@ffschrattenecker/tm1-mcp-server 7.0.2 → 8.1.0

package/CHANGELOG.md

@@ -7,6 +7,104 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.1.0] - 2026-09-28
+
+### Added
+
+- Connection secrets can live in the OS keychain instead of the `.env`: set `TM1_SECRETS=keychain`
+  in a connection folder and store the secrets with `npx tm1-mcp-server secrets set|list|delete`,
+  or move an existing `.env` over with `secrets migrate <connection>`. The keychain is read the
+  first time a connection is used, never when connections are listed. At startup the server warns
+  about connections that still keep plaintext secrets. See
+  [docs/CONFIGURATION.md](docs/CONFIGURATION.md#secrets-in-the-os-keychain--tm1_secretskeychain).
+
+### Changed
+
+- **`tm1_clear_cube` no longer declares `dimensions`/`tuples`.** They are dropped like any
+  unknown input, so an old call that still sends them empties the whole cube once `confirm`
+  matches. *Action:* remove them from stored calls; a partial clear is a TI process.
+
+## [8.0.0] - 2026-09-28
+
+Merged upstream tm1-mcp-server 5.0.0 (flameY3T1, 2026-09-27). Where both lines had
+built the same thing, upstream's behaviour was taken; fork-only features (connection
+registry, `tm1_delete_elements`, rules patch mode, batch attribute writes, the
+response-size guard, the per-connection caches) are unchanged.
+
+### Breaking
+
+- **`tm1_move_element` is removed.** It attached the element to the new parent but left it
+  under the old one. *Action:* use `tm1_update_element` on both parents' `components`.
+- **`tm1_clear_cube` takes only `cubeName` and `confirm`** (plus `timeoutMs`). The
+  `dimensions` and `tuples` inputs advertised a region clear the server cannot do: the only
+  route that works is a TI with `CubeClearData`, which empties the whole cube. A call that
+  still carries them is refused and nothing is cleared. *Action:* use a TI process for a
+  partial clear.
+- **`tm1_write_cells` refuses a consolidated coordinate.** Every coordinate is checked before
+  anything is sent; write the leaves or run a TI process.
+- **`tm1_set_cube_rules` fails with `VALIDATION_ERROR` when the preflight finds syntax
+  errors** (the errors are in `details`), instead of returning an `isError` payload. The check
+  still runs on the full resulting text, so an `edits` patch is checked as installed.
+  *Action:* `preflight: false` writes the text as is.
+- **Exported files hold the process code unmasked.** `'***'` in written files broke the
+  round-trip; `maskSecrets` now affects only the inline response of
+  `tm1_export_process_to_git`. Keep such files out of version control if the code contains
+  password literals.
+- **An unknown `TM1_MCP_TRANSPORT` or `TM1_LOG_LEVEL` stops the server at startup** instead of
+  falling back silently. Both are server-wide; a bad value in one connection's `.env` cannot
+  occur because folders may not set them.
+- **Unknown attributes are `NOT_FOUND`** in `tm1_update_element_attribute_value` (was
+  `VALIDATION_ERROR`), and attribute names match ignoring case and spaces, as TM1 does.
+
+### Added
+
+- **The five file tools reach the Applications tree** via `container: "applications"`.
+- **`tm1_get_file_content` takes `encoding: "base64"`** for binary files. Its `maxBytes` default
+  is 48 KB there (64 KB for text), so a default read fits the 80k response limit.
+- **Subset tools take `isPrivate`.**
+- **`tm1_upsert_process` takes `variablesUIData`** and warns when the kept column layout no
+  longer fits the variables.
+- **`tm1_clear_cube` takes `timeoutMs`** (1 s to 1 h).
+- **Feeder and cell-trace tools address alternate hierarchies** with `Hierarchy:Element`.
+- **The attribute value tools take `hierarchyName`** for alternate hierarchies (single element
+  and `updates[]`).
+
+### Fixed
+
+- **A rejected login is never retried.** A 401/403 on login latches for that connection, so
+  wrong credentials no longer lock the account; fix the `.env` and restart.
+- **MCP SDK 1.30.1**; `fast-uri` out of the vulnerable range; `npm run verify` runs
+  `npm audit` first.
+- **The ReDoS guard rejects repeated alternations** such as `^(\w|\w)*!$`.
+- **The HTTP transport caps a request body at 64 MB** (413) and accepts `Host: localhost:<port>`
+  and `[::1]:<port>`.
+- **A v12 connection no longer demands `TM1_PASSWORD`** for auth modes that never send one.
+- **A TM1 request can wait longer than five minutes**; `timeoutMs` is the only limit.
+- **`tm1_write_cells` no longer writes when its own pre-check failed.**
+- **`tm1_check_writable_coords` understands `[Dimension].[Hierarchy].[Element]`** and looks in
+  the hierarchy the write would hit.
+- **`fetchAll` and `limit: 0` on `tm1_execute_mdx` and `tm1_get_view` stop at 5000 cells.**
+- **`tm1_check_cube_rule` returns syntax errors as a normal result**, not as a tool error.
+- **`tm1_clear_cube` tells the truth on a timeout**: the clear finishes on the server.
+- **`tm1_update_subset` can change the element list** (replaces, in order).
+- **`tm1_get_descendants` and `tm1_get_ancestors` load only the subtree**, and `leavesOnly`
+  no longer returns empty consolidations.
+- **`tm1_update_element` reports type conversions.**
+- **Process imports remove what the source no longer has** (parameters, variables, data
+  source); a `.pro` round trip keeps trailing whitespace.
+- **Process analysis reads variable names with `.`, `$`, `%` and backtick, and `;;` inside a
+  string literal.**
+- **Both diff tools compare the delimiter type and the ODBC unicode flag.**
+- **`tm1_list_error_logs` reads v12 log names**, and `groupBy: "process"` passes schema checks.
+- **`tm1_list_clients` and `tm1_list_groups` show names in markdown.**
+- **`tm1_check_v12_readiness` gives the right reason for `SetODBCUnicodeInterface`.**
+- **Seven tools no longer claim to be v11-only**, among them `tm1_import_pro_file` and
+  `tm1_install_pro_bundle`.
+- **Corrected descriptions** of `tm1_unload_cube`, `tm1_clear_cube`, `tm1_delete_hierarchy`,
+  `tm1_get_cube_stats` and `tm1_get_transaction_log`.
+- **The wire contracts were re-recorded against 11.8** upstream and merged with the fork's
+  own recordings; the recorder now merges by default (`--replace` starts over).
+
 ## [7.0.2] - 2026-09-27
 
