@ezmodo/mcp-server 0.13.4 → 0.13.5

package/http.js

@@ -101,7 +101,7 @@ export function protectedResourceMetadata() {
  * server without being told out of band.
  */
 function authenticateChallenge(error, description) {
-  const parts = [`Bearer realm="ezmodo-mcp"`, `resource_metadata="${METADATA_URL}"`];
+  const parts = ['Bearer realm="ezmodo-mcp"', `resource_metadata="${METADATA_URL}"`];
   if (error) parts.push(`error="${error}"`);
   if (description) parts.push(`error_description="${description}"`);
   return parts.join(', ');
@@ -169,7 +169,10 @@ async function handleMcpPost(req, res, requestId) {
   }
 
   // One server and transport per request — see the stateless note at the top.
-  const server = createServer();
+  // 'remote': excludes tools that operate on a local checkout, which do not
+  // exist here and whose git helpers shell out with caller-supplied arguments
+  // (#2614).
+  const server = createServer({ surface: 'remote' });
   const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
 
   // Closing on response end matters: without it every request leaks a transport

package/lib/create-server.js

@@ -25,21 +25,50 @@ import { HANDLERS } from '../handlers/index.js';
 import { PROMPTS, getPromptContent } from '../prompts/index.js';
 import { MCP_VERSION } from './version.js';
 import { getLogger } from './logger.js';
+import { isRemoteSafe } from './remote-tools.js';
 
-export function createServer() {
+/**
+ * @param {object} [options]
+ * @param {'local'|'remote'} [options.surface] Which tool surface to serve.
+ *   'local' (the default) is the full set, for stdio on a user's machine.
+ *   'remote' excludes tools that operate on the local filesystem or git — see
+ *   lib/remote-tools.js for why that is an allowlist and not a denylist.
+ */
+export function createServer({ surface = 'local' } = {}) {
   const log = getLogger();
 
+  // Filtered ONCE here rather than at each call site, so listing and dispatch
+  // cannot disagree. They must agree: filtering only tools/list would leave
+  // every excluded handler dispatchable by a client that guesses the name,
+  // which is the failure this whole module exists to prevent.
+  const tools = surface === 'remote' ? TOOLS.filter((tool) => isRemoteSafe(tool.name)) : TOOLS;
+  const available = new Set(tools.map((tool) => tool.name));
+
   const server = new Server(
     { name: 'ezmodo-mcp-server', version: MCP_VERSION },
     { capabilities: { tools: {}, prompts: {} } }
   );
 
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
 
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
-    const handler = HANDLERS[name];
 
+    // Checked before the handler lookup: a tool excluded from this surface is
+    // refused even though HANDLERS still contains it.
+    if (!available.has(name)) {
+      const handler = HANDLERS[name];
+      if (handler) {
+        log.warn('Refused a tool not served on this surface', { tool: name, surface });
+        throw new Error(
+          `Tool "${name}" is not available over this connection. It operates on a local ` +
+            'checkout and is served only by the local (stdio) MCP server.'
+        );
+      }
+      throw new Error(`Unknown tool: ${name}`);
+    }
+
+    const handler = HANDLERS[name];
     if (!handler) {
       throw new Error(`Unknown tool: ${name}`);
     }

