feat(security): add Dependabot and optional rate limiting

.github/dependabot.yml

@@ -0,0 +1,75 @@
+# GitHub Dependabot Configuration
+# Automated dependency vulnerability scanning and updates
+
+version: 2
+updates:
+  # Monitor npm dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 10
+    reviewers:
+      - "czlonkowski"
+    versioning-strategy: "increase"
+    commit-message:
+      prefix: "deps"
+      prefix-development: "deps-dev"
+      include: "scope"
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      development-dependencies:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - "dependencies"
+      - "security"
+    allow:
+      - dependency-type: "all"
+    rebase-strategy: "auto"
+
+  # Monitor GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+    labels:
+      - "github-actions"
+      - "dependencies"
+    reviewers:
+      - "czlonkowski"
+
+  # Monitor Docker base images
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "docker"
+      include: "scope"
+    labels:
+      - "docker"
+      - "dependencies"
+    reviewers:
+      - "czlonkowski"
+

src/http-server.ts

@@ -20,6 +20,7 @@ import {
   logProtocolNegotiation,
   N8N_PROTOCOL_VERSION 
 } from './utils/protocol-version';
+import rateLimit from 'express-rate-limit';
 
 dotenv.config();
 
@@ -163,6 +164,31 @@ export async function startFixedHTTPServer() {
     next();
   });
 
+  // Rate limiting (optional, disabled by default)
+  // Enable via ENABLE_RATE_LIMITING=true environment variable
+  if (process.env.ENABLE_RATE_LIMITING === 'true') {
+    const limiter = rateLimit({
+      windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || '60000'), // 1 minute default
+      max: parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '100'), // 100 requests per window
+      message: {
+        jsonrpc: '2.0',
+        error: {
+          code: -32000,
+          message: 'Too many requests, please try again later.'
+        },
+        id: null
+      },
+      standardHeaders: true,
+      legacyHeaders: false,
+    });
+
+    app.use('/mcp', limiter);
+    logger.info('Rate limiting enabled', { 
+      windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || '60000'), 
+      max: parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '100') 
+    });
+  }
+
   // Request logging
   app.use((req, res, next) => {
     logger.info(`${req.method} ${req.path}`, {