@coinpaprika/mcp 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to the CoinPaprika MCP Server will be documented in this fil
 
 ## [Unreleased]
 
+## [1.4.1] - 2026-10-21
+
+### Security
+
+- **An id could change which API path a tool called.** Ids go into the request path through `encodeURIComponent`, which leaves `.` and `..` as they are, so an id of `..` moved the request, with your API key on it, to a different path. Every request now has its path checked before it is sent: a path that changes when parsed, or a segment that decodes to `.` or `..` or holds `/`, `\` or `%`, is refused with "Invalid identifier". No real coin, exchange, tag, person, platform or contract id is affected.
+
 ## [1.4.0] - 2026-08-19
 
 ### Fixed

package/dist/index.js

@@ -2,6 +2,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { createRequire } from 'module';
 import fetch from 'node-fetch';
+import { assertPathUnchanged } from './safe-path.js';
 import { z } from 'zod';
 
 // Server version, read from package.json so the banner, capabilities
@@ -195,7 +196,9 @@ function clamp(n, min, max) {
 // Helper function to fetch data from CoinPaprika API with structured error handling
 async function fetchFromAPI(endpoint) {
   const startTime = Date.now();
-  const response = await fetch(`${API_BASE_URL}${endpoint}`, { headers: buildHeaders() });
+  const url = `${API_BASE_URL}${endpoint}`;
+  assertPathUnchanged(url); // before the key leaves the process
+  const response = await fetch(url, { headers: buildHeaders() });
 
   if (!response.ok) {
     const structuredError = parseAPIError(response.status, response.statusText, endpoint);

package/dist/safe-path.js

@@ -0,0 +1,28 @@
+// Ids reach the upstream path through encodeURIComponent, which encodes "/", "?" and "#" but
+// leaves "." and "..". An id of ".." would make the request, with your API key on it, go to a
+// different path than the tool intended, because URL parsing resolves dot segments. And an id
+// of "../key/info" encodes to "..%2Fkey%2Finfo", which URL parsing leaves alone but a server
+// that decodes before routing might not. So refuse any URL whose path changes when parsed, and
+// any path segment that, decoded once, is "." or ".." or holds "/", "\" or "%". No real coin,
+// exchange, tag, person, platform or contract id contains any of these.
+export function assertPathUnchanged(url) {
+  const afterScheme = url.indexOf('://');
+  const pathStart = afterScheme === -1 ? -1 : url.indexOf('/', afterScheme + 3);
+  if (pathStart === -1) return;
+  const end = url.slice(pathStart).search(/[?#]/);
+  const rawPath = end === -1 ? url.slice(pathStart) : url.slice(pathStart, pathStart + end);
+  if (new URL(url).pathname !== rawPath) {
+    throw new Error('Invalid identifier: an id may not be "." or "..".');
+  }
+  for (const seg of rawPath.split('/').slice(1)) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(seg);
+    } catch {
+      throw new Error('Invalid identifier.');
+    }
+    if (decoded === '.' || decoded === '..' || /[\\/%]/.test(decoded)) {
+      throw new Error('Invalid identifier.');
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coinpaprika/mcp",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "A Model Context Protocol server for CoinPaprika cryptocurrency market data: prices, tickers, exchanges, and more",
   "main": "dist/index.js",
   "type": "module",
@@ -17,7 +17,7 @@
     "build": "mkdir -p dist && cp -r src/* dist/ && chmod +x dist/bin.js",
     "prepublishOnly": "npm run build",
     "start": "node src/index.js",
-    "test": "node test/smoke.js"
+    "test": "node test/path_safety.js && node test/smoke.js"
   },
   "keywords": [
     "mcp",