Middleware for validating host headers in requests to protect against DNS rebinding attacks.

Node.js middleware to validate Host and Referer headers in HTTP requests and protect against DNS rebinding attacks.

Stunning, dismissible home-page overlay for the pi coding agent — branded splash at startup, then 100% native pi. No native hotkey rebinding.

Minimalistic keybinds interface, with rebinding and saving. Made for Svelte.

SSRF-safe fetch() for server-side use — validates IPs, enforces scheme/port, eliminates DNS rebinding via undici connect.lookup

A malicious DNS server for executing DNS Rebinding attacks on the fly.

A drop-in fetch() that blocks SSRF: refuses loopback/private/link-local/CGNAT targets and pins the connection to the validated IP to defeat DNS rebinding (TOCTOU).

Fumadocs integration to render DGMO diagrams from fenced code blocks at build time. Two-step install: `withDgmo()` in source.config.ts plus `<DgmoClient />` in app/layout.tsx — the client component handles route-change rebinding and auto-imports the theme

A TypeScript SSRF protection library for Node.js (express/axios) with advanced policies, DNS rebinding detection and cloud metadata protection.

Express adapters for the Model Context Protocol TypeScript server SDK - Express middleware

Nextra integration to render DGMO diagrams from fenced code blocks at build time. Two-step install: `withDgmo()` in next.config.mjs plus `<DgmoClient />` in app/layout.tsx — the client component handles route-change rebinding and auto-imports the theme-aw

Shared SSRF guard — reject non-http(s) schemes and resolve+validate hostnames against loopback/private/link-local/reserved ranges, returning a pinned IP so callers can close DNS-rebinding. Open source under EUPL-1.2.

A secure-by-default MCP server for fetching web content: SSRF, DNS-rebinding, and redirect-to-internal protection with post-resolution IP validation.

Fastify adapters for the Model Context Protocol TypeScript server SDK - Fastify middleware

StreetJS outbound webhook dispatcher: an SSRF-hardened, HTTPS-only delivery queue with HMAC-SHA256 signatures, bounded queue + concurrency, exponential-backoff retries, DNS-rebinding protection, and private-CA TLS. Zero runtime dependencies. (Distinct fro

Wire consumer layer: HTTP-up/WebSocket-down client, ConnectionController dual streams with reconnect, and fixture api

Library for probing, validating, and reporting on A2A (Agent2Agent) protocol endpoints. Assertion engine + reporters (JSON, JUnit, SARIF 2.1.0, badge SVG, snapshot diff), SSRF guard, DNS-rebinding pin, check catalog. Used by @a2a-compliance/cli.

Safe, replayable web crawling for review pipelines — a crawler for untrusted URLs.

A command system for the web — typed commands, portable keybindings, scopes, sequences, conflict detection, rebinding, and platform-aware display.

MCP boilerplate code for Node.js