Skip to content

fix(mcp): fail closed for client IP encryption#2104

Open
mitre88 wants to merge 1 commit intoupstash:masterfrom
mitre88:fix/1965-fail-closed-client-ip-encryption
Open

fix(mcp): fail closed for client IP encryption#2104
mitre88 wants to merge 1 commit intoupstash:masterfrom
mitre88:fix/1965-fail-closed-client-ip-encryption

Conversation

@mitre88
Copy link

@mitre88 mitre88 commented Mar 4, 2026

Summary

  • make client IP encryption fail closed in MCP header generation
  • return undefined from encryptClientIp on invalid key or crypto failure
  • only set mcp-client-ip header when encryption succeeds

Why

Current behavior sends the raw client IP in plaintext when encryption fails, which defeats the purpose of enabling encryption.

Verification

  • pnpm --filter @upstash/context7-mcp lint
  • pnpm --filter @upstash/context7-mcp typecheck

Closes #1965

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: encryptClientIp falls back to sending raw client IP in plaintext when encryption fails

1 participant