@candledottv/mcp 0.6.1 → 0.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +21 -3
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -17,6 +17,24 @@ function isLoopbackHost(hostname) {
|
|
|
17
17
|
return true;
|
|
18
18
|
return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
|
|
19
19
|
}
|
|
20
|
+
function isPrivateHost(hostname) {
|
|
21
|
+
const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
|
|
22
|
+
if (!host.includes(".") && !host.includes(":"))
|
|
23
|
+
return true;
|
|
24
|
+
if (/\.(local|internal|home\.arpa)$/.test(host))
|
|
25
|
+
return true;
|
|
26
|
+
if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
27
|
+
return true;
|
|
28
|
+
if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
29
|
+
return true;
|
|
30
|
+
if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
31
|
+
return true;
|
|
32
|
+
if (/^169\.254\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
33
|
+
return true;
|
|
34
|
+
if (/^f[cd][0-9a-f]{2}:/.test(host))
|
|
35
|
+
return true;
|
|
36
|
+
return /^fe[89ab][0-9a-f]:/.test(host);
|
|
37
|
+
}
|
|
20
38
|
function assertTransportSecurity(apiUrl, env) {
|
|
21
39
|
let parsed;
|
|
22
40
|
try {
|
|
@@ -31,9 +49,9 @@ function assertTransportSecurity(apiUrl, env) {
|
|
|
31
49
|
}
|
|
32
50
|
if (isLoopbackHost(parsed.hostname))
|
|
33
51
|
return;
|
|
34
|
-
if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim())
|
|
52
|
+
if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim() && isPrivateHost(parsed.hostname))
|
|
35
53
|
return;
|
|
36
|
-
throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint.");
|
|
54
|
+
throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + (isPrivateHost(parsed.hostname) ? "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint." : "URL. CANDLE_ALLOW_INSECURE_HTTP does not apply here: it covers private networks only, " + "and this is a public address."));
|
|
37
55
|
}
|
|
38
56
|
function resolveConfig(env = process.env) {
|
|
39
57
|
const apiUrl = env.CANDLE_API_URL?.trim() || DEFAULT_API_URL;
|
|
@@ -769,7 +787,7 @@ function registerTools(server, env = process.env) {
|
|
|
769
787
|
}
|
|
770
788
|
|
|
771
789
|
// src/version.ts
|
|
772
|
-
var SERVER_VERSION = "0.6.
|
|
790
|
+
var SERVER_VERSION = "0.6.2";
|
|
773
791
|
|
|
774
792
|
// src/server.ts
|
|
775
793
|
function createCandleMcpServer(env = process.env) {
|