@fouradata/mcp 0.2.11

package/dist/prompts.js

@@ -0,0 +1,149 @@
+import { z } from "zod";
+/**
+ * MCP Prompts — pre-written workflow templates the user can invoke from the
+ * MCP client UI (Claude Desktop / Cursor / etc) instead of figuring out the
+ * tool orchestration themselves.
+ *
+ * Prompts are LAZY context — they only enter the LLM's window when invoked,
+ * unlike tool descriptions which are loaded on every turn. So we can be more
+ * verbose here.
+ */
+export function registerPrompts(server) {
+    server.registerPrompt("scrape_product_page", {
+        title: "Scrape a product page",
+        description: "Fetch an e-commerce product URL and extract structured product info as JSON (title, price, image, availability).",
+        argsSchema: {
+            url: z.string().describe("Product page URL (any e-commerce site)"),
+        },
+    }, ({ url }) => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `Fetch the product page at ${url} using the foura_browser tool — most product pages are single-page apps and need JavaScript to render.\n\n` +
+                        `From the response body extract:\n` +
+                        `- product title\n` +
+                        `- price (with currency)\n` +
+                        `- primary product image URL (absolute, not relative)\n` +
+                        `- availability / stock status\n` +
+                        `- product SKU or ID if visible\n\n` +
+                        `If the response body is large (you'll see a resource_link instead of inline HTML), call resources/read on that URI to get the full page.\n\n` +
+                        `Return the result as JSON:\n` +
+                        `{"title": "...", "price": 0, "currency": "USD", "image_url": "...", "in_stock": true, "sku": "..."}`,
+                },
+            },
+        ],
+    }));
+    server.registerPrompt("extract_article", {
+        title: "Extract an article",
+        description: "Fetch a news/blog article URL and extract the main content (headline, author, body, date) stripped of nav/ads/footer.",
+        argsSchema: {
+            url: z.string().describe("Article URL"),
+        },
+    }, ({ url }) => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `Fetch ${url} using the foura_single tool with unblocker:true. Most news and blog sites are server-rendered, so HTTP is fastest (200ms-2s).\n\n` +
+                        `If foura_single returns a 403, captcha page, or empty content, retry the same URL with foura_proxy (maxTries:3) — it routes through a rotating proxy pool.\n\n` +
+                        `From the response, extract:\n` +
+                        `- headline (the main H1, not the page title bar)\n` +
+                        `- author byline (may be inside .author / [rel=author] / itemprop)\n` +
+                        `- publication date (look for <time>, .published, or JSON-LD)\n` +
+                        `- main article body (strip navigation, ads, related-content, footer, comments)\n` +
+                        `- canonical URL (rel=canonical or og:url)\n\n` +
+                        `Return as JSON:\n` +
+                        `{"title": "...", "author": "...", "date_published": "ISO8601", "body": "...", "canonical_url": "..."}`,
+                },
+            },
+        ],
+    }));
+    server.registerPrompt("monitor_pricing", {
+        title: "Monitor a price",
+        description: "Fetch a pricing page and extract the current price; compare to a target if provided.",
+        argsSchema: {
+            url: z.string().describe("Pricing or product page URL"),
+            target_price: z
+                .string()
+                .optional()
+                .describe("Optional target price to compare against (e.g. \"19.99\")"),
+        },
+    }, ({ url, target_price }) => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `Use the foura_proxy tool with maxTries:5 and unblocker:true to fetch ${url}. Pricing pages often have aggressive bot detection, so go through the proxy pool from the start.\n\n` +
+                        `Extract the current price (look for visible $/€/£ amounts, JSON-LD Offer schema, [itemprop=price]).\n\n` +
+                        (target_price
+                            ? `Compare against target price ${target_price}: report whether current is below/at/above target, and the absolute difference.\n\n`
+                            : "") +
+                        `Return as JSON:\n` +
+                        `{"url": "...", "current_price": 0.00, "currency": "USD"` +
+                        (target_price
+                            ? `, "target_price": ${target_price}, "difference": 0, "status": "below|at|above"`
+                            : "") +
+                        `}`,
+                },
+            },
+        ],
+    }));
+    server.registerPrompt("check_endpoint_health", {
+        title: "Check API endpoint health",
+        description: "GET a URL through foura_single with strict validation and report whether it's reachable and responding correctly.",
+        argsSchema: {
+            url: z.string().describe("HTTP endpoint URL to probe"),
+            expected_text: z
+                .string()
+                .optional()
+                .describe("Optional substring that must appear in the response body for the endpoint to count as healthy"),
+        },
+    }, ({ url, expected_text }) => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `Use the foura_single tool with GET on ${url}, timeout_ms:5000, and validate.status.accept:[200].` +
+                        (expected_text
+                            ? ` Also set validate.data.accept:["${expected_text}"] so the request only counts as success when the body contains "${expected_text}".`
+                            : "") +
+                        `\n\nReport:\n` +
+                        `- reachable (true if a response came back at all, false on connection error/timeout)\n` +
+                        `- status_code (HTTP code from target)\n` +
+                        `- total_time_ms (from the total_time field)\n` +
+                        `- validation_passed (true if status + body validation conditions were met)\n\n` +
+                        `Return as JSON:\n` +
+                        `{"url": "...", "reachable": true, "status_code": 200, "total_time_ms": 0, "validation_passed": true}`,
+                },
+            },
+        ],
+    }));
+    server.registerPrompt("bulk_fetch_urls", {
+        title: "Fetch a list of URLs in parallel",
+        description: "Fetch multiple URLs concurrently and return per-URL outcome. Auto-falls back to foura_proxy on bot-block.",
+        argsSchema: {
+            urls: z.string().describe("Comma-separated list of URLs to fetch"),
+        },
+    }, ({ urls }) => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `Parse the following comma-separated URLs and fetch each one concurrently using foura_single (unblocker:true).\n\n` +
+                        `URLs: ${urls}\n\n` +
+                        `For any URL that returns 403, captcha page, or empty body — retry that single URL with foura_proxy (maxTries:3).\n\n` +
+                        `Return a JSON array, one entry per URL in input order:\n` +
+                        `[{"url": "...", "status": 200, "success": true, "body_size_bytes": 0, "via": "single|proxy", "error": null}, ...]\n\n` +
+                        `Do NOT inline full response bodies in the output — only metadata. If the caller needs body content, they should call foura_single individually.`,
+                },
+            },
+        ],
+    }));
+}
+//# sourceMappingURL=prompts.js.map

