modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add code reference links and backticks to JSDoc comments (#1484)

Browse source 
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
This commit is contained in:
Jonathan Hefner 2026-02-11 16:40:32 -06:00 • committed by GitHub
commit 42b335953a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 400 additions and 400 deletions
Download patch file Download diff file Expand all files Collapse all files

10
packages/middleware/express/src/express.ts
View file

@ -8,17 +8,17 @@ import { hostHeaderValidation, localhostHostValidation } from './middleware/host
*/
export interface CreateMcpExpressAppOptions {
/**
* The hostname to bind to. Defaults to '127.0.0.1'.
* When set to '127.0.0.1', 'localhost', or '::1', DNS rebinding protection is automatically enabled.
* The hostname to bind to. Defaults to `'127.0.0.1'`.
* When set to `'127.0.0.1'`, `'localhost'`, or `'::1'`, DNS rebinding protection is automatically enabled.
*/
host?: string;
/**
* List of allowed hostnames for DNS rebinding protection.
* If provided, host header validation will be applied using this list.
* For IPv6, provide addresses with brackets (e.g., '[::1]').
* For IPv6, provide addresses with brackets (e.g., `'[::1]'`).
*
* This is useful when binding to '0.0.0.0' or '::' but still wanting
* This is useful when binding to `'0.0.0.0'` or `'::'` but still wanting
* to restrict which hostnames are allowed.
*/
allowedHosts?: string[];
@ -27,7 +27,7 @@ export interface CreateMcpExpressAppOptions {
/**
* Creates an Express application pre-configured for MCP servers.
*
* When the host is '127.0.0.1', 'localhost', or '::1' (the default is '127.0.0.1'),
* When the host is `'127.0.0.1'`, `'localhost'`, or `'::1'` (the default is `'127.0.0.1'`),
* DNS rebinding protection middleware is automatically applied to protect against
* DNS rebinding attacks on localhost servers.
*

