@chenyingxian/zentao-mcp 0.1.1 → 0.1.2

package/.env.example

@@ -1,6 +1,8 @@
-ZENTAO_BASE_URL=https://zentao.example.com
-ZENTAO_ACCOUNT=admin
-ZENTAO_PASSWORD=change-me
-# Optional: use a pre-issued V1 token instead of logging in with account/password.
-ZENTAO_TOKEN=
-ZENTAO_TIMEOUT_MS=15000
+ZENTAO_BASE_URL=https://zentao.example.com
+ZENTAO_ACCOUNT=admin
+ZENTAO_PASSWORD=change-me
+# Optional: use a pre-issued V1 token instead of logging in with account/password.
+ZENTAO_TOKEN=
+ZENTAO_TIMEOUT_MS=15000
+# Optional: put the variables above in another local file and expose only this path to your MCP client.
+ZENTAO_CONFIG_FILE=

package/CONFIG.md

@@ -19,13 +19,27 @@ ZENTAO_BASE_URL=https://zentao.example.com
 ZENTAO_TOKEN=your-token
 ```
 
-## Optional Variables
-
-```bash
-ZENTAO_TIMEOUT_MS=15000
-```
-
-`ZENTAO_TIMEOUT_MS` controls the HTTP request timeout in milliseconds.
+## Optional Variables
+
+```bash
+ZENTAO_TIMEOUT_MS=15000
+ZENTAO_CONFIG_FILE=/path/to/zentao.env
+```
+
+`ZENTAO_TIMEOUT_MS` controls the HTTP request timeout in milliseconds.
+
+`ZENTAO_CONFIG_FILE` points to a local KEY=value config file. This is useful when you do not want to show credentials in the MCP client configuration UI.
+
+Example config file:
+
+```bash
+ZENTAO_BASE_URL=https://zentao.example.com
+ZENTAO_ACCOUNT=your-account
+ZENTAO_PASSWORD=your-password
+ZENTAO_TIMEOUT_MS=15000
+```
+
+Environment variables override values from `ZENTAO_CONFIG_FILE`.
 
 ## MCP Client Example
 
@@ -34,7 +48,7 @@ ZENTAO_TIMEOUT_MS=15000
   "mcpServers": {
     "zentao": {
       "command": "npx",
-      "args": ["@chenyingxian/zentao-mcp"],
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
       "env": {
         "ZENTAO_BASE_URL": "https://zentao.example.com",
         "ZENTAO_ACCOUNT": "your-account",
@@ -42,9 +56,25 @@ ZENTAO_TIMEOUT_MS=15000
         "ZENTAO_TIMEOUT_MS": "15000"
       }
     }
-  }
-}
-```
+  }
+}
+```
+
+Credentials can also be kept out of the MCP client config:
+
+```json
+{
+  "mcpServers": {
+    "zentao": {
+      "command": "npx",
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
+      "env": {
+        "ZENTAO_CONFIG_FILE": "/path/to/zentao.env"
+      }
+    }
+  }
+}
+```
 
 ## Token Helper
 

package/CONFIG.zh-CN.md

@@ -19,13 +19,27 @@ ZENTAO_BASE_URL=https://zentao.example.com
 ZENTAO_TOKEN=your-token
 ```
 
-## 可选变量
-
-```bash
-ZENTAO_TIMEOUT_MS=15000
-```
-
-`ZENTAO_TIMEOUT_MS` 用于控制 HTTP 请求超时时间，单位为毫秒。
+## 可选变量
+
+```bash
+ZENTAO_TIMEOUT_MS=15000
+ZENTAO_CONFIG_FILE=/path/to/zentao.env
+```
+
+`ZENTAO_TIMEOUT_MS` 用于控制 HTTP 请求超时时间，单位为毫秒。
+
+`ZENTAO_CONFIG_FILE` 指向一个本地 KEY=value 配置文件。这样 MCP 客户端配置里只需要展示文件路径，不需要直接展示密码。
+
+配置文件示例：
+
+```bash
+ZENTAO_BASE_URL=https://zentao.example.com
+ZENTAO_ACCOUNT=your-account
+ZENTAO_PASSWORD=your-password
+ZENTAO_TIMEOUT_MS=15000
+```
+
+环境变量会覆盖 `ZENTAO_CONFIG_FILE` 文件里的同名配置。
 
