Merge remote-tracking branch 'origin/main' into mgd-13107-snyk-does-not-have-authorization-in-github-actions

Author: ArkadiuszSzamockiDT

CHANGELOG.md

@@ -1,7 +1,22 @@
 # @dynatrace-oss/dynatrace-managed-mcp
 
-## Unreleased Changes
+## Unreleased
 
+### Breaking changes
+
+- Security (HTTP mode): unauthenticated requests are now rejected. A request that omits the `X-Dynatrace-Tokens` header, or supplies no token that is valid on its environment, receives HTTP 401 before any MCP server or tool is created. Previously such a request could complete the MCP `initialize` handshake and call tools — including `get_environments_info`, which disclosed configured environment aliases and URLs.
+- Removed the `dynatrace_managed_check_config_errors` tool. The startup configuration errors it reported are redundant with `get_environments_info`; any automation referencing this tool by name must be updated.
+- The server no longer starts when any configured environment is invalid — configuration errors now fail startup instead of being skipped. Fix all environment configuration errors before starting.
+
+### Changes
+
+- Added `DT_MCP_TOKEN_VALIDATION_TTL_MS` (default `60000`) to control how long per-caller token-validation results are cached.
+- Updated `fast-uri` to 3.1.4.
+
+### Fixes
+
+- Per-request tokens are validated against the cluster (`POST /api/v2/apiTokens/lookup`) before tools are exposed. Validation results are cached per caller (keyed by a hash of the supplied tokens) and concurrent requests share a single validation, so the cluster is not probed on every request.
+- `get_environments_info` now reports only on environments the caller supplied a token for, and returns an identical "invalid token" message whether an alias is unknown or its token is invalid — so callers can no longer enumerate which environments are configured.
 - Improved `get_environments_info` in stdio mode: now uses cached startup validation results (version, validity, error) instead of re-probing live on every call, eliminating redundant network requests. The cluster version and minimum version check are now displayed from the cached result.
 - Improved rate-limiting key stability: `deriveUserKey` now normalises the `X-Dynatrace-Tokens` header (sorts aliases, strips whitespace) so equivalent token sets produce the same rate-limit bucket regardless of header ordering.
 

package-lock.json

@@ -29,6 +29,11 @@ export interface ManagedAuthClientParams {
   minimum_version: string;
 }
 
+interface ApiToken {
+  enabled?: boolean;
+  scopes?: string[];
+}
+
 /** Thrown when a request targets an environment for which the caller supplied no token. */
 export class MissingTokenError extends Error {
   constructor(public readonly alias: string) {
@@ -75,6 +80,20 @@ export class ManagedAuthClient {
     return { Authorization: `Api-Token ${token}` };
   }
 
+  async validateAPIToken(token: string): Promise<boolean> {
+    try {
+      const response = await this.httpClient.post<ApiToken>(
+        '/api/v2/apiTokens/lookup',
+        { token },
+        { headers: this.authHeader(token) },
+      );
+      return !!(response.data?.enabled && response.data?.scopes && response.data.scopes.length > 0);
+    } catch (error) {
+      logger.warn(`[Alias: ${this.alias}] API token failed validation`, { error });
+      return false;
+    }
+  }
+
   async validateConnection(token: string): Promise<boolean> {
     try {
       // Try cluster version endpoint for Managed environments
@@ -255,6 +274,11 @@ export class ManagedAuthClientManager {
     return this.tokens.get(alias);
   }
 
+  /** Aliases the caller actually supplied a token for (their own input, not the configured set). */
+  suppliedAliases(): string[] {
+    return [...this.tokens.keys()];
+  }
+
   async makeRequests<T>(
     endpoint: string,
     params: Record<string, string | number | boolean | undefined>,

src/authentication/managed-auth-client.ts

@@ -39,6 +39,53 @@ logger.info('Starting Dynatrace Managed MCP');
 // In stdio mode there is a single user key, which reproduces the previous single-bucket behavior.
 const rateLimiter = new RateLimiter();
 
+// Caches the in-flight Promise so a burst of concurrent requests shares one lookup.
+const tokenValidationCache = new Map<string, { expiresAt: number; result: Promise<boolean> }>();
+const TOKEN_VALIDATION_TTL_MS = (() => {
+  const parsed = Number(process.env.DT_MCP_TOKEN_VALIDATION_TTL_MS);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : 60 * 1000;
+})();
+
+const hasValidSuppliedTokens = (
+  clients: ManagedAuthClient[],
+  tokenMap: Map<string, string>,
+  userKey: string,
+): Promise<boolean> => {
+  const now = Date.now();
+
+  const cached = tokenValidationCache.get(userKey);
+  if (cached !== undefined) {
+    if (cached.expiresAt > now) {
+      return cached.result;
+    } else {
+      tokenValidationCache.delete(userKey);
+    }
+  }
+
+  const supplied = clients
+    .map((client) => ({ client, token: tokenMap.get(client.alias) }))
+    .filter((entry): entry is { client: ManagedAuthClient; token: string } => entry.token !== undefined);
+  if (supplied.length === 0) {
+    return Promise.resolve(false);
+  }
+
+  const result = (async (): Promise<boolean> => {
+    const results = await Promise.all(supplied.map(({ client, token }) => client.validateAPIToken(token)));
+    return results.some(Boolean);
+  })();
+
+  tokenValidationCache.set(userKey, { expiresAt: now + TOKEN_VALIDATION_TTL_MS, result });
+  result
+    .then((valid) => {
+      if (!valid) {
+        tokenValidationCache.delete(userKey);
+      }
+    })
+    .catch(() => tokenValidationCache.delete(userKey));
+
+  return result;
+};
+
 const main = async () => {
   logger.info(`Initializing Dynatrace Managed MCP Server v${getPackageJsonVersion()}...`);
 
