@kynver-app/mcp-estimator 0.2.8 → 0.2.11

package/dist/lib/mcp-sse-server.d.ts

@@ -23,6 +23,21 @@ export declare function headerValue(req: IncomingMessage, name: string): string
 export declare function timingSafeEqualString(a: string, b: string): boolean;
 export declare function hasForbiddenQueryAuth(url: URL): boolean;
 export declare function resolveListenHost(): string;
+/** Positive integer from env, else fallback. */
+export declare function intFromEnv(name: string, fallback: number): number;
+/**
+ * Resolve + validate the Kynver API origin the server sends bearer keys to.
+ * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
+ * anything that isn't https (http is allowed only for localhost dev).
+ */
+export declare function resolveApiBaseUrl(): string;
+/** First client IP from x-forwarded-for, else the socket address. */
+export declare function clientIp(req: IncomingMessage): string;
+type RateLimiter = {
+    check: (key: string) => boolean;
+};
+/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
+export declare function createFixedWindowRateLimiter(limit: number, windowMs: number): RateLimiter;
 export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<unknown>;
 export declare function validateMcporterServerName(name: string): string;
 export declare function startKynverMcpSseServer(options: StartKynverMcpSseServerOptions): void;

package/dist/lib/mcp-sse-server.js

@@ -26,6 +26,61 @@ export function resolveListenHost() {
     const configured = process.env.MCP_SSE_HOST?.trim();
     return configured || "127.0.0.1";
 }
+/** Positive integer from env, else fallback. */
+export function intFromEnv(name, fallback) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+/**
+ * Resolve + validate the Kynver API origin the server sends bearer keys to.
+ * A poisoned/misconfigured value would exfiltrate API keys, so fail closed on
+ * anything that isn't https (http is allowed only for localhost dev).
+ */
+export function resolveApiBaseUrl() {
+    const raw = process.env.KYNVER_API_URL?.trim();
+    if (!raw)
+        return "https://kynver.com";
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`Invalid KYNVER_API_URL: ${raw}`);
+    }
+    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && isLocalhost)) {
+        throw new Error(`KYNVER_API_URL must be https (got "${parsed.protocol}//${parsed.hostname}"); API keys are sent to this origin.`);
+    }
+    return raw.replace(/\/$/, "");
+}
+/** First client IP from x-forwarded-for, else the socket address. */
+export function clientIp(req) {
+    const fwd = headerValue(req, "x-forwarded-for");
+    if (fwd)
+        return fwd.split(",")[0].trim();
+    return req.socket?.remoteAddress ?? "unknown";
+}
+/** Minimal in-process fixed-window limiter (the SSE server is single-process). */
+export function createFixedWindowRateLimiter(limit, windowMs) {
+    const hits = new Map();
+    return {
+        check(key) {
+            const now = Date.now();
+            const entry = hits.get(key);
+            if (!entry || now >= entry.resetAt) {
+                hits.set(key, { count: 1, resetAt: now + windowMs });
+                return true;
+            }
+            if (entry.count >= limit)
+                return false;
+            entry.count += 1;
+            return true;
+        },
+    };
+}
 export function parseJsonBody(req, maxBytes = MAX_SSE_BODY_BYTES) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -106,14 +161,37 @@ function json(res, status, body) {
 }
 export function startKynverMcpSseServer(options) {
     const port = parseInt(process.env.PORT ?? String(options.defaultPort), 10);
-    const baseUrl = process.env.KYNVER_API_URL ?? "https://kynver.com";
+    const baseUrl = resolveApiBaseUrl();
     const serviceSecret = process.env.KYNVER_SERVICE_SECRET ?? "";
     const host = resolveListenHost();
     const sessions = {};
+    // Resource / abuse limits (env-overridable; in-process per server).
+    const maxSessions = intFromEnv("MCP_SSE_MAX_SESSIONS", 200);
+    const maxSessionsPerUser = intFromEnv("MCP_SSE_MAX_SESSIONS_PER_USER", 20);
+    const idleTimeoutMs = intFromEnv("MCP_SSE_IDLE_TIMEOUT_MS", 5 * 60 * 1000);
+    const rateLimitPerMin = intFromEnv("MCP_SSE_RATE_LIMIT_PER_MIN", 120);
+    const rejectQueryApiKey = /^(1|true|yes)$/i.test(process.env.MCP_SSE_REJECT_QUERY_APIKEY ?? "");
+    const rateLimiter = createFixedWindowRateLimiter(rateLimitPerMin, 60 * 1000);
+    // Close idle SSE sessions so a flood of half-open connections can't pin memory.
+    const idleSweep = setInterval(() => {
+        const now = Date.now();
+        for (const [sid, entry] of Object.entries(sessions)) {
+            if (now - entry.lastActivity > idleTimeoutMs) {
+                delete sessions[sid];
+                void entry.transport.close().catch(() => { });
+            }
+        }
+    }, 60 * 1000);
+    idleSweep.unref?.();
     const httpServer = createServer(async (req, res) => {
         const url = parseUrl(req, port);
         const path = url.pathname;
         if (req.method === "GET" && path === "/sse") {
+            // Pre-auth rate limit by client IP (we don't know the user yet).
+            if (!rateLimiter.check(`sse:${clientIp(req)}`)) {
+                json(res, 429, { error: "Too many requests. Slow down and retry." });
+                return;
+            }
             if (hasForbiddenQueryAuth(url)) {
                 json(res, 400, {
                     error: "Internal auth via query params is not allowed. Use X-Kynver-User-Id and X-Kynver-Service-Secret headers.",
@@ -121,6 +199,12 @@ export function startKynverMcpSseServer(options) {
                 return;
             }
             if (url.searchParams.has("apiKey")) {
+                if (rejectQueryApiKey) {
+                    json(res, 400, {
+                        error: "apiKey via query param is disabled. Use Authorization: Bearer <key>.",
+                    });
+                    return;
+                }
                 console.warn("[MCP SSE] WARNING: apiKey in query string may leak via logs. Prefer Authorization header when your client supports it.");
             }
             let userId = null;
@@ -144,9 +228,20 @@ export function startKynverMcpSseServer(options) {
                 });
                 return;
             }
+            // Connection caps — bound total + per-user concurrent SSE sessions so an
+            // authenticated caller can't exhaust memory/sockets by opening many.
+            const allEntries = Object.values(sessions);
+            if (allEntries.length >= maxSessions) {
+                json(res, 503, { error: "Server at capacity. Try again shortly." });
+                return;
+            }
+            if (allEntries.filter((s) => s.userId === userId).length >= maxSessionsPerUser) {
+                json(res, 429, { error: "Too many concurrent connections for this account." });
+                return;
+            }
             console.log(`[MCP SSE] New connection (${options.label}, user: ${userId.slice(0, 8)}...)`);
             const transport = new SSEServerTransport("/messages", res);
-            sessions[transport.sessionId] = { transport, userId, auth };
+            sessions[transport.sessionId] = { transport, userId, auth, lastActivity: Date.now() };
             res.on("close", () => {
                 delete sessions[transport.sessionId];
             });
@@ -165,6 +260,12 @@ export function startKynverMcpSseServer(options) {
                 json(res, 401, { error: "Unauthorized. Re-send the same credentials used to open the SSE session." });
                 return;
             }
+            // Per-user rate limit on tool/message traffic.
+            if (!rateLimiter.check(`msg:${entry.userId}`)) {
+                json(res, 429, { error: "Too many requests. Slow down and retry." });
+                return;
+            }
+            entry.lastActivity = Date.now();
             try {
                 const body = await parseJsonBody(req);
                 await options.requestContext.run({ userId: entry.userId }, async () => {