package/dist/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,MAAM,CAAC,cAAc,CACnB,qBAAqB,EACrB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,kHAAkH;QACpH,UAAU,EAAE;YACV,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SACnE;KACF,EACD,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,6BAA6B,GAAG,4GAA4G;wBAC5I,mCAAmC;wBACnC,mBAAmB;wBACnB,2BAA2B;wBAC3B,wDAAwD;wBACxD,iCAAiC;wBACjC,oCAAoC;wBACpC,8IAA8I;wBAC9I,8BAA8B;wBAC9B,qGAAqG;iBACxG;aACF;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,iBAAiB,EACjB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,uHAAuH;QACzH,UAAU,EAAE;YACV,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;SACxC;KACF,EACD,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,SAAS,GAAG,oIAAoI;wBAChJ,gKAAgK;wBAChK,+BAA+B;wBAC/B,oDAAoD;wBACpD,qEAAqE;wBACrE,gEAAgE;wBAChE,kFAAkF;wBAClF,+CAA+C;wBAC/C,mBAAmB;wBACnB,uGAAuG;iBAC1G;aACF;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,sFAAsF;QACxF,UAAU,EAAE;YACV,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACvD,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,2DAA2D,CAAC;SACzE;KACF,EACD,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,wEAAwE,GAAG,uGAAuG;wBAClL,yGAAyG;wBACzG,CAAC,YAAY;4BACX,CAAC,CAAC,gCAAgC,YAAY,qFAAqF;4BACnI,CAAC,CAAC,EAAE,CAAC;wBACP,mBAAmB;wBACnB,yDAAyD;wBACzD,CAAC,YAAY;4BACX,CAAC,CAAC,qBAAqB,YAAY,+CAA+C;4BAClF,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG;iBACN;aACF;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,uBAAuB,EACvB;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,mHAAmH;QACrH,UAAU,EAAE;YACV,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YACtD,aAAa,EAAE,CAAC;iBACb,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,+FAA+F,CAAC;SAC7G;KACF,EACD,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,yCAAyC,GAAG,sDAAsD;wBAClG,CAAC,aAAa;4BACZ,CAAC,CAAC,oCAAoC,aAAa,oEAAoE,aAAa,IAAI;4BACxI,CAAC,CAAC,EAAE,CAAC;wBACP,eAAe;wBACf,wFAAwF;wBACxF,yCAAyC;wBACzC,+CAA+C;wBAC/C,gFAAgF;wBAChF,mBAAmB;wBACnB,sGAAsG;iBACzG;aACF;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,iBAAiB,EACjB;QACE,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,2GAA2G;QAC7G,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;SACnE;KACF,EACD,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,mHAAmH;wBACnH,SAAS,IAAI,MAAM;wBACnB,sHAAsH;wBACtH,0DAA0D;wBAC1D,uHAAuH;wBACvH,iJAAiJ;iBACpJ;aACF;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/resources.d.ts

