@kaddo/mcp 3.126.1 → 3.128.0

package/dist/index.js

@@ -2619,6 +2619,29 @@ var RESOURCE_TYPES = [
   "other"
 ];
 var INTERFACE_TYPES = ["cli", "mcp", "api", "sql", "sdk", "iac", "console", "other"];
+var REDACTED_COORDINATE = "\u2022\u2022\u2022\u2022 (hidden \u2014 store as an authentication reference)";
+var SECRET_KEY_RE = /(pass(word|phrase)?|secret|token|api[_-]?key|\bkey\b|credential|private|auth[_-]?token|access[_-]?key)/i;
+var SECRET_VALUE_PATTERNS = [
+  /\b(AKIA|ASIA)[A-Z0-9]{8,}/,
+  // AWS access key id
+  /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/,
+  // GitHub tokens
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
+  // Slack tokens
+  /\bsk-[A-Za-z0-9]{16,}/,
+  // OpenAI-style secret keys
+  /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\./,
+  // JWT
+  /\w+=[^;\s]{6,}/,
+  // key=value credential fragments
+  /^[A-Za-z0-9+/]{40,}={0,2}$/
+  // long opaque base64 blob
+];
+function looksLikeSecretCoordinate(key, value) {
+  if (SECRET_KEY_RE.test(key)) return true;
+  const v = value.trim();
+  return SECRET_VALUE_PATTERNS.some((re) => re.test(v));
+}
 function str(v) {
   return typeof v === "string" && v.trim() ? v.trim() : null;
 }
@@ -2647,6 +2670,29 @@ function parseInterfaces(v) {
   }
   return out;
 }
+function parseConnectionProfiles(v) {
+  if (!Array.isArray(v)) return [];
+  const out = [];
+  for (const raw of v) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const o2 = raw;
+    const coords = [];
+    const rawCoords = o2.coordinates;
+    if (rawCoords && typeof rawCoords === "object" && !Array.isArray(rawCoords)) {
+      for (const [key, val] of Object.entries(rawCoords)) {
+        const k2 = key.trim();
+        const value = val == null ? "" : String(val).trim();
+        if (!k2 || !value) continue;
+        coords.push({ key: k2, value: looksLikeSecretCoordinate(k2, value) ? REDACTED_COORDINATE : value });
+      }
+    }
+    const environment = str(o2.environment);
+    const iface = str(o2.interface);
+    if (!environment && !iface && coords.length === 0) continue;
+    out.push({ environment, interface: iface, coordinates: coords });
+  }
+  return out;
+}
 function parseBoundaries(v) {
   if (!v || typeof v !== "object" || Array.isArray(v)) return {};
   const out = {};
@@ -2695,6 +2741,7 @@ function toDetail(filePath, relPath, raw) {
       const a2 = parseAuth(fm.authentication);
       return { authRefs: a2.refs, authMode: a2.mode };
     })(),
+    connectionProfiles: parseConnectionProfiles(fm.connection_profiles),
     markdownBody: body
   };
 }
@@ -13897,6 +13944,29 @@ function suggestInitiativesForExternalItem(dir, integration, externalId) {
   );
 }
 var RESOURCE_ARTIFACT_TYPE2 = "project-resource";
+var REDACTED_COORDINATE2 = "\u2022\u2022\u2022\u2022 (hidden \u2014 store as an authentication reference)";
+var SECRET_KEY_RE2 = /(pass(word|phrase)?|secret|token|api[_-]?key|\bkey\b|credential|private|auth[_-]?token|access[_-]?key)/i;
+var SECRET_VALUE_PATTERNS2 = [
+  /\b(AKIA|ASIA)[A-Z0-9]{8,}/,
+  // AWS access key id
+  /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/,
+  // GitHub tokens
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
+  // Slack tokens
+  /\bsk-[A-Za-z0-9]{16,}/,
+  // OpenAI-style secret keys
+  /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\./,
+  // JWT
+  /\w+=[^;\s]{6,}/,
+  // key=value credential fragments
+  /^[A-Za-z0-9+/]{40,}={0,2}$/
+  // long opaque base64 blob
+];
+function looksLikeSecretCoordinate2(key, value) {
+  if (SECRET_KEY_RE2.test(key)) return true;
+  const v = value.trim();
+  return SECRET_VALUE_PATTERNS2.some((re) => re.test(v));
+}
 function str3(v) {
   return typeof v === "string" && v.trim() ? v.trim() : null;
 }
