@aiwerk/mcp-bridge 2.6.6 → 2.6.7

package/dist/src/security.js

@@ -155,6 +155,18 @@ function truncateJsonAware(value, limit) {
     return null;
 }
 function truncateArray(arr, limit) {
+    // For very large arrays, skip binary search (too many JSON.stringify calls)
+    // and use progressive halving instead
+    if (arr.length > 1000) {
+        let count = arr.length;
+        while (count > 1) {
+            count = Math.ceil(count / 2);
+            if (JSON.stringify(arr.slice(0, count)).length <= limit) {
+                return arr.slice(0, count);
+            }
+        }
+        return arr.slice(0, 1);
+    }
     // Binary search for the number of elements that fit
     let lo = 0;
     let hi = arr.length;
@@ -213,20 +225,19 @@ export function processResult(result, serverName, serverConfig, clientConfig) {
     const wasTruncated = processed !== null && typeof processed === "object" && processed._truncated === true;
     // Sanitize step (only for trust=sanitize, handled inside applyTrustLevel)
     processed = applyTrustLevel(processed, serverName, serverConfig);
-    // If both truncated and untrusted/sanitize, flatten the metadata to top level
-    // to avoid double-wrapping ({ _trust, result: { _truncated, result: actual } })
+    // If both truncated and untrusted, flatten the metadata to top level
+    // to avoid double-wrapping ({ _trust, result: { _truncated, result: actual } }).
+    // Note: sanitize mode does NOT wrap — it sanitizes in-place, so the truncation
+    // markers (_truncated, _originalLength) are already at the right level.
     const trust = serverConfig.trust ?? "trusted";
-    if (wasTruncated && (trust === "untrusted" || trust === "sanitize")) {
-        const flat = {
+    if (wasTruncated && trust === "untrusted") {
+        return {
+            _trust: "untrusted",
+            _server: serverName,
             _truncated: true,
             _originalLength: processed.result?._originalLength,
             result: processed.result?.result,
         };
-        if (trust === "untrusted") {
-            flat._trust = "untrusted";
-            flat._server = serverName;
-        }
-        return flat;
     }
     return processed;
 }

package/dist/src/standalone-server.js

@@ -30,6 +30,14 @@ export class StandaloneServer {
         if (this.isRouterMode()) {
             this.router = new McpRouter(config.servers ?? {}, config, logger);
         }
+        else {
+            // Warn if security config is used in direct mode where processResult() doesn't run
+            const hasSecurityConfig = Object.values(config.servers ?? {}).some(s => s.trust && s.trust !== "trusted" || s.maxResultChars || s.toolFilter);
+            if (hasSecurityConfig || config.maxResultChars) {
+                logger.warn("[mcp-bridge] Security config (trust/maxResultChars/toolFilter) detected in direct mode. " +
+                    "These settings only apply in router mode. Consider switching to mode: \"router\".");
+            }
+        }
     }
     isRouterMode() {
         return (this.config.mode ?? "router") === "router";

package/dist/src/transport-base.js

@@ -106,6 +106,8 @@ export class BaseTransport {
                 this.scheduleReconnect();
             }
         }, reconnectInterval);
+        // Allow Node.js process to exit gracefully even if reconnect is pending
+        this.reconnectTimer.unref();
     }
     /** Cancel any scheduled reconnection timer. */
     cleanupReconnectTimer() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwerk/mcp-bridge",
-  "version": "2.6.6",
+  "version": "2.6.7",
   "description": "Standalone MCP server that multiplexes multiple MCP servers into one interface",
   "type": "module",
   "main": "./dist/src/index.js",