 ## MCP 客户端示例
 
@@ -34,7 +48,7 @@ ZENTAO_TIMEOUT_MS=15000
   "mcpServers": {
     "zentao": {
       "command": "npx",
-      "args": ["@chenyingxian/zentao-mcp"],
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
       "env": {
         "ZENTAO_BASE_URL": "https://zentao.example.com",
         "ZENTAO_ACCOUNT": "your-account",
@@ -42,9 +56,25 @@ ZENTAO_TIMEOUT_MS=15000
         "ZENTAO_TIMEOUT_MS": "15000"
       }
     }
-  }
-}
-```
+  }
+}
+```
+
+也可以把账号密码放在本地配置文件中，MCP 客户端只配置路径：
+
+```json
+{
+  "mcpServers": {
+    "zentao": {
+      "command": "npx",
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
+      "env": {
+        "ZENTAO_CONFIG_FILE": "/path/to/zentao.env"
+      }
+    }
+  }
+}
+```
 
 ## Token 辅助脚本
 

package/README.md

@@ -24,7 +24,7 @@ npx @chenyingxian/zentao-mcp
 
 ## Configuration
 
-Set the following environment variables in your MCP client:
+Set the following environment variables in your MCP client:
 
 ```bash
 ZENTAO_BASE_URL=https://zentao.example.com
@@ -42,26 +42,51 @@ ZENTAO_TOKEN=your-token
 Optional:
 
 ```bash
-ZENTAO_TIMEOUT_MS=15000
-```
-
-## MCP Client Example
-
-```json
-{
-  "mcpServers": {
-    "zentao": {
+ZENTAO_TIMEOUT_MS=15000
+```
+
+If you do not want to expose credentials directly in the MCP client config, put them in a local config file:
+
+```bash
+ZENTAO_BASE_URL=https://zentao.example.com
+ZENTAO_ACCOUNT=your-account
+ZENTAO_PASSWORD=your-password
+ZENTAO_TIMEOUT_MS=15000
+```
+
+Then expose only the file path to the MCP client:
+
+```json
+{
+  "mcpServers": {
+    "zentao": {
       "command": "npx",
-      "args": ["@chenyingxian/zentao-mcp"],
-      "env": {
-        "ZENTAO_BASE_URL": "https://zentao.example.com",
-        "ZENTAO_ACCOUNT": "your-account",
-        "ZENTAO_PASSWORD": "your-password"
-      }
-    }
-  }
-}
-```
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
+      "env": {
+        "ZENTAO_CONFIG_FILE": "/path/to/zentao.env"
+      }
+    }
+  }
+}
+```
+
+Environment variables override values from `ZENTAO_CONFIG_FILE`.
+
+## MCP Client Example
+
+```json
+{
+  "mcpServers": {
+    "zentao": {
+      "command": "npx",
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
+      "env": {
+        "ZENTAO_CONFIG_FILE": "/path/to/zentao.env"
+      }
+    }
+  }
+}
+```
 
 ## Get a Token
 

package/README.zh-CN.md

@@ -32,30 +32,55 @@ ZENTAO_ACCOUNT=your-account
 ZENTAO_PASSWORD=your-password
 ```
 
-也可以直接使用已签发的 v1 token：
+也可以直接使用已签发的 v1 token：
 