 ### Fixed
@@ -1324,7 +1422,9 @@ Initial public release.
 - Quality gates: strict typecheck, ESLint, `lint:no-flat-api`,
   annotation-coverage, and tool-registration wiring.
 
-[Unreleased]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v7.0.2...HEAD
+[Unreleased]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v8.1.0...HEAD
+[8.1.0]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v8.0.0...v8.1.0
+[8.0.0]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v7.0.2...v8.0.0
 [7.0.2]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v7.0.1...v7.0.2
 [7.0.1]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v7.0.0...v7.0.1
 [7.0.0]: https://github.com/ffschrattenecker/tm1-mcp-server/compare/v6.1.1...v7.0.0

package/README.md

@@ -18,7 +18,7 @@ published as `@ffschrattenecker/tm1-mcp-server`. The command is still `tm1-mcp-s
 
 ## Features
 
-112 tools across 12 categories — every one listed in
+111 tools across 12 categories — every one listed in
 [docs/TOOLS.md](docs/TOOLS.md), with working JSON payloads in
 [docs/EXAMPLES.md](docs/EXAMPLES.md). Past plain CRUD over the REST API:
 
@@ -45,7 +45,7 @@ published as `@ffschrattenecker/tm1-mcp-server`. The command is still `tm1-mcp-s
   in chat, plus five starting-point prompts.
 
 > **Token tip:** every registered tool's name + input schema costs context on
-> *each* turn, so exposing all 114 is wasteful when a session needs a slice.
+> *each* turn, so exposing all 113 is wasteful when a session needs a slice.
 > Narrow the surface with your client's tool filter; `TM1_MODE=readonly` already
 > trims it to read-only tools.
 
