Secure MCP endpoint for LAN clients

src/config.js

@@ -14,9 +14,16 @@ export function getConfig() {
     throw new Error("MACMINI_MCP_PORT must be an integer between 1 and 65535.");
   }
 
-  return {
+  const config = {
     host: process.env.MACMINI_MCP_HOST || "127.0.0.1",
     port,
     token: process.env.MACMINI_MCP_TOKEN || "",
   };
+
+  const isLoopback = ["127.0.0.1", "::1", "localhost"].includes(config.host);
+  if (!isLoopback && !config.token) {
+    throw new Error("MACMINI_MCP_TOKEN is required when listening beyond localhost.");
+  }
+
+  return config;
 }

src/http.js

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { timingSafeEqual } from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { getConfig } from "./config.js";
 import { createMacMiniMcpServer } from "./server.js";
@@ -9,7 +10,10 @@ function authorized(request) {
   if (!config.token) {
     return true;
   }
-  return request.headers.authorization === `Bearer ${config.token}`;
+  const authorization = request.headers.authorization || "";
+  const expected = Buffer.from(`Bearer ${config.token}`);
+  const provided = Buffer.from(authorization);
+  return provided.length === expected.length && timingSafeEqual(provided, expected);
 }
 
 const service = http.createServer(async (request, response) => {