Function buildApp

mcp/src/http-server.ts:71–164

(opts: HttpServerOptions)

 * OAuth refresh) ever ends a connection.
 */
export function buildApp(opts: HttpServerOptions): BuiltApp {
  const cache =
    opts.resolveCache ??
    new ResolveCache({
      ttlMs: opts.resolveCacheTtlMs ?? 60_000,
      maxEntries: opts.resolveCacheMaxEntries ?? 500,
    });

  const app = express();
  app.use(express.json({ limit: "1mb" }));
  // CORS open for v0.2; revisit when we have a real allowlist of MCP hosts.
  app.use(cors({ origin: "*", exposedHeaders: ["Mcp-Session-Id"] }));

  app.get("/healthz", (_req, res) => {
    res.json({ ok: true });
  });

  // DNS rebinding protection. The SDK deprecated its in-transport allowlist
  // in favor of external middleware; we enforce it here. 421 Misdirected
  // Request is the spec-recommended status for "this server is not what
  // you asked for." Strip port before comparing so the same allowlist
  // entry works both for prod (`api.e2a.dev`) and tests on random ports
  // (`127.0.0.1:54321`).
  const allowedHosts = new Set(opts.allowedHosts.map((h) => h.toLowerCase()));
  app.use("/mcp", (req, res, next) => {
    const host = req.headers.host;
    if (!host) {
      res.status(421).end();
      return;
    }
    const bare = host.split(":")[0]!.toLowerCase();
    if (!allowedHosts.has(bare)) {
      res.status(421).end();
      return;
    }
    next();
  });

  // Spec-mandated discovery for hosts probing where the auth server lives.
  // Served unconditionally (even pre-OAuth) so clients don't get a confusing
  // 404 between v0.2 and v0.3. Validates Host against the allowlist to
  // avoid reflecting attacker-controlled hosts back in the `resource` URL.
  // Compute the public-facing URL of this MCP server. Three cases:
  //   1. publicUrl set explicitly: trust it verbatim (local-dev http,
  //      or any deployment behind a fronting proxy that knows its own
  //      external URL better than we do).
  //   2. unset + Host header present + Host in allowlist: synthesize
  //      `https://{Host}`. This is the prod-default Caddy-fronted path.
  //   3. unset + Host missing/disallowed: caller wrapped function
  //      rejects with 421 before reaching here.
  const resolveResourceUrl = (req: Request): string | null => {
    if (opts.publicUrl) {
      return opts.publicUrl.replace(/\/+$/, "");
    }
    const host = req.headers.host;
    if (!host) return null;
    const bare = host.split(":")[0]!.toLowerCase();
    if (!allowedHosts.has(bare)) return null;