@dpesch/mantisbt-mcp-server 1.18.1 → 1.18.3

package/CHANGELOG.md

@@ -11,6 +11,42 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.18.3] – 2026-11-12
+
+### Documentation
+
+- mcprush directory badge added to README.md and README.de.md
+- New "Security considerations" section in the README (#8636): issue and note texts are untrusted input that a prompt injection can use to drive write tools. `MANTIS_UPLOAD_DIR` is now recommended in stdio mode as well and appears in the installation examples, because without it `upload_file`'s `file_path` can read any file the server process can read. The section also points to `MANTIS_TOOLSETS`, `MANTIS_DISABLE_DESTRUCTIVE` and the tool annotations.
+
+### Deprecated
+
+- `upload_file`'s `file_path` without `MANTIS_UPLOAD_DIR` in stdio mode: starting with 2.0.0, `file_path` is disabled in stdio mode too unless `MANTIS_UPLOAD_DIR` is set (#8637). Uploads via `content` (Base64) are not affected.
+
+### Security
+
+- Updated dependencies with known vulnerabilities: `@modelcontextprotocol/sdk` 1.32.2 and `zod` 4.6.7, and through the SDK `proxy-addr` 2.0.8, `body-parser`, `hono`, `@hono/node-server`, `fast-uri`, `ip-address` and `qs`. `npm audit` reports no vulnerabilities.
+
+---
+
+## [1.18.2] – 2026-11-11
+
+### Added
+
+- `MCP_HTTP_MAX_BODY_SIZE` sets the largest accepted `/mcp` request body in bytes, default 64 MB (#8631). An empty value counts as unset. In HTTP mode, any other value that is not a positive whole number stops the server at startup; stdio ignores it.
+
+### Security
+
+- `search_issues` with `select`: when MantisBT refused an issue (401, 403) or no longer had it (404), the result still came back with `highlights` taken from the local search index — text of an issue the API user may no longer read (#8617). Such results are now left out. Other errors (network, 5xx) keep the previous fallback to the indexed text.
+- `upload_file` with `MANTIS_UPLOAD_DIR`: the directory check looked only at the path as written, while the read followed symbolic links (#8618). A link inside the upload directory could therefore upload a file from anywhere the server can read. The check now resolves links and compares the real target, and the server reads that target. A link swapped in between check and read is still not caught — keep the upload directory unwritable for less trusted users.
+- `MANTIS_DISABLE_DESTRUCTIVE=true` hid `remove_monitor`, but `update_issue` could still remove monitors through `remove_monitors` (#8621). `update_issue` now rejects `remove_monitors` in that mode, before anything is changed; `add_monitors` keeps working.
+- `update_issue` with `fields.notes`: the check for repeated note IDs took quadratic time and ran before any access check, so a request with many note edits could block the server (#8622). It now takes a single pass, and each repeated ID appears once in the error message.
+- `search_issues`: the exact-match ranking scanned issue texts once per identifier in the query, with no limit, so a long query full of identifiers could block the server (#8623). It now looks at no more than 32 identifiers, checks no more than 10,000 issue texts per query and starts with the rarest identifier. The limits sit well above what real queries need, so their results do not change.
+- HTTP transport: `POST /mcp` read the whole request body into memory, however large (#8624). Bodies above 64 MB are now refused with `413 Payload Too Large` and the connection is closed. The limit leaves room for `upload_file` with `content`: files up to about 48 MB still fit as Base64.
+- Metadata cache and search index were shared by every configuration using the same directory, so one account could see projects, members and issues cached for another (#8625). Both now live in a subdirectory per base URL and API key (host name plus hash, never the key itself), also under an explicit `MANTIS_SEARCH_DIR`; see the README. The server logs the paths on startup. **The search index is rebuilt once after the update**, and again after an API key change. Old files directly in `MANTIS_CACHE_DIR` or `MANTIS_SEARCH_DIR` are no longer read: delete them, or move them into the new subdirectory to skip the rebuild if only one configuration ever used them. After a key change, the folder of the old key can be deleted as well.
+- Search index: the incremental sync only added and updated issues, so issues deleted in MantisBT or no longer visible to the account stayed in the index for good, and `search_issues` kept returning them (#8626). A sync over all projects now lists the issue IDs the account can see (about 1 s for 7,800 issues) and removes the others; `rebuild_search_index` reports them as `removed`. A sync limited to `project_id` removes nothing, and neither does a listing that does not finish.
+
+---
+
 ## [1.18.1] – 2026-11-10
 
 ### Fixed

package/README.de.md

@@ -4,6 +4,7 @@
 [![license](https://img.shields.io/npm/l/@dpesch/mantisbt-mcp-server)](LICENSE)
 [![MCP compatible](https://img.shields.io/badge/MCP-compatible-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
 [![MCP Badge](https://lobehub.com/badge/mcp/dpesch-mantisbt-mcp-server)](https://lobehub.com/mcp/dpesch-mantisbt-mcp-server)
+[![Mantisbt MCP on mcprush](https://mcprush.com/badge/mantisbt-mcp/score.svg)](https://mcprush.com/to/mantisbt-mcp?ref=badge)
 [![MantisBT MCP Server](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server/badges/card.svg)](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server)
 
