From 5482d905a92555248226d76f66c2df40634c61f0 Mon Sep 17 00:00:00 2001
From: Basil Hosmer <basil@anthropic.com>
Date: Mon, 6 Oct 2025 21:38:33 -0400
Subject: [PATCH] Fix security vulnerabilities identified by CodeQL

- Fix information exposure: return generic error instead of stack traces in sse.ts
- Add missing rate limiting to root route in index.ts
---
 mcp-server/src/handlers/sse.ts | 2 +-
 mcp-server/src/index.ts        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mcp-server/src/handlers/sse.ts b/mcp-server/src/handlers/sse.ts
index 409d792..9da3477 100644
--- a/mcp-server/src/handlers/sse.ts
+++ b/mcp-server/src/handlers/sse.ts
@@ -88,7 +88,7 @@ export async function handleMessage(req: Request, res: Response) {
 
     body = JSON.stringify(req.body);
   } catch (error) {
-    res.status(400).json(error);
+    res.status(400).json({ error: "Bad request" });
     logger.error('Bad POST request', error as Error, {
       sessionId,
       contentType: req.headers['content-type']
diff --git a/mcp-server/src/index.ts b/mcp-server/src/index.ts
index d1ed039..e035268 100644
--- a/mcp-server/src/index.ts
+++ b/mcp-server/src/index.ts
@@ -229,7 +229,7 @@ app.get("/styles.css", staticFileRateLimit, (req, res) => {
 });
 
 // Splash page
-app.get("/", (req, res) => {
+app.get("/", staticFileRateLimit, (req, res) => {
   const splashPath = path.join(__dirname, "static", "index.html");
   res.sendFile(splashPath);
 });