@@ -171,7 +171,10 @@ its report, just redacted.
 Copy `mcp.json.example` to `.mcp.json` (project-local) or merge it into
 `~/.claude/settings.json`. **Do not put `TM1_PASSWORD` in either file** — those
 are routinely shared or committed; keep it in a gitignored `.env`
-([where the server looks for one](docs/CONFIGURATION.md#where-credentials-are-read-from)).
+([where the server looks for one](docs/CONFIGURATION.md#where-credentials-are-read-from)),
+or out of files altogether in the OS keychain with
+`npx tm1-mcp-server secrets migrate <connection>`
+([details](docs/CONFIGURATION.md#secrets-in-the-os-keychain--tm1_secretskeychain)).
 
 For the `npx` install:
 
@@ -218,7 +221,7 @@ security notes and the `autoApprove` allowlist:
 
 <!-- TOOLS-AUTOGEN:START -->
 
-## Tools (112)
+## Tools (111)
 
 Names and one-line descriptions: [docs/TOOLS.md](docs/TOOLS.md).
 
@@ -226,7 +229,7 @@ Names and one-line descriptions: [docs/TOOLS.md](docs/TOOLS.md).
 |---|---|
 | analysis | 10 |
 | celldata | 10 |
-| dimension-management | 14 |
+| dimension-management | 13 |
 | fileops | 5 |
 | metadata | 9 |
 | model-building | 9 |
@@ -236,7 +239,7 @@ Names and one-line descriptions: [docs/TOOLS.md](docs/TOOLS.md).
 | subsets | 5 |
 | ti-development | 17 |
 | views | 4 |
-| **Total** | **112** |
+| **Total** | **111** |
 
 <!-- TOOLS-AUTOGEN:END -->
 

package/dist/config.d.ts

@@ -35,7 +35,16 @@ export interface TM1Config {
 export declare const DEFAULT_MAX_RESPONSE_CHARS = 80000;
 export type ServerSettings = Pick<TM1Config, "logLevel" | "logFile" | "transport" | "httpHost" | "httpPort" | "httpAllowedOrigins" | "httpToken" | "responseMode" | "maxResponseChars">;
 export declare function loadServerSettings(env?: NodeJS.ProcessEnv): ServerSettings;
-export declare function loadConfig(env?: NodeJS.ProcessEnv): TM1Config;
+export interface LoadConfigOptions {
+    /**
+     * The secrets are not in `env` yet: they are read from the OS keychain when
+     * the connection is first used (see ./secrets.ts), and loadConfig runs again
+     * then, with them. Until then a missing secret is not an error, and neither
+     * is a missing TM1_USER — the keychain may hold a TM1_CAM_PASSPORT.
+     */
+    deferSecrets?: boolean;
+}
+export declare function loadConfig(env?: NodeJS.ProcessEnv, options?: LoadConfigOptions): TM1Config;
 /**
  * Stable label for a connection: host and port, plus the v12
  * instance/database. Keys per-connection state (process backups, the callgraph