 [English](README.md) · **Deutsch**
@@ -31,7 +32,8 @@ In `~/.claude/claude_desktop_config.json` (Claude Desktop) oder der lokalen
       "args": ["-y", "@dpesch/mantisbt-mcp-server"],
       "env": {
         "MANTIS_BASE_URL": "https://deine-mantis-instanz.example.com/api/rest",
-        "MANTIS_API_KEY": "dein-api-token"
+        "MANTIS_API_KEY": "dein-api-token",
+        "MANTIS_UPLOAD_DIR": "/pfad/zu/mantis-uploads"
       }
     }
   }
@@ -55,13 +57,16 @@ npm run build
       "args": ["/pfad/zum/mantisbt-mcp-server/dist/index.js"],
       "env": {
         "MANTIS_BASE_URL": "https://deine-mantis-instanz.example.com/api/rest",
-        "MANTIS_API_KEY": "dein-api-token"
+        "MANTIS_API_KEY": "dein-api-token",
+        "MANTIS_UPLOAD_DIR": "/pfad/zu/mantis-uploads"
       }
     }
   }
 }
 ```
 
+`MANTIS_UPLOAD_DIR` ist optional, wird aber **auch im stdio-Modus empfohlen**: Die Variable beschränkt `upload_file` auf Dateien in diesem Verzeichnis, sodass eine Prompt Injection im Tickettext das Modell nicht dazu bringen kann, beliebige lokale Dateien anzuhängen. Ohne sie kann `file_path` jede Datei lesen, die der Server-Prozess lesen darf. Ab 2.0.0 ist `file_path` deaktiviert, solange die Variable nicht gesetzt ist. Siehe [Sicherheitshinweise](#sicherheitshinweise).
+
 ## Konfiguration
 
 ### Umgebungsvariablen
@@ -71,20 +76,21 @@ npm run build
 | `MANTIS_BASE_URL` | ✅ | – | Basis-URL der MantisBT-Installation. Beide Formate werden akzeptiert: `https://deine-mantis-instanz.example.com` und `https://deine-mantis-instanz.example.com/api/rest` – das `/api/rest`-Suffix wird automatisch normalisiert. |
 | `MANTIS_API_KEY` | ✅ | – | API-Token für die Authentifizierung |
 | `MANTIS_USE_INDEX_PHP` | – | auto | Auf `true` setzen, wenn URL-Rewriting nicht verfügbar ist – REST-Anfragen verwenden dann `/api/rest/index.php/` statt `/api/rest/`. Wird automatisch erkannt, wenn `MANTIS_BASE_URL` auf `/api/rest/index.php` endet; ein explizit gesetzter Wert hat immer Vorrang. Siehe [Cookbook](docs/cookbook.de.md#installation-ohne-url-rewriting-anbinden). |
-| `MANTIS_CACHE_DIR` | – | `~/.cache/mantisbt-mcp` | Verzeichnis für den Metadaten-Cache |
+| `MANTIS_CACHE_DIR` | – | `~/.cache/mantisbt-mcp` | Basisverzeichnis für den Metadaten-Cache. Jede MantisBT-Instanz und jedes Konto (Basis-URL plus API-Key) bekommt ein eigenes Unterverzeichnis aus Hostname und Hash; der Server gibt dessen Pfad beim Start aus |
 | `MANTIS_CACHE_TTL` | – | `3600` | Cache-Lebensdauer in Sekunden |
 | `TRANSPORT` | – | `stdio` | Transport-Modus: `stdio` oder `http` |
 | `PORT` | – | `3000` | Port für HTTP-Modus |
 | `MCP_HTTP_HOST` | – | `127.0.0.1` | Bind-Adresse für HTTP-Modus. **Geändert von `0.0.0.0` auf `127.0.0.1`** – der Server horcht standardmäßig nur auf localhost. Für Docker oder Remote-Zugriff `0.0.0.0` setzen. |
 | `MCP_HTTP_TOKEN` | ✅ (HTTP-Modus) | – | Bearer-Token für den `/mcp`-Endpunkt (`Authorization: Bearer <token>`). **Pflicht bei `TRANSPORT=http`** – der Server startet im HTTP-Modus ohne diesen Wert nicht, damit Tools nie unauthentifiziert erreichbar sind. Im stdio-Modus ohne Bedeutung. `/health` ist immer öffentlich. |
+| `MCP_HTTP_MAX_BODY_SIZE` | – | `67108864` (64 MB) | Größter angenommener Request-Body für `/mcp` in Bytes; größere bekommen `413 Payload Too Large`. Leer oder nicht gesetzt gilt der Standardwert; im HTTP-Modus muss jeder andere Wert eine positive ganze Zahl sein, sonst startet der Server nicht. Im stdio-Modus ohne Bedeutung. |
 | `MANTIS_SEARCH_ENABLED` | – | `false` | Auf `true` setzen, um die semantische Suche zu aktivieren |
 | `MANTIS_SEARCH_BACKEND` | – | `vectra` | Vektorspeicher: `vectra` (reines JS) oder `sqlite-vec` (manuelle Installation erforderlich) |
-| `MANTIS_SEARCH_DIR` | – | `{MANTIS_CACHE_DIR}/search` | Verzeichnis für den Suchindex |
+| `MANTIS_SEARCH_DIR` | – | `{MANTIS_CACHE_DIR}/<instanz>/search` | Basisverzeichnis für den Suchindex; auch ein ausdrücklich gesetzter Wert bekommt ein Unterverzeichnis pro Instanz und Konto (`{MANTIS_SEARCH_DIR}/<instanz>`) |
 | `MANTIS_SEARCH_MODEL` | – | `Xenova/paraphrase-multilingual-MiniLM-L12-v2` | Embedding-Modell (wird beim ersten Start einmalig heruntergeladen, ~80 MB). Nach einem Wechsel baut der nächste Sync den Index von selbst neu auf. |
 | `MANTIS_SEARCH_THREADS` | – | `1` | Anzahl der ONNX-Intra-Op-Threads für das Embedding-Modell. Standard ist 1, um CPU-Sättigung auf Mehrkernsystemen und in WSL zu verhindern. Auf Rechnern mit 4 oder mehr Kernen ist `4` ein guter Wert: Ein vollständiger Neuaufbau von 7.700 Issues dauerte damit 160 s statt 377 s mit 1 Thread. Die Einstellung beschleunigt vor allem das Indexieren; eine Suchanfrage ist ein einzelner kurzer Text und profitiert kaum. Wirksam ab 1.16.0 – frühere Versionen haben die Einstellung ignoriert und immer alle Kerne genutzt. |
-| `MANTIS_UPLOAD_DIR` | – | – | Schränkt den `file_path` von `upload_file` auf dieses Verzeichnis ein (Pfad-Traversal via `../` wird blockiert). Im **stdio-Modus** ist `file_path` ohne diese Variable unbeschränkt. Im **HTTP-Modus** liest `file_path` aus dem Dateisystem des Servers und ist deshalb **deaktiviert, sofern diese Variable nicht gesetzt ist** – HTTP-Clients sollten stattdessen den Parameter `content` (Base64) verwenden. |
+| `MANTIS_UPLOAD_DIR` | – | – | Schränkt den `file_path` von `upload_file` auf dieses Verzeichnis ein (Pfad-Traversal via `../` und symbolische Links, die nach außen führen, werden blockiert; das Verzeichnis sollte für weniger vertrauenswürdige Nutzer nicht beschreibbar sein, denn ein Link, der zwischen Prüfung und Lesen ausgetauscht wird, fällt nicht auf). Im **stdio-Modus** ist `file_path` ohne diese Variable unbeschränkt – **das Setzen wird auch im stdio-Modus empfohlen** (siehe [Sicherheitshinweise](#sicherheitshinweise)); ab 2.0.0 ist `file_path` auch im stdio-Modus deaktiviert, solange sie nicht gesetzt ist. Im **HTTP-Modus** liest `file_path` aus dem Dateisystem des Servers und ist deshalb **deaktiviert, sofern diese Variable nicht gesetzt ist** – HTTP-Clients sollten stattdessen den Parameter `content` (Base64) verwenden. |
 | `MANTIS_TOOLSETS` | – | – (alle) | Kommagetrennte Liste der anzubietenden Tool-Gruppen: `issues`, `notes`, `links`, `files`, `projects`, `versions`, `meta`, `search` (Groß-/Kleinschreibung egal). Nicht gesetzt oder leer bedeutet alle Gruppen. Die Gruppe `search` erfordert zusätzlich `MANTIS_SEARCH_ENABLED=true`; ohne die Gruppe wird das Such-Modul gar nicht gestartet. Ein unbekannter Gruppenname stoppt den Server beim Start mit einer Meldung, die die gültigen Namen auflistet. Siehe [Angebotene Tools einschränken](#angebotene-tools-einschränken) und das [Cookbook](docs/cookbook.de.md#nur-bestimmte-tool-gruppen-anbieten). |
-| `MANTIS_DISABLE_DESTRUCTIVE` | – | `false` | Auf `true` setzen, um alle destruktiven Tools auszublenden – `delete_issue`, `delete_note`, `delete_version`, `remove_relationship`, `remove_monitor` – unabhängig von den aktiven Gruppen. Ausgeblendete Tools werden nicht aufgelistet und liefern »Tool … not found«, wenn sie aufgerufen werden. |
+| `MANTIS_DISABLE_DESTRUCTIVE` | – | `false` | Auf `true` setzen, um alle destruktiven Tools auszublenden – `delete_issue`, `delete_note`, `delete_version`, `remove_relationship`, `remove_monitor` – unabhängig von den aktiven Gruppen. Ausgeblendete Tools werden nicht aufgelistet und liefern »Tool … not found«, wenn sie aufgerufen werden. `update_issue` lehnt dann auch `remove_monitors` ab. |
 
 ### Angebotene Tools einschränken
 
@@ -321,10 +327,18 @@ MCP_HTTP_TOKEN=secret MANTIS_BASE_URL=... MANTIS_API_KEY=... \
 #   TRANSPORT=http PORT=3456 MCP_HTTP_HOST=0.0.0.0 node dist/index.js
 ```
 
-Jede `/mcp`-Anfrage muss `Authorization: Bearer <token>` senden. Im HTTP-Modus ist der `file_path` von `upload_file` deaktiviert, sofern `MANTIS_UPLOAD_DIR` nicht gesetzt ist – stattdessen den Parameter `content` (Base64) verwenden.
+Jede `/mcp`-Anfrage muss `Authorization: Bearer <token>` senden. Im HTTP-Modus ist der `file_path` von `upload_file` deaktiviert, sofern `MANTIS_UPLOAD_DIR` nicht gesetzt ist – stattdessen den Parameter `content` (Base64) verwenden. Ein Request-Body darf standardmäßig höchstens 64 MB groß sein (`MCP_HTTP_MAX_BODY_SIZE`) – größere bekommen `413 Payload Too Large` –, über `content` passen also Dateien bis etwa 48 MB.
 
 Healthcheck: `GET http://localhost:3456/health` (immer öffentlich, kein Token erforderlich)
 
+## Sicherheitshinweise
+
+Ticketbeschreibungen, Notizen und Anhänge schreibt, wer in deinem MantisBT melden oder kommentieren darf – und das Modell liest sie. Behandle sie als **nicht vertrauenswürdige Eingaben**: Eine in einem Ticket versteckte Prompt Injection kann versuchen, das Modell zu schreibenden Tools wie `create_issue`, `update_issue` oder `upload_file` zu bewegen.
+
+- **`MANTIS_UPLOAD_DIR` setzen – auch im stdio-Modus.** Ohne die Variable liest `upload_file` per `file_path` jede lokale Datei, die der Server-Prozess lesen darf. Eine eingeschleuste Anweisung könnte das Modell dazu bringen, etwa einen privaten SSH-Schlüssel an ein Ticket anzuhängen – sichtbar für alle, die das Ticket lesen können. Mit `MANTIS_UPLOAD_DIR` ist `file_path` auf dieses Verzeichnis beschränkt. Über HTTP ist `file_path` ohne die Variable bereits deaktiviert; ab 2.0.0 gilt das auch für stdio.
+- **Nur die nötigen Tools anbieten.** `MANTIS_TOOLSETS` beschränkt die angebotenen Gruppen – `files` weglassen, wenn nie hochgeladen wird, oder für eine überwiegend lesende Triage nur `issues,meta` verwenden. `MANTIS_DISABLE_DESTRUCTIVE=true` blendet alle Lösch- und Entfern-Tools aus. Beides lohnt sich besonders dort, wo auch Personen außerhalb des eigenen Teams Tickets schreiben. Siehe [Angebotene Tools einschränken](#angebotene-tools-einschränken).
+- **Schreibende Aufrufe vom Client bestätigen lassen.** Alle Tools tragen MCP-Annotationen (`readOnlyHint`, `destructiveHint`), sodass Clients, die sie unterstützen, vor ändernden Aufrufen nachfragen können.
+
 ## Dokumentation
 
