@evantahler/mcpx 0.18.3 → 0.18.6

package/package.json

@@ -1,65 +1,65 @@
 {
-  "name": "@evantahler/mcpx",
-  "version": "0.18.3",
-  "description": "A command-line interface for MCP servers. curl for MCP.",
-  "type": "module",
-  "exports": {
-    ".": "./src/sdk.ts",
-    "./cli": "./src/cli.ts"
-  },
-  "main": "./src/sdk.ts",
-  "types": "./src/sdk.ts",
-  "bin": {
-    "mcpx": "./src/cli.ts"
-  },
-  "files": [
-    "src",
-    ".claude",
-    ".cursor",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "dev": "bun run src/cli.ts",
-    "test": "bun test",
-    "test:e2e": "bun test test/integration/remote-server.test.ts",
-    "lint": "prettier --check . && tsc --noEmit",
-    "format": "prettier --write .",
-    "build": "bun build --compile --minify --sourcemap ./src/cli.ts --outfile dist/mcpx"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/evantahler/mcpx.git"
-  },
-  "keywords": [
-    "mcp",
-    "cli",
-    "model-context-protocol",
-    "ai",
-    "llm",
-    "tools"
-  ],
-  "author": "Evan Tahler",
-  "license": "MIT",
-  "dependencies": {
-    "@huggingface/transformers": "^3.8.1",
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "ajv": "^8.18.0",
-    "ansis": "^4.2.0",
-    "commander": "^14.0.3",
-    "nanospinner": "^1.2.2",
-    "picomatch": "^4.0.3",
-    "@types/picomatch": "^4.0.2"
-  },
-  "devDependencies": {
-    "@types/bun": "latest",
-    "prettier": "^3.8.1",
-    "typescript": "^5"
-  },
-  "peerDependencies": {
-    "typescript": "^5"
-  }
+	"name": "@evantahler/mcpx",
+	"version": "0.18.6",
+	"description": "A command-line interface for MCP servers. curl for MCP.",
+	"type": "module",
+	"exports": {
+		".": "./src/sdk.ts",
+		"./cli": "./src/cli.ts"
+	},
+	"main": "./src/sdk.ts",
+	"types": "./src/sdk.ts",
+	"bin": {
+		"mcpx": "./src/cli.ts"
+	},
+	"files": [
+		"src",
+		".claude",
+		".cursor",
+		"README.md",
+		"LICENSE"
+	],
+	"scripts": {
+		"dev": "bun run src/cli.ts",
+		"test": "bun test",
+		"test:e2e": "bun test test/integration/remote-server.test.ts",
+		"lint": "biome ci . && tsc --noEmit",
+		"format": "biome check --write .",
+		"build": "bun build --compile --minify --sourcemap ./src/cli.ts --outfile dist/mcpx"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/evantahler/mcpx.git"
+	},
+	"keywords": [
+		"mcp",
+		"cli",
+		"model-context-protocol",
+		"ai",
+		"llm",
+		"tools"
+	],
+	"author": "Evan Tahler",
+	"license": "MIT",
+	"dependencies": {
+		"@huggingface/transformers": "^3.8.1",
+		"@modelcontextprotocol/sdk": "^1.27.1",
+		"ajv": "^8.18.0",
+		"ansis": "^4.2.0",
+		"commander": "^14.0.3",
+		"nanospinner": "^1.2.2",
+		"picomatch": "^4.0.3",
+		"@types/picomatch": "^4.0.2"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2.4.11",
+		"@types/bun": "latest",
+		"typescript": "^5"
+	},
+	"peerDependencies": {
+		"typescript": "^5"
+	}
 }