package/dist/config.js

@@ -24,15 +24,21 @@ function parseIntEnv(name, raw, def) {
     return n;
 }
 export function loadServerSettings(env = process.env) {
-    const logLevelRaw = env.TM1_LOG_LEVEL ?? "info";
-    const logLevel = VALID_LOG_LEVELS.includes(logLevelRaw)
-        ? logLevelRaw
-        : "info";
+    // Same parse shape as TM1_MODE: case-insensitive, an unknown value throws at
+    // startup instead of silently falling back to the default.
+    const logLevelRaw = (env.TM1_LOG_LEVEL ?? "info").trim().toLowerCase();
+    if (!VALID_LOG_LEVELS.includes(logLevelRaw)) {
+        throw new Error(`Invalid TM1_LOG_LEVEL: "${env.TM1_LOG_LEVEL}". Expected one of ${VALID_LOG_LEVELS.join(", ")}.`);
+    }
+    const logLevel = logLevelRaw;
     const logFile = env.TM1_LOG_FILE || undefined;
-    const transportRaw = env.TM1_MCP_TRANSPORT ?? "stdio";
-    const transport = VALID_TRANSPORTS.includes(transportRaw)
-        ? transportRaw
-        : "stdio";
+    // A typo here used to start on stdio without a word: the expected /mcp port
+    // never bound and the operator saw only a client that could not connect.
+    const transportRaw = (env.TM1_MCP_TRANSPORT ?? "stdio").trim().toLowerCase();
+    if (!VALID_TRANSPORTS.includes(transportRaw)) {
+        throw new Error(`Invalid TM1_MCP_TRANSPORT: "${env.TM1_MCP_TRANSPORT}". Expected "stdio" or "http".`);
+    }
+    const transport = transportRaw;
     // Default to loopback. Binding to 0.0.0.0 must be opt-in to avoid exposing
     // a TM1-credentialed MCP server to the LAN by accident.
     const httpHost = env.TM1_MCP_HTTP_HOST || "127.0.0.1";
@@ -100,7 +106,8 @@ export function loadServerSettings(env = process.env) {
 }
 // `env` defaults to the process environment. The multi-connection registry
 // passes one record per connection folder instead (see ./connections.ts).
-export function loadConfig(env = process.env) {
+export function loadConfig(env = process.env, options = {}) {
+    const deferred = options.deferSecrets === true;
     const baseUrl = env.TM1_BASE_URL;
     const user = env.TM1_USER;
     const password = env.TM1_PASSWORD;
@@ -113,6 +120,22 @@ export function loadConfig(env = process.env) {
     // obtained out-of-band via TM1_CAM_PASSPORT instead.
     const namespace = env.TM1_NAMESPACE || undefined;
     const camPassport = env.TM1_CAM_PASSPORT || undefined;
+    // Which connection this is has to be known BEFORE the required-variable
+    // check below, because the answer decides which credential is required.
+    const tm1Version = env.TM1_VERSION || "11.8";
+    const instance = env.TM1_INSTANCE || undefined;
+    const database = env.TM1_DATABASE || undefined;
+    const versionMajor = Number.parseInt(tm1Version, 10);
+    const isV12 = Boolean(instance || database) || versionMajor === 12;
+    const version = isV12 ? 12 : 11;
+    // Every v12 auth mode except "basic" authenticates with a client secret, a
+    // bearer token or an API key, and the session login sends no password at all
+    // (connection/profile.ts buildV12Authorization). Demanding TM1_PASSWORD there
+    // rejects exactly the configuration docs/CONFIGURATION.md prescribes, and it
+    // does so at startup, before the server can say anything more useful. The v12
+    // block below still requires whichever credential the chosen mode does need.
+    const v12AuthMode = (env.TM1_AUTH_MODE ?? "s2s").trim().toLowerCase();
+    const passwordlessV12 = version === 12 && v12AuthMode !== "basic";
     // Required: baseUrl always. user/password only when NOT using a passport — a
     // passport carries the authenticated identity, so TM1 needs no credentials.
     // Empty strings are rejected (treated as unset). Password may be empty — some