package/lib/remote-tools.js

@@ -0,0 +1,151 @@
+/**
+ * Which tools may be served over the REMOTE transport (#2614).
+ *
+ * The HTTP entry point and the stdio entry point deliberately build the same
+ * server (lib/create-server.js) so their tool surfaces cannot drift. That is
+ * right for almost everything — and wrong for the handful of tools that are
+ * not network operations at all.
+ *
+ * `detect_git_repository`, `manage_worktree`, `rebuild_manifest` and friends
+ * read and write the LOCAL machine: the working directory, `.ezmodo/`, the git
+ * repository. Over stdio that is the whole point — the server runs inside the
+ * user's checkout, at their request, as them. On a hosted server there is no
+ * checkout, so at best they fail confusingly.
+ *
+ * At worst they are dangerous. lib/git-helpers.js `execGit` passes its command
+ * to `execSync` — a shell — and callers interpolate tool arguments into it:
+ *
+ *     execGit(`git branch ${branchName} ${baseBranch}`, repoPath)
+ *
+ * On a user's own machine the blast radius is their own shell, which is why
+ * this has been tolerable. Reachable over the internet it is arbitrary command
+ * execution in the container. So these tools are not hardened for remote use —
+ * they are not served remotely at all, because they have no meaning there and
+ * hardening would leave a shell-executing surface exposed for no benefit.
+ *
+ * ── The list is an ALLOWLIST, deliberately ───────────────────────────────────
+ *
+ * A denylist would mean every tool added from now on is exposed remotely by
+ * default, and the mistake would be invisible: the tool simply works, until one
+ * of them turns out to touch the filesystem. Listing what is safe means a new
+ * tool is refused remotely until someone decides otherwise, and
+ * remote-tools.test.js fails loudly when a tool is unclassified rather than
+ * letting it through.
+ *
+ * Note some tools do local work as a SIDE EFFECT and are still fine here:
+ * manage_task writes `.ezmodo/active-session.json`, and lib/active-session.js
+ * already skips that when no config directory exists — which is exactly the
+ * case in a container. Likewise get_context and resolve_concepts read a local
+ * manifest when there is one and fall back to the API when there is not.
+ */
+
+/** Tools that operate on the local machine and are never served remotely. */
+export const LOCAL_ONLY_TOOLS = Object.freeze([
+  'detect_git_repository',
+  'get_current_project_context',
+  'initialize_project_context',
+  'list_project_worktrees',
+  'manage_worktree',
+  'rebuild_manifest',
+]);
+
+/** Tools safe to serve over the remote transport. */
+export const REMOTE_SAFE_TOOLS = Object.freeze([
+  'accept_agent_suggestion',
+  'configure_agent',
+  'create_tasks',
+  'delete_attachment',
+  'estimate_task',
+  'evaluate_feature_flag',
+  'get_access',
+  'get_ai_insights',
+  'get_attachment_url',
+  'get_catalog',
+  'get_catalog_diff',
+  'get_context',
+  'get_decision',
+  'get_design',
+  'get_design_system',
+  'get_document',
+  'get_document_template',
+  'get_epic',
+  'get_feature',
+  'get_feature_flag',
+  'get_goal',
+  'get_graph',
+  'get_manifest_schema',
+  'get_milestone',
+  'get_org_areas',
+  'get_organization',
+  'get_project',
+  'get_project_changes',
+  'get_project_story',
+  'get_task',
+  'get_testing_summary',
+  'infer_dependencies',
+  'list_agent_suggestions',
+  'list_attachments',
+  'list_catalog_items',
+  'list_catalogs',
+  'list_components',
+  'list_designs',
+  'list_epics',
+  'list_facts',
+  'list_feature_flags',
+  'list_folders',
+  'list_links',
+  'list_notifications',
+  'list_org_documents',
+  'list_repositories',
+  'list_tags',
+  'list_test_cases',
+  'list_test_suites',
+  'list_todos',
+  'list_watched',
+  'manage_access',
+  'manage_catalog',
+  'manage_component',
+  'manage_decision',
+  'manage_design',
+  'manage_document',
+  'manage_document_template',
+  'manage_environment',
+  'manage_epic',
+  'manage_fact',
+  'manage_feature',
+  'manage_feature_flag',
+  'manage_folder',
+  'manage_goal',
+  'manage_link',
+  'manage_milestone',
+  'manage_project',
+  'manage_pull_request',
+  'manage_recurring_task',
+  'manage_tag',
+  'manage_task',
+  'manage_team',
+  'manage_test_case',
+  'manage_test_suite',
+  'manage_todo',
+  'manage_watch',
+  'manage_work_template',
+  'preview_links',
+  'reject_agent_suggestion',
+  'report_untracked_work',
+  'resolve_concepts',
+  'resolve_link_suggestions',
+  'resolve_links',
+  'run_agent_now',
+  'search_epics',
+  'search_features',
+  'search_tasks',
+  'update_manifest_entries',
+  'validate_manifest',
+]);
+
+const remoteSafe = new Set(REMOTE_SAFE_TOOLS);
+
+/** Whether a tool may be served over the remote transport. */
+export function isRemoteSafe(toolName) {
+  return remoteSafe.has(toolName);
+}

package/lib/version.js

@@ -7,4 +7,4 @@
  *
  * Update this when bumping the version in package.json.
  */
-export const MCP_VERSION = '0.13.4';
+export const MCP_VERSION = '0.13.5';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ezmodo/mcp-server",
-  "version": "0.13.4",
+  "version": "0.13.5",
   "description": "MCP server for ezmodo - AI-first project management",
   "main": "index.js",
   "type": "module",