@@ -0,0 +1,33 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Resources — offload large response bodies (>= THRESHOLD bytes) onto host
+ * disk and return a MCP resource_link instead of inlining megabytes into the
+ * LLM context.
+ *
+ * Transport-level cross-cutting concern (same carve-out as auth.ts and
+ * safe-target.ts). Per-tool product code stays per-file: each tool decides
+ * which response field is the "large payload" (single/proxy use `data`,
+ * browser uses `body`).
+ *
+ * Audit 1.5 — tenant isolation. Payloads are stored under
+ * `<PAYLOADS_DIR>/<keyhash>/<uuid>.{bin,meta.json}`, where `keyhash` is the
+ * first 16 hex chars of sha256(apiKey). The resource handler validates the
+ * caller's keyhash matches the storage path before serving — any other
+ * tenant gets a `resource not found` (no leaking whether the UUID exists).
+ */
+export declare const THRESHOLD_BYTES = 50000;
+export declare const PAYLOADS_DIR: string;
+export interface StoredPayload {
+    uri: string;
+    name: string;
+    mimeType: string;
+    size: number;
+}
+export declare function hashApiKey(apiKey: string): string;
+/**
+ * Write `data` to disk under the caller's tenant namespace + return a
+ * resource_link descriptor. Caller has already decided the payload is large
+ * enough to offload (use THRESHOLD_BYTES for the size check).
+ */
+export declare function storePayload(data: Buffer | string, mimeType: string, suggestedName: string): Promise<StoredPayload>;
+export declare function registerResourceHandler(server: McpServer): void;