 ```bash
 ZENTAO_BASE_URL=https://zentao.example.com
-ZENTAO_TOKEN=your-token
-```
-
-## MCP 客户端示例
-
-```json
-{
-  "mcpServers": {
-    "zentao": {
+ZENTAO_TOKEN=your-token
+```
+
+如果不希望密码直接展示在 MCP 客户端配置里，可以把真实配置写到本地配置文件：
+
+```bash
+ZENTAO_BASE_URL=https://zentao.example.com
+ZENTAO_ACCOUNT=your-account
+ZENTAO_PASSWORD=your-password
+ZENTAO_TIMEOUT_MS=15000
+```
+
+然后 MCP 客户端只配置文件路径：
+
+```json
+{
+  "mcpServers": {
+    "zentao": {
       "command": "npx",
-      "args": ["@chenyingxian/zentao-mcp"],
-      "env": {
-        "ZENTAO_BASE_URL": "https://zentao.example.com",
-        "ZENTAO_ACCOUNT": "your-account",
-        "ZENTAO_PASSWORD": "your-password"
-      }
-    }
-  }
-}
-```
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
+      "env": {
+        "ZENTAO_CONFIG_FILE": "/path/to/zentao.env"
+      }
+    }
+  }
+}
+```
+
+环境变量会覆盖 `ZENTAO_CONFIG_FILE` 文件里的同名配置。
+
+## MCP 客户端示例
+
+```json
+{
+  "mcpServers": {
+    "zentao": {
+      "command": "npx",
+      "args": ["-y", "@chenyingxian/zentao-mcp@latest"],
+      "env": {
+        "ZENTAO_CONFIG_FILE": "/path/to/zentao.env"
+      }
+    }
+  }
+}
+```
 
 ## 获取 Token
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chenyingxian/zentao-mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "MCP server for ZenTao RESTful API v1 and legacy JSON routes.",
   "type": "module",
   "bin": {

package/src/index.js

@@ -6,7 +6,7 @@ import { createClientFromEnv } from "./zentao-client.js";
 
 const server = new McpServer({
   name: "zentao-mcp",
-  version: "0.1.1"
+  version: "0.1.2"
 });
 
 server.tool(

package/src/zentao-client.js

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
 
@@ -467,9 +468,57 @@ export class ZentaoClient {
  * @param {NodeJS.ProcessEnv} env Process environment.
  * @returns {ZentaoClient} ZenTao client.
  */
-export function createClientFromEnv(env = process.env) {
-  return new ZentaoClient({ baseUrl: env.ZENTAO_BASE_URL, account: env.ZENTAO_ACCOUNT, password: env.ZENTAO_PASSWORD, token: env.ZENTAO_TOKEN, timeoutMs: env.ZENTAO_TIMEOUT_MS });
-}
+export function createClientFromEnv(env = process.env) {
+  const fileConfig = env.ZENTAO_CONFIG_FILE ? readEnvConfigFile(env.ZENTAO_CONFIG_FILE) : {};
+  const merged = { ...fileConfig, ...compactEnv(env) };
+  return new ZentaoClient({ baseUrl: merged.ZENTAO_BASE_URL, account: merged.ZENTAO_ACCOUNT, password: merged.ZENTAO_PASSWORD, token: merged.ZENTAO_TOKEN, timeoutMs: merged.ZENTAO_TIMEOUT_MS });
+}
+
+/**
+ * Read a simple KEY=value config file.
+ * @param {string} filePath Config file path.
+ * @returns {Record<string, string>} Parsed config.
+ */
+function readEnvConfigFile(filePath) {
+  const text = readFileSync(filePath, "utf8");
+  return parseEnvFile(text);
+}
+
+/**
+ * Parse dotenv-like config text without adding a runtime dependency.
+ * @param {string} text Raw config text.
+ * @returns {Record<string, string>} Parsed key-value pairs.
+ */
+function parseEnvFile(text) {
+  const result = {};
+  for (const line of String(text).split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+    if (!match) continue;
+    result[match[1]] = unquoteEnvValue(match[2].trim());
+  }
+  return result;
+}
+
+/**
+ * Remove simple dotenv quotes from one value.
+ * @param {string} value Raw config value.
+ * @returns {string} Unquoted value.
+ */
+function unquoteEnvValue(value) {
+  if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) return value.slice(1, -1);
+  return value;
+}
+
+/**
+ * Keep only defined non-empty environment values so config files can provide defaults.
+ * @param {NodeJS.ProcessEnv} env Process environment.
+ * @returns {Record<string, string>} Compact environment.
+ */
+function compactEnv(env) {
+  return Object.fromEntries(Object.entries(env).filter(([, value]) => value !== undefined && value !== ""));
+}
 
 /**
  * Normalize a ZenTao site URL.