mirror of
https://github.com/Sea-Haven-Industries/sh-mcp.git
synced 2026-10-07 09:19:13 +00:00
Adam Moussa
00762de0a6
GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. |
||
|---|---|---|
| .. | ||
| src | ||
| package.json | ||
| tsconfig.json | ||