 - [**Cookbook**](docs/cookbook.de.md) – Tool-orientierte Rezepte mit direkt verwendbaren Parameter-Beispielen für alle registrierten Tools
@@ -341,7 +355,7 @@ npm test             # Tests ausführen (vitest)
 npm run test:watch   # Tests im Watch-Modus
 npm run test:coverage # Coverage-Report
 npm run benchmark    # Token-Benchmark gegen eine Live-MantisBT-Instanz (siehe Token-Verbrauch oben)
-npm run benchmark:search # Such-Trefferquote und Exakt-Treffer-Reihenfolge auf einem bestehenden Index (MANTIS_SEARCH_DIR), Vektor vs. hybrid
+npm run benchmark:search # Such-Trefferquote und Exakt-Treffer-Reihenfolge auf einem bestehenden Index (gefunden wie vom Server: MANTIS_SEARCH_DIR, MANTIS_BASE_URL, MANTIS_API_KEY), Vektor vs. hybrid
 ```
 
 `benchmark:search` liest optional handgeschriebene Umschreibungen (`BENCHMARK_PARAPHRASES`) und feste Fälle mit erwarteter Rangfolge (`BENCHMARK_EXACT`); die Dateiformate stehen am Anfang von `scripts/benchmark-search.ts`.

package/README.md

@@ -4,6 +4,7 @@
 [![license](https://img.shields.io/npm/l/@dpesch/mantisbt-mcp-server)](LICENSE)
 [![MCP compatible](https://img.shields.io/badge/MCP-compatible-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
 [![MCP Badge](https://lobehub.com/badge/mcp/dpesch-mantisbt-mcp-server)](https://lobehub.com/mcp/dpesch-mantisbt-mcp-server)
+[![Mantisbt MCP on mcprush](https://mcprush.com/badge/mantisbt-mcp/score.svg)](https://mcprush.com/to/mantisbt-mcp?ref=badge)
 [![MantisBT MCP Server](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server/badges/card.svg)](https://glama.ai/mcp/servers/dpesch/mantisbt-mcp-server)
 
 **English** · [Deutsch](README.de.md)
@@ -31,7 +32,8 @@ Add to `~/.claude/claude_desktop_config.json` (Claude Desktop) or your local
       "args": ["-y", "@dpesch/mantisbt-mcp-server"],
       "env": {
         "MANTIS_BASE_URL": "https://your-mantis.example.com/api/rest",
-        "MANTIS_API_KEY": "your-api-token"
+        "MANTIS_API_KEY": "your-api-token",
+        "MANTIS_UPLOAD_DIR": "/path/to/mantis-uploads"
       }
     }
   }
@@ -55,13 +57,16 @@ npm run build
       "args": ["/path/to/mantisbt-mcp-server/dist/index.js"],
       "env": {
         "MANTIS_BASE_URL": "https://your-mantis.example.com/api/rest",
-        "MANTIS_API_KEY": "your-api-token"
+        "MANTIS_API_KEY": "your-api-token",
+        "MANTIS_UPLOAD_DIR": "/path/to/mantis-uploads"
       }
     }
   }
 }
 ```
 
+`MANTIS_UPLOAD_DIR` is optional, but **recommended in stdio mode as well**: it limits `upload_file` to files in that directory, so a prompt injection in issue text cannot make the model attach arbitrary local files. Without it, `file_path` can read any file the server process can read. Starting with 2.0.0, `file_path` will be disabled unless the variable is set. See [Security considerations](#security-considerations).
+
 ## Configuration
 
 ### Environment variables
@@ -71,20 +76,21 @@ npm run build
 | `MANTIS_BASE_URL` | ✅ | – | Base URL of your MantisBT installation. Both `https://your-mantis.example.com` and `https://your-mantis.example.com/api/rest` are accepted — the `/api/rest` suffix is normalized automatically. |
 | `MANTIS_API_KEY` | ✅ | – | API token for authentication |
 | `MANTIS_USE_INDEX_PHP` | – | auto | Set to `true` when URL rewriting is unavailable — REST requests then use `/api/rest/index.php/` instead of `/api/rest/`. Detected automatically when `MANTIS_BASE_URL` ends with `/api/rest/index.php`; an explicit value always wins. See the [cookbook](docs/cookbook.md#connect-to-an-installation-without-url-rewriting). |
-| `MANTIS_CACHE_DIR` | – | `~/.cache/mantisbt-mcp` | Directory for the metadata cache |
+| `MANTIS_CACHE_DIR` | – | `~/.cache/mantisbt-mcp` | Base directory for the metadata cache. Each MantisBT instance and account (base URL plus API key) gets a subdirectory of its own, named after the host plus a hash; the server logs its path on startup |
 | `MANTIS_CACHE_TTL` | – | `3600` | Cache lifetime in seconds |
 | `TRANSPORT` | – | `stdio` | Transport mode: `stdio` or `http` |
 | `PORT` | – | `3000` | Port for HTTP mode |
 | `MCP_HTTP_HOST` | – | `127.0.0.1` | Bind address for HTTP mode. **Changed from `0.0.0.0` to `127.0.0.1`** — the server now listens on localhost only by default. Set to `0.0.0.0` for Docker or remote access. |
 | `MCP_HTTP_TOKEN` | ✅ (HTTP mode) | – | Bearer token for the `/mcp` endpoint (`Authorization: Bearer <token>`). **Required when `TRANSPORT=http`** — the server refuses to start in HTTP mode without it, so tools are never exposed unauthenticated. Ignored in stdio mode. The `/health` endpoint is always public. |
+| `MCP_HTTP_MAX_BODY_SIZE` | – | `67108864` (64 MB) | Largest accepted `/mcp` request body in bytes; larger ones get `413 Payload Too Large`. Empty or unset means the default; in HTTP mode any other value must be a positive whole number, otherwise the server does not start. Ignored in stdio mode. |
 | `MANTIS_SEARCH_ENABLED` | – | `false` | Set to `true` to enable semantic search |
 | `MANTIS_SEARCH_BACKEND` | – | `vectra` | Vector store backend: `vectra` (pure JS) or `sqlite-vec` (requires manual install) |
-| `MANTIS_SEARCH_DIR` | – | `{MANTIS_CACHE_DIR}/search` | Directory for the search index |
+| `MANTIS_SEARCH_DIR` | – | `{MANTIS_CACHE_DIR}/<instance>/search` | Base directory for the search index; an explicit value also gets a subdirectory per instance and account (`{MANTIS_SEARCH_DIR}/<instance>`) |
 | `MANTIS_SEARCH_MODEL` | – | `Xenova/paraphrase-multilingual-MiniLM-L12-v2` | Embedding model name (downloaded once on first use, ~80 MB). After a change the index is rebuilt automatically on the next sync. |
 | `MANTIS_SEARCH_THREADS` | – | `1` | Number of ONNX intra-op threads for the embedding model. Default is 1 to prevent CPU saturation on multi-core machines and WSL. On a machine with 4 or more cores, `4` is a good value: a full rebuild of 7,700 issues took 160 s instead of 377 s with 1 thread. The setting mainly speeds up indexing; a search query is a single short text and hardly benefits. Effective since 1.16.0 — earlier versions ignored this setting and always used every core. |
-| `MANTIS_UPLOAD_DIR` | – | – | Restrict `upload_file`'s `file_path` to files within this directory (path traversal via `../` is blocked). In **stdio mode** `file_path` is unrestricted unless this is set. In **HTTP mode** `file_path` reads from the server's filesystem, so it is **disabled unless this variable is set** — HTTP clients should upload via the `content` (Base64) parameter instead. |
+| `MANTIS_UPLOAD_DIR` | – | – | Restrict `upload_file`'s `file_path` to files within this directory (path traversal via `../` and symbolic links that lead outside are blocked; keep the directory unwritable for less trusted users, as a link swapped in between check and read is not caught). In **stdio mode** `file_path` is unrestricted unless this is set — **setting it is recommended in stdio mode as well** (see [Security considerations](#security-considerations)); starting with 2.0.0, `file_path` will be disabled in stdio mode too unless it is set. In **HTTP mode** `file_path` reads from the server's filesystem, so it is **disabled unless this variable is set** — HTTP clients should upload via the `content` (Base64) parameter instead. |
 | `MANTIS_TOOLSETS` | – | – (all) | Comma-separated list of tool groups to offer: `issues`, `notes`, `links`, `files`, `projects`, `versions`, `meta`, `search` (case-insensitive). Unset or empty means all groups. The `search` group additionally requires `MANTIS_SEARCH_ENABLED=true`; without the group the search module is not started at all. An unknown group name stops the server at startup with a message listing the valid names. See [Limit the offered tools](#limit-the-offered-tools) and the [cookbook](docs/cookbook.md#offer-only-some-tool-groups). |
-| `MANTIS_DISABLE_DESTRUCTIVE` | – | `false` | Set to `true` to hide every destructive tool — `delete_issue`, `delete_note`, `delete_version`, `remove_relationship`, `remove_monitor` — regardless of the active groups. Hidden tools are not listed and return "Tool … not found" when called. |
+| `MANTIS_DISABLE_DESTRUCTIVE` | – | `false` | Set to `true` to hide every destructive tool — `delete_issue`, `delete_note`, `delete_version`, `remove_relationship`, `remove_monitor` — regardless of the active groups. Hidden tools are not listed and return "Tool … not found" when called. `update_issue` then also rejects `remove_monitors`. |
 
