modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796)

Browse source 
Closes #1795.

Enforce localhost-only binding in code (the "never 0.0.0.0" rule was only a spec note): refuse an all-interfaces HOST — across every spelling the OS binds as the wildcard (inet_aton decimal/octal/hex, IPv6, IPv4-mapped, zone-scoped, IDNA/Unicode) — unless DANGEROUSLY_BIND_ALL_INTERFACES=true (Docker's sanctioned opt-in). Fixes the reported stdio-connect 403 by expanding the default loopback origin allow-list to all three interchangeable forms.

Hardening surfaced across an extended review: closes an IDNA/fullwidth wildcard bypass, a blank-ALLOWED_ORIGINS fail-open, and the CLI/TUI OAuth-callback wildcard bind (loopback-only now, RFC 8252); canonicalizes the origin allow-list the way a browser does; derives frame-ancestors from the real embedder list (IPv6-literal exclusion verified in headless Chromium); strictPort on all three bind points; and preserves the CLI exit-code map + JSON envelope through the mcp-inspector --cli launcher path. Shared host normalization lives in core/node/hostUrl.ts. Docs + tests + smokes throughout.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
This commit is contained in:
Cliff Hall 2026-07-26 22:15:10 -04:00 • committed by GitHub
commit cea22d86b8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 1610 additions and 86 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/auth/node/oauth-callback-server.ts
View file

@ -1,4 +1,5 @@
import { createServer, type Server } from "node:http";
import { formatHostForUrl } from "../../node/hostUrl.js";
import { parseOAuthCallbackParams } from "../utils.js";
import { generateOAuthErrorDescription } from "../utils.js";
@ -220,7 +221,5 @@ export function createOAuthCallbackServer(): OAuthCallbackServer {
}
function buildRedirectUrl(host: string, port: number, path: string): string {
const needsBrackets = host.includes(":") && !host.startsWith("[");
const formattedHost = needsBrackets ? `[${host}]` : host;
return `http://${formattedHost}:${port}${path}`;
return `http://${formatHostForUrl(host)}:${port}${path}`;
}

31
core/auth/node/runner-oauth-callback.ts
View file

@ -10,6 +10,12 @@
* unsupported; override via `--callback-url` / `MCP_OAUTH_CALLBACK_URL`.
*/
import {
formatHostForUrl,
isLoopbackHost,
stripBrackets,
} from "../../node/hostUrl.js";
export const RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME = "127.0.0.1";
/** Default loopback port for TUI/CLI OAuth callback (6276 ≈ T9 "MCPO", MCP OAuth). */
export const RUNNER_OAUTH_CALLBACK_DEFAULT_PORT = 6276;
@ -58,6 +64,19 @@ export function parseRunnerOAuthCallbackUrl(
throw new Error("OAuth callback URL must include a hostname");
}
/* v8 ignore stop */
// The callback listener receives the OAuth *authorization code* over plaintext
// http, so it must be loopback (RFC 8252 §7.3) — a routable host would deliver
// the credential in cleartext over the network. Reject anything non-loopback,
// not just the all-interfaces wildcard.
if (!isLoopbackHost(hostname)) {
throw new Error(
`OAuth callback URL must bind a loopback host (localhost / 127.0.0.1 / ` +
`[::1]), not "${hostname}": the callback listener receives the OAuth ` +
`authorization code over plaintext http, so a network-reachable host ` +
`risks credential interception. Use 127.0.0.1 (and a port-forward if the ` +
`browser is elsewhere).`,
);
}
/* v8 ignore next -- an http: URL always has a non-empty pathname (min "/"), so the fallback is unreachable */
const pathname = url.pathname || "/";
let port: number;
@ -76,7 +95,10 @@ export function parseRunnerOAuthCallbackUrl(
}
/* v8 ignore stop */
}
return { hostname, port, pathname };
// De-bracket an IPv6 host (`url.hostname` keeps the brackets) so `listen()` can
// consume it — `[::1]` fails ENOTFOUND, `::1` binds. formatRunnerOAuthRedirectUrl
// re-brackets via formatHostForUrl for the redirect URI.
return { hostname: stripBrackets(hostname), port, pathname };
}
/**
@ -87,10 +109,5 @@ export function parseRunnerOAuthCallbackUrl(
export function formatRunnerOAuthRedirectUrl(
config: RunnerOAuthCallbackConfig,
): string {
const needsBrackets =
config.hostname.includes(":") && !config.hostname.startsWith("[");
const formattedHost = needsBrackets
? `[${config.hostname}]`
: config.hostname;
return `http://${formattedHost}:${config.port}${config.pathname}`;
return `http://${formatHostForUrl(config.hostname)}:${config.port}${config.pathname}`;
}