| Filename | Latest commit message | Latest commit date |
|---|---|---|
1201cbd82b## What this does Fixes an open redirect plus a handful of small, mostly-invisible hardening changes around it. ## What's in it - **The fix**: trailing-slash redirects no longer let `//evil.com/` redirect off-host. - **SSRF block** on the DNS/HTTP namespace verification — refuses to dial loopback, RFC1918, link-local, multicast, CGNAT, or IP-literal/single-label \"domains\". - **Slow-client guard**: `ReadTimeout` and `IdleTimeout` on the HTTP server (no `WriteTimeout` — would risk cutting off legitimate multi-package publishes). - **Defence-in-depth headers** on the UI (`/`) and 404 responses. - **5xx responses** stop leaking raw DB error text to clients (logged server-side instead). - **Search filter** stops treating `%` and `_` as wildcards. - **Validators**: PyPI/NuGet identifiers URL-escaped before fetching; MCPB no longer follows redirects. - **Misc**: `Version` field bounded to 255 chars; logs quote user input; `BlockedNamespaces` denylist now catches subdomain claimants. Each change is its own commit so they can be reviewed (or reverted) independently. ## Test plan - [ ] CI green - [ ] Synthetic publish in staging for each package type (npm, pypi, nuget, oci, mcpb) — confirms validator changes don't regress - [ ] Quick browser check of `/` after deploy to confirm UI still loads with the new CSP - [ ] `curl https://<host>//evil.com/` — confirm the open redirect is closed 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
| .. | ||
| 2025-07-09.json | ||
| 2025-09-16.json | ||
| 2025-09-29.json | ||
| 2025-10-11.json | ||
| 2025-10-17.json | ||
| 2025-12-11.json | ||
| README.md | ||
Schema Files
This directory contains JSON Schema files that are embedded into the Go binary (using the go:embed directive) for runtime validation.
How Schema Files Get Here
Schema files are automatically synced from the modelcontextprotocol/static repository via the GitHub Actions workflow .github/workflows/sync-schema.yml.
The workflow:
- Checks out the
modelcontextprotocol/staticrepository - Copies all versioned schema files from
static-repo/schemas/*/server.schema.json - Saves them here as
{version}.json(e.g.,2025-10-17.json) - Automatically commits and pushes any new or updated schemas
Do not manually edit files in this directory - they are managed by the sync workflow.
Usage
These schema files are embedded into the Go binary using the go:embed directive for offline schema validation. The embedded schemas are used by the validation code in internal/validators/schema.go to validate server.json files against their specified schema version.
File Naming
Files are named {YYYY-MM-DD}.json where the date corresponds to the schema version (e.g., 2025-10-17.json). This matches the version in the schema's $id field.