@casys/mcp-erpnext 2.4.1 → 2.4.2

package/mcp-erpnext.mjs

@@ -3775,6 +3775,7 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3804,6 +3805,11 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -29680,6 +29686,12 @@ var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) =
   return {};
 };
 async function parseFormData(request, options) {
+  if (!isRawRequest(request) && request.bodyCache.formData) {
+    return convertFormDataToBodyData(
+      await request.bodyCache.formData,
+      options
+    );
+  }
   const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const arrayBuffer = await request.arrayBuffer();
   const formDataPromise = bufferToFormData(arrayBuffer, headers.get("Content-Type") || "");
@@ -45338,13 +45350,13 @@ async function main() {
   const portArg = args.find((arg) => arg.startsWith("--port="));
   const httpPort = portArg ? parseInt(portArg.split("=")[1], 10) : DEFAULT_HTTP_PORT;
   const hostnameArg = args.find((arg) => arg.startsWith("--hostname="));
-  const hostname = hostnameArg ? hostnameArg.split("=")[1] : "0.0.0.0";
+  const hostname = hostnameArg ? hostnameArg.split("=")[1] : "127.0.0.1";
   const toolsClient = new ErpNextToolsClient(
     categories ? { categories } : void 0
   );
   const server = new McpApp({
     name: "mcp-erpnext",
-    version: "2.4.1",
+    version: "2.4.2",
     maxConcurrent: 10,
     backpressureStrategy: "queue",
     validateSchema: true,
@@ -45390,6 +45402,12 @@ async function main() {
     `[mcp-erpnext] Initialized \u2014 ${toolsClient.count} tools${categories ? ` (categories: ${categories.join(", ")})` : ""}`
   );
   if (httpFlag) {
+    const isLoopback = hostname === "127.0.0.1" || hostname === "::1" || hostname === "localhost";
+    if (!isLoopback) {
+      console.error(
+        `[mcp-erpnext] WARNING: binding to ${hostname} exposes the HTTP server to the network. Every tool acts with the server's ERPNext API key, so restrict access (firewall, private network, or an authenticating reverse proxy).`
+      );
+    }
     await server.startHttp({
       port: httpPort,
       hostname,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casys/mcp-erpnext",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "MCP server for ERPNext with interactive UI viewers",
   "type": "module",
   "bin": {