package/src/cli.ts

@@ -1,53 +1,52 @@
 #!/usr/bin/env bun
 
+import { bold, cyan, dim, green, yellow } from "ansis";
 import { program } from "commander";
-import { bold, cyan, yellow, dim, green } from "ansis";
-import { registerListCommand } from "./commands/list.ts";
-import { registerInfoCommand } from "./commands/info.ts";
-import { registerSearchCommand } from "./commands/search.ts";
-import { registerExecCommand } from "./commands/exec.ts";
+import pkg from "../package.json";
+import { registerAddCommand } from "./commands/add.ts";
+import { registerAllowCommand } from "./commands/allow.ts";
 import { registerAuthCommand, registerDeauthCommand } from "./commands/auth.ts";
+import { registerCheckUpdateCommand } from "./commands/check-update.ts";
+import { registerDenyCommand } from "./commands/deny.ts";
+import { registerExecCommand } from "./commands/exec.ts";
 import { registerIndexCommand } from "./commands/index.ts";
-import { registerAddCommand } from "./commands/add.ts";
-import { registerRemoveCommand } from "./commands/remove.ts";
-import { registerSkillCommand } from "./commands/skill.ts";
+import { registerInfoCommand } from "./commands/info.ts";
+import { registerListCommand } from "./commands/list.ts";
 import { registerPingCommand } from "./commands/ping.ts";
-import { registerResourceCommand } from "./commands/resource.ts";
 import { registerPromptCommand } from "./commands/prompt.ts";
+import { registerRemoveCommand } from "./commands/remove.ts";
+import { registerResourceCommand } from "./commands/resource.ts";
+import { registerSearchCommand } from "./commands/search.ts";
 import { registerServersCommand } from "./commands/servers.ts";
+import { registerSkillCommand } from "./commands/skill.ts";
 import { registerTaskCommand } from "./commands/task.ts";
-import { registerAllowCommand } from "./commands/allow.ts";
-import { registerDenyCommand } from "./commands/deny.ts";
-import { registerCheckUpdateCommand } from "./commands/check-update.ts";
 import { registerUpgradeCommand } from "./commands/upgrade.ts";
 import { maybeCheckForUpdate } from "./update/background.ts";
 
-import pkg from "../package.json";
-
 program
-  .name("mcpx")
-  .description("A command-line interface for MCP servers. curl for MCP.")
-  .version(pkg.version)
-  .option("-c, --config <path>", "config directory path")
-  .option("-d, --with-descriptions", "include tool descriptions in output")
-  .option("-j, --json", "force JSON output")
-  .option("-F, --format <format>", "output format (json, markdown)")
-  .option("-v, --verbose", "show HTTP details and JSON-RPC protocol messages")
-  .option("-S, --show-secrets", "show full auth tokens in verbose output")
-  .option("-N, --no-interactive", "decline server elicitation requests")
-  .option(
-    "-l, --log-level <level>",
-    "minimum server log level (debug|info|notice|warning|error|critical|alert|emergency)",
-    "warning",
-  );
+	.name("mcpx")
+	.description("A command-line interface for MCP servers. curl for MCP.")
+	.version(pkg.version)
+	.option("-c, --config <path>", "config directory path")
+	.option("-d, --with-descriptions", "include tool descriptions in output")
+	.option("-j, --json", "force JSON output")
+	.option("-F, --format <format>", "output format (json, markdown)")
+	.option("-v, --verbose", "show HTTP details and JSON-RPC protocol messages")
+	.option("-S, --show-secrets", "show full auth tokens in verbose output")
+	.option("-N, --no-interactive", "decline server elicitation requests")
+	.option(
+		"-l, --log-level <level>",
+		"minimum server log level (debug|info|notice|warning|error|critical|alert|emergency)",
+		"warning",
+	);
 
 program.configureHelp({
-  styleTitle: (str) => bold(str),
-  styleCommandText: (str) => cyan(str),
-  styleSubcommandText: (str) => cyan(str),
-  styleOptionText: (str) => yellow(str),
-  styleArgumentText: (str) => green(str),
-  styleDescriptionText: (str) => dim(str),
+	styleTitle: (str) => bold(str),
+	styleCommandText: (str) => cyan(str),
+	styleSubcommandText: (str) => cyan(str),
+	styleOptionText: (str) => yellow(str),
+	styleArgumentText: (str) => green(str),
+	styleDescriptionText: (str) => dim(str),
 });
 