package/dist/resources.js

@@ -0,0 +1,126 @@
+import { mkdir, writeFile, readFile } from "node:fs/promises";
+import { randomUUID, createHash } from "node:crypto";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { getApiKey } from "./auth.js";
+/**
+ * Resources — offload large response bodies (>= THRESHOLD bytes) onto host
+ * disk and return a MCP resource_link instead of inlining megabytes into the
+ * LLM context.
+ *
+ * Transport-level cross-cutting concern (same carve-out as auth.ts and
+ * safe-target.ts). Per-tool product code stays per-file: each tool decides
+ * which response field is the "large payload" (single/proxy use `data`,
+ * browser uses `body`).
+ *
+ * Audit 1.5 — tenant isolation. Payloads are stored under
+ * `<PAYLOADS_DIR>/<keyhash>/<uuid>.{bin,meta.json}`, where `keyhash` is the
+ * first 16 hex chars of sha256(apiKey). The resource handler validates the
+ * caller's keyhash matches the storage path before serving — any other
+ * tenant gets a `resource not found` (no leaking whether the UUID exists).
+ */
+export const THRESHOLD_BYTES = 50_000;
+export const PAYLOADS_DIR = process.env.FOURA_MCP_PAYLOADS_DIR ?? path.join(tmpdir(), "foura-mcp-payloads");
+const URI_PREFIX = "foura-mcp://payload/";
+// sha256(apiKey).hex().slice(0, 16) — gives 64 bits of namespacing entropy,
+// short enough for a filesystem path component and unguessable for an
+// attacker who doesn't have the corresponding API key.
+export function hashApiKey(apiKey) {
+    return createHash("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+const SAFE_UUID = /^[0-9a-f-]{36}$/i;
+const SAFE_KEYHASH = /^[0-9a-f]{16}$/;
+const tenantDirReady = new Set();
+async function ensureTenantDir(keyhash) {
+    const dir = path.join(PAYLOADS_DIR, keyhash);
+    if (!tenantDirReady.has(keyhash)) {
+        await mkdir(dir, { recursive: true });
+        tenantDirReady.add(keyhash);
+    }
+    return dir;
+}
+/**
+ * Write `data` to disk under the caller's tenant namespace + return a
+ * resource_link descriptor. Caller has already decided the payload is large
+ * enough to offload (use THRESHOLD_BYTES for the size check).
+ */
+export async function storePayload(data, mimeType, suggestedName) {
+    const keyhash = hashApiKey(getApiKey());
+    const dir = await ensureTenantDir(keyhash);
+    const uuid = randomUUID();
+    const isBinary = Buffer.isBuffer(data);
+    const buf = isBinary ? data : Buffer.from(data, "utf8");
+    const dataPath = path.join(dir, `${uuid}.bin`);
+    const metaPath = path.join(dir, `${uuid}.meta.json`);
+    const meta = {
+        mimeType,
+        originalName: suggestedName,
+        size: buf.byteLength,
+        storedAt: new Date().toISOString(),
+        binary: isBinary,
+        keyhash,
+    };
+    await Promise.all([
+        writeFile(dataPath, buf),
+        writeFile(metaPath, JSON.stringify(meta), { encoding: "utf8" }),
+    ]);
+    return {
+        uri: `${URI_PREFIX}${uuid}`,
+        name: suggestedName,
+        mimeType,
+        size: buf.byteLength,
+    };
+}
+export function registerResourceHandler(server) {
+    server.registerResource("payload", new ResourceTemplate(`${URI_PREFIX}{uuid}`, { list: undefined }), {
+        title: "Cached foura-mcp response payload",
+        description: "A large response body (>=50KB) returned by an earlier foura-mcp tool call, " +
+            "stored on disk for follow-up reads instead of inlined into context. " +
+            "Tenant-isolated: only the API key that stored the payload can read it back.",
+    }, async (uri, { uuid }) => {
+        const uuidStr = Array.isArray(uuid) ? uuid[0] : uuid;
+        if (!uuidStr || !SAFE_UUID.test(uuidStr)) {
+            throw new Error(`Payload not found: ${uuidStr}`);
+        }
+        // Resolve the caller's tenant namespace and read ONLY from there.
+        // Cross-tenant reads bubble up as plain ENOENT (don't leak existence).
+        const keyhash = hashApiKey(getApiKey());
+        if (!SAFE_KEYHASH.test(keyhash)) {
+            throw new Error("Payload not found");
+        }
+        const dir = path.join(PAYLOADS_DIR, keyhash);
+        const metaPath = path.join(dir, `${uuidStr}.meta.json`);
+        const dataPath = path.join(dir, `${uuidStr}.bin`);
+        let metaRaw;
+        try {
+            metaRaw = await readFile(metaPath, "utf8");
+        }
+        catch {
+            throw new Error(`Payload not found: ${uuidStr}`);
+        }
+        const meta = JSON.parse(metaRaw);
+        // Defense in depth — even if filesystem permissions ever got bypassed,
+        // the meta sidecar carries the keyhash; reject on mismatch.
+        if (meta.keyhash !== keyhash) {
+            throw new Error(`Payload not found: ${uuidStr}`);
+        }
+        const buf = await readFile(dataPath);
+        return {
+            contents: [
+                meta.binary
+                    ? {
+                        uri: uri.href,
+                        mimeType: meta.mimeType,
+                        blob: buf.toString("base64"),
+                    }
+                    : {
+                        uri: uri.href,
+                        mimeType: meta.mimeType,
+                        text: buf.toString("utf8"),
+                    },
+            ],
+        };
+    });
+}
+//# sourceMappingURL=resources.js.map