 ### Limit the offered tools
 
@@ -321,10 +327,18 @@ MCP_HTTP_TOKEN=secret MANTIS_BASE_URL=... MANTIS_API_KEY=... \
 #   TRANSPORT=http PORT=3456 MCP_HTTP_HOST=0.0.0.0 node dist/index.js
 ```
 
-Every `/mcp` request must send `Authorization: Bearer <token>`. Over HTTP, `upload_file`'s `file_path` is disabled unless `MANTIS_UPLOAD_DIR` is set — use the `content` (Base64) parameter instead.
+Every `/mcp` request must send `Authorization: Bearer <token>`. Over HTTP, `upload_file`'s `file_path` is disabled unless `MANTIS_UPLOAD_DIR` is set — use the `content` (Base64) parameter instead. A request body may be at most 64 MB by default (`MCP_HTTP_MAX_BODY_SIZE`) — larger ones get `413 Payload Too Large` — so `content` fits files up to about 48 MB.
 
 Health check: `GET http://localhost:3456/health` (always public, no token required)
 
+## Security considerations
+
+Issue descriptions, notes and attachments are written by whoever can report or comment in your MantisBT — and the model reads them. Treat them as **untrusted input**: a prompt injection hidden in an issue can try to make the model call write tools such as `create_issue`, `update_issue` or `upload_file`.
+
+- **Set `MANTIS_UPLOAD_DIR` — in stdio mode as well.** Without it, `upload_file` reads any local file the server process can read via `file_path`. An injected instruction could get the model to attach, for example, a private SSH key to an issue, where everyone who can read the issue sees it. With `MANTIS_UPLOAD_DIR`, `file_path` is limited to that directory. Over HTTP, `file_path` is already disabled without it; starting with 2.0.0 the same applies to stdio.
+- **Offer only the tools you need.** `MANTIS_TOOLSETS` limits the offered groups — leave out `files` if you never upload, or use only `issues,meta` for read-mostly triage. `MANTIS_DISABLE_DESTRUCTIVE=true` hides every delete and remove tool. Both are especially useful where people outside your team can write issues. See [Limit the offered tools](#limit-the-offered-tools).
+- **Let your client confirm write calls.** Every tool carries MCP annotations (`readOnlyHint`, `destructiveHint`), so clients that support them can ask before a tool changes data.
+
 ## Documentation
 
 - [**Cookbook**](docs/cookbook.md) — tool-oriented recipes with copy-paste-ready parameter examples for all registered tools
@@ -341,7 +355,7 @@ npm test             # Run tests (vitest)
 npm run test:watch   # Run tests in watch mode
 npm run test:coverage # Coverage report
 npm run benchmark    # Token benchmark against a live MantisBT (see Token usage above)
-npm run benchmark:search # Search recall and exact-first order on an existing index (MANTIS_SEARCH_DIR), vectors vs. hybrid
+npm run benchmark:search # Search recall and exact-first order on an existing index (found like the server does: MANTIS_SEARCH_DIR, MANTIS_BASE_URL, MANTIS_API_KEY), vectors vs. hybrid
 ```
 
 `benchmark:search` optionally reads hand-written paraphrases (`BENCHMARK_PARAPHRASES`) and fixed cases with an expected ranking (`BENCHMARK_EXACT`); the file formats are described at the top of `scripts/benchmark-search.ts`.

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.18.1",
-  "commit": "53e8d2f",
-  "built_at": "2026-11-10T20:19:47.616Z"
+  "version": "1.18.3",
+  "commit": "759969d",
+  "built_at": "2026-11-12T11:13:36.433Z"
 }

package/dist/config.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
@@ -41,9 +42,25 @@ async function readDotEnvLocal() {
 // Non-credential config (safe to read at startup without credentials)
 // ---------------------------------------------------------------------------
 export const DEFAULT_SEARCH_MODEL = 'Xenova/paraphrase-multilingual-MiniLM-L12-v2';
+/**
+ * Subdirectory of the cache and search directories for one MantisBT instance
+ * and account (#8625), so configurations sharing a directory never read each
+ * other's data. The host keeps it recognisable; the hash covers URL and API
+ * key, never the key itself. Without credentials: an empty folder of its own.
+ */
+export function instanceDirName(baseUrl, apiKey) {
+    if (!baseUrl || !apiKey)
+        return 'unconfigured';
+    const url = normalizeBaseUrl(baseUrl);
+    const hash = createHash('sha256').update(`${url}\n${apiKey}`).digest('hex').slice(0, 16);
+    // The regex also drops the [ ] : of IPv6 hosts, not allowed in Windows paths.
+    const host = URL.canParse(url) ? new URL(url).hostname.replace(/[^a-z0-9.-]/gi, '') : '';
+    return host ? `${host}-${hash}` : hash;
+}
 function readNonCredentialConfig() {
     const defaultCacheDir = join(homedir(), '.cache', 'mantisbt-mcp');
-    const cacheDir = process.env.MANTIS_CACHE_DIR ?? defaultCacheDir;
+    const instance = instanceDirName(process.env.MANTIS_BASE_URL, process.env.MANTIS_API_KEY);
+    const cacheDir = join(process.env.MANTIS_CACHE_DIR ?? defaultCacheDir, instance);
     const cacheTtl = process.env.MANTIS_CACHE_TTL
         ? parseInt(process.env.MANTIS_CACHE_TTL, 10)
         : 3600;
@@ -53,7 +70,9 @@ function readNonCredentialConfig() {
         process.stderr.write(`[mantisbt-config] Unknown MANTIS_SEARCH_BACKEND="${searchBackendRaw}", falling back to "vectra"\n`);
     }
     const searchBackend = searchBackendRaw === 'sqlite-vec' ? 'sqlite-vec' : 'vectra';
-    const searchDir = process.env.MANTIS_SEARCH_DIR ?? join(cacheDir, 'search');
+    const searchDir = process.env.MANTIS_SEARCH_DIR
+        ? join(process.env.MANTIS_SEARCH_DIR, instance)
+        : join(cacheDir, 'search');
     const searchModelName = process.env.MANTIS_SEARCH_MODEL ?? DEFAULT_SEARCH_MODEL;
     const searchNumThreads = Math.max(1, parseInt(process.env.MANTIS_SEARCH_THREADS ?? '', 10) || 1);
     return {
@@ -63,6 +82,7 @@ function readNonCredentialConfig() {
         httpHost: process.env.MCP_HTTP_HOST ?? '127.0.0.1',
         httpPort: parseInt(process.env.PORT ?? '3000', 10),
         httpToken: process.env.MCP_HTTP_TOKEN,
+        httpMaxBodySize: process.env.MCP_HTTP_MAX_BODY_SIZE,
         search: {
             enabled: searchEnabled,
             backend: searchBackend,
@@ -99,7 +119,8 @@ function resolveUseIndexPhp(rawBaseUrl) {
  * Returns all non-credential config values. Never throws, even when
  * MANTIS_BASE_URL / MANTIS_API_KEY are absent. Use this at server startup
  * so the MCP transport can connect and respond to tools/list without
- * requiring credentials to be configured.
+ * requiring credentials to be configured. The credentials, when present,
+ * still pick the instance subdirectory of the cache and search paths.
  */
 export async function getStartupConfig() {
     await loadDotEnvLocal();

