@ainecto/mcp 0.1.3 → 0.2.0

package/README.md

@@ -1,10 +1,10 @@
-# @ainecto/mcp
+# @ai-erd/mcp
 
-Ainecto MCP connector and first-party CLI.
+AI-ERD MCP connector and first-party CLI.
 
 This package exposes two entry points:
 
-- `npx -y @ainecto/mcp` or `ainecto mcp`: raw stdio-to-HTTP JSON-RPC proxy for Ainecto MCP.
+- `npx -y @ai-erd/mcp` or `ainecto mcp`: raw stdio-to-HTTP JSON-RPC proxy for AI-ERD MCP.
 - `ainecto <command>`: human CLI for auth and low-level tool calls.
 
 Phase 1 keeps the connector as a raw proxy. File, stdin, and inline JSON parsing are only available in first-party CLI commands.
@@ -41,12 +41,14 @@ Endpoint resolution priority:
 1. `--endpoint <url>`
 2. `AINECTO_MCP_ENDPOINT`
 3. `--env dev`
-4. production default, `https://ainecto.com/mcp`
+4. production default, `https://ai-erd.com/mcp`
+
+Endpoint URLs must use `https:`. Plain `http:` is accepted only for localhost loopback targets such as `127.0.0.1`. When `AINECTO_TOKEN` is set, the CLI only sends it to the default prod/dev endpoints unless `AINECTO_ALLOW_CUSTOM_ENDPOINT_TOKEN=1` is set for an explicitly trusted custom endpoint.
 
 ## Connector Mode
 
 ```bash
-npx -y @ainecto/mcp
+npx -y @ai-erd/mcp
 ainecto mcp --env dev
 ```
 
@@ -61,7 +63,7 @@ Use the direct package configuration until the server is published to the offici
   "mcpServers": {
     "ainecto": {
       "command": "npx",
-      "args": ["-y", "@ainecto/mcp"]
+      "args": ["-y", "@ai-erd/mcp"]
     }
   }
 }
@@ -74,13 +76,13 @@ For a non-production endpoint, pass CLI flags through the package args:
   "mcpServers": {
     "ainecto-dev": {
       "command": "npx",
-      "args": ["-y", "@ainecto/mcp", "--env", "dev"]
+      "args": ["-y", "@ai-erd/mcp", "--env", "dev"]
     }
   }
 }
 ```
 
-The planned official Registry server name is `io.github.codelives/ainecto`, backed by the public npm package `@ainecto/mcp`. Registry publication requires the npm package version referenced by `server.json` to include a matching `mcpName` field in `package.json`.
+The planned official Registry server name is `io.github.codelives/ainecto`, backed by the public npm package `@ai-erd/mcp`. Registry publication requires the npm package version referenced by `server.json` to include a matching `mcpName` field in `package.json`.
 
 ## Catalog Sync
 
@@ -92,9 +94,9 @@ AINECTO_CATALOG_SYNC_TOKEN=... npm run sync:tools -- --env prod --check
 AINECTO_CATALOG_SYNC_TOKEN=... npm run sync:tools -- --env dev --check
 ```
 
-The checked-in generated catalogs are deterministic output from `tools/list`. The dev catalog has been live-synced from `https://dev.ainecto.com/mcp`; the prod catalog remains a seed fixture until prod auth is available. Presentation metadata lives separately in `src/core/catalog/enrichments.ts`.
+The checked-in generated catalogs are deterministic output from `tools/list`. The prod and dev catalogs are live-synced snapshots from `https://ai-erd.com/mcp` and `https://dev.ainecto.com/mcp`. Presentation metadata lives separately in `src/core/catalog/enrichments.ts`.
 
-`ainecto tools catalog` prints the local generated catalog. Prod output is fixture-only until authenticated prod live sync updates `generated.prod.ts` and `tools-list.prod.json`.
+`ainecto tools catalog` prints the local generated catalog. Rerun authenticated `sync:tools` when prod or dev `tools/list` changes.
 
 ## Generated Friendly Commands
 
@@ -126,8 +128,8 @@ The generated `request_upload_token` and `upload_attachments` paths remain raw M
 
 ```bash
 npm pack
-npx -y ./ainecto-mcp-0.1.3.tgz --help
-npm exec --package ./ainecto-mcp-0.1.3.tgz -- ainecto --help
+npx -y ./ainecto-mcp-0.1.4.tgz --help
+npm exec --package ./ainecto-mcp-0.1.4.tgz -- ainecto --help
 ```
 
