LibreChat/api/server/routes
Atef Bellaaj 95a69df70e
🔒 feat: Add MCP server domain restrictions for remote transports (#11013)
* 🔒 feat: Add MCP server domain restrictions for remote transports

* 🔒 feat: Implement comprehensive MCP error handling and domain validation

- Added `handleMCPError` function to centralize error responses for domain restrictions and inspection failures.
- Introduced custom error classes: `MCPDomainNotAllowedError` and `MCPInspectionFailedError` for better error management.
- Updated MCP server controllers to utilize the new error handling mechanism.
- Enhanced domain validation logic in `createMCPTools` and `createMCPTool` functions to prevent operations on disallowed domains.
- Added tests for runtime domain validation scenarios to ensure correct behavior.

* chore: import order

* 🔒 feat: Enhance domain validation in MCP tools with user role-based restrictions

- Integrated `getAppConfig` to fetch allowed domains based on user roles in `createMCPTools` and `createMCPTool` functions.
- Removed the deprecated `getAllowedDomains` method from `MCPServersRegistry`.
- Updated tests to verify domain restrictions are applied correctly based on user roles.
- Ensured that domain validation logic is consistent and efficient across tool creation processes.

* 🔒 test: Refactor MCP tests to utilize configurable app settings

- Introduced a mock for `getAppConfig` to enhance test flexibility.
- Removed redundant mock definition to streamline test setup.
- Ensured tests are aligned with the latest domain validation logic.

---------

Co-authored-by: Atef Bellaaj <slalom.bellaaj@external.daimlertruck.com>
Co-authored-by: Danny Avila <danny@librechat.ai>
2025-12-18 13:57:49 -05:00
..
__tests__ 🔒 feat: Add MCP server domain restrictions for remote transports (#11013) 2025-12-18 13:57:49 -05:00
agents 👤 feat: Agent Avatar Removal and Decouple upload/reset from Agent Updates (#10527) 2025-11-17 17:04:01 -05:00
assistants 📦 chore: Bump Express.js to v5 (#10671) 2025-12-11 16:36:15 -05:00
files 🧵 refactor: Migrate Endpoint Initialization to TypeScript (#10794) 2025-12-11 16:37:16 -05:00
types WIP: Update UI to match Official Style; Vision and Assistants 👷🏽 (#1190) 2023-11-16 10:42:24 -05:00
accessPermissions.js 🏗️ feat: Dynamic MCP Server Infrastructure with Access Control (#10787) 2025-12-11 16:38:37 -05:00
actions.js 🪐 feat: MCP OAuth 2.0 Discovery Support (#7924) 2025-06-17 13:50:33 -04:00
auth.js 🛜 refactor: Streamline App Config Usage (#9234) 2025-08-26 12:10:18 -04:00
balance.js feat: Accurate Token Usage Tracking & Optional Balance (#1018) 2023-10-05 18:34:10 -04:00
banner.js 🚀 feat: Banner (#3952) 2024-09-11 09:34:25 -04:00
categories.js 🗨️ feat: Prompts (#3131) 2024-06-20 20:24:32 -04:00
config.js 🧩 refactor: Decouple MCP Config from Startup Config (#10689) 2025-12-11 16:36:34 -05:00
convos.js 🪟 feat: DataTable update + Various UI enhancements (#9698) 2025-12-11 16:39:06 -05:00
endpoints.js 🛜 refactor: Streamline App Config Usage (#9234) 2025-08-26 12:10:18 -04:00
index.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00
keys.js 🧵 refactor: Migrate Endpoint Initialization to TypeScript (#10794) 2025-12-11 16:37:16 -05:00
mcp.js 🏗️ feat: Dynamic MCP Server Infrastructure with Access Control (#10787) 2025-12-11 16:38:37 -05:00
memories.js 🛜 refactor: Streamline App Config Usage (#9234) 2025-08-26 12:10:18 -04:00
messages.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00
models.js 🛠️ refactor: Model Loading and Custom Endpoint Error Handling (#1849) 2024-02-20 12:57:58 -05:00
oauth.js 🔒 fix: Email Domain Validation Order and Coverage (#9566) 2025-09-10 23:13:39 -04:00
presets.js 🧹 chore: Cleanup Logger and Utility Imports (#9935) 2025-10-01 23:30:47 -04:00
prompts.js 🛡️ feat: Add Middleware for JSON Parsing and Prompt Group Updates (#10757) 2025-12-02 00:10:30 -05:00
prompts.test.js 🛡️ feat: Add Middleware for JSON Parsing and Prompt Group Updates (#10757) 2025-12-02 00:10:30 -05:00
roles.js 🏗️ feat: Dynamic MCP Server Infrastructure with Access Control (#10787) 2025-12-11 16:38:37 -05:00
search.js 🧹 chore: Cleanup Logger and Utility Imports (#9935) 2025-10-01 23:30:47 -04:00
settings.js 📌 feat: Pin Agents and Models in the Sidebar (#10634) 2025-12-11 16:38:20 -05:00
share.js 🔗 fix: Add branch-specific shared links (targetMessageId) (#10016) 2025-10-10 08:42:05 -04:00
static.js 🧹 chore: Cleanup Logger and Utility Imports (#9935) 2025-10-01 23:30:47 -04:00
tags.js 🔒 fix: Agents Config/Permission Checks after Streamline Change (#8089) 2025-06-26 18:53:05 -04:00
user.js 📌 feat: Pin Agents and Models in the Sidebar (#10634) 2025-12-11 16:38:20 -05:00