package/dist/http-body.js

@@ -0,0 +1,63 @@
+// Default upper bound for a POST /mcp body (#8624). Generous because
+// upload_file sends files as Base64 in `content`, a third larger than the
+// file itself.
+export const MAX_REQUEST_BODY_BYTES = 64 * 1024 * 1024;
+/**
+ * MCP_HTTP_MAX_BODY_SIZE in bytes (#8631); the default when unset. Anything
+ * but a positive whole number throws — silently falling back to the default
+ * would hide the typo until an upload fails. Called in HTTP mode only, so a
+ * stray value never stops the stdio server.
+ */
+export function parseMaxBodySize(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return MAX_REQUEST_BODY_BYTES;
+    const bytes = Number(value);
+    if (!Number.isSafeInteger(bytes) || bytes <= 0) {
+        throw new Error(`MCP_HTTP_MAX_BODY_SIZE must be a positive whole number of bytes, got "${raw}".`);
+    }
+    return bytes;
+}
+/**
+ * Reads the request body, at most `limit` bytes. A larger body — announced
+ * by Content-Length or found while reading — gets 413 and the connection is
+ * closed. Resolves undefined then, or when the client aborts; the caller must
+ * not respond in either case.
+ *
+ * The SDK transport has its own limit (maxRequestBodySize), but it reads the
+ * body inside handleRequest — in runHttp that runs in the serialized request
+ * queue, where one slow upload would stall every other request. Reading here,
+ * before the queue, avoids that; the 413 matches the SDK's JSON-RPC error.
+ */
+export function readBody(req, res, limit) {
+    return new Promise(resolve => {
+        const tooLarge = () => {
+            res.writeHead(413, { 'Content-Type': 'application/json', Connection: 'close' });
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                error: { code: -32000, message: `Request body exceeds ${limit} bytes` },
+                id: null,
+            }));
+            resolve(undefined);
+        };
+        if (Number(req.headers['content-length']) > limit) {
+            tooLarge();
+            return;
+        }
+        let chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            if (!chunks)
+                return; // over the limit: drop the rest until the socket closes
+            size += chunk.length;
+            if (size <= limit) {
+                chunks.push(chunk);
+                return;
+            }
+            chunks = undefined;
+            tooLarge();
+        });
+        req.on('end', () => resolve(chunks && Buffer.concat(chunks)));
+        req.on('error', () => resolve(undefined));
+    });
+}

package/dist/index.js

@@ -6,6 +6,7 @@ import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
 import { loadBuildInfo } from './build-info.js';
+import { parseMaxBodySize, readBody } from './http-body.js';
 import { getConfig, getStartupConfig, assertHttpAuthConfigured } from './config.js';
 import { MantisClient } from './client.js';
 import { VersionHintService, setGlobalVersionHint } from './version-hint.js';
@@ -38,6 +39,9 @@ async function createMcpServer(transport) {
         };
     }, (response) => versionHint.onSuccessfulResponse(response));
     const cache = new MetadataCache(startupConfig.cacheDir, startupConfig.cacheTtl);
+    console.error(`[mantisbt-config] cache directory: ${startupConfig.cacheDir}`);
+    if (startupConfig.search.enabled)
+        console.error(`[mantisbt-config] search index: ${startupConfig.search.dir}`);
     const server = new McpServer({
         name: 'mantisbt-mcp-server',
         version,
@@ -58,6 +62,7 @@ async function createMcpServer(transport) {
         build,
         uploadDir: startupConfig.uploadDir,
         transport,
+        disableDestructive: startupConfig.disableDestructive,
         searchIndexStatus,
     });
     registerPrompts(server);
@@ -80,6 +85,7 @@ async function runStdio() {
 async function runHttp() {
     const startupConfig = await getStartupConfig();
     assertHttpAuthConfigured(startupConfig.httpToken);
+    const maxBodySize = parseMaxBodySize(startupConfig.httpMaxBodySize);
     const server = await createMcpServer('http');
     const port = startupConfig.httpPort;
     // Serialize stateless requests: each request waits for the previous transport
@@ -97,34 +103,42 @@ async function runHttp() {
                 res.end(JSON.stringify({ error: 'Unauthorized' }));
                 return;
             }
-            const chunks = [];
-            req.on('data', (chunk) => chunks.push(chunk));
-            req.on('end', () => {
-                const prev = requestQueue;
-                let releaseLock;
-                requestQueue = new Promise(resolve => { releaseLock = resolve; });
-                void prev.then(async () => {
-                    try {
-                        const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-                        const transport = new StreamableHTTPServerTransport({
-                            sessionIdGenerator: undefined,
-                            enableJsonResponse: true,
-                        });
-                        await server.connect(transport);
-                        await transport.handleRequest(req, res, body);
-                    }
-                    catch (err) {
-                        console.error('[HTTP handler error]', err instanceof Error ? err.stack : err);
-                        if (!res.headersSent) {
-                            res.writeHead(400, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({ error: 'Bad Request' }));
-                        }
-                    }
-                    finally {
-                        await server.close();
-                        releaseLock();
+            const raw = await readBody(req, res, maxBodySize);
+            if (raw === undefined)
+                return; // aborted, or 413 already sent
+            // Parsed before queueing, so the raw bytes are not held while waiting.
+            let body;
+            try {
+                body = JSON.parse(raw.toString('utf8'));
+            }
+            catch {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Bad Request' }));
+                return;
+            }
+            const prev = requestQueue;
+            let releaseLock;
+            requestQueue = new Promise(resolve => { releaseLock = resolve; });
+            void prev.then(async () => {
+                try {
+                    const transport = new StreamableHTTPServerTransport({
+                        sessionIdGenerator: undefined,
+                        enableJsonResponse: true,
+                    });
+                    await server.connect(transport);
+                    await transport.handleRequest(req, res, body);
+                }
+                catch (err) {
+                    console.error('[HTTP handler error]', err instanceof Error ? err.stack : err);
+                    if (!res.headersSent) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Bad Request' }));
                     }
-                });
+                }
+                finally {
+                    await server.close();
+                    releaseLock();
+                }
             });
         }
         else if (req.method === 'GET' && req.url === '/health') {

package/dist/search/lexical.js

@@ -21,6 +21,12 @@ export function tokenize(text) {
 // common tokens such as UTF-8 from taking over a search. The rare identifiers
 // of the search benchmark occur in at most 8 issues, well below the cap.
 const MAX_EXACT_MATCHES = 20;
+// The query is caller input of any length, and each identifier costs a text
+// check per candidate issue (#8623). These caps bound that work per query.
+// Measured on 7,800 issues: real queries name at most 22 identifiers and
+// check at most 2,700 texts, so neither cap changes a real search.
+export const MAX_QUERY_IDENTIFIERS = 32;
+export const MAX_CHECKED_TEXTS = 10_000;
 // Words, or words joined by - . : / (CVE-2026-1234, 7.0.0-1014-azure).
 const COMPOUND = /[\p{L}\p{N}_]+(?:[-.:/][\p{L}\p{N}_]+)*/gu;
 function looksLikeIdentifier(word) {
@@ -132,24 +138,35 @@ export class LexicalIndex {
      * Per document id, how many identifiers of the query it contains as a whole
      * (#8545); documents without one are absent. Candidates come from the
      * postings of the identifier's rarest word, the text check decides.
+     *
+     * The MAX_QUERY_IDENTIFIERS cheapest identifiers, until MAX_CHECKED_TEXTS
+     * is spent (#8623). An identifier with more candidates than the budget left
+     * could count for no issue anyway — it either exceeds MAX_EXACT_MATCHES or
+     * runs out of budget — and the ones after it have at least as many.
      */
     exactMatches(query) {
         const counts = new Map();
         const frequency = (term) => this.offsets[term + 1] - this.offsets[term];
-        for (const identifier of identifiers(query)) {
+        const lookups = identifiers(query).flatMap(identifier => {
             const terms = tokenize(identifier).map(word => this.termIds.get(word));
             if (terms.length === 0 || terms.some(term => term === undefined))
-                continue;
+                return [];
             const rarest = terms.reduce((a, b) => (frequency(a) <= frequency(b) ? a : b));
+            return [{ identifier, start: this.offsets[rarest], end: this.offsets[rarest + 1] }];
+        }).sort((a, b) => (a.end - a.start) - (b.end - b.start)).slice(0, MAX_QUERY_IDENTIFIERS);
+        let budget = MAX_CHECKED_TEXTS;
+        for (const { identifier, start, end } of lookups) {
+            if (end - start > budget)
+                break;
             const pattern = wholeIdentifier(identifier);
             const matches = [];
-            for (let at = this.offsets[rarest]; at < this.offsets[rarest + 1]; at++) {
+            let at = start;
+            for (; at < end && matches.length <= MAX_EXACT_MATCHES; at++) {
                 const doc = this.documents[this.docs[at]];
                 if (pattern.test(doc.summary) || pattern.test(doc.description ?? ''))
                     matches.push(doc.id);
-                if (matches.length > MAX_EXACT_MATCHES)
-                    break;
             }
+            budget -= at - start;
             if (matches.length > MAX_EXACT_MATCHES)
                 continue;
             for (const id of matches)

package/dist/search/store.js

@@ -126,9 +126,14 @@ export class VectraStore {
         await this.ensureLoaded();
         return this.items.get(id) ?? null;
     }
-    async delete(id) {
+    async ids() {
         await this.ensureLoaded();
-        this.items.delete(id);
+        return [...this.items.keys()];
+    }
+    async delete(...ids) {
+        await this.ensureLoaded();
+        for (const id of ids)
+            this.items.delete(id);
         this.lexical = null;
         await this.persist();
     }