6
packages/middleware/express/src/middleware/hostHeaderValidation.ts
View file

@ -3,7 +3,7 @@ import type { NextFunction, Request, RequestHandler, Response } from 'express';
/**
* Express middleware for DNS rebinding protection.
* Validates Host header hostname (port-agnostic) against an allowed list.
* Validates `Host` header hostname (port-agnostic) against an allowed list.
*
* This is particularly important for servers without authorization or HTTPS,
* such as localhost servers or development servers. DNS rebinding attacks can
@ -11,7 +11,7 @@ import type { NextFunction, Request, RequestHandler, Response } from 'express';
* localhost address, allowing malicious websites to access your local server.
*
* @param allowedHostnames - List of allowed hostnames (without ports).
* For IPv6, provide the address with brackets (e.g., '[::1]').
* For IPv6, provide the address with brackets (e.g., `[::1]`).
* @returns Express middleware function
*
* @example
@ -40,7 +40,7 @@ export function hostHeaderValidation(allowedHostnames: string[]): RequestHandler
/**
* Convenience middleware for localhost DNS rebinding protection.
* Allows only localhost, 127.0.0.1, and [::1] (IPv6 localhost) hostnames.
* Allows only `localhost`, `127.0.0.1`, and `[::1]` (IPv6 localhost) hostnames.
*
* @example
* ```typescript

6
packages/middleware/hono/src/hono.ts
View file

@ -8,8 +8,8 @@ import { hostHeaderValidation, localhostHostValidation } from './middleware/host
*/
export interface CreateMcpHonoAppOptions {
/**
* The hostname to bind to. Defaults to '127.0.0.1'.
* When set to '127.0.0.1', 'localhost', or '::1', DNS rebinding protection is automatically enabled.
* The hostname to bind to. Defaults to `'127.0.0.1'`.
* When set to `'127.0.0.1'`, `'localhost'`, or `'::1'`, DNS rebinding protection is automatically enabled.
*/
host?: string;
@ -27,7 +27,7 @@ export interface CreateMcpHonoAppOptions {
/**
* Creates a Hono application pre-configured for MCP servers.
*
* When the host is '127.0.0.1', 'localhost', or '::1' (the default is '127.0.0.1'),
* When the host is `'127.0.0.1'`, `'localhost'`, or `'::1'` (the default is `'127.0.0.1'`),
* DNS rebinding protection middleware is automatically applied to protect against
* DNS rebinding attacks on localhost servers.
*

4
packages/middleware/hono/src/middleware/hostHeaderValidation.ts
View file

@ -3,7 +3,7 @@ import type { MiddlewareHandler } from 'hono';
/**
* Hono middleware for DNS rebinding protection.
* Validates Host header hostname (port-agnostic) against an allowed list.
* Validates `Host` header hostname (port-agnostic) against an allowed list.
*/
export function hostHeaderValidation(allowedHostnames: string[]): MiddlewareHandler {
return async (c, next) => {
@ -26,7 +26,7 @@ export function hostHeaderValidation(allowedHostnames: string[]): MiddlewareHand
}
/**
* Convenience middleware for localhost DNS rebinding protection.
* Convenience middleware for `localhost` DNS rebinding protection.
*/
export function localhostHostValidation(): MiddlewareHandler {
return hostHeaderValidation(localhostAllowedHostnames());

26
packages/middleware/node/src/streamableHttp.ts
View file

@ -1,10 +1,10 @@
/**
* Node.js Streamable HTTP Server Transport
*
* This is a thin wrapper around `WebStandardStreamableHTTPServerTransport` that provides
* compatibility with Node.js HTTP server (IncomingMessage/ServerResponse).
* This is a thin wrapper around {@linkcode WebStandardStreamableHTTPServerTransport} that provides
* compatibility with Node.js HTTP server (`IncomingMessage`/`ServerResponse`).
*
* For web-standard environments (Cloudflare Workers, Deno, Bun), use `WebStandardStreamableHTTPServerTransport` directly.
* For web-standard environments (Cloudflare Workers, Deno, Bun), use {@linkcode WebStandardStreamableHTTPServerTransport} directly.
*/
import type { IncomingMessage, ServerResponse } from 'node:http';
@ -15,9 +15,9 @@ import type { WebStandardStreamableHTTPServerTransportOptions } from '@modelcont
import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
/**
* Configuration options for StreamableHTTPServerTransport
* Configuration options for {@linkcode NodeStreamableHTTPServerTransport}
*
* This is an alias for WebStandardStreamableHTTPServerTransportOptions for backward compatibility.
* This is an alias for {@linkcode WebStandardStreamableHTTPServerTransportOptions} for backward compatibility.
*/
export type StreamableHTTPServerTransportOptions = WebStandardStreamableHTTPServerTransportOptions;
@ -25,7 +25,7 @@ export type StreamableHTTPServerTransportOptions = WebStandardStreamableHTTPServ
* Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
* It supports both SSE streaming and direct HTTP responses.
*
* This is a wrapper around `WebStandardStreamableHTTPServerTransport` that provides Node.js HTTP compatibility.
* This is a wrapper around {@linkcode WebStandardStreamableHTTPServerTransport} that provides Node.js HTTP compatibility.
* It uses the `@hono/node-server` library to convert between Node.js HTTP and Web Standard APIs.
*
* Usage example:
@ -50,8 +50,8 @@ export type StreamableHTTPServerTransportOptions = WebStandardStreamableHTTPServ
* In stateful mode:
* - Session ID is generated and included in response headers
* - Session ID is always included in initialization responses
* - Requests with invalid session IDs are rejected with 404 Not Found
* - Non-initialization requests without a session ID are rejected with 400 Bad Request
* - Requests with invalid session IDs are rejected with `404 Not Found`
* - Non-initialization requests without a session ID are rejected with `400 Bad Request`
* - State is maintained in-memory (connections, message history)
*
* In stateless mode:
@ -125,7 +125,7 @@ export class NodeStreamableHTTPServerTransport implements Transport {
}
/**
* Starts the transport. This is required by the Transport interface but is a no-op
* Starts the transport. This is required by the {@linkcode Transport} interface but is a no-op
* for the Streamable HTTP transport as connections are managed per-request.
*/
async start(): Promise<void> {
@ -147,13 +147,13 @@ export class NodeStreamableHTTPServerTransport implements Transport {
}
/**
* Handles an incoming HTTP request, whether GET or POST.
* Handles an incoming HTTP request, whether `GET` or `POST`.
*
* This method converts Node.js HTTP objects to Web Standard Request/Response
* and delegates to the underlying WebStandardStreamableHTTPServerTransport.
* and delegates to the underlying {@linkcode WebStandardStreamableHTTPServerTransport}.
*
* @param req - Node.js IncomingMessage, optionally with auth property from middleware
* @param res - Node.js ServerResponse
* @param req - Node.js `IncomingMessage`, optionally with `auth` property from middleware
* @param res - Node.js `ServerResponse`
* @param parsedBody - Optional pre-parsed body from body-parser middleware
*/
async handleRequest(req: IncomingMessage & { auth?: AuthInfo }, res: ServerResponse, parsedBody?: unknown): Promise<void> {