@candledottv/mcp 0.6.1 → 0.6.3

package/dist/index.js

@@ -17,6 +17,24 @@ function isLoopbackHost(hostname) {
     return true;
   return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
 }
+function isPrivateHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (!host.includes(".") && !host.includes(":"))
+    return true;
+  if (/\.(local|internal|home\.arpa)$/.test(host))
+    return true;
+  if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^169\.254\.\d{1,3}\.\d{1,3}$/.test(host))
+    return true;
+  if (/^f[cd][0-9a-f]{2}:/.test(host))
+    return true;
+  return /^fe[89ab][0-9a-f]:/.test(host);
+}
 function assertTransportSecurity(apiUrl, env) {
   let parsed;
   try {
@@ -31,9 +49,9 @@ function assertTransportSecurity(apiUrl, env) {
   }
   if (isLoopbackHost(parsed.hostname))
     return;
-  if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim())
+  if (env.CANDLE_ALLOW_INSECURE_HTTP?.trim() && isPrivateHost(parsed.hostname))
     return;
-  throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint.");
+  throw new Error(`Refusing to send credentials in the clear to ${parsed.origin}. Set CANDLE_API_URL to an https:// ` + (isPrivateHost(parsed.hostname) ? "URL, or set CANDLE_ALLOW_INSECURE_HTTP=1 if this really is a trusted local endpoint." : "URL. CANDLE_ALLOW_INSECURE_HTTP does not apply here: it covers private networks only, " + "and this is a public address."));
 }
 function resolveConfig(env = process.env) {
   const apiUrl = env.CANDLE_API_URL?.trim() || DEFAULT_API_URL;
@@ -413,10 +431,12 @@ async function executionStatus(cfg, doFetch) {
     ["tier", tier],
     ["limits", limits]
   ].filter(([, r]) => !r.ok);
+  const tierBody = tier.ok ? tier.body : undefined;
   return {
     text: JSON.stringify({
       success: true,
       ready: unreadable.length === 0 ? true : undefined,
+      notice: tierBody?.maxExpired ? tierBody.maxExpiredNotice : undefined,
       unreadable: unreadable.length > 0 ? unreadable.map(([name]) => name) : undefined,
       wallets: wallets.body,
       tier: tier.body,
@@ -769,7 +789,7 @@ function registerTools(server, env = process.env) {
 }
 
 // src/version.ts
-var SERVER_VERSION = "0.6.1";
+var SERVER_VERSION = "0.6.3";
 
 // src/server.ts
 function createCandleMcpServer(env = process.env) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/mcp",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "MCP server for the Candle agent rail: launch tokens, read markets, report activity",
   "type": "module",
   "license": "MIT",