@@ -121,17 +144,18 @@ export function loadConfig(env = process.env) {
     const missing = [];
     if (!baseUrl)
         missing.push("TM1_BASE_URL");
-    if (!camPassport) {
+    if (!camPassport && !deferred) {
         if (!user)
             missing.push("TM1_USER");
-        if (password === undefined)
+        if (password === undefined && !passwordlessV12) {
             missing.push("TM1_PASSWORD");
+        }
     }
     if (missing.length > 0) {
         throw new Error(`Missing or empty required environment variables: ${missing.join(", ")}. ` +
             `Set them in your shell or .env file before starting the server.`);
     }
-    if (!camPassport && password === "") {
+    if (!camPassport && !passwordlessV12 && !deferred && password === "") {
         process.stderr.write("[tm1-mcp-server] WARNING: TM1_PASSWORD is empty. " +
             "If TM1 rejects with 401, check whether the account actually allows blank passwords.\n");
     }
@@ -140,7 +164,6 @@ export function loadConfig(env = process.env) {
     const keepAliveIntervalMs = parseIntEnv("TM1_KEEP_ALIVE_INTERVAL", env.TM1_KEEP_ALIVE_INTERVAL, 60000);
     const requestTimeoutMs = parseIntEnv("TM1_REQUEST_TIMEOUT", env.TM1_REQUEST_TIMEOUT, 30000);
     const server = loadServerSettings(env);
-    const tm1Version = env.TM1_VERSION || "11.8";
     // Case-insensitive so a `TM1_MODE=ReadWrite` typo resolves to readwrite rather
     // than silently falling back to readonly (dropping every write tool without a
     // word). A genuinely-unknown value throws at startup — parity with the numeric
@@ -164,11 +187,6 @@ export function loadConfig(env = process.env) {
             "TM1_ENVIRONMENT=prod forces readonly; set TM1_ALLOW_PROD_WRITES=true to allow writes.";
     }
     // --- v12 (Planning Analytics Engine) connection ---------------------------
-    const instance = env.TM1_INSTANCE || undefined;
-    const database = env.TM1_DATABASE || undefined;
-    const versionMajor = Number.parseInt(tm1Version, 10);
-    const isV12 = Boolean(instance || database) || versionMajor === 12;
-    const version = isV12 ? 12 : 11;
     // Keep the DISPLAY string (server_info, logs) consistent with the numeric
     // `version`: a v12 connection (isV12, via TM1_INSTANCE/TM1_DATABASE) declared
     // with a v11-looking TM1_VERSION="11.8" would otherwise report "11.8" to users
@@ -189,7 +207,7 @@ export function loadConfig(env = process.env) {
         if (!database) {
             throw new Error("v12 connection requires TM1_DATABASE (set alongside TM1_INSTANCE).");
         }
-        const authModeRaw = (env.TM1_AUTH_MODE ?? "s2s").trim().toLowerCase();
+        const authModeRaw = v12AuthMode;
         if (!VALID_AUTH_MODES.includes(authModeRaw)) {
             throw new Error(`Invalid TM1_AUTH_MODE: "${env.TM1_AUTH_MODE}". ` +
                 `Expected one of: ${VALID_AUTH_MODES.join(", ")}.`);
@@ -212,15 +230,15 @@ export function loadConfig(env = process.env) {
         if (authMode === "s2s") {
             if (!clientId)
                 missingV12.push("TM1_CLIENT_ID");
-            if (!clientSecret)
+            if (!clientSecret && !deferred)
                 missingV12.push("TM1_CLIENT_SECRET");
         }
         else if (authMode === "access_token" || authMode === "oidc") {
-            if (!accessToken)
+            if (!accessToken && !deferred)
                 missingV12.push("TM1_ACCESS_TOKEN");
         }
         else if (authMode === "iam") {
-            if (!apiKey)
+            if (!apiKey && !deferred)
                 missingV12.push("TM1_API_KEY");
             if (!iamUrl)
                 missingV12.push("TM1_IAM_URL");

