@cyanheads/pubchem-mcp-server 0.3.0 → 0.4.0

package/dist/mcp-server/tools/definitions/untrusted-text.js

@@ -0,0 +1,65 @@
+/**
+ * @fileoverview Framing helpers that render upstream-controlled free text as
+ * clearly-delimited DATA in MCP `content[]` output. PubChem descriptions,
+ * summaries, interaction statements, synonyms, and assay/GHS text are relayed
+ * verbatim into the model's context; rendered as bare prose they blur the
+ * boundary between server-authored instructions and retrieved data and can
+ * inject markdown structure. These helpers keep that boundary explicit and
+ * neutralize markdown-structure injection. `structuredContent` always carries
+ * the raw value — this only shapes the human/LLM text-rendering surface.
+ * @module mcp-server/tools/definitions/untrusted-text
+ */
+/**
+ * Inline markdown delimiters an upstream value could use to break out of a
+ * surrounding emphasis/code span (`**bold**`, `` `code` ``) or inject its own.
+ * Deliberately narrow — ordinary chemistry punctuation (hyphens, parentheses,
+ * brackets, commas, +/=/#) is left intact so legitimate names are not mangled.
+ * Underscore is intentionally excluded: CommonMark treats intraword `_` as
+ * literal, so it is a far weaker vector than `*`, and escaping it collides with
+ * the format-parity linter's underscored sentinels.
+ */
+const INLINE_MARKDOWN = /[`*~]/g;
+/**
+ * Frame a single upstream value for safe inline interpolation into `content[]`
+ * markdown. Collapses embedded newlines (so the value cannot start a new
+ * markdown block) and escapes emphasis / inline-code delimiters. Proportionate
+ * by design: the goal is a data boundary, not heavy escaping.
+ */
+export function inlineData(value) {
+    return value
+        .replace(/\s*[\r\n]+\s*/g, ' ')
+        .replace(INLINE_MARKDOWN, '\\$&')
+        .trim();
+}
+/**
+ * Frame multi-line upstream prose as a markdown blockquote — an explicit
+ * "quoted data" boundary distinct from server-authored instructions. Every
+ * line (blank ones included) is prefixed with `>` so the payload cannot break
+ * out of the quote; inline emphasis/code is escaped and a leading block marker
+ * (heading, quote, bullet, ordered list) is defused so it cannot restructure
+ * the surrounding document.
+ */
+export function quoteData(text) {
+    return text
+        .split(/\r\n?|\n/)
+        .map((rawLine) => {
+        const line = rawLine
+            .replace(INLINE_MARKDOWN, '\\$&')
+            .replace(/^(\s*)([#>+-])/, '$1\\$2')
+            .replace(/^(\s*\d{1,9})([.)])/, '$1\\$2');
+        return line.trim().length > 0 ? `> ${line}` : '>';
+    })
+        .join('\n');
+}
+/**
+ * Wrap raw upstream text in a fenced code block whose fence is guaranteed
+ * longer than any backtick run inside the payload, so a stray ``` cannot close
+ * the fence early and let following lines render as markdown. Preserves the
+ * content verbatim (no character substitution) — used for raw V2000 SDF.
+ */
+export function fencedData(content, language = '') {
+    const longestRun = Math.max(0, ...[...content.matchAll(/`+/g)].map((m) => m[0].length));
+    const fence = '`'.repeat(Math.max(3, longestRun + 1));
+    return `${fence}${language}\n${content}\n${fence}`;
+}
+//# sourceMappingURL=untrusted-text.js.map

package/dist/mcp-server/tools/definitions/untrusted-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-text.js","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/untrusted-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI;SACR,KAAK,CAAC,UAAU,CAAC;SACjB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,OAAO;aACjB,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;aAChC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC;aACnC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,QAAQ,GAAG,EAAE;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,GAAG,KAAK,GAAG,QAAQ,KAAK,OAAO,KAAK,KAAK,EAAE,CAAC;AACrD,CAAC"}

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "pubchem-mcp-server",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Search the PubChem chemical database for compounds, properties, safety data, bioactivity, cross-references, and entity summaries via MCP. STDIO or Streamable HTTP.",
   "author": {
     "name": "cyanheads"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/pubchem-mcp-server",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Search the PubChem chemical database for compounds, properties, safety data, bioactivity, cross-references, and entity summaries via MCP. STDIO or Streamable HTTP.",
   "mcpName": "io.github.cyanheads/pubchem-mcp-server",
   "type": "module",
@@ -78,8 +78,8 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.1",
-    "@types/node": "^26.0.1",
+    "@biomejs/biome": "^2.5.2",
+    "@types/node": "^26.1.0",
     "depcheck": "^1.4.7",
     "ignore": "^7.0.5",
     "tsc-alias": "^1.8.17",

package/server.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/cyanheads/pubchem-mcp-server",
     "source": "github"
   },
-  "version": "0.3.0",
+  "version": "0.4.0",
   "remotes": [
     {
       "type": "streamable-http",
@@ -19,7 +19,7 @@
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/pubchem-mcp-server",
       "runtimeHint": "bun",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "packageArguments": [
         { "type": "positional", "value": "run" },
         { "type": "positional", "value": "start:stdio" }
@@ -42,7 +42,7 @@
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/pubchem-mcp-server",
       "runtimeHint": "bun",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "packageArguments": [
         { "type": "positional", "value": "run" },
         { "type": "positional", "value": "start:http" }