@cyanheads/pubmed-mcp-server 1.2.2 → 1.2.3

package/README.md

@@ -2,7 +2,7 @@
 
 [![TypeScript](https://img.shields.io/badge/TypeScript-^5.8.3-blue.svg)](https://www.typescriptlang.org/)
 [![Model Context Protocol](https://img.shields.io/badge/MCP%20SDK-^1.13.0-green.svg)](https://modelcontextprotocol.io/)
-[![Version](https://img.shields.io/badge/Version-1.2.2-blue.svg)](./CHANGELOG.md)
+[![Version](https://img.shields.io/badge/Version-1.2.3-blue.svg)](./CHANGELOG.md)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Status](https://img.shields.io/badge/Status-Stable-green.svg)](https://github.com/cyanheads/pubmed-mcp-server/issues)
 [![GitHub](https://img.shields.io/github/stars/cyanheads/pubmed-mcp-server?style=social)](https://github.com/cyanheads/pubmed-mcp-server)

package/dist/utils/internal/logger.js

@@ -35,8 +35,11 @@ const mcpToWinstonLevel = {
     alert: "error",
     emerg: "error",
 };
+// The logsPath from config is already resolved and validated by src/config/index.ts
+const resolvedLogsDir = config.logsPath;
+const isLogsDirSafe = !!resolvedLogsDir; // If logsPath is set, it's considered safe by config logic.
 /**
- * Creates the Winston console log format for interactive TTY sessions.
+ * Creates the Winston console log format.
  * @returns The Winston log format for console output.
  * @private
  */
@@ -100,45 +103,47 @@ export class Logger {
             });
             return;
         }
+        // Set initialized to true at the beginning of the initialization process.
         this.initialized = true;
         this.currentMcpLevel = level;
         this.currentWinstonLevel = mcpToWinstonLevel[level];
+        // The logs directory (config.logsPath / resolvedLogsDir) is expected to be created and validated
+        // by the configuration module (src/config/index.ts) before logger initialization.
+        // If isLogsDirSafe is true, we assume resolvedLogsDir exists and is usable.
+        // No redundant directory creation logic here.
+        const fileFormat = winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json());
         const transports = [];
-        if (config.logOutputMode === "stdout") {
-            transports.push(new winston.transports.Console({
-                format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json()),
+        const fileTransportOptions = {
+            format: fileFormat,
+            maxsize: this.LOG_FILE_MAX_SIZE,
+            maxFiles: this.LOG_MAX_FILES,
+            tailable: true,
+        };
+        if (isLogsDirSafe) {
+            transports.push(new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "error.log"),
+                level: "error",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "warn.log"),
+                level: "warn",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "info.log"),
+                level: "info",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "debug.log"),
+                level: "debug",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "combined.log"),
+                ...fileTransportOptions,
             }));
         }
         else {
-            const resolvedLogsDir = config.logsPath;
-            if (resolvedLogsDir) {
-                const fileFormat = winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json());
-                const fileTransportOptions = {
-                    format: fileFormat,
-                    maxsize: this.LOG_FILE_MAX_SIZE,
-                    maxFiles: this.LOG_MAX_FILES,
-                    tailable: true,
-                };
-                transports.push(new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "error.log"),
-                    level: "error",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "warn.log"),
-                    level: "warn",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "info.log"),
-                    level: "info",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "debug.log"),
-                    level: "debug",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "combined.log"),
-                    ...fileTransportOptions,
-                }));
+            if (process.stdout.isTTY) {
+                console.warn("File logging disabled as logsPath is not configured or invalid.");
             }
         }
         this.winstonLogger = winston.createLogger({
@@ -146,20 +151,23 @@ export class Logger {
             transports,
             exitOnError: false,
         });
+        // Configure console transport after Winston logger is created
         const consoleStatus = this._configureConsoleTransport();
         const initialContext = {
             loggerSetup: true,
             requestId: "logger-init-deferred",
             timestamp: new Date().toISOString(),
         };
+        // Removed logging of logsDirCreatedMessage as it's no longer set
         if (consoleStatus.message) {
             this.info(consoleStatus.message, initialContext);
         }
-        this.info(`Logger initialized. Mode: ${config.logOutputMode}. File logging level: ${this.currentWinstonLevel}. MCP logging level: ${this.currentMcpLevel}.`, {
