@commercetools/commerce-mcp 4.0.0 → 4.1.0

package/dist/index.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveToolsForConfiguration = exports.applyResolvedToolsToConfiguration = exports.ACCEPTED_TOOLS = void 0;
 exports.parseArgs = parseArgs;
@@ -7,7 +10,9 @@ exports.main = main;
 const modelcontextprotocol_1 = require("@commercetools/commerce-agent/modelcontextprotocol");
 const processors_1 = require("@commercetools/processors");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
-const colors_1 = require("colors");
+const colors_1 = __importDefault(require("colors"));
+const red = colors_1.default.red;
+const yellow = colors_1.default.yellow;
 const HIDDEN_ARGS = ['customerId', 'isAdmin', 'storeKey', 'businessUnitKey'];
 const PUBLIC_ARGS = [
     'tools',
@@ -21,6 +26,10 @@ const PUBLIC_ARGS = [
     'dynamicToolLoadingThreshold',
     'toolOutputFormat',
     'logging',
+    'host',
+    'port',
+    'allowedHosts',
+    'allowedOrigins',
 ];
 const ACCEPTED_ARGS = [...PUBLIC_ARGS, ...HIDDEN_ARGS];
 var modelcontextprotocol_2 = require("@commercetools/commerce-agent/modelcontextprotocol");
@@ -63,6 +72,15 @@ function parseArgs(args) {
             else if (key == 'stateless') {
                 env.stateless = value == 'true';
             }
+            else if (key == 'host') {
+                env.host = value;
+            }
+            else if (key == 'allowedHosts') {
+                env.allowedHosts = splitList(value);
+            }
+            else if (key == 'allowedOrigins') {
+                env.allowedOrigins = splitList(value);
+            }
             else if (key == 'port') {
                 env.port = Number(value);
             }
@@ -130,6 +148,11 @@ function parseArgs(args) {
     env.remote = env.remote || process.env.REMOTE == 'true';
     env.logging = env.logging || process.env.LOGGING == 'true';
     env.stateless = env.stateless || process.env.STATELESS == 'true';
+    env.host = env.host || process.env.HOST || modelcontextprotocol_1.DEFAULT_HOST;
+    env.allowedHosts =
+        env.allowedHosts || splitList(process.env.ALLOWED_HOSTS) || undefined;
+    env.allowedOrigins =
+        env.allowedOrigins || splitList(process.env.ALLOWED_ORIGINS) || undefined;
     env.port = env.port || Number(process.env.PORT);
     options.businessUnitKey =
         options.businessUnitKey || process.env.BUSINESS_UNIT_KEY;
@@ -160,7 +183,7 @@ function parseArgs(args) {
             }
             break;
         case 'auth_token':
-            if (!env.accessToken) {
+            if (!env.remote && !env.accessToken) {
                 throw new Error('Missing required access token when "authType" is "auth_token". Please make sure to provide the value for "accessToken" or via environment variable (ACCESS_TOKEN).');
             }
             break;
@@ -260,14 +283,72 @@ function createAuthConfig(env) {
             throw new Error(`Unsupported auth type: ${env.authType}`);
     }
 }
+function splitList(value) {
+    if (!value)
+        return undefined;
+    const entries = value
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    return entries.length > 0 ? entries : undefined;
+}
+/**
+ * Hostnames the server will answer for. Loopback always works; the interface
+ * it was told to bind is added so addressing the server by that address works
+ * without extra configuration, and `--allowedHosts` covers the rest (a domain
+ * in front of a proxy, a container hostname, ...).
+ */
+function resolveAllowedHosts(env) {
+    const hosts = new Set([...modelcontextprotocol_1.LOOPBACK_HOSTNAMES, ...(env.allowedHosts ?? [])]);
+    const host = env.host;
+    if (host && !isWildcardHost(host)) {
+        hosts.add(host);
+    }
+    return [...hosts];
+}
+const LOOPBACK_HOSTS = ['127.0.0.1', 'localhost', '::1', '::ffff:127.0.0.1'];
+/** Hosts that mean "listen on every interface" rather than a single address. */
+const WILDCARD_HOSTS = ['0.0.0.0', '::', '::0', '*', ''];
+function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.includes(host) || host.startsWith('127.');
+}
+function isWildcardHost(host) {
+    return WILDCARD_HOSTS.includes(host.trim());
+}
+/**
+ * Binding beyond loopback puts the server on the network, where anything that
+ * can reach the port can talk to it. That is a legitimate choice behind a
+ * gateway, but it should never happen without the operator noticing — and a
+ * wildcard bind deserves a louder warning than a single chosen interface,
+ * since it also covers interfaces the operator may not have had in mind.
+ */
+function warnIfPubliclyBound(host) {
+    if (isLoopbackHost(host))
+        return;
+    const exposure = isWildcardHost(host)
+        ? `bound to ${host || '0.0.0.0'} — every network interface on this machine, including\n` +
+            `   any that is publicly routable`
+        : `bound to ${host}, so it is reachable from outside this machine`;
+    console.error(yellow(`\n\u26a0\ufe0f  The MCP server is ${exposure}.\n` +
+        `   Callers still need a valid "Authorization: Bearer <token>" header, but make sure the port\n` +
+        `   is only exposed to networks you trust. Use --host=127.0.0.1 to keep it local.\n`));
+}
+/** True once the server actually holds an address. */
+function isBound(server) {
+    const address = server?.address;
+    return typeof address === 'function' ? address.call(server) !== null : true;
+}
+function onServerError(server, listener) {
+    const on = server?.on;
+    if (typeof on === 'function')
+        on.call(server, 'error', listener);
+}
 function handleError(error) {
-    console.error((0, colors_1.red)('\n🚨  Error initializing commercetools MCP server:\n'));
-    console.error((0, colors_1.yellow)(`   ${error.message}\n`));
+    console.error(red('\n🚨  Error initializing commercetools MCP server:\n'));
+    console.error(yellow(`   ${error.message}\n`));
 }
 async function main() {
-    require('dotenv').config({
-        quiet: true,
-    });
+    require('dotenv').config({ quiet: true });
     const { options, env } = parseArgs(process.argv.slice(2));
     // Create the CommercetoolsCommerceAgent instance
     const selectedTools = options.tools;
@@ -302,13 +383,40 @@ async function main() {
             authConfig,
             configuration,
             stateless: env.stateless,
+            allowedHosts: resolveAllowedHosts(env),
+            allowedOrigins: env.allowedOrigins,
             streamableHttpOptions: {
                 sessionIdGenerator: undefined,
             },
         });
         const port = env.port || 8080;
-        streamServer.listen(port, function () {
-            console.error(`Stream server listening on`, port);
+        // `*` and an empty value mean "every interface"; the OS needs 0.0.0.0.
+        const host = (0, modelcontextprotocol_1.normalizeBindHost)(env.host);
+        warnIfPubliclyBound(host);
+        /**
+         * Kept in a holder so the listen callback can read the server without a
+         * binding that is still in its temporal dead zone should an app
+         * implementation invoke the callback synchronously.
+         */
+        const bound = {};
+        bound.server = streamServer.listen(port, host, function () {
+            /**
+             * Express runs this callback even when the bind failed (an unresolvable
+             * host leaves `address()` null), so confirm before claiming success —
+             * the error handler below reports the failure instead.
+             */
+            if (!isBound(bound.server))
+                return;
+            console.error(`Stream server listening on ${host}:${port}`);
+        });
+        /**
+         * A bind failure — port already taken, address not available, a host that
+         * does not resolve — arrives as an 'error' event. Left unhandled it kills
+         * the process with no explanation of what went wrong.
+         */
+        onServerError(bound.server, (error) => {
+            handleError(new Error(`Unable to bind ${host}:${port}${error.code ? ` (${error.code})` : ''}. ${error.message}`));
+            process.exitCode = 1;
         });
     }
     else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools/commerce-mcp",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "mcpName": "io.github.commercetools/commerce-mcp",
   "homepage": "https://github.com/commercetools/commerce-mcp",
   "description": "A command line tool for setting up commercetools MCP server",
@@ -23,7 +23,7 @@
     "colors": "^1.4.0",
     "dotenv": "^17.2.1",
     "mcp-remote": "^0.1.18",
-    "@commercetools/commerce-agent": "4.0.0",
+    "@commercetools/commerce-agent": "4.1.0",
     "@commercetools/processors": "0.0.0"
   },
   "keywords": [