@@ -13925,6 +13995,29 @@ function parseInterfaces2(v) {
   }
   return out;
 }
+function parseConnectionProfiles2(v) {
+  if (!Array.isArray(v)) return [];
+  const out = [];
+  for (const raw of v) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const o2 = raw;
+    const coords = [];
+    const rawCoords = o2.coordinates;
+    if (rawCoords && typeof rawCoords === "object" && !Array.isArray(rawCoords)) {
+      for (const [key, val] of Object.entries(rawCoords)) {
+        const k2 = key.trim();
+        const value = val == null ? "" : String(val).trim();
+        if (!k2 || !value) continue;
+        coords.push({ key: k2, value: looksLikeSecretCoordinate2(k2, value) ? REDACTED_COORDINATE2 : value });
+      }
+    }
+    const environment = str3(o2.environment);
+    const iface = str3(o2.interface);
+    if (!environment && !iface && coords.length === 0) continue;
+    out.push({ environment, interface: iface, coordinates: coords });
+  }
+  return out;
+}
 function parseBoundaries2(v) {
   if (!v || typeof v !== "object" || Array.isArray(v)) return {};
   const out = {};
@@ -13973,6 +14066,7 @@ function toDetail2(filePath, relPath, raw) {
       const a2 = parseAuth2(fm.authentication);
       return { authRefs: a2.refs, authMode: a2.mode };
     })(),
+    connectionProfiles: parseConnectionProfiles2(fm.connection_profiles),
     markdownBody: body
   };
 }
@@ -21442,6 +21536,20 @@ function validateResource(dir, input) {
       findings.push({ level: "warning", message: `Unknown access interface type "${i.type}".` });
     }
   }
+  for (const p of input.connectionProfiles ?? []) {
+    const where = p.environment ? ` in environment "${p.environment}"` : "";
+    for (const c of p.coordinates ?? []) {
+      const key = (c?.key ?? "").trim();
+      const value = (c?.value ?? "").trim();
+      if (!key || !value) continue;
+      if (looksLikeSecretCoordinate(key, value)) {
+        findings.push({
+          level: "error",
+          message: `Connection coordinate "${key}"${where} looks like a secret value. Store credentials as authentication references, not connection coordinates.`
+        });
+      }
+    }
+  }
   const mapped = loadMappedModules(dir).map((m2) => m2.id);
   if (mapped.length > 0) {
     const refs = /* @__PURE__ */ new Set();
@@ -21468,6 +21576,22 @@ function buildFrontmatter(id, input, base = {}) {
   if (input.modules != null) data.modules = input.modules;
   if (input.accessInterfaces != null) data.access_interfaces = input.accessInterfaces;
   if (input.accessBoundaries != null) data.access_boundaries = input.accessBoundaries;
+  if (input.connectionProfiles != null) {
+    data.connection_profiles = input.connectionProfiles.map((p) => {
+      const coordinates = {};
+      for (const c of p.coordinates ?? []) {
+        const key = (c?.key ?? "").trim();
+        const value = (c?.value ?? "").trim();
+        if (!key || !value || looksLikeSecretCoordinate(key, value)) continue;
+        coordinates[key] = value;
+      }
+      const entry = {};
+      if (p.environment?.trim()) entry.environment = p.environment.trim();
+      if (p.interface?.trim()) entry.interface = p.interface.trim();
+      if (Object.keys(coordinates).length) entry.coordinates = coordinates;
+      return entry;
+    }).filter((e) => Object.keys(e).length > 0);
+  }
   if (input.authentication != null) {
     const mode = input.authentication.mode;
     const refs = sanitizeRefs(input.authentication.refs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaddo/mcp",
-  "version": "3.126.1",
+  "version": "3.128.0",
   "description": "MCP server for Kaddo project knowledge: read-only resources/tools/prompts plus safe derived generation under .kaddo/.",
   "license": "MIT",
   "repository": {