+        this.initialized = true; // Ensure this is set after successful setup
+        this.info(`Logger initialized. File logging level: ${this.currentWinstonLevel}. MCP logging level: ${this.currentMcpLevel}. Console logging: ${consoleStatus.enabled ? "enabled" : "disabled"}`, {
             loggerSetup: true,
             requestId: "logger-post-init",
             timestamp: new Date().toISOString(),
-            logsPathUsed: config.logsPath,
+            logsPathUsed: resolvedLogsDir,
         });
     }
     /**
@@ -199,6 +207,7 @@ export class Logger {
         this.currentMcpLevel = newLevel;
         this.currentWinstonLevel = mcpToWinstonLevel[newLevel];
         if (this.winstonLogger) {
+            // Ensure winstonLogger is defined
             this.winstonLogger.level = this.currentWinstonLevel;
         }
         const consoleStatus = this._configureConsoleTransport();
@@ -217,12 +226,6 @@ export class Logger {
      * @private
      */
     _configureConsoleTransport() {
-        if (config.logOutputMode === "stdout") {
-            return {
-                enabled: true,
-                message: "Stdout logging is enabled by configuration.",
-            };
-        }
         if (!this.winstonLogger) {
             return {
                 enabled: false,
@@ -235,19 +238,17 @@ export class Logger {
         if (shouldHaveConsole && !consoleTransport) {
             const consoleFormat = createWinstonConsoleFormat();
             this.winstonLogger.add(new winston.transports.Console({
-                level: "debug",
+                level: "debug", // Console always logs debug if enabled
                 format: consoleFormat,
             }));
-            message =
-                "Interactive console logging enabled (level: debug, stdout is TTY).";
+            message = "Console logging enabled (level: debug, stdout is TTY).";
         }
         else if (!shouldHaveConsole && consoleTransport) {
             this.winstonLogger.remove(consoleTransport);
-            message =
-                "Interactive console logging disabled (level not debug or stdout not TTY).";
+            message = "Console logging disabled (level not debug or stdout not TTY).";
         }
         else {
-            message = "Interactive console logging status unchanged.";
+            message = "Console logging status unchanged.";
         }
         return { enabled: shouldHaveConsole, message };
     }
@@ -287,7 +288,7 @@ export class Logger {
         if (!this.ensureInitialized())
             return;
         if (mcpLevelSeverity[level] > mcpLevelSeverity[this.currentMcpLevel]) {
-            return;
+            return; // Do not log if message level is less severe than currentMcpLevel
         }
         const logData = { ...context };
         const winstonLevel = mcpToWinstonLevel[level];
@@ -303,6 +304,7 @@ export class Logger {
                 mcpDataPayload.context = context;
             if (error) {
                 mcpDataPayload.error = { message: error.message };
+                // Include stack trace in debug mode for MCP notifications, truncated for brevity
                 if (this.currentMcpLevel === "debug" && error.stack) {
                     mcpDataPayload.error.stack = error.stack.substring(0, this.MCP_NOTIFICATION_STACK_TRACE_MAX_LENGTH);
                 }
@@ -319,7 +321,7 @@ export class Logger {
                     originalLevel: level,
                     originalMessage: msg,
                     sendError: errorMessage,
-                    mcpPayload: JSON.stringify(mcpDataPayload).substring(0, 500),
+                    mcpPayload: JSON.stringify(mcpDataPayload).substring(0, 500), // Log a preview
                 };
                 this.winstonLogger.error("Failed to send MCP log notification", internalErrorContext);
             }

package/dist/utils/security/idGenerator.d.ts

@@ -85,6 +85,7 @@ export declare class IdGenerator {
      * @param id - The ID string to validate.
      * @param entityType - The expected entity type of the ID.
      * @param options - Optional parameters used during generation for validation consistency.
+     *                  The `charset` from these options will be used for validation.
      * @returns `true` if the ID is valid, `false` otherwise.
      */
     isValid(id: string, entityType: string, options?: IdGenerationOptions): boolean;
@@ -112,7 +113,9 @@ export declare class IdGenerator {
     getEntityType(id: string, separator?: string): string;
     /**
      * Normalizes an entity ID to ensure the prefix matches the registered case
-     * and the random part is uppercase.
+     * and the random part is uppercase. Note: This assumes the charset characters
+     * have a meaningful uppercase version if case-insensitivity is desired for the random part.
+     * For default charset (A-Z0-9), this is fine. For custom charsets, behavior might vary.
      * @param id - The ID to normalize (e.g., "proj_a6b3j0").
      * @param separator - The separator used in the ID. Defaults to `IdGenerator.DEFAULT_SEPARATOR`.
      * @returns The normalized ID (e.g., "PROJ_A6B3J0").