package/dist/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAEL,gBAAgB,GACjB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAEtC,MAAM,CAAC,MAAM,YAAY,GACvB,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAElF,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAkB1C,4EAA4E;AAC5E,sEAAsE;AACtE,uDAAuD;AACvD,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AACzC,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAqB,EACrB,QAAgB,EAChB,aAAqB;IAErB,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IACrD,MAAM,IAAI,GAAgB;QACxB,QAAQ;QACR,YAAY,EAAE,aAAa;QAC3B,IAAI,EAAE,GAAG,CAAC,UAAU;QACpB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,QAAQ;QAChB,OAAO;KACR,CAAC;IAEF,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC;QACxB,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE;QAC3B,IAAI,EAAE,aAAa;QACnB,QAAQ;QACR,IAAI,EAAE,GAAG,CAAC,UAAU;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB;IACvD,MAAM,CAAC,gBAAgB,CACrB,SAAS,EACT,IAAI,gBAAgB,CAAC,GAAG,UAAU,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAChE;QACE,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,6EAA6E;YAC7E,sEAAsE;YACtE,6EAA6E;KAChF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;QAElD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;QAChD,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE;gBACR,IAAI,CAAC,MAAM;oBACT,CAAC,CAAC;wBACE,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;qBAC7B;oBACH,CAAC,CAAC;wBACE,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;qBAC3B;aACN;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/safe-target.d.ts

@@ -0,0 +1,5 @@
+export declare class SsrfBlockedError extends Error {
+    readonly hostInfo: string;
+    constructor(hostInfo: string);
+}
+export declare function assertPublicTarget(rawUrl: string): Promise<void>;

package/dist/safe-target.js

@@ -0,0 +1,130 @@
+import { lookup } from "node:dns/promises";
+import { isIPv4, isIPv6 } from "node:net";
+function ipv4ToInt(addr) {
+    const parts = addr.split(".");
+    if (parts.length !== 4)
+        throw new Error(`bad IPv4: ${addr}`);
+    let n = 0;
+    for (const p of parts) {
+        const v = Number(p);
+        if (!Number.isInteger(v) || v < 0 || v > 255)
+            throw new Error(`bad IPv4 octet: ${addr}`);
+        n = n * 256 + v;
+    }
+    return n >>> 0;
+}
+// RFC 5735 + RFC 6598 (CGNAT) reserved IPv4 blocks.
+const V4_RESERVED = [
+    { base: ipv4ToInt("0.0.0.0"), prefix: 8 }, // "this network"
+    { base: ipv4ToInt("10.0.0.0"), prefix: 8 }, // RFC1918 private
+    { base: ipv4ToInt("100.64.0.0"), prefix: 10 }, // CGNAT (RFC 6598)
+    { base: ipv4ToInt("127.0.0.0"), prefix: 8 }, // loopback
+    { base: ipv4ToInt("169.254.0.0"), prefix: 16 }, // link-local
+    { base: ipv4ToInt("172.16.0.0"), prefix: 12 }, // RFC1918 private
+    { base: ipv4ToInt("192.0.0.0"), prefix: 24 }, // IETF protocol
+    { base: ipv4ToInt("192.0.2.0"), prefix: 24 }, // TEST-NET-1
+    { base: ipv4ToInt("192.88.99.0"), prefix: 24 }, // 6to4 anycast (deprecated)
+    { base: ipv4ToInt("192.168.0.0"), prefix: 16 }, // RFC1918 private
+    { base: ipv4ToInt("198.18.0.0"), prefix: 15 }, // benchmarking
+    { base: ipv4ToInt("198.51.100.0"), prefix: 24 }, // TEST-NET-2
+    { base: ipv4ToInt("203.0.113.0"), prefix: 24 }, // TEST-NET-3
+    { base: ipv4ToInt("224.0.0.0"), prefix: 4 }, // multicast
+    { base: ipv4ToInt("240.0.0.0"), prefix: 4 }, // reserved
+    { base: ipv4ToInt("255.255.255.255"), prefix: 32 }, // broadcast
+];
+function isReservedV4(addr) {
+    let n;
+    try {
+        n = ipv4ToInt(addr);
+    }
+    catch {
+        return false;
+    }
+    for (const b of V4_RESERVED) {
+        const mask = b.prefix === 0 ? 0 : (0xffffffff << (32 - b.prefix)) >>> 0;
+        if ((n & mask) === (b.base & mask))
+            return true;
+    }
+    return false;
+}
+function isReservedV6(addr) {
+    const a = addr.toLowerCase();
+    if (a === "::" || a === "::1")
+        return true;
+    const firstGroup = a.split(":")[0] ?? "";
+    // ULA fc00::/7 — first hex of first group is f, second is c or d
+    if (/^f[cd][0-9a-f]{0,2}$/.test(firstGroup))
+        return true;
+    // link-local fe80::/10 — first group starts fe8, fe9, fea, feb
+    if (/^fe[89ab][0-9a-f]{0,1}$/.test(firstGroup))
+        return true;
+    // documentation 2001:db8::/32
+    if (/^2001:0?db8(:|$)/.test(a))
+        return true;
+    // IPv4-mapped: ::ffff:x.x.x.x (dotted-quad form) — check embedded v4
+    const v4mappedDotted = /^::ffff:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)$/.exec(a);
+    if (v4mappedDotted?.[1])
+        return isReservedV4(v4mappedDotted[1]);
+    // IPv4-mapped canonical hex form (Node URL normalises ::ffff:192.168.1.1
+    // to ::ffff:c0a8:101). Match ::ffff: prefix + two hex groups, decode.
+    const v4mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(a);
+    if (v4mappedHex) {
+        const high = parseInt(v4mappedHex[1] ?? "0", 16);
+        const low = parseInt(v4mappedHex[2] ?? "0", 16);
+        const o1 = (high >> 8) & 0xff;
+        const o2 = high & 0xff;
+        const o3 = (low >> 8) & 0xff;
+        const o4 = low & 0xff;
+        return isReservedV4(`${o1}.${o2}.${o3}.${o4}`);
+    }
+    return false;
+}
+export class SsrfBlockedError extends Error {
+    hostInfo;
+    constructor(hostInfo) {
+        super(`Refusing to fetch ${hostInfo}: target resolves to a private or reserved IP range. ` +
+            `The FourA scraping API only forwards requests to public internet hosts.`);
+        this.hostInfo = hostInfo;
+        this.name = "SsrfBlockedError";
+    }
+}
+export async function assertPublicTarget(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new SsrfBlockedError(`invalid URL: ${rawUrl}`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new SsrfBlockedError(`unsupported scheme ${url.protocol}`);
+    }
+    // Strip the [...] brackets from a bare IPv6 hostname
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    if (isIPv4(host)) {
+        if (isReservedV4(host))
+            throw new SsrfBlockedError(host);
+        return;
+    }
+    if (isIPv6(host)) {
+        if (isReservedV6(host))
+            throw new SsrfBlockedError(host);
+        return;
+    }
+    let addrs;
+    try {
+        addrs = await lookup(host, { all: true, verbatim: true });
+    }
+    catch (e) {
+        throw new SsrfBlockedError(`DNS lookup failed for ${host}: ${e.message}`);
+    }
+    if (addrs.length === 0) {
+        throw new SsrfBlockedError(`${host} resolved to no addresses`);
+    }
+    for (const a of addrs) {
+        const bad = a.family === 4 ? isReservedV4(a.address) : isReservedV6(a.address);
+        if (bad)
+            throw new SsrfBlockedError(`${host} → ${a.address}`);
+    }
+}
+//# sourceMappingURL=safe-target.js.map

