@systemdox/mcp-server - npm Package Compare versions

Comparing version 0.1.23 to 0.1.24

dist/lib/config.js

+#!/usr/bin/env node
+
+// src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
+  }
+  return apiUrl;
+}
+function loadConfig() {
+  const apiKey = process.env.SYSTEMDOX_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "SYSTEMDOX_API_KEY is required. Generate one at your SystemDox settings page."
+    );
+  }
+  const apiUrl = requireHttpsApiUrl(
+    process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT
+  );
+  return {
+    apiKey,
+    apiUrl,
+    cacheTtlMs: parseInt(process.env.SYSTEMDOX_CACHE_TTL ?? "300", 10) * 1e3,
+    defaultOrg: process.env.SYSTEMDOX_DEFAULT_ORG
+  };
+}
+export {
+  API_URL_DEFAULT,
+  loadConfig,
+  requireHttpsApiUrl
+};

dist/http.js

@@ -1828,3 +1828,3 @@ #!/usr/bin/env node
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.23" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.24" : "0.0.0-dev";
 function createServer(apiClient) {
@@ -1831,0 +1831,0 @@ const server = new McpServer({

dist/index.js

@@ -7,2 +7,19 @@ #!/usr/bin/env node
 // src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
+  }
+  return apiUrl;
+}
 function loadConfig() {
@@ -15,5 +32,8 @@ const apiKey = process.env.SYSTEMDOX_API_KEY;
   }
+  const apiUrl = requireHttpsApiUrl(
+    process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT
+  );
   return {
     apiKey,
-    apiUrl: process.env.SYSTEMDOX_API_URL ?? "https://api.puglieseweb.com/systemdox",
+    apiUrl,
     cacheTtlMs: parseInt(process.env.SYSTEMDOX_CACHE_TTL ?? "300", 10) * 1e3,
@@ -1811,3 +1831,3 @@ defaultOrg: process.env.SYSTEMDOX_DEFAULT_ORG
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.23" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.24" : "0.0.0-dev";
 function createServer(apiClient2) {
@@ -1814,0 +1834,0 @@ const server2 = new McpServer({

dist/lib/config.d.ts

@@ -7,2 +7,9 @@ export interface ServerConfig {
 }
+export declare const API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+/**
+ * Fail closed on a non-https API URL. The API key travels as a bearer token in
+ * the Authorization header on every request, so an http:// URL would leak it in
+ * cleartext. Reject rather than downgrade. Returns the URL unchanged when valid.
+ */
+export declare function requireHttpsApiUrl(apiUrl: string): string;
 export declare function loadConfig(): ServerConfig;

package.json

 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "mcpName": "io.github.puglieseweb/systemdox",
@@ -5,0 +5,0 @@ "type": "module",

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

245874

1.08%

Number of package files

39

2.63%

Lines of code

7285

1.41%

Worsened metrics

Number of low supply chain risk alerts

16

33.33%

No dependency changes