 ## Live Dev MCP Smoke

package/dist/bin/ainecto.js

@@ -26,6 +26,7 @@ var FileTokenStore = class {
   }
   async readFile() {
     try {
+      await this.hardenExistingPermissions();
       const raw = await readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -49,6 +50,11 @@ var FileTokenStore = class {
     await rename(tmpPath, this.filePath);
     await chmod(this.filePath, 384);
   }
+  async hardenExistingPermissions() {
+    const dirPath = dirname(this.filePath);
+    await chmodIfPermissive(dirPath, 448);
+    await chmodIfPermissive(this.filePath, 384);
+  }
 };
 function tokenKey(endpoint) {
   return createHash("sha256").update(endpoint).digest("hex");
@@ -56,6 +62,19 @@ function tokenKey(endpoint) {
 function isNodeError(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
 }
+async function chmodIfPermissive(path, mode) {
+  try {
+    const result = await stat(path);
+    if ((result.mode & 63) !== 0) {
+      await chmod(path, mode);
+    }
+  } catch (error) {
+    if (isNodeError(error, "ENOENT")) {
+      return;
+    }
+    throw error;
+  }
+}
 
 // src/core/auth/oauth.ts
 import { createHash as createHash2, randomBytes } from "crypto";
@@ -63,8 +82,70 @@ import { createServer } from "http";
 import { spawn } from "child_process";
 import { URLSearchParams } from "url";
 
