@browserstack/mcp-server 2.1.0 → 2.1.1

package/dist/lib/instrumentation.js

@@ -6,6 +6,7 @@ const require = createRequire(import.meta.url);
 const packageJson = require("../../package.json");
 import { apiClient } from "./apiClient.js";
 import globalConfig from "../config.js";
+import { redact } from "../tools/capability-registry/redact.js";
 const INSTRUMENTATION_ENDPOINT = "https://api.browserstack.com/sdk/v1/event";
 function baseProperties(toolName, clientInfo) {
     return {
@@ -25,8 +26,13 @@ function errorProperties(error) {
 function sendEvent(event, config) {
     let authHeader;
     if (config) {
-        const authString = getBrowserStackAuth(config);
-        authHeader = `Basic ${Buffer.from(authString).toString("base64")}`;
+        try {
+            const authString = getBrowserStackAuth(config);
+            authHeader = `Basic ${Buffer.from(authString).toString("base64")}`;
+        }
+        catch {
+            // noop
+        }
     }
     apiClient
         .post({
@@ -80,6 +86,19 @@ export function trackMCP(toolName, clientInfo, error, config, extras) {
     };
     sendEvent(event, config);
 }
+/** The text a tool showed the user. */
+function errorTextOf(result) {
+    const content = result?.content;
+    if (!Array.isArray(content))
+        return undefined;
+    const text = content
+        .map((part) => typeof part?.text === "string"
+        ? part.text
+        : "")
+        .filter(Boolean)
+        .join(" ");
+    return redact(text);
+}
 function isErrorResult(result) {
     return (typeof result === "object" &&
         result !== null &&
@@ -93,10 +112,14 @@ export async function withToolCall(toolName, getClientInfo, config, fn) {
     const ctx = { toolName, clientInfo: {}, config };
     const startedAt = performance.now();
     let outcome = "ok";
+    let errorText;
     try {
         const result = await callContext.run(ctx, fn);
-        if (isErrorResult(result))
+        if (isErrorResult(result)) {
             outcome = "error_result";
+            // A returned failure never sets ctx.error, so the reason is read off the result.
+            errorText ??= errorTextOf(result);
+        }
         return result;
     }
     catch (error) {
@@ -123,6 +146,9 @@ export async function withToolCall(toolName, getClientInfo, config, fn) {
                     duration_ms: Math.max(0, Math.round(performance.now() - startedAt)),
                     outcome,
                     ...(ctx.error !== undefined ? errorProperties(ctx.error) : {}),
+                    ...(outcome === "error_result" && ctx.error === undefined && errorText
+                        ? { error_message: errorText }
+                        : {}),
                     ...(ctx.extras ?? {}),
                 },
             };

package/dist/tools/accessiblity-utils/scanner.js

@@ -74,7 +74,7 @@ export class AccessibilityScanner {
             });
             const data = response.data;
             if (!data.success)
-                throw new Error(`Unable to start scan: ${data.errors?.join(", ")}`);
+                throw new Error(`Unable to start scan: ${data.errors?.join(", ") || JSON.stringify(data)}`);
             return data;
         }
         catch (err) {

package/dist/tools/capability-registry/redact.js

@@ -25,13 +25,13 @@ const RULES = [
     },
     {
         name: "email",
-        pattern: /\b[\w.%+-]+@[\w.-]+\.[a-z]{2,}\b/gi,
+        pattern: /\b[\w.%+-]{1,128}@[\w.-]{1,128}\.[a-z]{2,24}\b/gi,
         replacement: "[email]",
     },
     // JWT: three base64url segments.
     {
         name: "jwt",
-        pattern: /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g,
+        pattern: /\beyJ[\w-]{8,1024}\.[\w-]{8,1024}\.[\w-]{8,1024}\b/g,
         replacement: "[token]",
     },
     // A long opaque run — access keys, API keys, session ids. Requires BOTH a digit and a
@@ -41,7 +41,7 @@ const RULES = [
     // wording a product uses is exactly the assumption that fails.
     {
         name: "opaque_token",
-        pattern: /\b(?=[A-Za-z0-9_-]*\d)(?=[A-Za-z0-9_-]*[A-Za-z])[A-Za-z0-9_-]{20,}\b/g,
+        pattern: /\b(?=[A-Za-z0-9_-]{0,256}\d)(?=[A-Za-z0-9_-]{0,256}[A-Za-z])[A-Za-z0-9_-]{20,256}\b/g,
         replacement: "[token]",
     },
     {
@@ -53,7 +53,7 @@ const RULES = [
     // separator or a `+`, so a bare digit run falls to long_number instead.
     {
         name: "phone",
-        pattern: /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?)?\d{3,5}[\s.-]\d{3,5}(?:[\s.-]\d{2,5})?\b/g,
+        pattern: /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?)?\b\d{3,5}[\s.-]\d{3,5}(?:[\s.-]\d{2,5})?\b/g,
         replacement: "[phone]",
     },
     // Long bare digit runs: account ids, card numbers, unseparated phone numbers.
@@ -81,7 +81,9 @@ export function redact(text) {
     try {
         if (typeof text !== "string")
             return undefined;
-        let out = text.replace(/\s+/g, " ").trim();
+        // Slice before the rules run; a multi-KB digit run makes them backtrack.
+        const SCAN_LIMIT = MAX_LENGTH * 8;
+        let out = text.slice(0, SCAN_LIMIT).replace(/\s+/g, " ").trim();
         if (!out)
             return undefined;
         for (const rule of RULES)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browserstack/mcp-server",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "BrowserStack's Official MCP Server",
   "mcpName": "io.github.browserstack/mcp-server",
   "main": "dist/index.js",