package/dist/utils/security/idGenerator.js

@@ -60,10 +60,18 @@ export class IdGenerator {
      * @returns The generated random string.
      */
     generateRandomString(length = IdGenerator.DEFAULT_LENGTH, charset = IdGenerator.DEFAULT_CHARSET) {
-        const bytes = randomBytes(length);
         let result = "";
-        for (let i = 0; i < length; i++) {
-            result += charset[bytes[i] % charset.length];
+        // Determine the largest multiple of charset.length that is less than or equal to 256
+        // This is the threshold for rejection sampling to avoid bias.
+        const maxValidByteValue = Math.floor(256 / charset.length) * charset.length;
+        while (result.length < length) {
+            const byteBuffer = randomBytes(1); // Get one random byte
+            const byte = byteBuffer[0];
+            // If the byte is within the valid range (i.e., it won't introduce bias),
+            // use it to select a character from the charset. Otherwise, discard and try again.
+            if (byte < maxValidByteValue) {
+                result += charset[byte % charset.length];
+            }
         }
         return result;
     }
@@ -101,16 +109,21 @@ export class IdGenerator {
      * @param id - The ID string to validate.
      * @param entityType - The expected entity type of the ID.
      * @param options - Optional parameters used during generation for validation consistency.
+     *                  The `charset` from these options will be used for validation.
      * @returns `true` if the ID is valid, `false` otherwise.
      */
     isValid(id, entityType, options = {}) {
         const prefix = this.entityPrefixes[entityType];
-        const { length = IdGenerator.DEFAULT_LENGTH, separator = IdGenerator.DEFAULT_SEPARATOR, } = options;
+        const { length = IdGenerator.DEFAULT_LENGTH, separator = IdGenerator.DEFAULT_SEPARATOR, charset = IdGenerator.DEFAULT_CHARSET, // Use charset from options or default
+         } = options;
         if (!prefix) {
             return false;
         }
-        // Assumes default charset characters (uppercase letters and digits) for regex.
-        const pattern = new RegExp(`^${this.escapeRegex(prefix)}${this.escapeRegex(separator)}[A-Z0-9]{${length}}$`);
+        // Build regex character class from the charset
+        // Escape characters that have special meaning inside a regex character class `[]`
+        const escapedCharsetForClass = charset.replace(/[[\]\\^-]/g, "\\$&");
+        const charsetRegexPart = `[${escapedCharsetForClass}]`;
+        const pattern = new RegExp(`^${this.escapeRegex(prefix)}${this.escapeRegex(separator)}${charsetRegexPart}{${length}}$`);
         return pattern.test(id);
     }
     /**
@@ -153,7 +166,9 @@ export class IdGenerator {
     }
     /**
      * Normalizes an entity ID to ensure the prefix matches the registered case
-     * and the random part is uppercase.
+     * and the random part is uppercase. Note: This assumes the charset characters
+     * have a meaningful uppercase version if case-insensitivity is desired for the random part.
+     * For default charset (A-Z0-9), this is fine. For custom charsets, behavior might vary.
      * @param id - The ID to normalize (e.g., "proj_a6b3j0").
      * @param separator - The separator used in the ID. Defaults to `IdGenerator.DEFAULT_SEPARATOR`.
      * @returns The normalized ID (e.g., "PROJ_A6B3J0").
@@ -164,6 +179,8 @@ export class IdGenerator {
         const registeredPrefix = this.entityPrefixes[entityType];
         const idParts = id.split(separator);
         const randomPart = idParts.slice(1).join(separator);
+        // Consider if randomPart.toUpperCase() is always correct for custom charsets.
+        // For now, maintaining existing behavior.
         return `${registeredPrefix}${separator}${randomPart.toUpperCase()}`;
     }
 }