package/dist/connections.d.ts

@@ -1,6 +1,21 @@
 import pino from "pino";
 import { type TM1Config } from "./config.js";
+import { type SecretStore } from "./secrets.js";
 import { TM1Client } from "./tm1-client.js";
+/** Folder holding one `<name>/.env` per connection. */
+export declare function connectionsDir(env: NodeJS.ProcessEnv): string;
+/**
+ * The environment one connection folder resolves to — the only way a
+ * connection's `.env` is read, by the server and by scripts/run-live-for.ts
+ * alike, so a script can never log in with a differently parsed password.
+ *
+ * Server-level settings and non-TM1 variables (PATH, proxies) carry over from
+ * `env`; connection-level TM1_* keys come from the folder only, so a stray
+ * TM1_INSTANCE in the shell cannot reroute a v11 connection. The folder may
+ * not override server-level settings: one folder's TM1_MCP_TRANSPORT must not
+ * reconfigure the whole process.
+ */
+export declare function connectionEnv(folder: string, env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export interface ConnectionInfo {
     name: string;
     /** Folder the `.env` came from; undefined for the legacy single connection. */
@@ -16,6 +31,8 @@ export interface ConnectionInfo {
     connectionId?: string | undefined;
     /** Set when the folder's `.env` could not be turned into a config. */
     configError?: string | undefined;
+    /** "keychain" when the secrets are read from the OS keychain on first use. */
+    secrets?: "keychain" | undefined;
 }
 export interface ConnectionStatus extends ConnectionInfo {
     connected: boolean;
@@ -23,10 +40,14 @@ export interface ConnectionStatus extends ConnectionInfo {
 }
 export declare class ConnectionRegistry {
     private readonly logger;
+    /** Defaults to the OS keychain; tests inject a fake. */
+    private readonly secretStore?;
     private readonly entries;
     private constructor();
     /** Discover connections from the environment (see the header comment). */
-    static fromEnvironment(env: NodeJS.ProcessEnv, logger: pino.Logger): ConnectionRegistry;
+    static fromEnvironment(env: NodeJS.ProcessEnv, logger: pino.Logger, options?: {
+        secretStore?: SecretStore;
+    }): ConnectionRegistry;
     /** Wrap one prebuilt client (tests, embedders). */
     static single(client: TM1Client, logger?: pino.Logger): ConnectionRegistry;
     /**
@@ -40,6 +61,8 @@ export declare class ConnectionRegistry {
         client: TM1Client;
         mode?: TM1Config["mode"];
     }>, logger?: pino.Logger): ConnectionRegistry;
+    /** Validate one connection's env; keychain secrets are read later. */
+    private addEnv;
     private addConfig;
     private discover;
     /** Every connection name, including ones whose config failed to load. */
@@ -59,9 +82,14 @@ export declare class ConnectionRegistry {
     /**
      * The client for a connection, built and logged in on first use. A failed
      * login does not poison the entry: the client's own request path retries
-     * authentication, so the next call gets a fresh attempt.
+     * authentication, so the next call gets a fresh attempt — except when TM1
+     * rejected the credentials (401/403). The client is kept, so its
+     * SessionManager's latch answers every later call without another login
+     * until the server restarts.
      */
     get(name: string | undefined): Promise<TM1Client>;
+    /** The full config of a keychain connection, secrets included. */
+    private resolveSecrets;
     /** Connection metadata for a resolved call (mode/version gates). */
     resolveInfo(name: string | undefined): ConnectionInfo;
     disconnectAll(): Promise<void>;

