Draft: Harden MCP transport and registry contracts

[Trailgenic]

Motivation

• Reduce MCP transport and registry attack surface by enforcing Origin/CORS semantics earlier and consistently, ensuring generated machine documents are fresh and honestly described, and making tool/schema/resource contracts semantically strict and testable.
• Ensure the trailgenic:// datasets resource mirrors the canonical /datasets/index catalog rather than a smaller duplicate object.
• Complete and codify the audit items: schema parity, strict validation, resource parity, CORS behavior, generated-document freshness, live acceptance checks, and a patch version bump.

Description

• MCP Origin/CORS hardening: validate Origin before the /mcp OPTIONS early-return, route all MCP early-error/OPTIONS responses through an origin-aware applyOriginCors that echoes allowed Origins and sets Vary: Origin, and document the transport 400/403/405/406/415 responses in the OpenAPI paths. (file: tool-registry/worker.js)
• Machine-document freshness and honest health: serve generated discovery and machine documents with Cache-Control: no-cache, leave dataset caching unchanged, and mark capabilities as not_checked in /health. (file: tool-registry/worker.js)
• Dataset-index parity: trailgenic://datasets/index now returns the canonical datasetCatalog() object (removed the smaller constructed index). (file: lib/resources.js)
• Registry→SDK schema parity: adapter now preserves property description and uses strict-object semantics (additionalProperties: false -> Zod .strict()), so tools/list emits schemas that match registry properties, required sets, enums, descriptions, and strictness. (file: lib/mcp-server.js)
• SDK limitation documented: the SDK/Zod→JSON Schema adapter currently injects a JavaScript safe-integer maximum: 9007199254740991 for integer fields lacking an explicit registry maximum; tests normalize this adapter artifact rather than silently drop or alter registry constraints. (explained in PR body and tests)
• Live-acceptance and validation test additions: added Workers-runtime (workerd) tests for semantic tools/list schema parity, successful representative call for every tool, invalid/extra argument rejection, gear-category corrective errors, full resource parity against REST endpoints (all 35), Origin/CORS preflight/early-error assertions, generated-document no-cache verification, and reverse parity between tool definitions and handlers; added live-acceptance checks for deep-equality of the dataset-index resource, disallowed-Origin POST rejection in production, cache-busted root discovery build-version parity, and root Cache-Control: no-cache. (files: tests/worker.vitest.mjs, scripts/live-acceptance.mjs, scripts/validate-registry.mjs, tests/registry.test.mjs)
• Version bump: patch version bumped from 1.4.0 to 1.4.1 while preserving dataset publication dates and last_updated values. (files: lib/registry.js, package.json, package-lock.json)
• Files changed (10): tool-registry/worker.js, lib/resources.js, lib/mcp-server.js, lib/registry.js, tests/worker.vitest.mjs, tests/registry.test.mjs, scripts/live-acceptance.mjs, scripts/validate-registry.mjs, package.json, package-lock.json.

Testing

• Ran npm ci then npm run lint and npm test successfully; unit validation node --test tests/registry.test.mjs passed after updates.
• Ran Workers-runtime tests: npm run test:workers (Vitest) executed the expanded suite and all tests passed locally after normalizing the SDK integer-maximum artifact.
• Ran registry and JSON validations: npm run validate:json and npm run validate:registry both passed and reported Registry validation passed: 35 resources (resource inventory = 35).
• Performed a Wrangler dry-run: npm run wrangler:dry-run succeeded (dry-run) with no bindings found.
• Note on CI/push: this environment had no configured remote origin, so I could not push the branch or confirm GitHub Actions PR CI; please push the branch and verify Actions CI in the remote repository before merging.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Building	Preview	Jul 14, 2026 5:29am