package/dist/utils/security/rateLimiter.d.ts

@@ -28,10 +28,6 @@ export interface RateLimitEntry {
 /**
  * A generic rate limiter class using an in-memory store.
  * Controls frequency of operations based on unique keys.
- *
- * @scalability Note: This is an in-memory store. For horizontal scaling across
- * multiple processes or machines, this state would need to be moved to a shared,
- * distributed store like Redis or a database.
  */
 export declare class RateLimiter {
     private config;

package/dist/utils/security/rateLimiter.js

@@ -9,10 +9,6 @@ import { logger, requestContextService } from "../index.js";
 /**
  * A generic rate limiter class using an in-memory store.
  * Controls frequency of operations based on unique keys.
- *
- * @scalability Note: This is an in-memory store. For horizontal scaling across
- * multiple processes or machines, this state would need to be moved to a shared,
- * distributed store like Redis or a database.
  */
 export class RateLimiter {
     /**

package/dist/utils/security/sanitization.d.ts

@@ -148,6 +148,17 @@ export declare class Sanitization {
      * Sanitizes input for logging by redacting sensitive fields.
      * Creates a deep clone and replaces values of fields matching `this.sensitiveFields`
      * (case-insensitive substring match) with "[REDACTED]".
+     *
+     * It uses `structuredClone` if available for a high-fidelity deep clone.
+     * If `structuredClone` is not available (e.g., in older Node.js environments),
+     * it falls back to `JSON.parse(JSON.stringify(input))`. This fallback has limitations:
+     * - `Date` objects are converted to ISO date strings.
+     * - `undefined` values within objects are removed.
+     * - `Map`, `Set`, `RegExp` objects are converted to empty objects (`{}`).
+     * - Functions are removed.
+     * - `BigInt` values will throw an error during `JSON.stringify` unless a `toJSON` method is provided.
+     * - Circular references will cause `JSON.stringify` to throw an error.
+     *
      * @param input - The input data to sanitize for logging.
      * @returns A sanitized (deep cloned) version of the input, safe for logging.
      *   Returns original input if not object/array, or "[Log Sanitization Failed]" on error.

package/dist/utils/security/sanitization.js

@@ -204,8 +204,11 @@ export class Sanitization {
             })) {
                 throw new Error("Invalid URL format or protocol not in allowed list.");
             }
-            if (trimmedInput.toLowerCase().startsWith("javascript:")) {
-                throw new Error("JavaScript pseudo-protocol is not allowed in URLs.");
+            const lowercasedInput = trimmedInput.toLowerCase();
+            if (lowercasedInput.startsWith("javascript:") ||
+                lowercasedInput.startsWith("data:") ||
+                lowercasedInput.startsWith("vbscript:")) {
+                throw new Error("Disallowed pseudo-protocol (javascript:, data:, or vbscript:) in URL.");
             }
             return trimmedInput;
         }
@@ -377,6 +380,17 @@ export class Sanitization {
      * Sanitizes input for logging by redacting sensitive fields.
      * Creates a deep clone and replaces values of fields matching `this.sensitiveFields`
      * (case-insensitive substring match) with "[REDACTED]".
+     *
+     * It uses `structuredClone` if available for a high-fidelity deep clone.
+     * If `structuredClone` is not available (e.g., in older Node.js environments),
+     * it falls back to `JSON.parse(JSON.stringify(input))`. This fallback has limitations:
+     * - `Date` objects are converted to ISO date strings.
+     * - `undefined` values within objects are removed.
+     * - `Map`, `Set`, `RegExp` objects are converted to empty objects (`{}`).
+     * - Functions are removed.
+     * - `BigInt` values will throw an error during `JSON.stringify` unless a `toJSON` method is provided.
+     * - Circular references will cause `JSON.stringify` to throw an error.
+     *
      * @param input - The input data to sanitize for logging.
      * @returns A sanitized (deep cloned) version of the input, safe for logging.
      *   Returns original input if not object/array, or "[Log Sanitization Failed]" on error.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/pubmed-mcp-server",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "A Model Context Protocol (MCP) server enabling AI agents to intelligently search, retrieve, and analyze biomedical literature from PubMed via NCBI E-utilities. Built on the mcp-ts-template for robust, production-ready performance.",
   "main": "dist/index.js",
   "files": [