🚨 Latest Research:Tanstack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack.Learn More →
Socket
Book a DemoSign in
Socket
Book a DemoSign in

@socketsecurity/mcp

Package Overview
Dependencies
Maintainers
2
Versions
16
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@socketsecurity/mcp - npm Package Compare versions

Comparing version
0.0.14
 to
0.0.15
+25
-7
index.js

@@ -238,11 +238,25 @@ #!/usr/bin/env -S node --experimental-strip-types

const origin = req.headers.origin;
const isLocalhostOrigin = (originUrl) => {
try {
const url = new URL(originUrl);
return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
}
catch {
return false;
}
};
const allowedOrigins = [
'http://localhost:3000',
'http://127.0.0.1:3000',
'https://mcp.socket.dev',
'https://mcp.socket-staging.dev'
];
const isValidOrigin = origin && allowedOrigins.includes(origin);
const host = req.headers.host || '';
const isLocalhostHost = host === `localhost:${port}` ||
host === `127.0.0.1:${port}` ||
host === 'localhost' ||
host === '127.0.0.1';
const isValidOrigin = origin
? (isLocalhostOrigin(origin) || allowedOrigins.includes(origin))
: isLocalhostHost;
if (!isValidOrigin) {
logger.warn(`Rejected request from invalid origin: ${origin}`);
logger.warn(`Rejected request from invalid origin: ${origin || 'missing'} (host: ${host})`);
res.writeHead(403, { 'Content-Type': 'application/json' });

@@ -256,5 +270,7 @@ res.end(JSON.stringify({

}
res.setHeader('Access-Control-Allow-Origin', origin);
res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
if (origin) {
res.setHeader('Access-Control-Allow-Origin', origin);
res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
}
if (req.method === 'OPTIONS') {

@@ -273,2 +289,4 @@ res.writeHead(200);

if (jsonData && jsonData.method === 'initialize') {
const clientInfo = jsonData.params?.clientInfo;
logger.info(`Client connected: ${clientInfo?.name || 'unknown'} v${clientInfo?.version || 'unknown'} from ${origin || host}`);
if (httpTransport) {

@@ -275,0 +293,0 @@ try {

+1
-1
package.json
{
"name": "@socketsecurity/mcp",
"version": "0.0.14",
"version": "0.0.15",
"type": "module",

@@ -5,0 +5,0 @@ "main": "./index.js",