mirror of
https://github.com/Sea-Haven-Industries/sh-mcp.git
synced 2026-10-07 16:18:58 +00:00
Adam Moussa
00762de0a6
GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. |
||
|---|---|---|
| .. | ||
| calendar | ||
| gmail | ||
| google-maps | ||
| internal-data | ||
| knowledge-base | ||
| payments | ||
| qbo | ||
| reminders | ||
| shared | ||
| tasks | ||
| .gitkeep | ||