@attackforge/mcp-server 0.3.2 → 0.3.4

package/README.md

@@ -16,7 +16,8 @@ The server requires the following environment variables:
 |----------|----------|-------------|
 | `AF_HOSTNAME` | Yes | Your AttackForge server hostname (e.g., `your-instance.attackforge.com`) |
 | `AF_USER_KEY` | Yes | Your AttackForge API user key for authentication |
-| `AF_PORT` | No | Custom port if your AttackForge server uses a non-standard HTTPS port |
+| `AF_PORT` | No | Custom port if your AttackForge server does not listen on the protocol's standard port |
+| `AF_PROTOCOL` | No | `https` (default) or `http`. `http` sends your API key unencrypted and is intended only for a local development instance |
 | `AF_TIMEOUT_MS` | No | How long to wait on an AttackForge request before giving up (default `60000`) |
 
 ## Usage
@@ -67,6 +68,8 @@ This MCP server implements the [Model Context Protocol](https://modelcontextprot
 3. When the client calls a tool, the server forwards the request to `https://{AF_HOSTNAME}/mcp/tools/call`
 4. All requests are authenticated using the `x-user-key` header
 
+Requests go over HTTPS unless `AF_PROTOCOL=http` is set.
+
 The tools available are determined by your AttackForge instance configuration and the permissions of the user whose key is configured.
 
 ### Protocol versions
@@ -120,7 +123,7 @@ npm run test:integration
 
 The tests are TypeScript run directly by Node, which needs Node.js 22.18 or later.
 
-Integration tests read `AF_HOSTNAME`, `AF_USER_KEY` and optionally `AF_PORT` and `AF_TIMEOUT_MS` from a gitignored `.env.integration` - copy `.env.integration.example` to start. They are skipped when those are not set, and are read-only unless `AF_TEST_ALLOW_WRITES=true`, which creates a tagged testsuite per protocol era on each run.
+Integration tests read `AF_HOSTNAME`, `AF_USER_KEY` and optionally `AF_PORT`, `AF_PROTOCOL` and `AF_TIMEOUT_MS` from a gitignored `.env.integration` - copy `.env.integration.example` to start. They are skipped when those are not set, and are read-only unless `AF_TEST_ALLOW_WRITES=true`, which creates a tagged testsuite per protocol era on each run.
 
 ## Requirements
 

package/dist/index.js

@@ -8,6 +8,11 @@ if (!process.env.AF_HOSTNAME) {
 if (!process.env.AF_USER_KEY) {
     throw new Error('Environment variable AF_USER_KEY is required');
 }
+// http sends AF_USER_KEY unencrypted, so it is opt-in and never inferred.
+const protocol = process.env.AF_PROTOCOL || 'https';
+if (protocol !== 'http' && protocol !== 'https') {
+    throw new Error('Environment variable AF_PROTOCOL must be http or https');
+}
 const DEFAULT_TIMEOUT_MS = 60_000;
 let packageJson;
 try {
@@ -37,7 +42,7 @@ function describeFailure(status, body) {
     }
 }
 async function forward(path, request) {
-    const url = new URL(path, `https://${process.env.AF_HOSTNAME}`);
+    const url = new URL(path, `${protocol}://${process.env.AF_HOSTNAME}`);
     if (process.env.AF_PORT) {
         url.port = process.env.AF_PORT;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attackforge/mcp-server",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "AttackForge MCP Server",
   "main": "dist/index.js",
   "type": "module",
@@ -11,7 +11,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "tsc && shx chmod +x dist/index.js",
+    "build": "tsc && chmod +x dist/index.js",
     "clean": "rm -rf dist",
     "prepare": "npm run rebuild",
     "rebuild": "npm run clean && npm run build",
@@ -24,13 +24,12 @@
     "node": ">=22"
   },
   "devDependencies": {
-    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/client": "^2.3.0",
     "@tsconfig/node22": "^22.0.6",
-    "@types/node": "^22.20.4",
-    "shx": "^0.4.0",
+    "@types/node": "^22.20.5",
     "typescript": "^6.0.2"
   },
   "dependencies": {
-    "@modelcontextprotocol/server": "^2.2.0"
+    "@modelcontextprotocol/server": "^2.3.0"
   }
 }