@crscreditapi/finstack-mcp-server 0.10.0-40e8ad4 → 0.10.0-a5d91e2

package/.env.example

@@ -15,3 +15,9 @@ FINSTACK_CHATBASE_SECRET=
 # Support Autopsy observability: insert one row per tool call into the shared tool_calls table
 # (n8n Postgres). Leave unset to emit a JSON log line instead. TOOL_LOG=off disables both.
 TOOL_CALLS_DATABASE_URL=
+# Preferred over the URL (no percent-encoding needed):
+# TOOL_CALLS_PGHOST=
+# TOOL_CALLS_PGUSER=n8n
+# TOOL_CALLS_PGPASSWORD=
+# TOOL_CALLS_PGDATABASE=n8n
+# SSL is on by default (no sslmode needed in the URL). TOOL_CALLS_PGSSL=off for a local DB.

package/dist/toolLog.d.ts

@@ -30,4 +30,5 @@ export declare function toRecord(e: ToolLogEntry): {
     truncated: boolean;
     upstream_status: number | null;
 };
+/** Never throws: a logging problem must never fail a tool call. */
 export declare function logToolCall(e: ToolLogEntry): void;

package/dist/toolLog.js

@@ -12,22 +12,52 @@
 import { createHash } from 'node:crypto';
 import pg from 'pg';
 const ENABLED = (process.env.TOOL_LOG || 'on').toLowerCase() !== 'off';
-const DB_URL = process.env.TOOL_CALLS_DATABASE_URL || '';
+// sslmode is stripped from the URL on purpose: pg >= 8.16 treats sslmode=require as
+// verify-full and the RDS certificate chain is not in the container's trust store. SSL is
+// on by default without chain verification (traffic stays inside the VPC);
+// TOOL_CALLS_PGSSL=off disables it for a local database.
+const DB_URL = (process.env.TOOL_CALLS_DATABASE_URL || '').replace(/[?&]sslmode=[^&]+/, '').replace(/\?$/, '');
+const DB_SSL = (process.env.TOOL_CALLS_PGSSL || 'on').toLowerCase() === 'off' ? false : { rejectUnauthorized: false };
+// Either a URL (password must be percent-encoded) or discrete variables, which need no
+// encoding and are therefore preferred: TOOL_CALLS_PGHOST, TOOL_CALLS_PGUSER,
+// TOOL_CALLS_PGPASSWORD, TOOL_CALLS_PGDATABASE (default n8n), TOOL_CALLS_PGPORT (default 5432).
+function poolConfig() {
+    const base = { max: 2, idleTimeoutMillis: 30_000, connectionTimeoutMillis: 3_000, ssl: DB_SSL };
+    const host = process.env.TOOL_CALLS_PGHOST;
+    if (host) {
+        return {
+            ...base,
+            host,
+            port: Number(process.env.TOOL_CALLS_PGPORT || 5432),
+            user: process.env.TOOL_CALLS_PGUSER || 'n8n',
+            password: process.env.TOOL_CALLS_PGPASSWORD || '',
+            database: process.env.TOOL_CALLS_PGDATABASE || 'n8n',
+        };
+    }
+    if (DB_URL)
+        return { ...base, connectionString: DB_URL };
+    return null;
+}
 const STREAM = (process.env.MCP_TRANSPORT || 'stdio') === 'http' ? process.stdout : process.stderr;
 let pool = null;
 let lastDbErrorAt = 0;
+let poolBroken = false;
 function getPool() {
-    if (!DB_URL)
+    if (poolBroken)
         return null;
     if (!pool) {
-        pool = new pg.Pool({
-            connectionString: DB_URL,
-            max: 2,
-            idleTimeoutMillis: 30_000,
-            connectionTimeoutMillis: 3_000,
-            ssl: /sslmode=require/.test(DB_URL) ? { rejectUnauthorized: false } : undefined,
-        });
-        pool.on('error', (err) => warnDb(err));
+        const cfg = poolConfig();
+        if (!cfg)
+            return null;
+        try {
+            pool = new pg.Pool(cfg);
+            pool.on('error', (err) => warnDb(err));
+        }
+        catch (err) {
+            poolBroken = true; // bad config (e.g. unencoded password in the URL): fall back to log lines
+            warnDb(err);
+            return null;
+        }
     }
     return pool;
 }
@@ -74,18 +104,31 @@ const INSERT = `INSERT INTO tool_calls
   (trace_id, channel, agent, server, tool, args_hash, args_summary, started_at,
    duration_ms, ok, error_class, error_message, result_bytes, truncated, upstream_status)
   VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`;
+/** Never throws: a logging problem must never fail a tool call. */
 export function logToolCall(e) {
-    if (!ENABLED)
-        return;
-    const r = toRecord(e);
-    const p = getPool();
-    if (!p) {
-        STREAM.write(JSON.stringify({ ts: new Date().toISOString(), kind: 'tool_call', ...r }) + '\n');
-        return;
+    try {
+        if (!ENABLED)
+            return;
+        const r = toRecord(e);
+        const p = getPool();
+        if (!p) {
+            STREAM.write(JSON.stringify({ ts: new Date().toISOString(), kind: 'tool_call', ...r }) + '\n');
+            return;
+        }
+        try {
+            p.query(INSERT, [
+                r.trace_id, r.channel, r.agent, r.server, r.tool, r.args_hash, JSON.stringify(r.args_summary),
+                r.started_at, r.duration_ms, r.ok, r.error_class, r.error_message, r.result_bytes,
+                r.truncated, r.upstream_status,
+            ]).catch(warnDb);
+        }
+        catch (err) {
+            // pg can throw synchronously on an unparseable connection string
+            poolBroken = true;
+            warnDb(err);
+        }
+    }
+    catch (err) {
+        warnDb(err);
     }
-    p.query(INSERT, [
-        r.trace_id, r.channel, r.agent, r.server, r.tool, r.args_hash, JSON.stringify(r.args_summary),
-        r.started_at, r.duration_ms, r.ok, r.error_class, r.error_message, r.result_bytes,
-        r.truncated, r.upstream_status,
-    ]).catch(warnDb);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@crscreditapi/finstack-mcp-server",
-	"version": "0.10.0-40e8ad4",
+	"version": "0.10.0-a5d91e2",
 	"description": "MCP server for Finstack",
 	"type": "module",
 	"main": "dist/index.js",