mail_mcp 1.0.1 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c33a2c64482699085c980befb438655c2d599512422281bd3c3cb48a32582500
-  data.tar.gz: 3dfbfeba54ef8f83d3bf99c7a727f7207c7245032c5df8eb6fbb53af4c089fb7
+  metadata.gz: e06ea684243f2124133903c64239d181b093c87e895f2716bb257d714f05aff3
+  data.tar.gz: b986c39811d9e1f3879b082796eba93ebb2a4a781c90309b2e1bb6e576875282
 SHA512:
-  metadata.gz: ba9e0f6e1dd9b84146a637d748e2559d60080f5358fd83718d7e162a513d964d8f4e492335c96435bac2954176981553700eb89227c2e8a54d12e48c230dbc76
-  data.tar.gz: 5063a62efb64854f0dfe47d2880621e9ee32a239280f78fd4d8202b405dbed45e8cc697a4269ceb59ba482e126c2cfcc6d2edbfbf29fd32abbf016ee4596d1fc
+  metadata.gz: 2ed02d68bf67c31a985199471ced7c4e9393485be999f6ed8fab254c19d55918cdc8e9d7aa3b7e35f631d0244ad3c5a38d22f21142681a613bc73aaa08b8e71d
+  data.tar.gz: 550a20589e633d0b29c7e1cf35ea0b48e2393452c2fbc07b2b51a6ae42805c2155952c8839aee0517bd054dea975dfb024468d0a759e06c3eb7961e9fa2ce396

data/lib/mail_mcp/app.rb

@@ -37,7 +37,11 @@ module MailMCP
         tools: MCP_TOOLS,
         server_context: server_context
       )
-      transport = MCP::Server::Transports::StreamableHTTPTransport.new(mcp_server, stateless: true)
+      transport = MCP::Server::Transports::StreamableHTTPTransport.new(
+        mcp_server,
+        stateless: true,
+        allowed_hosts: allowed_mcp_hosts
+      )
       status_code, resp_headers, body = transport.call(env)
       halt status_code, resp_headers, body
     end
@@ -144,7 +148,7 @@ module MailMCP
 
     def resolve_mcp_context
       auth = request.env["HTTP_AUTHORIZATION"]
-      return [nil, nil] unless auth&.start_with?("Bearer ")
+      return [nil, unauthorized_response("missing bearer token")] unless auth&.start_with?("Bearer ")
 
       creds = JwtService.verify(auth[7..])
       context = CredentialContext.new(
@@ -161,12 +165,16 @@ module MailMCP
       )
       [context, nil]
     rescue JwtService::Error => e
-      error = [
+      [nil, unauthorized_response(e.message)]
+    end
+
+    # 401 challenge that tells an MCP client where to run the OAuth flow.
+    def unauthorized_response(description)
+      [
         401,
         { "Content-Type" => "application/json", "WWW-Authenticate" => mcp_www_authenticate },
-        [JSON.generate({ error: "invalid_token", error_description: e.message })]
+        [JSON.generate({ error: "invalid_token", error_description: description })]
       ]
-      [nil, error]
     end
 
     def exchange_code(params, client_id)
@@ -216,6 +224,13 @@ module MailMCP
       ENV.fetch("BASE_URL")
     end
 
+    # The MCP transport's DNS-rebinding protection only accepts loopback `Host` values
+    # out of the box. This server is reached at its public hostname, so allow-list it —
+    # a bare host name matches any port.
+    def allowed_mcp_hosts
+      [URI.parse(base_url).host]
+    end
+
     def decode_client_id!(client_id)
       JwtService.decode_client_id(client_id.to_s)
     rescue JwtService::Error => e

data/lib/mail_mcp/imap_client.rb

@@ -190,12 +190,15 @@ module MailMCP
 
     def extract_attachments(mail)
       mail.attachments.map do |att|
+        # Mail#decoded does not memoize — it base64-decodes into a new String on
+        # every call, so decode once and reuse for both the upload and the size.
+        content = att.decoded
         url = AttachmentStore.upload(
-          content: att.decoded,
+          content: content,
           filename: att.filename || "attachment",
           content_type: att.content_type
         )
-        { filename: att.filename, content_type: att.content_type, size: att.decoded.bytesize, url: url }
+        { filename: att.filename, content_type: att.content_type, size: content.bytesize, url: url }
       end
     end
   end

data/lib/mail_mcp/version.rb

@@ -1,3 +1,3 @@
 module MailMCP
-  VERSION = "1.0.1".freeze
+  VERSION = "1.0.3".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mail_mcp
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.3
 platform: ruby
 authors:
 - Edgars Beigarts
@@ -71,14 +71,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.14'
+        version: 0.25.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.14'
+        version: 0.25.0
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement