@crscreditapi/finstack-mcp-server 0.10.0-40e8ad4 → 0.10.0-80b4ec3

package/.env.example

@@ -15,3 +15,4 @@ FINSTACK_CHATBASE_SECRET=
 # Support Autopsy observability: insert one row per tool call into the shared tool_calls table
 # (n8n Postgres). Leave unset to emit a JSON log line instead. TOOL_LOG=off disables both.
 TOOL_CALLS_DATABASE_URL=
+# SSL is on by default (no sslmode needed in the URL). TOOL_CALLS_PGSSL=off for a local DB.

package/dist/toolLog.js

@@ -12,7 +12,12 @@
 import { createHash } from 'node:crypto';
 import pg from 'pg';
 const ENABLED = (process.env.TOOL_LOG || 'on').toLowerCase() !== 'off';
-const DB_URL = process.env.TOOL_CALLS_DATABASE_URL || '';
+// sslmode is stripped from the URL on purpose: pg >= 8.16 treats sslmode=require as
+// verify-full and the RDS certificate chain is not in the container's trust store. SSL is
+// on by default without chain verification (traffic stays inside the VPC);
+// TOOL_CALLS_PGSSL=off disables it for a local database.
+const DB_URL = (process.env.TOOL_CALLS_DATABASE_URL || '').replace(/[?&]sslmode=[^&]+/, '').replace(/\?$/, '');
+const DB_SSL = (process.env.TOOL_CALLS_PGSSL || 'on').toLowerCase() === 'off' ? false : { rejectUnauthorized: false };
 const STREAM = (process.env.MCP_TRANSPORT || 'stdio') === 'http' ? process.stdout : process.stderr;
 let pool = null;
 let lastDbErrorAt = 0;
@@ -25,7 +30,7 @@ function getPool() {
             max: 2,
             idleTimeoutMillis: 30_000,
             connectionTimeoutMillis: 3_000,
-            ssl: /sslmode=require/.test(DB_URL) ? { rejectUnauthorized: false } : undefined,
+            ssl: DB_SSL,
         });
         pool.on('error', (err) => warnDb(err));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@crscreditapi/finstack-mcp-server",
-	"version": "0.10.0-40e8ad4",
+	"version": "0.10.0-80b4ec3",
 	"description": "MCP server for Finstack",
 	"type": "module",
 	"main": "dist/index.js",