@get-technology-inc/jamf-docs-mcp-server 1.0.0 → 1.2.0

package/dist/utils/sanitize.js

@@ -0,0 +1,57 @@
+/**
+ * Security sanitization utilities
+ *
+ * Functions for sanitizing user-controlled or externally-sourced content
+ * before interpolation into Markdown output or client-facing error messages.
+ */
+/**
+ * Escape Markdown special characters in text to prevent Markdown injection.
+ * Use this for titles, snippets, and other text interpolated into Markdown.
+ */
+export function sanitizeMarkdownText(text) {
+    return text.replace(/[[\]()#*_`~>!|\\]/g, '\\$&');
+}
+/**
+ * Sanitize a URL for use in Markdown link syntax.
+ * - Only allows https: protocol
+ * - Percent-encodes parentheses to prevent breaking Markdown links
+ * - Returns '#' for invalid or non-https URLs
+ */
+export function sanitizeMarkdownUrl(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'https:') {
+            return '#';
+        }
+        // Percent-encode parentheses in the URL to prevent breaking Markdown link syntax
+        return url.replace(/\(/g, '%28').replace(/\)/g, '%29');
+    }
+    catch {
+        return '#';
+    }
+}
+/**
+ * Extract and sanitize an error message from an unknown thrown value.
+ */
+export function getSafeErrorMessage(error) {
+    const raw = error instanceof Error ? error.message : 'Unknown error occurred';
+    return sanitizeErrorMessage(raw);
+}
+/**
+ * Sanitize error messages before returning to clients.
+ * - Replaces backend hostnames with frontend equivalents
+ * - Removes absolute file paths
+ * - Removes stack traces
+ */
+export function sanitizeErrorMessage(message) {
+    let sanitized = message;
+    // Replace backend hostname with frontend (hostnames extracted from DOCS_API_URL / DOCS_BASE_URL)
+    sanitized = sanitized.replaceAll('learn-be.jamf.com', 'learn.jamf.com');
+    // Remove absolute file paths (Unix and Windows)
+    sanitized = sanitized.replace(/\/[\w./-]+\.\w{1,4}/g, '<path>');
+    sanitized = sanitized.replace(/[A-Z]:\\[\w.\\-]+\.\w{1,4}/g, '<path>');
+    // Remove stack traces (lines starting with "at ")
+    sanitized = sanitized.replace(/\n\s*at\s+.+/g, '');
+    return sanitized;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/utils/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,iFAAiF;QACjF,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;IAC9E,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,iGAAiG;IACjG,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAExE,gDAAgD;IAChD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;IAChE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IAEvE,kDAAkD;IAClD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAEnD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/url.d.ts

@@ -0,0 +1,11 @@
+/**
+ * URL validation utilities
+ *
+ * Hostname allowlist and validation for Jamf documentation URLs.
+ * Shared by both the schema layer and the scraper service.
+ */
+/** Allowed hostnames for URL validation. */
+export declare const ALLOWED_HOSTNAMES: Set<string>;
+/** Check whether a URL string points to an allowed Jamf documentation hostname. */
+export declare function isAllowedHostname(urlStr: string): boolean;
+//# sourceMappingURL=url.d.ts.map

package/dist/utils/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/utils/url.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,aAI5B,CAAC;AAEH,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOzD"}

package/dist/utils/url.js

@@ -0,0 +1,23 @@
+/**
+ * URL validation utilities
+ *
+ * Hostname allowlist and validation for Jamf documentation URLs.
+ * Shared by both the schema layer and the scraper service.
+ */
+/** Allowed hostnames for URL validation. */
+export const ALLOWED_HOSTNAMES = new Set([
+    'learn.jamf.com',
+    'learn-be.jamf.com',
+    'docs.jamf.com',
+]);
+/** Check whether a URL string points to an allowed Jamf documentation hostname. */
+export function isAllowedHostname(urlStr) {
+    try {
+        const url = new URL(urlStr);
+        return ALLOWED_HOSTNAMES.has(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=url.js.map

package/dist/utils/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/utils/url.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,gBAAgB;IAChB,mBAAmB;IACnB,eAAe;CAChB,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@get-technology-inc/jamf-docs-mcp-server",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "MCP Server for accessing Jamf Documentation (learn.jamf.com)",
   "main": "dist/index.js",
   "type": "module",
@@ -11,10 +11,13 @@
     "build": "tsc",
     "dev": "tsx watch src/index.ts",
     "start": "node dist/index.js",
+    "start:http": "node dist/index.js --transport http",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:unit": "vitest run test/unit",
     "test:integration": "vitest run test/integration",
+    "test:e2e": "vitest run test/e2e",
+    "test:all": "vitest run test/unit && vitest run test/integration && vitest run test/e2e",
     "test:coverage": "vitest run --coverage",
     "test:inspector": "npx @modelcontextprotocol/inspector node dist/index.js",
     "lint": "eslint src/**/*.ts",
@@ -37,18 +40,18 @@
   "author": "GET Technology Inc.",
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "axios": "^1.7.0",
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "axios": "^1.13.6",
     "cheerio": "^1.0.0",
     "turndown": "^7.2.0",
-    "zod": "^3.23.0"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@eslint/js": "^9.17.0",
     "@types/node": "^25.0.9",
     "@types/turndown": "^5.0.5",
     "@vitest/coverage-v8": "^4.0.17",
-    "eslint": "^9.17.0",
+    "eslint": "^9.39.4",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.18.0",