+// src/core/config/endpoints.ts
+var DEFAULT_ENDPOINTS = {
+  prod: "https://ai-erd.com/mcp",
+  dev: "https://dev.ai-erd.com/mcp"
+};
+var LEGACY_DEFAULT_ENDPOINTS = [
+  "https://ainecto.com/mcp",
+  "https://dev.ainecto.com/mcp"
+];
+function resolveEndpoint(input = {}) {
+  const envVars = input.envVars ?? process.env;
+  const env = input.env ?? "prod";
+  if (input.endpoint) {
+    return { env, endpoint: normalizeEndpoint(input.endpoint), source: "flag" };
+  }
+  if (envVars.AINECTO_MCP_ENDPOINT) {
+    return { env, endpoint: normalizeEndpoint(envVars.AINECTO_MCP_ENDPOINT), source: "env" };
+  }
+  return { env, endpoint: DEFAULT_ENDPOINTS[env], source: "default" };
+}
+function normalizeEndpoint(endpoint) {
+  const url = new URL(endpoint);
+  assertTrustedEndpointUrl(url, "MCP endpoint");
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+function isDefaultEndpoint(endpoint) {
+  const normalized = normalizeEndpoint(endpoint);
+  return Object.values(DEFAULT_ENDPOINTS).includes(normalized) || LEGACY_DEFAULT_ENDPOINTS.includes(normalized);
+}
+function assertTrustedEndpointUrl(value, label = "URL") {
+  const url = typeof value === "string" ? new URL(value) : value;
+  if (url.protocol === "https:") {
+    return;
+  }
+  if (url.protocol === "http:" && isLoopbackHostname(url.hostname)) {
+    return;
+  }
+  throw new Error(`${label} must use https, except http is allowed for localhost loopback endpoints.`);
+}
+function assertLoopbackRedirectUrl(value) {
+  const url = new URL(value);
+  if (url.protocol === "http:" && isLoopbackHostname(url.hostname)) {
+    return;
+  }
+  throw new Error("OAuth redirect URI must be an http localhost loopback URL.");
+}
+function isLoopbackHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+}
+function assertEnv(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (value === "prod" || value === "dev") {
+    return value;
+  }
+  throw new Error(`Invalid --env value "${value}". Expected "prod" or "dev".`);
+}
+
 // src/core/auth/clientRegistration.ts
 async function registerPublicClient(registrationEndpoint, redirectUri, fetchImpl = fetch) {
+  assertTrustedEndpointUrl(registrationEndpoint, "OAuth client registration endpoint");
+  assertLoopbackRedirectUrl(redirectUri);
   const response = await fetchImpl(registrationEndpoint, {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
@@ -107,6 +188,7 @@ var OAuthClient = class {
   async getAccessToken() {
     const envToken = this.envVars.AINECTO_TOKEN;
     if (envToken) {
+      assertEnvTokenEndpointAllowed(this.options.endpoint, this.envVars);
       return envToken;
     }
     const stored = await this.options.tokenStore.load(this.options.endpoint);
@@ -140,6 +222,7 @@ var OAuthClient = class {
       authorizeUrl.searchParams.set("code_challenge_method", "S256");
       authorizeUrl.searchParams.set("resource", this.options.endpoint);
       authorizeUrl.searchParams.set("state", state);
+      assertTrustedEndpointUrl(authorizeUrl, "OAuth authorization URL");
       await this.openBrowserImpl(authorizeUrl.toString());
       const code = await loopback.waitForCode();
       const token = await exchangeToken(metadata.tokenEndpoint, {
@@ -193,18 +276,30 @@ function shouldRefresh(token, now = Date.now()) {
   return token.expiresAt - now < 6e4;
 }
 async function discoverOAuthMetadata(endpoint, fetchImpl = fetch) {
+  assertTrustedEndpointUrl(endpoint, "MCP endpoint");
   const resourceMetadataUrl = await discoverResourceMetadataUrl(endpoint, fetchImpl);
+  assertTrustedEndpointUrl(resourceMetadataUrl, "OAuth protected resource metadata URL");
   const resourceMetadata = await fetchJson(resourceMetadataUrl, fetchImpl);
   const authorizationServers = resourceMetadata.authorization_servers;
   if (!Array.isArray(authorizationServers) || typeof authorizationServers[0] !== "string") {
     throw new Error("OAuth protected resource metadata did not include authorization_servers.");
   }
   const authServer = authorizationServers[0];
+  assertTrustedEndpointUrl(authServer, "OAuth authorization server");
   const metadataUrl = authServer.includes("/.well-known/") ? authServer : `${authServer.replace(/\/$/, "")}/.well-known/oauth-authorization-server`;
+  assertTrustedEndpointUrl(metadataUrl, "OAuth authorization server metadata URL");
   const metadata = await fetchJson(metadataUrl, fetchImpl);
   if (typeof metadata.authorization_endpoint !== "string" || typeof metadata.token_endpoint !== "string") {
     throw new Error("OAuth authorization server metadata is missing authorization_endpoint or token_endpoint.");
   }
+  assertTrustedEndpointUrl(metadata.authorization_endpoint, "OAuth authorization endpoint");
+  assertTrustedEndpointUrl(metadata.token_endpoint, "OAuth token endpoint");
+  if (typeof metadata.registration_endpoint === "string") {
+    assertTrustedEndpointUrl(metadata.registration_endpoint, "OAuth client registration endpoint");
+  }
+  if (typeof metadata.issuer === "string") {
+    assertTrustedEndpointUrl(metadata.issuer, "OAuth issuer");
+  }
   const codeChallengeMethodsSupported = parseStringArray(metadata.code_challenge_methods_supported);
   if (!codeChallengeMethodsSupported.includes("S256")) {
     throw new Error("OAuth authorization server metadata must support PKCE S256.");
@@ -219,20 +314,25 @@ async function discoverOAuthMetadata(endpoint, fetchImpl = fetch) {
 }
 async function discoverResourceMetadataUrl(endpoint, fetchImpl) {
   const challengeUrl = new URL(endpoint);
+  assertTrustedEndpointUrl(challengeUrl, "MCP endpoint");
   const response = await fetchImpl(challengeUrl, { method: "GET" });
   const challenge = response.headers.get("www-authenticate");
   const fromChallenge = challenge ? parseBearerChallengeParam(challenge, "resource_metadata") : void 0;
   if (fromChallenge) {
+    assertTrustedEndpointUrl(fromChallenge, "OAuth protected resource metadata URL");
     return fromChallenge;
   }
   const origin = new URL(endpoint).origin;
-  return `${origin}/.well-known/oauth-protected-resource`;
+  const fallback = `${origin}/.well-known/oauth-protected-resource`;
+  assertTrustedEndpointUrl(fallback, "OAuth protected resource metadata URL");
+  return fallback;
 }
 function parseBearerChallengeParam(header, name) {
   const pattern = new RegExp(`${name}="([^"]+)"`);
   return pattern.exec(header)?.[1];
 }
 async function exchangeToken(tokenEndpoint, params, fetchImpl) {
+  assertTrustedEndpointUrl(tokenEndpoint, "OAuth token endpoint");
   const response = await fetchImpl(tokenEndpoint, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -311,48 +411,36 @@ function parseStringArray(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 async function fetchJson(url, fetchImpl) {
+  assertTrustedEndpointUrl(url, "OAuth metadata URL");
   const response = await fetchImpl(url);
   if (!response.ok) {
     throw new Error(`Failed to fetch OAuth metadata from ${url}: HTTP ${response.status}.`);
   }
   return response.json();
 }
-async function openBrowser(url) {
-  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-  const child = spawn(command, args, { stdio: "ignore", detached: true });
-  child.unref();
-}
-
-// src/core/config/endpoints.ts
-var DEFAULT_ENDPOINTS = {
-  prod: "https://ainecto.com/mcp",
-  dev: "https://dev.ainecto.com/mcp"
-};
-function resolveEndpoint(input = {}) {
-  const envVars = input.envVars ?? process.env;
-  const env = input.env ?? "prod";
-  if (input.endpoint) {
-    return { env, endpoint: normalizeEndpoint(input.endpoint), source: "flag" };
+function getBrowserOpenCommand(url, platform = process.platform) {
+  assertTrustedEndpointUrl(url, "OAuth authorization URL");
+  if (platform === "darwin") {
+    return { command: "open", args: [url] };
   }
-  if (envVars.AINECTO_MCP_ENDPOINT) {
-    return { env, endpoint: normalizeEndpoint(envVars.AINECTO_MCP_ENDPOINT), source: "env" };
+  if (platform === "win32") {
+    return { command: "explorer.exe", args: [url] };
   }
-  return { env, endpoint: DEFAULT_ENDPOINTS[env], source: "default" };
+  return { command: "xdg-open", args: [url] };
 }
-function normalizeEndpoint(endpoint) {
-  const url = new URL(endpoint);
-  url.hash = "";
-  return url.toString().replace(/\/$/, "");
+async function openBrowser(url) {
+  const { command, args } = getBrowserOpenCommand(url);
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.unref();
 }
-function assertEnv(value) {
-  if (value === void 0) {
-    return void 0;
+function assertEnvTokenEndpointAllowed(endpoint, envVars) {
+  if (envVars.AINECTO_ALLOW_CUSTOM_ENDPOINT_TOKEN === "1") {
+    return;
   }
-  if (value === "prod" || value === "dev") {
-    return value;
+  if (isDefaultEndpoint(endpoint)) {
+    return;
   }
-  throw new Error(`Invalid --env value "${value}". Expected "prod" or "dev".`);
+  throw new Error("AINECTO_TOKEN can only be used with the default prod/dev endpoints. Set AINECTO_ALLOW_CUSTOM_ENDPOINT_TOKEN=1 only when you intentionally trust the custom endpoint.");
 }
 