package/dist/connections.js

@@ -18,12 +18,17 @@
 // defaults to readonly: a connection-level key (TM1_MODE, TM1_BASE_URL, …) in
 // the server's own environment is NOT inherited, so a TM1_MODE=readwrite in
 // the launching shell cannot silently arm every connection.
+//
+// A folder with TM1_SECRETS=keychain keeps its secrets in the OS keychain
+// (see ./secrets.ts). Discovery validates it without them; get() reads them
+// and builds the real config on first use.
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parse as parseDotenv } from "dotenv";
 import pino from "pino";
 import { connectionIdOf, loadConfig } from "./config.js";
+import { keychainHint, plaintextSecretKeys, usesKeychain, withKeychainSecrets, } from "./secrets.js";
 import { SessionManager } from "./session-manager.js";
 import { TM1Client } from "./tm1-client.js";
 import { TM1Error, TM1ErrorCode } from "./types.js";
@@ -39,21 +44,53 @@ const SERVER_LEVEL_KEYS = new Set([
 function isServerLevelKey(key) {
     return SERVER_LEVEL_KEYS.has(key) || key.startsWith("TM1_MCP_");
 }
+/** Folder holding one `<name>/.env` per connection. */
+export function connectionsDir(env) {
+    return env.TM1_CONNECTIONS_DIR || join(homedir(), ".tm1", "mcp-servers");
+}
+/**
+ * The environment one connection folder resolves to — the only way a
+ * connection's `.env` is read, by the server and by scripts/run-live-for.ts
+ * alike, so a script can never log in with a differently parsed password.
+ *
+ * Server-level settings and non-TM1 variables (PATH, proxies) carry over from
+ * `env`; connection-level TM1_* keys come from the folder only, so a stray
+ * TM1_INSTANCE in the shell cannot reroute a v11 connection. The folder may
+ * not override server-level settings: one folder's TM1_MCP_TRANSPORT must not
+ * reconfigure the whole process.
+ */
+export function connectionEnv(folder, env) {
+    const connEnv = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (!key.startsWith("TM1_") || isServerLevelKey(key))
+            connEnv[key] = value;
+    }
+    const fileEnv = parseDotenv(readFileSync(join(folder, ".env")));
+    for (const [key, value] of Object.entries(fileEnv)) {
+        if (!isServerLevelKey(key))
+            connEnv[key] = value;
+    }
+    return connEnv;
+}
 export class ConnectionRegistry {
     logger;
+    secretStore;
     entries = new Map();
-    constructor(logger) {
+    constructor(logger, 
+    /** Defaults to the OS keychain; tests inject a fake. */
+    secretStore) {
         this.logger = logger;
+        this.secretStore = secretStore;
     }
     /** Discover connections from the environment (see the header comment). */
-    static fromEnvironment(env, logger) {
-        const registry = new ConnectionRegistry(logger);
+    static fromEnvironment(env, logger, options = {}) {
+        const registry = new ConnectionRegistry(logger, options.secretStore);
         const explicitDir = env.TM1_CONNECTIONS_DIR;
         if (!explicitDir && env.TM1_BASE_URL) {
-            registry.addConfig("default", loadConfig(env));
+            registry.addEnv("default", env);
             return registry;
         }
-        const dir = explicitDir || join(homedir(), ".tm1", "mcp-servers");
+        const dir = connectionsDir(env);
         registry.discover(dir, env);
         if (registry.entries.size === 0) {
             throw new Error(`No TM1 connections found. Set TM1_BASE_URL (single connection) or ` +
@@ -95,6 +132,17 @@ export class ConnectionRegistry {
         }
         return registry;
     }
+    /** Validate one connection's env; keychain secrets are read later. */
+    addEnv(name, env, dir) {
+        const keychain = usesKeychain(env);
+        const config = loadConfig(env, { deferSecrets: keychain });
+        this.addConfig(name, config, dir);
+        if (keychain) {
+            const entry = this.entries.get(name);
+            entry.env = env;
+            entry.info.secrets = "keychain";
+        }
+    }
     addConfig(name, config, dir) {
         this.entries.set(name, {
             info: {
@@ -119,30 +167,21 @@ export class ConnectionRegistry {
                 .map((s) => s.trim())
                 .filter(Boolean))
             : undefined;
-        // Server-level settings and non-TM1 variables (PATH, proxies) carry over;
-        // connection-level TM1_* keys come from the folder only.
-        const base = {};
-        for (const [key, value] of Object.entries(env)) {
-            if (!key.startsWith("TM1_") || isServerLevelKey(key))
-                base[key] = value;
-        }
         const names = readdirSync(dir, { withFileTypes: true })
             .filter((d) => d.isDirectory() && existsSync(join(dir, d.name, ".env")))
             .map((d) => d.name)
             .filter((name) => !only || only.has(name))
             .sort((a, b) => a.localeCompare(b));
+        const plaintext = [];
         for (const name of names) {
             const folder = join(dir, name);
             try {
-                const fileEnv = parseDotenv(readFileSync(join(folder, ".env")));
-                const connEnv = { ...base };
-                for (const [key, value] of Object.entries(fileEnv)) {
-                    // The folder may not override server-level settings: one folder's
-                    // TM1_MCP_TRANSPORT must not reconfigure the whole process.
-                    if (!isServerLevelKey(key))
-                        connEnv[key] = value;
+                const connEnv = connectionEnv(folder, env);
+                this.addEnv(name, connEnv, folder);
+                if (!this.entries.get(name).env &&
+                    plaintextSecretKeys(connEnv).length) {
+                    plaintext.push(name);
                 }
-                this.addConfig(name, loadConfig(connEnv), folder);
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
@@ -152,6 +191,10 @@ export class ConnectionRegistry {
                 });
             }
         }
+        if (plaintext.length > 0) {
+            this.logger.warn({ connections: plaintext }, "plaintext secrets in .env — move them to the OS keychain with " +
+                "`npx tm1-mcp-server secrets migrate <connection>`");
+        }
     }
     /** Every connection name, including ones whose config failed to load. */
     get names() {
@@ -216,10 +259,26 @@ export class ConnectionRegistry {
     /**
      * The client for a connection, built and logged in on first use. A failed
      * login does not poison the entry: the client's own request path retries
-     * authentication, so the next call gets a fresh attempt.
+     * authentication, so the next call gets a fresh attempt — except when TM1
+     * rejected the credentials (401/403). The client is kept, so its
+     * SessionManager's latch answers every later call without another login
+     * until the server restarts.
      */
     async get(name) {
         const entry = this.entryFor(name);
+        if (!entry.client && entry.env) {
+            // Concurrent first calls share one keychain read. A failure is not
+            // cached: the next call reads again, after the user stored the entry.
+            entry.resolving ??= this.resolveSecrets(entry)
+                .catch((err) => {
+                entry.lastError = err instanceof Error ? err.message : String(err);
+                throw err;
+            })
+                .finally(() => {
+                entry.resolving = undefined;
+            });
+            entry.config = await entry.resolving;
+        }
         if (!entry.client) {
             const config = entry.config;
             const logger = this.logger.child({ connection: entry.info.name });
@@ -242,6 +301,20 @@ export class ConnectionRegistry {
             await entry.connecting;
         return entry.client;
     }
+    /** The full config of a keychain connection, secrets included. */
+    async resolveSecrets(entry) {
+        const { name } = entry.info;
+        const env = await withKeychainSecrets(name, entry.env, this.secretStore);
+        try {
+            return loadConfig(env);
+        }
+        catch (err) {
+            throw new TM1Error({
+                code: TM1ErrorCode.VALIDATION_ERROR,
+                message: `Connection "${name}": ${err instanceof Error ? err.message : String(err)}${keychainHint(name)}`,
+            });
+        }
+    }
     /** Connection metadata for a resolved call (mode/version gates). */
     resolveInfo(name) {
         return this.entryFor(name).info;