@@ -56,7 +103,7 @@ const main = async () => {
 
   const options = program.opts();
   const httpMode = options.http || options.server;
-  const httpPort = parseInt(options.port, 10);
+  const httpPort = Number(options.port);
   const host = options.host || '127.0.0.1';
 
   // Read Managed environment configuration. In HTTP mode tokens are supplied per request
@@ -70,6 +117,8 @@ const main = async () => {
   if (initErrors.length > 0) {
     logger.error('Failed to get managed environments configurations: ', { error: initErrors });
     console.error('Failed to get managed environments configurations: ', { error: initErrors });
+    await flushLogger();
+    process.exit(1);
   }
 
   if (initConfigs.length === 0) {
@@ -118,7 +167,7 @@ const main = async () => {
   // Factory: creates a new McpServer with all tools registered, bound to this caller's tokens.
   // Must be called per-request in stateless HTTP mode (the SDK forbids connecting
   // the same McpServer instance to more than one transport).
-  const createConfiguredMcpServer = (tokenMap: Map<string, string>, userKey: string) => {
+  const createConfiguredMcpServer = (tokenMap: Map<string, string>, userKey: string): McpServer => {
     // Per-request auth router + API clients.
     const authClientManager = new ManagedAuthClientManager(allClients, validClients, validAliases, tokenMap);
     const metricsClient = new MetricsApiClient(authClientManager);
@@ -256,36 +305,30 @@ const main = async () => {
   // HTTP server mode (Stateless)
   if (httpMode) {
     const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {
-      // Parse request body for POST requests
-      let body: unknown;
-      // Create a new Stateless HTTP Transport
-      // enableJsonResponse: true returns application/json instead of keeping SSE streams open,
-      // which is required for MCP clients that don't support persistent SSE connections (e.g. Copilot CLI).
-      const httpTransport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: undefined, // No Session ID needed
-        enableJsonResponse: true,
-      });
-
-      // Per-request tokens come from the X-Dynatrace-Tokens header (alias=token;alias=token).
       const tokenHeader = req.headers['x-dynatrace-tokens'];
       const tokenMap = parseTokenHeader(tokenHeader);
       const userKey = deriveUserKey(Array.isArray(tokenHeader) ? tokenHeader.join(';') : tokenHeader);
 
-      // Create a fresh McpServer per request (stateless HTTP requirement)
-      const server = createConfiguredMcpServer(tokenMap, userKey);
-
-      res.on('close', () => {
-        // close transport and server, but not the httpServer itself
-        httpTransport.close();
-        server.close();
-      });
-
-      // Connecting MCP-server to HTTP transport
-      await server.connect(httpTransport);
+      // Validate every request: a stateless MCP connection spans several requests, and gating only
+      // the initialize handshake leaves the SSE GET to hang the client until timeout.
+      if (!(await hasValidSuppliedTokens(allClients, tokenMap, userKey))) {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(
+          JSON.stringify({
+            jsonrpc: '2.0',
+            id: null,
+            error: { code: -32000, message: 'Unauthorized: no valid Dynatrace token supplied' },
+          }),
+        );
+        return;
+      }
 
-      // Handle POST Requests for this endpoint
+      let body: unknown;
       if (req.method === 'POST') {
-        const maxBodySize = parseInt(process.env.DT_MCP_MAX_BODY_SIZE ?? String(1 * 1024 * 1024), 10); // default 1MB
+        const maxBodySize = (() => {
+          const parsed = Number(process.env.DT_MCP_MAX_BODY_SIZE);
+          return Number.isFinite(parsed) && parsed > 0 ? parsed : 1024 * 1024;
+        })(); // default 1MB
         const chunks: Buffer[] = [];
         let totalSize = 0;
         let tooLarge = false;
@@ -315,13 +358,32 @@ const main = async () => {
         }
       }
 
+      // Create a new Stateless HTTP Transport
+      // enableJsonResponse: true returns application/json instead of keeping SSE streams open,
+      // which is required for MCP clients that don't support persistent SSE connections (e.g. Copilot CLI).
+      const httpTransport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined, // No Session ID needed
+        enableJsonResponse: true,
+      });
+
+      // Create a fresh McpServer per request (stateless HTTP requirement)
+      const server = createConfiguredMcpServer(tokenMap, userKey);
+
+      res.on('close', () => {
+        // close transport and server, but not the httpServer itself
+        httpTransport.close();
+        server.close();
+      });
+
+      // Connecting MCP-server to HTTP transport
+      await server.connect(httpTransport);
+
       await httpTransport.handleRequest(req, res, body);
     });
 
     // Start HTTP Server on the specified host and port
     httpServer.listen(httpPort, host, () => {
       logger.info(`Dynatrace Managed MCP Server running on HTTP at http://${host}:${httpPort}`);
-      console.error(`Dynatrace Managed MCP Server running on HTTP at http://${host}:${httpPort}`);
     });
 
     // Handle graceful shutdown for http server mode