@systemdox/mcp-server - npm Package Compare versions

Comparing version 0.1.27 to 0.1.28

dist/http.js

@@ -1828,3 +1828,3 @@ #!/usr/bin/env node
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.27" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.28" : "0.0.0-dev";
 function createServer(apiClient) {
@@ -1831,0 +1831,0 @@ const server = new McpServer({

dist/index.js

@@ -8,3 +8,2 @@ #!/usr/bin/env node
 var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
 function requireHttpsApiUrl(apiUrl) {
@@ -19,9 +18,8 @@ let parsed;
   }
-  if (parsed.protocol === "https:") return apiUrl;
-  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
-    return apiUrl;
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
   }
-  throw new Error(
-    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-  );
+  return apiUrl;
 }
@@ -1833,3 +1831,3 @@ function loadConfig() {
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.27" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.28" : "0.0.0-dev";
 function createServer(apiClient2) {
@@ -1836,0 +1834,0 @@ const server2 = new McpServer({

dist/lib/config.d.ts

@@ -13,7 +13,10 @@ export interface ServerConfig {
  *
- * http://localhost is allowed: see LOOPBACK_HOSTS. Local development and the
- * MCP release gate (scripts/mcp-release-gate.mjs, which boots the published
- * server against an http stub on 127.0.0.1) both depend on it.
+ * The pin has NO exceptions, loopback included. A carve-out was tried and
+ * removed: it existed only because the release gate stood up a plain-http stub,
+ * and #1044 gave that stub TLS, so nothing in CI needs it. Local development
+ * against a local API should point at an https origin — the gate's per-run
+ * self-signed cert is a worked example. An exception in the shipped product to
+ * spare a dev a certificate is not a trade worth making.
  */
 export declare function requireHttpsApiUrl(apiUrl: string): string;
 export declare function loadConfig(): ServerConfig;

dist/lib/config.js

@@ -5,3 +5,2 @@ #!/usr/bin/env node
 var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
 function requireHttpsApiUrl(apiUrl) {
@@ -16,9 +15,8 @@ let parsed;
   }
-  if (parsed.protocol === "https:") return apiUrl;
-  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
-    return apiUrl;
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
   }
-  throw new Error(
-    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-  );
+  return apiUrl;
 }
@@ -25,0 +23,0 @@ function loadConfig() {

package.json

 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "mcpName": "io.github.puglieseweb/systemdox",
@@ -5,0 +5,0 @@ "type": "module",

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Worsened metrics

Total package byte prevSize

246327

-0.13%

Lines of code

7292

-0.04%

No dependency changes