package/dist/search/sync.js

@@ -5,6 +5,12 @@ import { acquireSyncLock } from './sync-lock.js';
 const PAGE_SIZE = 50;
 const EMBED_BATCH_SIZE = 10;
 const CHECKPOINT_INTERVAL = 100; // flush to disk every N indexed issues
+// Listing of the issue IDs the account can see (#8626), with select=id. It
+// ends at an empty page, not at a short one: a server that caps page_size
+// would otherwise end it after the first page and empty the index. Past
+// MAX_ID_PAGES it counts as incomplete, and nothing is removed.
+const ID_PAGE_SIZE = 1000;
+const MAX_ID_PAGES = 200;
 export class SyncLockedError extends Error {
     constructor() {
         super('A search index sync is already running — try again once it has finished');
@@ -98,8 +104,22 @@ export class SearchSyncService {
                 indexedSinceCheckpoint = 0;
             }
         }
+        // Issues deleted in MantisBT, or no longer visible to this account, never
+        // show up as changed (#8626). A sync over all projects therefore drops
+        // every indexed issue the account cannot see any more. A project-scoped
+        // sync sees only part of the issues, and a cleared index holds no stale
+        // ones — both skip the listing.
+        let removed = 0;
+        if (scope === undefined && !full && !outdated) {
+            const visible = await this.fetchVisibleIds();
+            const stale = visible ? (await this.store.ids()).filter(id => !visible.has(id)) : [];
+            if (stale.length > 0) {
+                await this.store.delete(...stale); // also writes the items added above
+                removed = stale.length;
+            }
+        }
         // Final flush for any remaining items not yet written by a checkpoint.
-        if (indexedSinceCheckpoint > 0) {
+        if (indexedSinceCheckpoint > 0 && removed === 0) {
             await this.store.flush();
         }
         // The watermark is the newest updated_at the server reported, not the local
@@ -118,7 +138,20 @@ export class SearchSyncService {
         const storeCount = await this.store.count();
         const total = totalFromApi ?? (lastSyncedAt === null ? allIssues.length : storeCount);
         await this.store.setLastKnownTotal(total);
-        return { indexed, skipped, total };
+        return { indexed, skipped, removed, total };
+    }
+    /** IDs of all issues the account can see; null if the listing did not end. */
+    async fetchVisibleIds() {
+        const ids = new Set();
+        for (let page = 1; page <= MAX_ID_PAGES; page++) {
+            const response = await this.client.get('issues', { page_size: ID_PAGE_SIZE, page, select: 'id' });
+            const issues = response.issues ?? [];
+            if (issues.length === 0)
+                return ids;
+            for (const { id } of issues)
+                ids.add(id);
+        }
+        return null;
     }
     async fetchAllIssues(updatedAfter, projectId) {
         const changedIssues = [];

package/dist/search/tools.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { coerceBool } from '../coerce.js';
-import { buildIssueViewUrl } from '../client.js';
+import { buildIssueViewUrl, MantisApiError } from '../client.js';
 import { SearchSyncService } from './sync.js';
 import { getVersionHint } from '../version-hint.js';
 import { firstIssue } from '../issue-envelope.js';
@@ -39,6 +39,8 @@ export async function getSearchIndexStatus(store) {
     const summary = total !== null ? `${indexed}/${total} (${percent} %)` : `${indexed}/? (total unknown)`;
     return { summary, indexed, total, percent, last_synced_at: lastSyncedAt };
 }
+/** API answers that mean the issue is not (or no longer) visible to this account. */
+const HIDDEN_ISSUE_STATUSES = new Set([401, 403, 404]);
 export function registerSearchTools(server, client, store, embedder, lockDir) {
     // ---------------------------------------------------------------------------
     // search_issues
@@ -63,7 +65,8 @@ export function registerSearchTools(server, client, store, embedder, lockDir) {
                 .describe('Number of results to return (default: 10, max: 50)'),
             select: z.string().optional().describe('Comma-separated list of fields to include for each result (e.g. "id,summary,status,handler,priority"). ' +
                 'When provided, each matching issue is fetched from MantisBT and enriched with the requested fields. ' +
-                'The relevance score is always included. Without this parameter only id and score are returned.'),
+                'The relevance score is always included. Issues that MantisBT reports as inaccessible or deleted are left out. ' +
+                'Without this parameter only id and score are returned.'),
             highlight: z
                 .preprocess(coerceBool, z.boolean().default(false))
                 .describe('If true, adds a "highlights" field per result with query terms bolded (**term**) ' +
@@ -144,7 +147,12 @@ export function registerSearchTools(server, client, store, embedder, lockDir) {
                     }
                     return projected;
                 }
-                catch {
+                catch (error) {
+                    // Denied or deleted: MantisBT has the final say, so indexed text
+                    // must not leak through the fallback below (#8617).
+                    if (error instanceof MantisApiError && HIDDEN_ISSUE_STATUSES.has(error.statusCode)) {
+                        return null;
+                    }
                     const result = { id, score, view_url: buildIssueViewUrl(baseUrl, id) };
                     if (terms.length > 0) {
                         const item = await store.getItem(id);
@@ -219,13 +227,13 @@ export function registerSearchTools(server, client, store, embedder, lockDir) {
         try {
             const startMs = Date.now();
             const syncService = new SearchSyncService(client, store, embedder, lockDir);
-            const { indexed, skipped, total } = await syncService.sync(project_id, { full });
+            const { indexed, skipped, removed, total } = await syncService.sync(project_id, { full });
             const duration_ms = Date.now() - startMs;
             return {
                 content: [
                     {
                         type: 'text',
-                        text: JSON.stringify({ indexed, skipped, total, duration_ms }, null, 2),
+                        text: JSON.stringify({ indexed, skipped, removed, total, duration_ms }, null, 2),
                     },
                 ],
             };

package/dist/tools/files.js

@@ -1,4 +1,4 @@
-import { readFile } from 'node:fs/promises';
+import { readFile, realpath } from 'node:fs/promises';
 import { basename, resolve, sep } from 'node:path';
 import { z } from 'zod';
 import { enrichIssue } from '../issue-enrich.js';
@@ -12,13 +12,13 @@ function errorText(msg) {
     return hint ? `Error: ${msg}\n\n${hint}` : `Error: ${msg}`;
 }
 export function registerFileTools(server, client, uploadDir, transport = 'stdio') {
-    const normalizedUploadDir = uploadDir ? resolve(uploadDir) + sep : undefined;
+    const uploadRoot = uploadDir ? resolve(uploadDir) : undefined;
     // file_path reads from the server's own filesystem. Over stdio the caller is
     // the trusted local agent (same machine, same user), so any path is fine. Over
     // HTTP a remote client neither controls nor should reach server-local paths —
     // it must send Base64 via `content`. Only allow file_path in HTTP mode when an
     // explicit MANTIS_UPLOAD_DIR sandboxes it.
-    const filePathAllowed = transport === 'stdio' || normalizedUploadDir !== undefined;
+    const filePathAllowed = transport === 'stdio' || uploadRoot !== undefined;
     // ---------------------------------------------------------------------------
     // list_issue_files
     // ---------------------------------------------------------------------------
@@ -93,13 +93,19 @@ Use this tool to attach files such as logs, screenshots, or patches to an existi
                 if (!filePathAllowed) {
                     return { content: [{ type: 'text', text: errorText('file_path is disabled over the HTTP transport. Send the file via the "content" parameter (Base64), or set MANTIS_UPLOAD_DIR to permit server-local paths within that directory.') }], isError: true };
                 }
-                if (normalizedUploadDir) {
-                    const normalizedPath = resolve(file_path);
-                    if (!normalizedPath.startsWith(normalizedUploadDir)) {
-                        return { content: [{ type: 'text', text: errorText('file_path is not allowed — access restricted to the designated upload directory') }], isError: true };
-                    }
+                let readPath = file_path;
+                if (uploadRoot) {
+                    const denied = { content: [{ type: 'text', text: errorText('file_path is not allowed — access restricted to the designated upload directory') }], isError: true };
+                    if (!resolve(file_path).startsWith(uploadRoot + sep))
+                        return denied;
+                    // The textual check alone is not enough: a link inside the directory
+                    // must not lead the read outside, so compare the real targets (#8618).
+                    const [realTarget, realRoot] = await Promise.all([realpath(file_path), realpath(uploadRoot)]);
+                    if (!realTarget.startsWith(realRoot + sep))
+                        return denied;
+                    readPath = realTarget;
                 }
-                const fileBuffer = await readFile(file_path);
+                const fileBuffer = await readFile(readPath);
                 base64Content = fileBuffer.toString('base64');
                 fileName = filename ?? basename(file_path);
             }

