@harness-engineering/mcp-server 0.5.2 → 0.5.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -29,8 +29,15 @@ export const generatePersonaArtifactsDefinition = {
29
29
  },
30
30
  };
31
31
  export async function handleGeneratePersonaArtifacts(input) {
32
+ if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.name)) {
33
+ return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.name}`)));
34
+ }
32
35
  const { loadPersona, generateRuntime, generateAgentsMd, generateCIWorkflow } = await import('@harness-engineering/cli');
33
- const filePath = path.join(resolvePersonasDir(), `${input.name}.yaml`);
36
+ const personasDir = resolvePersonasDir();
37
+ const filePath = path.join(personasDir, `${input.name}.yaml`);
38
+ if (!filePath.startsWith(personasDir)) {
39
+ return resultToMcpResponse(Err(new Error(`Invalid persona path: ${input.name}`)));
40
+ }
34
41
  const personaResult = loadPersona(filePath);
35
42
  if (!personaResult.ok)
36
43
  return resultToMcpResponse(personaResult);
@@ -81,8 +88,15 @@ export const runPersonaDefinition = {
81
88
  },
82
89
  };
83
90
  export async function handleRunPersona(input) {
91
+ if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.persona)) {
92
+ return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.persona}`)));
93
+ }
84
94
  const { loadPersona, runPersona, executeSkill } = await import('@harness-engineering/cli');
85
- const filePath = path.join(resolvePersonasDir(), `${input.persona}.yaml`);
95
+ const personasDir = resolvePersonasDir();
96
+ const filePath = path.join(personasDir, `${input.persona}.yaml`);
97
+ if (!filePath.startsWith(personasDir)) {
98
+ return resultToMcpResponse(Err(new Error(`Invalid persona path: ${input.persona}`)));
99
+ }
86
100
  const personaResult = loadPersona(filePath);
87
101
  if (!personaResult.ok)
88
102
  return resultToMcpResponse(personaResult);
@@ -24,7 +24,13 @@ export const runSkillDefinition = {
24
24
  };
25
25
  export async function handleRunSkill(input) {
26
26
  const skillsDir = resolveSkillsDir();
27
+ if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.skill)) {
28
+ return resultToMcpResponse(Err(new Error(`Invalid skill name: ${input.skill}`)));
29
+ }
27
30
  const skillDir = path.join(skillsDir, input.skill);
31
+ if (!skillDir.startsWith(skillsDir)) {
32
+ return resultToMcpResponse(Err(new Error(`Invalid skill path: ${input.skill}`)));
33
+ }
28
34
  if (!fs.existsSync(skillDir)) {
29
35
  return resultToMcpResponse(Err(new Error(`Skill not found: ${input.skill}`)));
30
36
  }
package/package.json CHANGED
@@ -1,14 +1,14 @@
1
1
  {
2
2
  "name": "@harness-engineering/mcp-server",
3
- "version": "0.5.2",
3
+ "version": "0.5.3",
4
4
  "description": "MCP server for Harness Engineering toolkit",
5
5
  "type": "module",
6
- "main": "./dist/index.js",
7
- "types": "./dist/index.d.ts",
6
+ "main": "./dist/src/index.js",
7
+ "types": "./dist/src/index.d.ts",
8
8
  "exports": {
9
9
  ".": {
10
- "types": "./dist/index.d.ts",
11
- "import": "./dist/index.js"
10
+ "types": "./dist/src/index.d.ts",
11
+ "import": "./dist/src/index.js"
12
12
  }
13
13
  },
14
14
  "bin": {
@@ -24,15 +24,15 @@
24
24
  "yaml": "^2.3.0",
25
25
  "handlebars": "^4.7.0",
26
26
  "@harness-engineering/core": "0.8.0",
27
- "@harness-engineering/cli": "1.6.2",
28
- "@harness-engineering/graph": "0.2.1",
29
- "@harness-engineering/linter-gen": "0.1.0",
30
- "@harness-engineering/types": "0.1.0"
27
+ "@harness-engineering/graph": "0.2.2",
28
+ "@harness-engineering/types": "0.1.0",
29
+ "@harness-engineering/cli": "1.7.0",
30
+ "@harness-engineering/linter-gen": "0.1.1"
31
31
  },
32
32
  "devDependencies": {
33
- "@types/node": "^20.0.0",
34
- "typescript": "^5.0.0",
35
- "vitest": "^2.0.0"
33
+ "@types/node": "^22.0.0",
34
+ "typescript": "^5.3.3",
35
+ "vitest": "^4.0.18"
36
36
  },
37
37
  "license": "MIT",
38
38
  "publishConfig": {