From 4e1f1898d625fa31ad60baa3e4fe7e2cd9bbacb3 Mon Sep 17 00:00:00 2001
From: Sebastion <sebastion@sebastion.dev>
Date: Fri, 10 Jul 2026 02:36:56 +0100
Subject: [PATCH] fix(http): avoid leaking internal error details in responses
 (CWE-209)

Interpolating the caught Error into the JSON response exposed stack
traces and internal paths to unauthenticated HTTP callers. Return a
generic message and keep full details in server logs only.
---
 src/server/http-server.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/server/http-server.ts b/src/server/http-server.ts
index cb20194..afa4034 100644
--- a/src/server/http-server.ts
+++ b/src/server/http-server.ts
@@ -98,7 +98,7 @@ app.post("/mcp", async (req: Request, res: Response) => {
   } catch (error) {
     console.error(`Error handling request: ${error}`);
     if (!res.headersSent) {
-      res.status(500).json({ error: `Internal server error: ${error}` });
+      res.status(500).json({ error: "Internal server error" });
     }
   }
 });
@@ -126,7 +126,7 @@ app.get("/mcp", async (req: Request, res: Response) => {
   } catch (error) {
     console.error(`Error handling SSE request: ${error}`);
     if (!res.headersSent) {
-      res.status(500).json({ error: `Internal server error: ${error}` });
+      res.status(500).json({ error: "Internal server error" });
     }
   }
 });
@@ -147,7 +147,7 @@ app.delete("/mcp", async (req: Request, res: Response) => {
   } catch (error) {
     console.error(`Error closing session: ${error}`);
     if (!res.headersSent) {
-      res.status(500).json({ error: `Internal server error: ${error}` });
+      res.status(500).json({ error: "Internal server error" });
     }
   }
 });