package/dist/http-transport.js

@@ -16,8 +16,25 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 //
 // Per MCP best practices: bind 127.0.0.1 by default and enable DNS-rebinding
 // protection. allowedHosts/Origins narrow what the transport accepts.
+// Cap on a single /mcp request body. Without one the whole request is buffered
+// and then copied again by Buffer.concat().toString(), so a large enough POST
+// can take the process down before any tool-level limit applies. Sized above
+// the biggest legitimate payload: tm1_upload_file accepts 32 MB of bytes, which
+// is ~43 MB base64 plus JSON framing.
+// ponytail: fixed constant, make it configurable if a deployment needs more.
+const MAX_BODY_BYTES = 64 * 1024 * 1024;
 export async function startHttpTransport(buildServer, config, logger) {
-    const allowedHost = `${config.httpHost}:${config.httpPort}`;
+    // The SDK compares the Host header as one string, port included, so every
+    // entry needs the port. Loopback names are safe to always allow: a rebinding
+    // attacker's page sends its own hostname, never one of these.
+    const allowedHosts = [
+        ...new Set([
+            `${config.httpHost}:${config.httpPort}`,
+            `127.0.0.1:${config.httpPort}`,
+            `localhost:${config.httpPort}`,
+            `[::1]:${config.httpPort}`,
+        ]),
+    ];
     if (!config.httpToken) {
         logger.warn("HTTP transport has no TM1_MCP_HTTP_TOKEN set — /mcp requests are unauthenticated. " +
             "Bind loopback only, or front the server with an authenticating reverse proxy.");
@@ -55,12 +72,42 @@ export async function startHttpTransport(buildServer, config, logger) {
         }
         let body;
         if (req.method === "POST") {
+            // Refuse on the declared length before a single byte is read; the
+            // counter below is the backstop for a chunked body that declares none.
+            const declared = Number(req.headers["content-length"]);
+            if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+                logger.warn({ declared, limit: MAX_BODY_BYTES }, "Request body too large");
+                res.statusCode = 413;
+                res.setHeader("Content-Type", "application/json");
+                // Close the connection: the client is still holding a body this
+                // server will never read, and keep-alive would leave it queued.
+                res.setHeader("Connection", "close");
+                res.end(JSON.stringify({
+                    error: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
+                }));
+                return;
+            }
             try {
                 const chunks = [];
+                let size = 0;
                 for await (const chunk of req) {
-                    chunks.push(typeof chunk === "string"
+                    const buf = typeof chunk === "string"
                         ? Buffer.from(chunk)
-                        : chunk);
+                        : chunk;
+                    size += buf.length;
+                    if (size > MAX_BODY_BYTES) {
+                        logger.warn({ limit: MAX_BODY_BYTES }, "Request body too large");
+                        res.statusCode = 413;
+                        res.setHeader("Content-Type", "application/json");
+                        res.end(JSON.stringify({
+                            error: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
+                        }));
+                        // Answer first, then stop reading: the rest of the upload is
+                        // dropped instead of being buffered behind an already-sent reply.
+                        req.destroy();
+                        return;
+                    }
+                    chunks.push(buf);
                 }
                 const raw = Buffer.concat(chunks).toString("utf8");
                 body = raw ? JSON.parse(raw) : undefined;
@@ -80,7 +127,7 @@ export async function startHttpTransport(buildServer, config, logger) {
             // sessionIdGenerator omitted → stateless mode (single-use per request)
             enableJsonResponse: true,
             enableDnsRebindingProtection: true,
-            allowedHosts: [allowedHost, "127.0.0.1", "localhost"],
+            allowedHosts,
             allowedOrigins: config.httpAllowedOrigins,
         });
         res.on("close", () => {