Repository navigation
Hardens HammerAgent's server, since anything that can reach it can control the app.
Changes
- Requests from web browsers are rejected, so websites open on the Mac can't drive the app. POSTs need
Content-Type: application/json, which thehammertool and MCP server already send. - The agent only starts in the simulator. Pass
start(allowsPhysicalDevice: true)to run it on a device, where other apps can connect to it. - Set
HAMMER_AGENT_TOKENin the app and the tool (or passHammerAgent(token:)) to require a token on every request.start(allowsRemoteConnections: true)needs one. - The agent logs its port and who can reach it when it starts.
What's Changed
- Harden the agent's server by @gabriellanata in #89
Full Changelog: 2.1.0...2.1.1