Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

`createMcpHandler` is validation-free; bare fetch mounts can skip the Host/Origin guards the framework helpers install |

Abierto
  • ¿Algo no está bien?
#2,844 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
nodejs, typescript
Área
backend-api-design, security

Línea de trabajo

The issue is about adding Host/Origin validation to createMcpHandler in packages/server/src/server/createMcpHandler.ts. Start by reading the existing JSDoc and the docs/serving/http.md guide to understand the current validation-free behavior. Look at the hostHeaderValidationResponse and originValidationResponse utilities to see how validation is applied. The goal is to design an API option or wrapper that adds these guards, while keeping an escape hatch for reverse-proxy deployments. Test by mounting the handler in a fetch-native runtime like Workers or Deno.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

v2

Static review of public source at commit 603217008710. No traffic was sent to any MCP environment.

createMcpHandler intentionally performs no Host/Origin (or token) checks — documented in the JSDoc and in docs/serving/http.md. Framework helpers (createMcpExpressApp / Hono / Fastify) arm those checks for loopback. The bare fetch entry does not:

packages/server/src/server/createMcpHandler.ts (doc comment on the export):

* When mounting bare on a fetch-native runtime,
* put Origin/Host validation in front of the handler — the entry itself is
* deliberately validation-free:
*
* const rejected =
*     hostHeaderValidationResponse(request, localhostAllowedHostnames()) ??
*     originValidationResponse(request, localhostAllowedOrigins());
* return rejected ?? handler.fetch(request);

On Workers / Deno / Bun, export default handler (as shown earlier in the same guide for “Mount it on your runtime”) is a one-liner that never installs those guards unless the reader continues to the later section. That is a footgun relative to the Express path, where loopback protection is automatic.

Suggested change:

  • Offer createMcpHandler(factory, { allowedHosts, allowedOrigins }) (or a withLocalhostProtection(handler) wrapper) that applies hostHeaderValidationResponse / originValidationResponse before fetch.
  • Or make the quickstart export default example always show the validation wrapper first.
  • Keep a documented escape hatch for authenticated reverse-proxy deployments.

Severity: low–medium / API footgun and defense-in-depth (complements finding #1 on non-loopback Express/Hono binds). No proof-of-concept.

Happy to send a focused PR if useful.

Lenguaje dominante
TypeScript
Estrellas
13.6k
Forks
2.3k
Merge medio
1 d 15 h
PR fusionados (30 d)
51

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/typescript-sdk

Todos los issues de modelcontextprotocol/typescript-sdk

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.