 registerListCommand(program);
@@ -75,25 +74,18 @@ const knownCommands = new Set(program.commands.map((c) => c.name()));
 const cliArgs = process.argv.slice(2);
 let firstCommand: string | undefined;
 for (let i = 0; i < cliArgs.length; i++) {
-  const a = cliArgs[i]!;
-  if (
-    a === "-c" ||
-    a === "--config" ||
-    a === "-l" ||
-    a === "--log-level" ||
-    a === "-F" ||
-    a === "--format"
-  ) {
-    i++; // skip the option's value argument
-    continue;
-  }
-  if (a.startsWith("-")) continue;
-  firstCommand = a;
-  break;
+	const a = cliArgs[i]!;
+	if (a === "-c" || a === "--config" || a === "-l" || a === "--log-level" || a === "-F" || a === "--format") {
+		i++; // skip the option's value argument
+		continue;
+	}
+	if (a.startsWith("-")) continue;
+	firstCommand = a;
+	break;
 }
 if (firstCommand && !knownCommands.has(firstCommand)) {
-  console.error(`error: unknown command '${firstCommand}'. See 'mcpx --help'.`);
-  process.exit(1);
+	console.error(`error: unknown command '${firstCommand}'. See 'mcpx --help'.`);
+	process.exit(1);
 }
 
 // Fire-and-forget background update check
@@ -103,6 +95,6 @@ program.parse();
 
 // Print update notice after command output completes
 process.on("beforeExit", async () => {
-  const notice = await updateNotice;
-  if (notice) process.stderr.write(notice);
+	const notice = await updateNotice;
+	if (notice) process.stderr.write(notice);
 });

package/src/client/browser.ts

@@ -1,24 +1,45 @@
-import { exec } from "child_process";
+import { execFile } from "node:child_process";
 
 /**
  * Open a URL in the default browser (macOS/Windows/Linux).
  * Falls back to printing the URL to stderr if no browser is available
  * (e.g., headless servers, Docker containers).
+ *
+ * Uses execFile (not exec) to avoid shell injection via malicious URLs.
  */
 export function openBrowser(url: string): Promise<void> {
-  const cmd =
-    process.platform === "darwin"
-      ? `open "${url}"`
-      : process.platform === "win32"
-        ? `start "${url}"`
-        : `xdg-open "${url}"`;
+	// Validate URL scheme to prevent non-HTTP protocols
+	try {
+		const parsed = new URL(url);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+			process.stderr.write(`Refusing to open non-HTTP URL: ${url}\n`);
+			return Promise.resolve();
+		}
+	} catch {
+		process.stderr.write(`Invalid URL: ${url}\n`);
+		return Promise.resolve();
+	}
 
-  return new Promise((resolve) => {
-    exec(cmd, (err) => {
-      if (err) {
-        process.stderr.write(`Could not open browser. Please visit:\n  ${url}\n`);
-      }
-      resolve();
-    });
-  });
+	let cmd: string;
+	let args: string[];
+
+	if (process.platform === "darwin") {
+		cmd = "open";
+		args = [url];
+	} else if (process.platform === "win32") {
+		cmd = "cmd";
+		args = ["/c", "start", "", url];
+	} else {
+		cmd = "xdg-open";
+		args = [url];
+	}
+
+	return new Promise((resolve) => {
+		execFile(cmd, args, (err) => {
+			if (err) {
+				process.stderr.write(`Could not open browser. Please visit:\n  ${url}\n`);
+			}
+			resolve();
+		});
+	});
 }

package/src/client/debug-fetch.ts

@@ -4,78 +4,86 @@ import { logger } from "../output/logger.ts";
 export type FetchLike = (url: string | URL, init?: RequestInit) => Promise<Response>;
 
 export function createDebugFetch(showSecrets: boolean): FetchLike {
-  const isTTY = process.stderr.isTTY ?? false;
-  const fmt = (s: string) => (isTTY ? dim(s) : s);
+	const isTTY = process.stderr.isTTY ?? false;
+	const fmt = (s: string) => (isTTY ? dim(s) : s);
 
-  return async (url, init) => {
-    const start = performance.now();
+	return async (url, init) => {
+		const start = performance.now();
 
