@imenam/mcp-documentor 1.0.55 → 1.0.56

package/README.md

@@ -58,6 +58,7 @@ Add to your MCP client config (e.g. Cursor `mcp.json`):
 | `MCP_DOCUMENTOR_OPENAI_MODEL` | No | Embedding model (default: `text-embedding-3-small`) |
 | `PROXY_URL` | No | URL of the proxy server to register and launch the GUI |
 | `MCP_DATA_DIR` | No | Overrides the default data directory (see Data storage) |
+| `READ_ONLY` | No | When set to `1`/`true`/`yes`, disables all create/update/delete tools and GUI write actions (read-only mode) |
 
 Optional `.env` at the package root (directory containing `package.json` discovered from the installed binary) is loaded when present.
 

package/dist/shared/read-only.d.ts

@@ -0,0 +1,4 @@
+/** True quand la variable d'environnement READ_ONLY est activée. */
+export declare function isReadOnly(): boolean;
+/** Outils MCP qui créent / modifient / suppriment de la donnée. */
+export declare const WRITE_TOOLS: Set<string>;

package/dist/shared/read-only.js

@@ -0,0 +1,11 @@
+/** True quand la variable d'environnement READ_ONLY est activée. */
+export function isReadOnly() {
+    const v = (process.env.READ_ONLY ?? "").trim().toLowerCase();
+    return v === "1" || v === "true" || v === "yes";
+}
+/** Outils MCP qui créent / modifient / suppriment de la donnée. */
+export const WRITE_TOOLS = new Set([
+    "create_doc", "update_doc", "patch_doc", "move_doc", "delete_doc",
+    "restore_doc_version", "refresh_file_snapshot", "reindex_embeddings",
+    "prepare_export_bundle", "delete_export_bundle", "upload_image",
+]);

package/dist/src/gui-worker.js

@@ -4,6 +4,7 @@ import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { ProxyClient } from "@imenam/mcp-gui-interface";
 import { IPCMessageSchema } from "../shared/schemas/doc.schema.js";
+import { isReadOnly } from "../shared/read-only.js";
 import path from "path";
 import fs from "fs";
 import { execFile } from "child_process";
@@ -184,6 +185,23 @@ function setupIpcErrorHandlers() {
     });
 }
 // --- HTTP Routes ---
+// Bloque les écritures GUI en mode lecture seule (READ_ONLY).
+const READ_ONLY_WRITE_ROUTES = [
+    { method: "POST", prefix: "/api/doc" },
+    { method: "PUT", prefix: "/api/doc/" },
+    { method: "POST", prefix: "/api/images" },
+    { method: "POST", prefix: "/api/configurations/apply" },
+];
+app.use("*", async (c, next) => {
+    if (isReadOnly()) {
+        const m = c.req.method;
+        const p = c.req.path;
+        if (READ_ONLY_WRITE_ROUTES.some((r) => r.method === m && p.startsWith(r.prefix))) {
+            return c.json({ error: "READ_ONLY mode: write operations are disabled" }, 403);
+        }
+    }
+    return next();
+});
 app.get("/proxy/health", (c) => {
     const memory = process.memoryUsage();
     return c.json({