modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add code reference links and backticks to JSDoc comments (#1484)

Browse source 
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
This commit is contained in:
Jonathan Hefner 2026-02-11 16:40:32 -06:00 • committed by GitHub
commit 42b335953a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 400 additions and 400 deletions
Download patch file Download diff file Expand all files Collapse all files

10
packages/middleware/express/src/express.ts
View file

@ -8,17 +8,17 @@ import { hostHeaderValidation, localhostHostValidation } from './middleware/host
*/
export interface CreateMcpExpressAppOptions {
/**
* The hostname to bind to. Defaults to '127.0.0.1'.
* When set to '127.0.0.1', 'localhost', or '::1', DNS rebinding protection is automatically enabled.
* The hostname to bind to. Defaults to `'127.0.0.1'`.
* When set to `'127.0.0.1'`, `'localhost'`, or `'::1'`, DNS rebinding protection is automatically enabled.
*/
host?: string;
/**
* List of allowed hostnames for DNS rebinding protection.
* If provided, host header validation will be applied using this list.
* For IPv6, provide addresses with brackets (e.g., '[::1]').
* For IPv6, provide addresses with brackets (e.g., `'[::1]'`).
*
* This is useful when binding to '0.0.0.0' or '::' but still wanting
* This is useful when binding to `'0.0.0.0'` or `'::'` but still wanting
* to restrict which hostnames are allowed.
*/
allowedHosts?: string[];
@ -27,7 +27,7 @@ export interface CreateMcpExpressAppOptions {
/**
* Creates an Express application pre-configured for MCP servers.
*
* When the host is '127.0.0.1', 'localhost', or '::1' (the default is '127.0.0.1'),
* When the host is `'127.0.0.1'`, `'localhost'`, or `'::1'` (the default is `'127.0.0.1'`),
* DNS rebinding protection middleware is automatically applied to protect against
* DNS rebinding attacks on localhost servers.
*

6
packages/middleware/express/src/middleware/hostHeaderValidation.ts
View file

@ -3,7 +3,7 @@ import type { NextFunction, Request, RequestHandler, Response } from 'express';
/**
* Express middleware for DNS rebinding protection.
* Validates Host header hostname (port-agnostic) against an allowed list.
* Validates `Host` header hostname (port-agnostic) against an allowed list.
*
* This is particularly important for servers without authorization or HTTPS,
* such as localhost servers or development servers. DNS rebinding attacks can
@ -11,7 +11,7 @@ import type { NextFunction, Request, RequestHandler, Response } from 'express';
* localhost address, allowing malicious websites to access your local server.
*
* @param allowedHostnames - List of allowed hostnames (without ports).
* For IPv6, provide the address with brackets (e.g., '[::1]').
* For IPv6, provide the address with brackets (e.g., `[::1]`).
* @returns Express middleware function
*
* @example
@ -40,7 +40,7 @@ export function hostHeaderValidation(allowedHostnames: string[]): RequestHandler
/**
* Convenience middleware for localhost DNS rebinding protection.
* Allows only localhost, 127.0.0.1, and [::1] (IPv6 localhost) hostnames.
* Allows only `localhost`, `127.0.0.1`, and `[::1]` (IPv6 localhost) hostnames.
*
* @example
* ```typescript