@aborruso/ckan-mcp-server 0.4.126 → 0.4.128

package/LOG.md

@@ -1,5 +1,29 @@
 # LOG
 
+## 2026-09-28
+
+### v0.4.128
+
+Ships #556: every redirect hop in `makeCkanRequest` is re-validated (GHSA-279h-fmcr-4rwv), on both the Node/axios and Workers/fetch paths. Smoke 17/17.
+
+### Security: validate every redirect hop in `makeCkanRequest` (GHSA-279h-fmcr-4rwv)
+
+`makeCkanRequest` followed up to 5 redirects via axios without re-validating the target. The SSRF-safe agent `lookup` is skipped by Node for IP literals, so a public URL 302-ing to `http://127.0.0.1/` or `169.254.169.254` was followed, and an internal endpoint answering `success: true` was returned in full (reproduced end-to-end via httpbin `redirect-to`). Fix: axios `beforeRedirect` calls `validateServerUrl` on each hop; the Workers `fetch` branch now uses `safeFetch` (`maxHops: 5`). Side effect: `CKAN_ALLOWED_DOMAINS` now applies to redirect targets too, so a portal redirecting to another host needs both listed. The public Worker (no allowlist) is unaffected for public portals.
+
+## 2026-09-24
+
+### v0.4.127
+
+Ships #554: `dct:temporal` coverage in `ckan_package_show` (markdown + JSON, every period, `start_equals_issued` flag) and `CKAN_ALLOWED_DOMAINS` declared optional in `server.json` for the MCP Registry. Smoke 17/17.
+
+### `ckan_package_show`: temporal coverage (dct:temporal)
+
+New `readTemporalCoverage()` reads `dct:temporal` in both shapes dati.gov.it uses: root `temporal_coverage` (JSON string, e.g. Comune di Coriano) and extras `temporal_start`/`temporal_end`/`temporal_coverage` (Regione Toscana, 12,426 datasets). Rendered as **Temporal Coverage (dct:temporal)** in markdown and `temporal_coverage: [{start, end, start_equals_issued}]` in JSON, every period kept; before, JSON had nothing and markdown only the extras case. `start_equals_issued` is a factual flag for start = issued with no end: a full scan of the 17,860 datasets with `temporal_start` found a third like that, and on the origin portals (dati.toscana.it, opendata.maggioli.cloud, opendata.uniba.it, all dcatapit) `temporal_coverage` is empty in the CKAN API while their RDF export emits `dct:temporal` with `startDate` = `dct:issued`. So it is an export artefact, not a publisher entry. INPS, MIT, LaMMA weather runs and Camera di Commercio Marche carry real spans.
+
+### server.json: declare `CKAN_ALLOWED_DOMAINS` as optional
+
+Claude Desktop's configure dialog asked for six env vars, `CKAN_ALLOWED_DOMAINS` marked required, inferred from the README HTTP table. The registry package is stdio, where the allowlist is optional. `server.json` now declares the one variable explicitly (`isRequired: false`, placeholder). Takes effect on the next registry publish.
+
 ## 2026-09-23
 
