@candledottv/mcp 0.6.1 → 0.6.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +23 -3
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -17,6 +17,24 @@ function isLoopbackHost(hostname) {
|
|
|
17
17
|
return true;
|
|
18
18
|
return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
|
|
19
19
|
}
|
|
20
|
+
function isPrivateHost(hostname) {
|
|
21
|
+
const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
|
|
22
|
+
if (!host.includes(".") && !host.includes(":"))
|
|
23
|
+
return true;
|
|
24
|
+
if (/\.(local|internal|home\.arpa)$/.test(host))
|
|
25
|
+
return true;
|
|
26
|
+
if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
27
|
+
return true;
|
|
28
|
+
if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
29
|
+
return true;
|
|
30
|
+
if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
31
|
+
return true;
|
|
32
|
+
if (/^169\.254\.\d{1,3}\.\d{1,3}$/.test(host))
|
|
33
|
+
return true;
|
|
34
|
+
if (/^f[cd][0-9a-f]{2}:/.test(host))
|
|
35
|
+
return true;
|
|
36
|
+
return /^fe[89ab][0-9a-f]:/.test(host);
|
|
37
|
+
}
|
|
20
38
|
function assertTransportSecurity(apiUrl, env) {
|
|
21
39
|
let parsed;
|
|
22
40
|
try {
|
|
@@ -31,9 +49,9 @@ function assertTransportSecurity(apiUrl, env) {
|
|
|
31
49
|
}
|
|
32
50
|
if (isLoopbackHost(parsed.hostname))
|
|
33
51
|
return;
|
|
34
|
-
if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim())
|
|
52
|
+
if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim() && isPrivateHost(parsed.hostname))
|
|
35
53
|
return;
|
|
36
|
-
throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint.");
|
|
54
|
+
throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + (isPrivateHost(parsed.hostname) ? "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint." : "URL. CANDLE_ALLOW_INSECURE_HTTP does not apply here: it covers private networks only, " + "and this is a public address."));
|
|
37
55
|
}
|
|
38
56
|
function resolveConfig(env = process.env) {
|
|
39
57
|
const apiUrl = env.CANDLE_API_URL?.trim() || DEFAULT_API_URL;
|
|
@@ -413,10 +431,12 @@ async function executionStatus(cfg, doFetch) {
|
|
|
413
431
|
["tier", tier],
|
|
414
432
|
["limits", limits]
|
|
415
433
|
].filter(([, r]) => !r.ok);
|
|
434
|
+
const tierBody = tier.ok ? tier.body : undefined;
|
|
416
435
|
return {
|
|
417
436
|
text: JSON.stringify({
|
|
418
437
|
success: true,
|
|
419
438
|
ready: unreadable.length === 0 ? true : undefined,
|
|
439
|
+
notice: tierBody?.maxExpired ? tierBody.maxExpiredNotice : undefined,
|
|
420
440
|
unreadable: unreadable.length > 0 ? unreadable.map(([name]) => name) : undefined,
|
|
421
441
|
wallets: wallets.body,
|
|
422
442
|
tier: tier.body,
|
|
@@ -769,7 +789,7 @@ function registerTools(server, env = process.env) {
|
|
|
769
789
|
}
|
|
770
790
|
|
|
771
791
|
// src/version.ts
|
|
772
|
-
var SERVER_VERSION = "0.6.
|
|
792
|
+
var SERVER_VERSION = "0.6.3";
|
|
773
793
|
|
|
774
794
|
// src/server.ts
|
|
775
795
|
function createCandleMcpServer(env = process.env) {
|