@systemdox/mcp-server - npm Package Compare versions

Comparing version 0.1.28 to 0.1.29

dist/http.js

@@ -120,2 +120,21 @@ #!/usr/bin/env node
 
+// src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
+  }
+  return apiUrl;
+}
+
 // src/lib/metrics.ts
@@ -1829,3 +1848,3 @@ var NAMESPACE = "SystemDox/Mcp";
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.28" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.29" : "0.0.0-dev";
 function createServer(apiClient) {
@@ -1901,5 +1920,12 @@ const server = new McpServer({
   emitMcpToolCalls(keyTenant, rawBody);
+  let apiUrl;
+  try {
+    apiUrl = requireHttpsApiUrl(process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT);
+  } catch (err) {
+    console.error("Refusing to proxy MCP tool calls:", err);
+    return jsonError(500, "Server misconfigured: API URL must use https://");
+  }
   const apiClient = new SystemDoxApiClient({
     apiKey,
-    apiUrl: process.env.SYSTEMDOX_API_URL ?? "https://api.puglieseweb.com/systemdox",
+    apiUrl,
     cacheTtlMs: 0,
@@ -1906,0 +1932,0 @@ // per-request client; never cache across invocations

dist/index.js

@@ -1829,3 +1829,3 @@ #!/usr/bin/env node
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.28" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.29" : "0.0.0-dev";
 function createServer(apiClient2) {
@@ -1832,0 +1832,0 @@ const server2 = new McpServer({

package.json

 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "mcpName": "io.github.puglieseweb/systemdox",
@@ -5,0 +5,0 @@ "type": "module",

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

247018

0.28%

Lines of code

7317

0.34%

No dependency changes