 ### v0.4.126 - why MQA URL tests fail

package/dist/index.js

@@ -945,6 +945,12 @@ async function makeCkanRequest(serverUrl, action, params = {}, opts = {}) {
         timeout: 3e4,
         responseType: "arraybuffer",
         maxRedirects: 5,
+        // Re-validate every redirect hop: Node skips the agent's `lookup` for IP
+        // literals, so a public host 302-ing to e.g. 169.254.169.254 would otherwise
+        // be followed. Also enforces CKAN_ALLOWED_DOMAINS on redirect targets.
+        beforeRedirect: (redirectOptions) => {
+          validateServerUrl(redirectOptions.href);
+        },
         // Never route through HTTP_PROXY/HTTPS_PROXY: a proxy would connect to the
         // target itself, bypassing the SSRF-safe lookup pinned in the agents below.
         proxy: false,
@@ -979,7 +985,7 @@ async function makeCkanRequest(serverUrl, action, params = {}, opts = {}) {
       const timeoutId = setTimeout(() => controller.abort(), 3e4);
       let response;
       try {
-        response = await fetch(fetchUrl, {
+        response = await safeFetch(fetchUrl, {
           method: "GET",
           signal: controller.signal,
           headers: {
@@ -987,7 +993,7 @@ async function makeCkanRequest(serverUrl, action, params = {}, opts = {}) {
             "Accept-Encoding": "identity",
             "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
           }
-        });
+        }, { maxHops: 5 });
       } finally {
         clearTimeout(timeoutId);
       }
@@ -1517,6 +1523,42 @@ var readDcatExtra = (dataset, key) => {
   const rootValue = dataset[key];
   return typeof rootValue === "string" ? rootValue : "";
 };
+var readExtra = (dataset, key) => {
+  const extras = Array.isArray(dataset.extras) ? dataset.extras : [];
+  for (const e of extras) {
+    if (e && typeof e === "object" && e.key === key) {
+      return e.value;
+    }
+  }
+  return void 0;
+};
+var toPeriod = (item) => {
+  if (!item || typeof item !== "object") return null;
+  const { temporal_start, temporal_end } = item;
+  const start = typeof temporal_start === "string" && temporal_start ? temporal_start : null;
+  const end = typeof temporal_end === "string" && temporal_end ? temporal_end : null;
+  return start || end ? { start, end } : null;
+};
+var parseTemporalCoverage = (raw) => {
+  let value = raw;
+  if (typeof value === "string") {
+    try {
+      value = JSON.parse(value);
+    } catch {
+      return [];
+    }
+  }
+  const items = Array.isArray(value) ? value : [value];
+  return items.map(toPeriod).filter((p) => p !== null);
+};
+var readTemporalCoverage = (dataset) => {
+  const fromRoot = parseTemporalCoverage(dataset.temporal_coverage);
+  if (fromRoot.length > 0) return fromRoot;
+  const fromExtra = parseTemporalCoverage(readExtra(dataset, "temporal_coverage"));
+  if (fromExtra.length > 0) return fromExtra;
+  return parseTemporalCoverage({ temporal_start: readExtra(dataset, "temporal_start"), temporal_end: readExtra(dataset, "temporal_end") });
+};
+var startEqualsIssued = (period, issued) => period.end === null && typeof issued === "string" && period.start !== null && period.start.slice(0, 10) === issued.slice(0, 10);
 var scoreDatasetRelevance = (query, dataset, weights = DEFAULT_RELEVANCE_WEIGHTS, fullCoverage = false) => {
   const terms = extractQueryTerms(query);
   const titleText = dataset.title || dataset.name || "";
@@ -1655,6 +1697,15 @@ var formatPackageShowMarkdown = (result, serverUrl) => {
   const accessRights = dcatField("access_rights");
   if (accessRights) markdown += `- **Access Rights (dct:accessRights)**: ${sanitizeInline(accessRights)}
 `;
+  const periods = readTemporalCoverage(result);
+  if (periods.length > 0) {
+    const spans = periods.map((p) => {
+      const span = `${p.start ? formatDate(p.start) : "?"} \u2192 ${p.end ? formatDate(p.end) : "open"}`;
+      return startEqualsIssued(p, result.issued) ? `${span} (start equals issued, no end)` : span;
+    });
+    markdown += `- **Temporal Coverage (dct:temporal)**: ${sanitizeInline(spans.join("; "))}
+`;
+  }
   markdown += `
 `;
   if (result.organization) {
@@ -1888,6 +1939,7 @@ function compactPackageShow(result, serverUrl) {
     holder_name: result.holder_name || null,
     hvd_category: result.hvd_category || null,
     applicable_legislation: result.applicable_legislation || null,
+    temporal_coverage: readTemporalCoverage(result).map((p) => ({ ...p, start_equals_issued: startEqualsIssued(p, result.issued) })),
     resources: (result.resources || []).map((r) => ({
       id: r.id,
       name: r.name || null,
@@ -2500,6 +2552,8 @@ Returns (JSON format):
   author, maintainer,
   frequency, language, publisher_name, holder_name,
   hvd_category, applicable_legislation,
+  temporal_coverage (array of {start, end, start_equals_issued} from dct:temporal; empty if absent;
+    start_equals_issued=true when start = issued and no end: on dcatapit portals an export default, not a data period),
   resources (id, name, format, url, size, datastore_active, created, last_modified, api_json_url),
   view_url, api_json_url
 
@@ -5994,7 +6048,7 @@ var registerAllPrompts = (server) => {
 function createServer() {
   return new McpServer({
     name: "ckan-mcp-server",
-    version: "0.4.126"
+    version: "0.4.128"
   });
 }
 function registerAll(server) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aborruso/ckan-mcp-server",
-  "version": "0.4.126",
+  "version": "0.4.128",
   "mcpName": "io.github.aborruso/ckan-mcp-server",
   "description": "MCP server for interacting with CKAN open data portals",
   "repository": {