-    // Request
-    log("");
-    log(fmt(`> ${init?.method ?? "GET"} ${url}`));
-    logHeaders(">", init?.headers, fmt, showSecrets);
-    log(fmt(">"));
-    if (init?.body) {
-      logBody(String(init.body), fmt);
-    }
+		// Request
+		log("");
+		log(fmt(`> ${init?.method ?? "GET"} ${url}`));
+		logHeaders(">", init?.headers, fmt, showSecrets);
+		log(fmt(">"));
+		if (init?.body) {
+			logBody(String(init.body), fmt);
+		}
 
-    const response = await fetch(url, init);
-    const elapsed = Math.round(performance.now() - start);
+		const response = await fetch(url, init);
+		const elapsed = Math.round(performance.now() - start);
 
-    // Response
-    log(fmt(`< ${response.status} ${response.statusText} (${elapsed}ms)`));
-    logHeaders("<", response.headers, fmt, showSecrets);
-    log(fmt("<"));
-    log("");
+		// Response
+		log(fmt(`< ${response.status} ${response.statusText} (${elapsed}ms)`));
+		logHeaders("<", response.headers, fmt, showSecrets);
+		log(fmt("<"));
+		log("");
 
-    return response;
-  };
+		return response;
+	};
 }
 
 function log(line: string) {
-  logger.writeRaw(line + "\n");
+	logger.writeRaw(`${line}\n`);
 }
 
-function logHeaders(
-  prefix: string,
-  headers: RequestInit["headers"],
-  fmt: (s: string) => string,
-  showSecrets: boolean,
-) {
-  if (!headers) return;
+function logHeaders(prefix: string, headers: RequestInit["headers"], fmt: (s: string) => string, showSecrets: boolean) {
+	if (!headers) return;
 
-  const format = (key: string, value: string) =>
-    fmt(`${prefix} ${key}: ${showSecrets ? value : maskSensitive(key, value)}`);
+	const format = (key: string, value: string) =>
+		fmt(`${prefix} ${key}: ${showSecrets ? value : maskSensitive(key, value)}`);
 
-  if (headers instanceof Headers) {
-    headers.forEach((value, key) => log(format(key, value)));
-  } else if (Array.isArray(headers)) {
-    for (const pair of headers) {
-      log(format(String(pair[0]), String(pair[1])));
-    }
-  } else {
-    for (const [key, value] of Object.entries(headers as Record<string, string>)) {
-      log(format(key, value));
-    }
-  }
+	if (headers instanceof Headers) {
+		headers.forEach((value, key) => {
+			log(format(key, value));
+		});
+	} else if (Array.isArray(headers)) {
+		for (const pair of headers) {
+			log(format(String(pair[0]), String(pair[1])));
+		}
+	} else {
+		for (const [key, value] of Object.entries(headers as Record<string, string>)) {
+			log(format(key, value));
+		}
+	}
 }
 
 function logBody(body: string, fmt: (s: string) => string) {
-  try {
-    const formatted = JSON.stringify(JSON.parse(body), null, 2);
-    for (const line of formatted.split("\n")) {
-      log(fmt(line));
-    }
-  } catch {
-    log(fmt(body));
-  }
+	try {
+		const formatted = JSON.stringify(JSON.parse(body), null, 2);
+		for (const line of formatted.split("\n")) {
+			log(fmt(line));
+		}
+	} catch {
+		log(fmt(body));
+	}
 }
 
+const SENSITIVE_HEADERS = new Set([
+	"authorization",
+	"cookie",
+	"set-cookie",
+	"proxy-authorization",
+	"x-api-key",
+	"api-key",
+	"x-auth-token",
+	"x-token",
+	"token",
+]);
+
 export function maskSensitive(key: string, value: string): string {
-  const lower = key.toLowerCase();
-  if (lower === "authorization" || lower === "cookie" || lower === "set-cookie") {
-    if (value.length <= 12) return value;
-    return value.slice(0, 12) + "...";
-  }
-  return value;
+	if (SENSITIVE_HEADERS.has(key.toLowerCase())) {
+		if (value.length <= 6) return "***";
+		return `${value.slice(0, 4)}...`;
+	}
+	return value;
 }