@anthropic.com> * fix: accept any 4xx status code for DNS rebinding rejection Update the DNS rebinding protection test to accept any 4xx status code as a valid rejection response, not just 403. This accommodates different HTTP semantics: - 403 Forbidden: Per MCP spec - 421 Misdirected Request: RFC 7540 (semantically correct for DNS rebinding) - Other 4xx: Implementation-specific error codes * refactor: address PR review comments - Simplify negative test server (remove event store, sessions) - Update spec reference URL to security_best_practices - Clarify scope: localhost servers without HTTPS/auth - DRY up checks.push using spread operator - Fix valid host check to require 2xx response * fix: include error details in catch block * refactor: simplify negative test server to stateless * refactor: check both Host and Origin headers for DNS rebinding protection - Send both Host and Origin headers in test requests so servers checking either header will pass the conformance test - Add second spec reference for Origin check (transports#security-warning) - Update descriptions to mention both Host and Origin headers - Fix protocol version to 2025-11-25 - Remove unnecessary 'as const' type assertions --------- Co-authored-by: Claude <noreply@anthropic.com>
57 lines
1.6 KiB
JSON
57 lines
1.6 KiB
JSON
{
|
|
"name": "@modelcontextprotocol/conformance",
|
|
"version": "0.1.10",
|
|
"type": "module",
|
|
"license": "MIT",
|
|
"author": "Anthropic, PBC (https://anthropic.com)",
|
|
"homepage": "https://modelcontextprotocol.io",
|
|
"bugs": "https://github.com/modelcontextprotocol/conformance/issues",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/modelcontextprotocol/conformance.git"
|
|
},
|
|
"scripts": {
|
|
"start": "tsx src/index.ts",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"build": "tsdown src/index.ts --minify --clean --target node20",
|
|
"lint": "eslint src/ examples/ && prettier --check .",
|
|
"lint:fix": "eslint src/ examples/ --fix && prettier --write .",
|
|
"lint:fix_check": "npm run lint:fix && git diff --exit-code --quiet",
|
|
"check": "npm run typecheck && npm run lint",
|
|
"typecheck": "tsgo --noEmit",
|
|
"prepack": "npm run build"
|
|
},
|
|
"files": [
|
|
"dist"
|
|
],
|
|
"bin": {
|
|
"conformance": "dist/index.js"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.39.1",
|
|
"@types/express": "^5.0.3",
|
|
"@types/node": "^22.10.2",
|
|
"@typescript/native-preview": "^7.0.0-dev.20251201.1",
|
|
"cors": "^2.8.5",
|
|
"eslint": "^9.8.0",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"lefthook": "^2.0.2",
|
|
"prettier": "3.6.2",
|
|
"tsdown": "^0.15.12",
|
|
"tsx": "^4.7.0",
|
|
"typescript": "^5.5.4",
|
|
"typescript-eslint": "8.48.0",
|
|
"vitest": "^4.0.16"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.25.2",
|
|
"commander": "^14.0.2",
|
|
"eventsource-parser": "^3.0.6",
|
|
"express": "^5.1.0",
|
|
"jose": "^6.1.2",
|
|
"undici": "^7.19.0",
|
|
"yaml": "^2.8.2",
|
|
"zod": "^3.25.76"
|
|
}
|
|
}
|