 // src/core/input/payloadSource.ts
@@ -478,10 +566,11 @@ var McpRpcClient = class {
     }
     const text = await response.text();
     if (!response.ok) {
-      throw new McpRpcError(`MCP HTTP request failed with HTTP ${response.status}.`, "MCP_HTTP_ERROR", {
-        status: response.status,
-        body: safeBodyPreview(text)
-      });
+      throw new McpRpcError(
+        `MCP HTTP request failed with HTTP ${response.status}.`,
+        "MCP_HTTP_ERROR",
+        httpErrorDetails(response.status, text, this.options.envVars ?? process.env)
+      );
     }
     if (!text.trim()) {
       return void 0;
@@ -513,6 +602,13 @@ function isJsonRpcResponse(value) {
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function httpErrorDetails(status, body, envVars) {
+  const details = { status };
+  if (envVars.AINECTO_CLI_DEBUG === "1" || envVars.AINECTO_DEBUG === "1") {
+    details.body = safeBodyPreview(body);
+  }
+  return details;
+}
 function safeBodyPreview(body) {
   return body.length > 500 ? `${body.slice(0, 500)}...` : body;
 }
@@ -549,12 +645,15 @@ function toErrorShape(error) {
       error: {
         code: maybe.code ?? "CLI_ERROR",
         message: error.message,
-        details: maybe.details
+        details: redactSecrets(maybe.details)
       }
     };
   }
   return { ok: false, error: { code: "CLI_ERROR", message: String(error) } };
 }
+function redactSecrets(value) {
+  return redactSecretsInner(value, /* @__PURE__ */ new WeakSet());
+}
 function renderHuman(data) {
   if (Array.isArray(data)) {
     return data.map((item) => renderHuman(item)).join("\n");
@@ -564,6 +663,33 @@ function renderHuman(data) {
   }
   return JSON.stringify(data, null, 2);
 }
+function redactSecretsInner(value, seen) {
+  if (typeof value === "string") {
+    return redactSecretString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactSecretsInner(item, seen));
+  }
+  if (value && typeof value === "object") {
+    if (seen.has(value)) {
+      return "[circular]";
+    }
+    seen.add(value);
+    const output = {};
+    for (const [key, child] of Object.entries(value)) {
+      output[key] = isSecretKey(key) ? "[redacted]" : redactSecretsInner(child, seen);
+    }
+    return output;
+  }
+  return value;
+}
+function isSecretKey(key) {
+  const normalized = key.toLowerCase().replace(/-/g, "_");
+  return normalized === "authorization" || normalized.includes("access_token") || normalized.includes("refresh_token") || normalized.includes("client_secret") || normalized.includes("token");
+}
+function redactSecretString(value) {
+  return value.replace(/("(?:authorization|access_token|refresh_token|client_secret|token)"\s*:\s*")([^"]*)(")/gi, "$1[redacted]$3").replace(/((?:authorization|access_token|refresh_token|client_secret|token)=)([^&\s"']+)/gi, "$1[redacted]").replace(/(authorization:\s*bearer\s+)([^\s,}]+)/gi, "$1[redacted]").replace(/(bearer\s+)(eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)/gi, "$1[redacted]");
+}
 
 // src/core/catalog/generated.prod.ts
 var generatedTools = [