@ferrlabs/mcp 6.5.0 → 6.5.5

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { runMcp } from '@ferrlabs/mcp-core';
+import { runMcp, readPackageVersion } from '@ferrlabs/mcp-core';
 import { registerStatsTools } from './tools/stats.js';
 import { registerTokenTools } from './tools/tokens.js';
 import { registerOrgsTools } from './tools/orgs.js';
@@ -11,7 +11,7 @@ import { registerSubscriptionsTools } from './tools/subscriptions.js';
 import { registerDocsTools } from './tools/docs.js';
 runMcp({
     name: 'ferrlabs',
-    version: '5.2.5',
+    version: readPackageVersion(import.meta.url),
     register: (server) => {
         registerStatsTools(server);
         registerTokenTools(server);

package/dist/tools/__tests__/docs.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=docs.test.d.ts.map

package/dist/tools/__tests__/docs.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.test.d.ts","sourceRoot":"","sources":["../../../src/tools/__tests__/docs.test.ts"],"names":[],"mappings":""}

package/dist/tools/__tests__/docs.test.js

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { buildDocUrl, fetchDoc } from '../docs.js';
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+describe('buildDocUrl', () => {
+    it('maps a product and slug to the allowlisted host', () => {
+        expect(buildDocUrl('ferrflow', 'docs/getting-started')).toBe('https://ferrflow.com/docs/getting-started');
+        expect(buildDocUrl('ferrlabs')).toBe('https://ferrlabs.com/');
+    });
+    it('rejects slugs containing a scheme, traversal, or a leading //', () => {
+        expect(() => buildDocUrl('ferrflow', 'https://evil.test')).toThrow(/invalid slug/);
+        expect(() => buildDocUrl('ferrflow', '../../etc/passwd')).toThrow(/invalid slug/);
+        expect(() => buildDocUrl('ferrflow', '//evil.test/x')).toThrow(/invalid slug/);
+    });
+    it('rejects an unknown product', () => {
+        expect(() => buildDocUrl('notaproduct')).toThrow(/unknown product/);
+    });
+});
+describe('fetchDoc', () => {
+    function makeResponse(status, body = '') {
+        return {
+            ok: status >= 200 && status < 300,
+            status,
+            text: () => Promise.resolve(body),
+        };
+    }
+    it('does not follow a redirect off the allowlisted host', async () => {
+        const fetchMock = vi.fn().mockResolvedValue(makeResponse(302));
+        vi.stubGlobal('fetch', fetchMock);
+        await expect(fetchDoc('ferrgrowth', 'r')).rejects.toThrow(/refused to follow redirect/);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock.mock.calls[0][1]).toMatchObject({ redirect: 'manual' });
+    });
+    it('returns stripped text on a 200', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(makeResponse(200, '<main><p>hello world</p></main>')));
+        const out = await fetchDoc('ferrflow', 'pricing');
+        expect(out).toContain('# https://ferrflow.com/pricing');
+        expect(out).toContain('hello world');
+    });
+});

package/dist/tools/docs.d.ts

@@ -1,3 +1,5 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function buildDocUrl(product: string, slug?: string): string;
+export declare function fetchDoc(product: string, slug?: string): Promise<string>;
 export declare function registerDocsTools(server: McpServer): void;
 //# sourceMappingURL=docs.d.ts.map

package/dist/tools/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/tools/docs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiCpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA4ClD"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/tools/docs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAkCpE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAclE;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B9E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QAyBlD"}

package/dist/tools/docs.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { fetchWithTimeout } from '@ferrlabs/mcp-core';
 const PRODUCT_HOSTS = {
     ferrlabs: 'https://ferrlabs.com',
     ferrflow: 'https://ferrflow.com',
@@ -26,6 +27,40 @@ function stripHtml(html) {
         .replace(/\n{3,}/g, '\n\n')
         .trim();
 }
+export function buildDocUrl(product, slug) {
+    const host = PRODUCT_HOSTS[product];
+    if (!host) {
+        throw new Error(`fetch_docs: unknown product '${product}'`);
+    }
+    if (slug !== undefined) {
+        if (slug.includes('://') || slug.includes('..') || slug.startsWith('//')) {
+            throw new Error(`fetch_docs: invalid slug '${slug}' — must be a relative path without '://', '..', or a leading '//'`);
+        }
+    }
+    const path = slug ? `/${slug.replace(/^\//, '')}` : '/';
+    return `${host}${path}`;
+}
+export async function fetchDoc(product, slug) {
+    const url = buildDocUrl(product, slug);
+    const res = await fetchWithTimeout(url, {
+        redirect: 'manual',
+        headers: {
+            'User-Agent': 'ferrlabs-mcp',
+            Accept: 'text/html,text/markdown,text/plain',
+        },
+    });
+    if (res.status >= 300 && res.status < 400) {
+        throw new Error(`fetch_docs ${url}: refused to follow redirect (HTTP ${res.status}) off the allowlisted host`);
+    }
+    if (!res.ok) {
+        throw new Error(`fetch_docs ${url}: HTTP ${res.status}`);
+    }
+    const raw = await res.text();
+    const text = stripHtml(raw);
+    const truncated = text.length > MAX_BYTES;
+    const out = truncated ? `${text.slice(0, MAX_BYTES)}\n\n[truncated]` : text;
+    return `# ${url}\n\n${out}`;
+}
 export function registerDocsTools(server) {
     server.tool('fetch_docs', 'Fetch documentation or marketing copy from a FerrLabs product website (ferrflow, ferrvault, ferrtrack, ferrgrowth, ferrfleet, ferrlens, or ferrlabs holding). Returns the page text content, HTML stripped.', {
         product: productEnum.describe('FerrLabs product whose docs to fetch'),
@@ -34,27 +69,12 @@ export function registerDocsTools(server) {
             .optional()
             .describe("Path on the product site, e.g. 'docs/getting-started' or 'pricing'. Omit for the homepage."),
     }, async ({ product, slug }) => {
-        const host = PRODUCT_HOSTS[product];
-        const path = slug ? `/${slug.replace(/^\//, '')}` : '/';
-        const url = `${host}${path}`;
-        const res = await fetch(url, {
-            headers: {
-                'User-Agent': 'ferrlabs-mcp/4.0.0',
-                Accept: 'text/html,text/markdown,text/plain',
-            },
-        });
-        if (!res.ok) {
-            throw new Error(`fetch_docs ${url}: HTTP ${res.status}`);
-        }
-        const raw = await res.text();
-        const text = stripHtml(raw);
-        const truncated = text.length > MAX_BYTES;
-        const out = truncated ? `${text.slice(0, MAX_BYTES)}\n\n[truncated]` : text;
+        const text = await fetchDoc(product, slug);
         return {
             content: [
                 {
                     type: 'text',
-                    text: `# ${url}\n\n${out}`,
+                    text,
                 },
             ],
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ferrlabs/mcp",
-  "version": "6.5.0",
+  "version": "6.5.5",
   "description": "Model Context Protocol server for the FerrLabs platform (orgs, projects, subscriptions, docs, tokens, public stats)",
   "license": "MPL-2.0",
   "type": "module",
@@ -23,7 +23,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "zod": "^4.3.6",
-    "@ferrlabs/mcp-core": "^6.5.0"
+    "@ferrlabs/mcp-core": "^6.5.5"
   },
   "publishConfig": {
     "access": "public"