package/dist/safe-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-target.js","sourceRoot":"","sources":["../src/safe-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAqB1C,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,oDAAoD;AACpD,MAAM,WAAW,GAA2B;IAC1C,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,EAAU,MAAM,EAAE,CAAC,EAAG,EAAI,iBAAiB;IACvE,EAAE,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,EAAS,MAAM,EAAE,CAAC,EAAG,EAAI,kBAAkB;IACxE,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,EAAO,MAAM,EAAE,EAAE,EAAE,EAAI,mBAAmB;IACzE,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,EAAQ,MAAM,EAAE,CAAC,EAAG,EAAI,WAAW;IACjE,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,EAAM,MAAM,EAAE,EAAE,EAAE,EAAI,aAAa;IACnE,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,EAAO,MAAM,EAAE,EAAE,EAAE,EAAI,kBAAkB;IACxE,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,EAAQ,MAAM,EAAE,EAAE,EAAE,EAAI,gBAAgB;IACtE,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,EAAQ,MAAM,EAAE,EAAE,EAAE,EAAI,aAAa;IACnE,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,EAAM,MAAM,EAAE,EAAE,EAAE,EAAI,4BAA4B;IAClF,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,EAAM,MAAM,EAAE,EAAE,EAAE,EAAI,kBAAkB;IACxE,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,EAAO,MAAM,EAAE,EAAE,EAAE,EAAI,eAAe;IACrE,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC,EAAK,MAAM,EAAE,EAAE,EAAE,EAAI,aAAa;IACnE,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,EAAM,MAAM,EAAE,EAAE,EAAE,EAAI,aAAa;IACnE,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,EAAQ,MAAM,EAAE,CAAC,EAAG,EAAI,YAAY;IAClE,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,EAAQ,MAAM,EAAE,CAAC,EAAG,EAAI,WAAW;IACjE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAI,YAAY;CACnE,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QACH,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,iEAAiE;IACjE,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,+DAA+D;IAC/D,IAAI,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,8BAA8B;IAC9B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,qEAAqE;IACrE,MAAM,cAAc,GAAG,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC7B,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;QACtB,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAA5B,YAA4B,QAAgB;QAC1C,KAAK,CACH,qBAAqB,QAAQ,uDAAuD;YAClF,yEAAyE,CAC5E,CAAC;QAJwB,aAAQ,GAAR,QAAQ,CAAQ;QAK1C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,qDAAqD;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,YAAY,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,YAAY,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,KAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/E,IAAI,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createServer(): McpServer;

