security(http-server): validate every present Origin

[ihor-sokoliuk]

Summary

• validate every present Origin at the /mcp boundary before parsing, CORS, authentication, rate limiting, or server construction
• use exact loopback-only defaults for non-hardened HTTP deployments and preserve explicit allowlist replacement semantics
• document the browser-client migration requirement and hardened-mode behavior

Testing

• npm exec -- tsx __tests__/unit/http-security.test.ts (28 passed)
• npm exec -- tsx __tests__/integration/http-server.test.ts (59 passed)
• npm test (711 passed)
• npm run test:coverage (94.72% lines, 91.9% branches)
• npm run lint
• npm run build
• npm run test:e2e (26 passed)
• npm run verify:packed-consumer
• npm audit --audit-level=moderate
• npm audit --omit=dev --audit-level=moderate

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 medium

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
BestPractice	1 medium

View in Codacy

🟢 Metrics 4 complexity · 4 duplication

Metric	Results
Complexity	4
Duplication	4

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

This PR tightens HTTP transport security by enforcing strict Origin validation at the /mcp boundary and by switching non-hardened deployments to a loopback-only default allowlist unless explicitly configured.

Changes:

• Add an early /mcp middleware that rejects any present invalid Origin with a fixed, non-reflecting 403 JSON-RPC error before parsing/CORS/auth/limits/server construction.
• Change HTTP security defaults so restrictOrigins is always enabled, with non-hardened mode defaulting to exact loopback origin allowlists (optionally including the configured port), and explicit env allowlists replacing defaults.
• Expand documentation and tests to cover the new behavior and upgrade requirements.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/http-server.ts	Adds /mcp origin boundary middleware and aligns CORS origin evaluation with strict Origin handling.
src/http-security.ts	Introduces loopback default origin allowlists and makes origin restriction always-on (with explicit allowlist replacement semantics).
SECURITY.md	Documents origin validation behavior, hardened-mode requirements, and upgrade implications.
README.md	Adds an upgrade notice describing the new origin validation and defaults.
CONFIGURATION.md	Adds an origin validation and upgrade notice in configuration docs.
tests/unit/http-security.test.ts	Adds unit coverage for loopback defaults, explicit allowlist replacement, and exact-match origin behavior.
tests/integration/http-server.test.ts	Adds integration coverage ensuring early rejection occurs before parsers/CORS/rate limiting/auth/server construction, and validates allowed/absent origin behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ihor-sokoliuk]

Review findings for 92b6f58ad00a7c1384b7b71e987b79de74b7e6de:

• Addressed the valid Codacy maintainability finding by extracting the repeated allowed-preflight assertions; the flagged callback is now below the configured line limit with behavior unchanged.
• Left the documentation wording unchanged after verifying the warning was a false positive: the same paragraph explicitly documents both supported escape hatches—an absent Origin for non-browser clients and an explicit MCP_HTTP_ALLOWED_ORIGINS allowlist for intended browser clients.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/http-server.ts:216

• Vary: Origin is added by a later global middleware, but originBoundary can terminate the request early with a 403 before that middleware runs. That means the 403 response can be cached without varying by Origin, even though the response behavior depends on whether an Origin header is present/what it is. Setting Vary: Origin inside originBoundary avoids incorrect caching and aligns with the later CORS reflection behavior for allowed Origins.

  const originBoundary: express.RequestHandler = (req, res, next) => {
    if (!isOriginAllowed(req.headers.origin, security)) {
      res.status(403).json({
        jsonrpc: "2.0",
        error: { code: -32000, message: "Invalid Origin header" },

[ihor-sokoliuk]

Review update for cc66c87d79d41c699580daa24622a52722aef964:

• Rephrased the Origin policy sentence in SECURITY.md to avoid Codacy's absolute-rule heuristic while preserving the same hardened/non-hardened allowlist enforcement, absent-Origin behavior, and migration requirement.
• No product behavior changed in this commit.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.