package/dist/tools/index.js

@@ -18,7 +18,7 @@ import { registerVersionTools } from './version.js';
  */
 export function registerAllTools(server, deps) {
     const { client, cache } = deps;
-    registerIssueTools(server, client, cache);
+    registerIssueTools(server, client, cache, { disableDestructive: deps.disableDestructive });
     registerNoteTools(server, client);
     registerFileTools(server, client, deps.uploadDir, deps.transport);
     registerRelationshipTools(server, client);

package/dist/tools/issues.js

@@ -139,7 +139,7 @@ async function resolveEnum(group, value, client) {
     const valid = Object.values(MANTIS_CANONICAL_ENUM_NAMES[group]).join(', ');
     return `Invalid ${group} "${value}". Valid canonical names: ${valid}. Call get_issue_schema to see localized labels.`;
 }
-export function registerIssueTools(server, client, cache) {
+export function registerIssueTools(server, client, cache, { disableDestructive = false } = {}) {
     /**
      * Pages through GET /issues and hands every issue matching the client-side
      * filter to onMatch (return false to stop). Ends on a short page, or after
@@ -542,7 +542,7 @@ Steps run in order: fields, monitors, note. Once one step succeeded, a later fai
         inputSchema: z.object({
             id: z.coerce.number().int().positive().describe('Numeric issue ID to update'),
             add_monitors: z.array(z.string().min(1)).min(1).optional().describe('MantisBT login names to add as monitors (watchers) of the issue'),
-            remove_monitors: z.array(z.string().min(1)).min(1).optional().describe('MantisBT login names to remove from the monitors of the issue; names that are not monitoring are ignored'),
+            remove_monitors: z.array(z.string().min(1)).min(1).optional().describe('MantisBT login names to remove from the monitors of the issue; names that are not monitoring are ignored. Rejected when the server runs with MANTIS_DISABLE_DESTRUCTIVE=true'),
             dry_run: z.preprocess(coerceBool, z.boolean().optional()).describe('If true, return the patch payload that would be sent without actually updating the issue. Useful for previewing changes before committing them.'),
             note: z.string().min(1).optional().describe('Optional note text appended after a successful update (e.g. reason for a status change). Replaces a separate add_note call.'),
             note_view_state: z.enum(['public', 'private']).default('public').describe('Visibility of the appended note: "public" (default) or "private". Only used when "note" is set.'),
@@ -591,6 +591,13 @@ Steps run in order: fields, monitors, note. Once one step succeeded, a later fai
                 isError: true,
             };
         }
+        // remove_monitor is hidden then; the same removal must not run here (#8621).
+        if (disableDestructive && remove_monitors !== undefined) {
+            return {
+                content: [{ type: 'text', text: errorText('remove_monitors is disabled — this server runs with MANTIS_DISABLE_DESTRUCTIVE=true.') }],
+                isError: true,
+            };
+        }
         const removing = new Set(remove_monitors?.map(u => u.toLowerCase()));
         const conflicting = add_monitors?.filter(u => removing.has(u.toLowerCase())) ?? [];
         if (conflicting.length > 0) {

package/dist/tools/notes.js

@@ -35,10 +35,17 @@ const noteEdit = z.object({
 }).strict().refine(e => e.text !== undefined || e.view_state !== undefined, { message: "A note edit needs 'text' or 'view_state'" });
 /** Schema of update_issue fields.notes. */
 export const noteEditsSchema = z.array(noteEdit).min(1).superRefine((edits, ctx) => {
-    const ids = edits.map(e => e.id);
-    const twice = ids.filter((noteId, i) => ids.indexOf(noteId) !== i);
-    if (twice.length > 0)
-        ctx.addIssue({ code: 'custom', message: `Note ${twice.join(', ')} listed more than once` });
+    // Linear on purpose: this runs before any access check (#8622).
+    const seen = new Set();
+    const twice = new Set();
+    for (const { id } of edits) {
+        if (seen.has(id))
+            twice.add(id);
+        else
+            seen.add(id);
+    }
+    if (twice.size > 0)
+        ctx.addIssue({ code: 'custom', message: `Note ${[...twice].join(', ')} listed more than once` });
 });
 /**
  * Turns note edits into the PATCH payload. MantisBT has no REST route for

package/docs/cookbook.de.md

@@ -120,7 +120,7 @@ Endet `MANTIS_BASE_URL` auf `/api/rest/index.php`, wird das index.php-Routing au
 
 ### Nur bestimmte Tool-Gruppen anbieten
 
-Standardmäßig sind alle 41 Tools aktiv (Suche deaktiviert). Mit `MANTIS_TOOLSETS` lassen sich nur die benötigten Gruppen laden – das hält den Kontext des Modells kürzer. Mit `MANTIS_DISABLE_DESTRUCTIVE=true` werden alle destruktiven Tools ausgeblendet, unabhängig von den aktiven Gruppen.
+Standardmäßig sind alle 41 Tools aktiv (Suche deaktiviert). Mit `MANTIS_TOOLSETS` lassen sich nur die benötigten Gruppen laden – das hält den Kontext des Modells kürzer. Mit `MANTIS_DISABLE_DESTRUCTIVE=true` werden alle destruktiven Tools ausgeblendet, unabhängig von den aktiven Gruppen; `update_issue` lehnt dann auch `remove_monitors` ab.
 
 Gültige Gruppennamen: `issues`, `notes`, `links`, `files`, `projects`, `versions`, `meta`, `search`. Ein unbekannter Name stoppt den Server beim Start mit einer Meldung, die die gültigen Namen auflistet. Veraltete Tools gehören immer zur gleichen Gruppe wie ihr Ersatz. Die vollständige Zuordnung von Gruppe zu Tools findet sich unter [Angebotene Tools einschränken im README](../README.de.md#angebotene-tools-einschränken).
 
@@ -1140,13 +1140,13 @@ Hängt eine Datei aus dem lokalen Dateisystem an ein Issue an.
 
 > **Hinweis:** Falls die MantisBT-Instanz keine Datei-Metadaten zurückgibt, lautet die Response `{ "success": true }`.
 
-> **Hinweis:** Wenn `MANTIS_UPLOAD_DIR` gesetzt ist, muss `file_path` auf eine Datei innerhalb dieses Verzeichnisses zeigen. Pfade außerhalb des Verzeichnisses oder Path-Traversal-Versuche (`../`) werden mit einem Fehler abgelehnt.
+> **Hinweis:** Wenn `MANTIS_UPLOAD_DIR` gesetzt ist, muss `file_path` auf eine Datei innerhalb dieses Verzeichnisses zeigen. Pfade außerhalb des Verzeichnisses, Path-Traversal-Versuche (`../`) und symbolische Links, die nach außen führen, werden mit einem Fehler abgelehnt. Das Setzen wird auch im stdio-Modus empfohlen, damit eine Prompt Injection im Tickettext das Modell nicht dazu bringen kann, beliebige lokale Dateien hochzuladen; ab 2.0.0 setzt `file_path` die Variable voraus. Siehe [Sicherheitshinweise](../README.de.md#sicherheitshinweise).
 
 ---
 
 ### Dateiinhalt hochladen (Base64)
 
-Hängt eine Datei an, indem ihr base64-kodierter Inhalt direkt übergeben wird. Nur als **Fallback** verwenden, wenn die Datei nicht über einen Pfad im Server-Dateisystem erreichbar ist (z.B. im Speicher erzeugte Daten oder Dateien, die nur auf der Client-Seite vorliegen). `file_path` bevorzugen, wenn die Datei auf der Festplatte existiert – der Server liest und kodiert sie automatisch.
+Hängt eine Datei an, indem ihr base64-kodierter Inhalt direkt übergeben wird. Nur als **Fallback** verwenden, wenn die Datei nicht über einen Pfad im Server-Dateisystem erreichbar ist (z.B. im Speicher erzeugte Daten oder Dateien, die nur auf der Client-Seite vorliegen). `file_path` bevorzugen, wenn die Datei auf der Festplatte existiert – der Server liest und kodiert sie automatisch. Über den HTTP-Transport darf eine Anfrage standardmäßig höchstens 64 MB groß sein, das reicht für Dateien bis etwa 48 MB; `MCP_HTTP_MAX_BODY_SIZE` ändert die Grenze.
 
 **Tool:** `upload_file`
 
@@ -1646,6 +1646,7 @@ Der Server baut den Index außerdem von selbst neu auf, wenn er mit einem andere
 {
   "indexed": 312,
   "skipped": 0,
+  "removed": 0,
   "total": 312,
   "duration_ms": 48203
 }
@@ -1657,7 +1658,7 @@ Der Server baut den Index außerdem von selbst neu auf, wenn er mit einem andere
 
 Aktualisiert den Index mit Issues, die seit der letzten Synchronisation hinzugekommen oder geändert wurden. Schneller als ein vollständiger Neuaufbau: Nur die seitdem geänderten Issues werden abgerufen und neu eingebettet.
 
