@delega-dev/mcp 1.0.6 → 1.0.8

package/README.md

@@ -34,9 +34,16 @@ Add to your MCP client config (e.g. Claude Desktop `claude_desktop_config.json`)
 |----------|---------|-------------|
 | `DELEGA_API_URL` | `http://127.0.0.1:18890` | Delega API endpoint |
 | `DELEGA_AGENT_KEY` | (none) | Agent API key for authenticated requests |
+| `DELEGA_REVEAL_AGENT_KEYS` | `0` | Set to `1` only if you want MCP tool output to print full agent API keys |
 
 For the hosted tier, use `https://api.delega.dev` as the URL.
 
+## Security Notes
+
+- Non-local `DELEGA_API_URL` values must use `https://`.
+- Agent keys are passed through environment variables rather than command-line arguments, which avoids process-list leakage.
+- MCP tool output redacts full agent API keys by default. Set `DELEGA_REVEAL_AGENT_KEYS=1` only when you explicitly want them printed back to the client.
+
 ## Tools
 
 | Tool | Description |

package/dist/index.js

@@ -7,14 +7,34 @@ import { z } from "zod";
 
 // src/delega-client.ts
 var DEFAULT_BASE_URL = "http://127.0.0.1:18890";
+var LOCAL_API_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
+var DelegaApiError = class extends Error {
+  status;
+  statusText;
+  responseBody;
+  constructor(status, statusText, responseBody) {
+    super(`Delega API request failed (${status} ${statusText})`);
+    this.name = "DelegaApiError";
+    this.status = status;
+    this.statusText = statusText;
+    this.responseBody = responseBody;
+  }
+};
+function normalizeBaseUrl(rawUrl) {
+  const parsed = new URL(rawUrl);
+  if (parsed.protocol !== "https:" && !LOCAL_API_HOSTS.has(parsed.hostname)) {
+    throw new Error("Delega API URL must use HTTPS unless it points to localhost");
+  }
+  return rawUrl.replace(/\/+$/, "");
+}
 var DelegaClient = class {
   baseUrl;
   agentKey;
   pathPrefix;
   constructor(baseUrl, agentKey) {
-    this.baseUrl = (baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.baseUrl = normalizeBaseUrl(baseUrl || DEFAULT_BASE_URL);
     this.agentKey = agentKey;
-    this.pathPrefix = this.baseUrl.includes("api.delega.dev") ? "/v1" : "/api";
+    this.pathPrefix = new URL(this.baseUrl).hostname === "api.delega.dev" ? "/v1" : "/api";
   }
   async request(method, path, body, query) {
     const url = new URL(path, this.baseUrl);
@@ -38,9 +58,7 @@ var DelegaClient = class {
     });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
-      throw new Error(
-        `Delega API error: ${res.status} ${res.statusText}${text ? ` \u2014 ${text}` : ""}`
-      );
+      throw new DelegaApiError(res.status, res.statusText, text);
     }
     if (res.status === 204) {
       return void 0;
@@ -130,15 +148,62 @@ function formatTask(t) {
 function formatProject(p) {
   return `[#${p.id}] ${p.name}`;
 }
+function maskApiKey(key) {
+  if (key.length <= 12) return key;
+  return `${key.slice(0, 8)}...${key.slice(-4)}`;
+}
 function formatAgent(a) {
   const lines = [];
   lines.push(`[#${a.id}] ${a.name}${a.display_name ? ` (${a.display_name})` : ""}`);
   if (a.description) lines.push(`  Description: ${a.description}`);
-  if (a.api_key) lines.push(`  API Key: ${a.api_key}`);
+  if (a.api_key) {
+    if (process.env.DELEGA_REVEAL_AGENT_KEYS === "1") {
+      lines.push(`  API Key: ${a.api_key}`);
+    } else {
+      lines.push(`  API Key Preview: ${maskApiKey(a.api_key)}`);
+    }
+  }
   if (a.permissions?.length) lines.push(`  Permissions: ${a.permissions.join(", ")}`);
   if (a.active !== void 0) lines.push(`  Active: ${a.active ? "yes" : "no"}`);
   return lines.join("\n");
 }
+function sanitizeToolError(error) {
+  if (error instanceof DelegaApiError) {
+    if (error.responseBody) {
+      console.error("Delega API error response:", {
+        status: error.status,
+        statusText: error.statusText,
+        body: error.responseBody
+      });
+    }
+    if (error.status === 400 || error.status === 422) {
+      return "Delega API rejected the request. Check the tool inputs and try again.";
+    }
+    if (error.status === 401) {
+      return "Delega API authentication failed. Check DELEGA_AGENT_KEY.";
+    }
+    if (error.status === 403) {
+      return "Delega API denied this action.";
+    }
+    if (error.status === 404) {
+      return "The requested Delega resource was not found.";
+    }
+    if (error.status >= 500) {
+      return "Delega API returned a server error.";
+    }
+    return `Delega API request failed (${error.status} ${error.statusText}).`;
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return "Unexpected error";
+}
+function toolErrorResult(error) {
+  return {
+    content: [{ type: "text", text: `Error: ${sanitizeToolError(error)}` }],
+    isError: true
+  };
+}
 var server = new McpServer({
   name: "delega-mcp",
   version: "1.0.0"
@@ -160,8 +225,8 @@ server.tool(
       }
       const text = tasks.map(formatTask).join("\n\n");
       return { content: [{ type: "text", text }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -175,8 +240,8 @@ server.tool(
     try {
       const task = await client.getTask(task_id);
       return { content: [{ type: "text", text: formatTask(task) }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -199,8 +264,8 @@ server.tool(
 
 ${formatTask(task)}` }]
       };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -224,8 +289,8 @@ server.tool(
 
 ${formatTask(task)}` }]
       };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -244,8 +309,8 @@ server.tool(
 Next occurrence: ${task.next_occurrence}`;
       }
       return { content: [{ type: "text", text }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -261,8 +326,8 @@ server.tool(
       return {
         content: [{ type: "text", text: `Task #${task_id} deleted.` }]
       };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -286,8 +351,8 @@ server.tool(
           }
         ]
       };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -303,8 +368,8 @@ server.tool(
       }
       const text = projects.map(formatProject).join("\n");
       return { content: [{ type: "text", text }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -327,8 +392,8 @@ server.tool(
         }
       }
       return { content: [{ type: "text", text: lines.join("\n") }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -344,8 +409,8 @@ server.tool(
       }
       const text = agents.map(formatAgent).join("\n\n");
       return { content: [{ type: "text", text }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );
@@ -361,15 +426,14 @@ server.tool(
   async (params) => {
     try {
       const agent = await client.registerAgent(params);
+      const warning = process.env.DELEGA_REVEAL_AGENT_KEYS === "1" ? "\n\n\u26A0\uFE0F Save the API key \u2014 it won't be shown again." : "\n\nAPI keys are redacted by default in MCP output. Set DELEGA_REVEAL_AGENT_KEYS=1 to reveal them.";
       return {
         content: [{ type: "text", text: `Agent registered:
 
-${formatAgent(agent)}
-
-\u26A0\uFE0F Save the API key \u2014 it won't be shown again.` }]
+${formatAgent(agent)}${warning}` }]
       };
-    } catch (e) {
-      return { content: [{ type: "text", text: `Error: ${e.message}` }], isError: true };
+    } catch (error) {
+      return toolErrorResult(error);
     }
   }
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delega-dev/mcp",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "mcpName": "io.github.delega-dev/delega",
   "description": "MCP server for Delega — task infrastructure for AI agents",
   "type": "module",