package/dist/server.js

@@ -0,0 +1,19 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerSingleTool } from "./tools/single.js";
+import { registerProxyTool } from "./tools/proxy.js";
+import { registerBrowserTool } from "./tools/browser.js";
+import { registerResourceHandler } from "./resources.js";
+import { registerPrompts } from "./prompts.js";
+export function createServer() {
+    const server = new McpServer({
+        name: "foura-mcp",
+        version: "0.2.11",
+    });
+    registerSingleTool(server);
+    registerProxyTool(server);
+    registerBrowserTool(server);
+    registerResourceHandler(server);
+    registerPrompts(server);
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IAEH,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/stdio.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/stdio.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createServer } from "./server.js";
+const server = createServer();
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=stdio.js.map

package/dist/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/tools/browser.d.ts

@@ -0,0 +1,77 @@
+import { z } from "zod";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+declare function deriveCode(status: number, envelope: Record<string, unknown>): string;
+export declare function registerBrowserTool(server: McpServer): void;
+export declare const __test: {
+    deriveCode: typeof deriveCode;
+    CdpCookieSchema: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        domain: z.ZodOptional<z.ZodString>;
+        path: z.ZodOptional<z.ZodString>;
+        expires: z.ZodOptional<z.ZodNumber>;
+        size: z.ZodOptional<z.ZodNumber>;
+        httpOnly: z.ZodOptional<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        session: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnknown>>;
+    BrowserCookieInputSchema: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        domain: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    browserInputShape: {
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        cookies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+            domain: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        proxy: z.ZodOptional<z.ZodString>;
+        timeout_ms: z.ZodOptional<z.ZodNumber>;
+        checkStatus: z.ZodOptional<z.ZodNumber>;
+        checkText: z.ZodOptional<z.ZodString>;
+        offload_large: z.ZodOptional<z.ZodBoolean>;
+    };
+    browserOutputShape: {
+        status: z.ZodOptional<z.ZodNumber>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        body: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+        cookies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+            domain: z.ZodOptional<z.ZodString>;
+            path: z.ZodOptional<z.ZodString>;
+            expires: z.ZodOptional<z.ZodNumber>;
+            size: z.ZodOptional<z.ZodNumber>;
+            httpOnly: z.ZodOptional<z.ZodBoolean>;
+            secure: z.ZodOptional<z.ZodBoolean>;
+            session: z.ZodOptional<z.ZodBoolean>;
+            sameSite: z.ZodOptional<z.ZodString>;
+        }, z.core.$catchall<z.ZodUnknown>>>>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        offloaded_resource_uri: z.ZodOptional<z.ZodString>;
+        size_bytes: z.ZodOptional<z.ZodNumber>;
+        error: z.ZodOptional<z.ZodString>;
+        service: z.ZodOptional<z.ZodEnum<{
+            single: "single";
+            proxy: "proxy";
+            browser: "browser";
+            api: "api";
+        }>>;
+        retryAfter: z.ZodOptional<z.ZodNumber>;
+        current: z.ZodOptional<z.ZodObject<{
+            concurrency: z.ZodOptional<z.ZodNumber>;
+            rpm: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            maxConcurrency: z.ZodOptional<z.ZodNumber>;
+            maxRpm: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        code: z.ZodOptional<z.ZodString>;
+    };
+};
+export {};