-Es synchronisiert immer nur ein Serverprozess den gemeinsamen Index. Läuft bereits eine Synchronisation in einem anderen Prozess (etwa einer anderen Client-Sitzung), gibt das Tool einen Fehler zurück – nach deren Ende einfach erneut aufrufen. Eine auf `project_id` beschränkte Synchronisation verschiebt `last_synced_at` nicht, damit Änderungen in anderen Projekten beim nächsten Sync trotzdem erfasst werden. Wurde der Index mit einem anderen Embedding-Modell oder einer anderen Version erstellt, baut der Sync ihn für alle Projekte neu auf, auch mit `project_id`.
+Es synchronisiert immer nur ein Serverprozess den gemeinsamen Index. Läuft bereits eine Synchronisation in einem anderen Prozess (etwa einer anderen Client-Sitzung), gibt das Tool einen Fehler zurück – nach deren Ende einfach erneut aufrufen. Eine auf `project_id` beschränkte Synchronisation entfernt nichts und verschiebt `last_synced_at` nicht, damit Änderungen in anderen Projekten beim nächsten Sync trotzdem erfasst werden. Eine Synchronisation über alle Projekte entfernt außerdem Issues, die in MantisBT gelöscht wurden oder die das Konto nicht mehr sehen darf (`removed`); dafür listet sie die sichtbaren Issue-IDs auf, rund 1 s für 7.800 Issues. Wurde der Index mit einem anderen Embedding-Modell oder einer anderen Version erstellt, baut der Sync ihn für alle Projekte neu auf, auch mit `project_id`.
 
 **Tool:** `rebuild_search_index`
 
@@ -1679,6 +1680,7 @@ Es synchronisiert immer nur ein Serverprozess den gemeinsamen Index. Läuft bere
 {
   "indexed": 14,
   "skipped": 0,
+  "removed": 0,
   "total": 312,
   "duration_ms": 2104
 }

package/docs/cookbook.md

@@ -120,7 +120,7 @@ When `MANTIS_BASE_URL` ends with `/api/rest/index.php`, index.php routing is ena
 
 ### Offer only some tool groups
 
-By default all 41 tools are active (search off). Restrict them with `MANTIS_TOOLSETS` to keep the model's context shorter and load only what is needed for the task. Use `MANTIS_DISABLE_DESTRUCTIVE=true` to hide every destructive tool regardless of the active groups.
+By default all 41 tools are active (search off). Restrict them with `MANTIS_TOOLSETS` to keep the model's context shorter and load only what is needed for the task. Use `MANTIS_DISABLE_DESTRUCTIVE=true` to hide every destructive tool regardless of the active groups; `update_issue` then also rejects `remove_monitors`.
 
 Valid group names: `issues`, `notes`, `links`, `files`, `projects`, `versions`, `meta`, `search`. An unknown name stops the server at startup with a message listing the valid ones. Deprecated tools always belong to the same group as their replacement. For the complete group-to-tool mapping see [Limit the offered tools in the README](../README.md#limit-the-offered-tools).
 
@@ -1140,13 +1140,13 @@ Attaches a file from the local filesystem to an issue.
 
 > **Note:** If the MantisBT instance does not return file metadata, the response is `{ "success": true }`.
 
-> **Note:** If `MANTIS_UPLOAD_DIR` is set, `file_path` must point to a file inside that directory. Paths outside the directory or path traversal attempts (`../`) are rejected with an error.
+> **Note:** If `MANTIS_UPLOAD_DIR` is set, `file_path` must point to a file inside that directory. Paths outside the directory, path traversal attempts (`../`) and symbolic links that lead outside are rejected with an error. Setting it is recommended in stdio mode as well, so that a prompt injection in issue text cannot make the model upload arbitrary local files; starting with 2.0.0, `file_path` requires it. See [Security considerations](../README.md#security-considerations).
 
 ---
 
 ### Upload file content (base64)
 
-Attaches a file by passing its base64-encoded content directly. Use this **only** as a fallback when the file is not accessible via a path on the server filesystem (e.g. in-memory data or files generated on the client side). Prefer `file_path` whenever the file exists on disk — the server reads and encodes it automatically.
+Attaches a file by passing its base64-encoded content directly. Use this **only** as a fallback when the file is not accessible via a path on the server filesystem (e.g. in-memory data or files generated on the client side). Prefer `file_path` whenever the file exists on disk — the server reads and encodes it automatically. Over the HTTP transport a request may be at most 64 MB by default, which fits files up to about 48 MB; `MCP_HTTP_MAX_BODY_SIZE` changes the limit.
 
 **Tool:** `upload_file`
 
@@ -1646,6 +1646,7 @@ The server also rebuilds the index by itself when it was made with another embed
 {
   "indexed": 312,
   "skipped": 0,
+  "removed": 0,
   "total": 312,
   "duration_ms": 48203
 }
@@ -1657,7 +1658,7 @@ The server also rebuilds the index by itself when it was made with another embed
 
 Updates the index with issues added or changed since the last sync. Faster than a full rebuild: only issues changed since then are fetched and re-embedded.
 
-Only one server process syncs the shared index at a time. If another process (for example another client session) is already syncing, the tool returns an error ("A search index sync is already running") — try again once that sync has finished. A sync limited to `project_id` does not advance `last_synced_at`, so changes in other projects are still picked up by the next sync. If the index was made with another embedding model or version, the sync rebuilds it for all projects, even with `project_id`.
+Only one server process syncs the shared index at a time. If another process (for example another client session) is already syncing, the tool returns an error ("A search index sync is already running") — try again once that sync has finished. A sync limited to `project_id` removes nothing and does not advance `last_synced_at`, so changes in other projects are still picked up by the next sync. A sync over all projects also removes issues that were deleted in MantisBT or that the account can no longer see (`removed`); it lists the visible issue IDs for that, about 1 s for 7,800 issues. If the index was made with another embedding model or version, the sync rebuilds it for all projects, even with `project_id`.
 
 **Tool:** `rebuild_search_index`
 
@@ -1679,6 +1680,7 @@ Only one server process syncs the shared index at a time. If another process (fo
 {
   "indexed": 14,
   "skipped": 0,
+  "removed": 0,
   "total": 312,
   "duration_ms": 2104
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dpesch/mantisbt-mcp-server",
-  "version": "1.18.1",
+  "version": "1.18.3",
   "mcpName": "io.github.dpesch/mantisbt-mcp-server",
   "description": "MCP server for MantisBT REST API – read and manage bug tracker issues",
   "author": "Dominik Pesch",
@@ -53,12 +53,17 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.4",
-    "@vitest/coverage-v8": "^5.0.2",
+    "@vitest/coverage-v8": "^5.1.0",
     "tsx": "^4.23.15",
     "typescript": "^5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.1.0"
   },
   "engines": {
     "node": ">=22"
+  },
+  "allowScripts": {
+    "esbuild@0.28.2": true,
+    "onnxruntime-node@1.30.0": true,
+    "protobufjs@7.6.6": true
   }
 }

package/server.json

@@ -3,12 +3,12 @@
   "name": "io.github.dpesch/mantisbt-mcp-server",
   "title": "MantisBT MCP Server",
   "description": "MantisBT MCP server – manage issues, notes, files, tags, and relationships. With semantic search.",
-  "version": "1.18.1",
+  "version": "1.18.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dpesch/mantisbt-mcp-server",
-      "version": "1.18.1",
+      "version": "1.18.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -39,7 +39,7 @@
         },
         {
           "name": "MANTIS_CACHE_DIR",
-          "description": "Directory for the metadata cache. Defaults to ~/.cache/mantisbt-mcp",
+          "description": "Directory for the metadata cache. Defaults to ~/.cache/mantisbt-mcp; each base URL and API key gets its own subdirectory",
           "isRequired": false,
           "isSecret": false,
           "format": "filepath"
@@ -79,11 +79,19 @@
         },
         {
           "name": "MCP_HTTP_TOKEN",
-          "description": "Optional Bearer token to protect the /mcp endpoint when TRANSPORT=http",
+          "description": "Bearer token protecting the /mcp endpoint. Required when TRANSPORT=http; the server refuses to start without it",
           "isRequired": false,
           "isSecret": true,
           "format": "string"
         },
+        {
+          "name": "MCP_HTTP_MAX_BODY_SIZE",
+          "description": "Largest accepted /mcp request body in bytes when TRANSPORT=http. Default: 67108864 (64 MB)",
+          "isRequired": false,
+          "isSecret": false,
+          "format": "number",
+          "default": "67108864"
+        },
         {
           "name": "MANTIS_SEARCH_ENABLED",
           "description": "Enable offline semantic search (requires ~80 MB model download on first use)",
@@ -103,7 +111,7 @@
         },
         {
           "name": "MANTIS_SEARCH_DIR",
-          "description": "Directory for the semantic search index. Defaults to ~/.cache/mantisbt-mcp/search",
+          "description": "Directory for the semantic search index. Defaults to the search subdirectory of the instance cache directory; when set, each base URL and API key gets its own subdirectory",
           "isRequired": false,
           "isSecret": false,
           "format": "filepath"