package/dist/server.js

@@ -4,15 +4,20 @@
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import * as catalogTools from "./tools/catalog-tools.js";
+import * as priceCatalogTools from "./tools/price-catalog-tools.js";
 import * as estimateTools from "./tools/estimate-tools.js";
 import * as templateTools from "./tools/template-tools.js";
 import * as versionTools from "./tools/version-tools.js";
 import * as photoTools from "./tools/photo-tools.js";
 import * as statsPdfTools from "./tools/stats-pdf-tools.js";
+import * as emailPdfTools from "./tools/email-pdf-tools.js";
 import * as visionTools from "./tools/vision-tools.js";
 import * as companyTools from "./tools/company-tools.js";
 import * as clientTools from "./tools/client-tools.js";
 import * as takeoffTools from "./tools/takeoff-tools.js";
+import * as intakeTools from "./tools/intake-tools.js";
+import * as remodelEstimateTools from "./tools/remodel-estimate-tools.js";
+import * as remodelDeliverableTools from "./tools/remodel-deliverable-tools.js";
 import { readOwnPackageVersion } from "./lib/package-version.js";
 const PACKAGE_VERSION = readOwnPackageVersion(import.meta.url);
 function toolResult(text) {
@@ -34,6 +39,11 @@ export function createEstimatorServer() {
     register(catalogTools.getConfig.name, { description: catalogTools.getConfig.description, inputSchema: catalogTools.getConfig.inputSchemaZod }, (args) => catalogTools.getConfig.execute(args));
     register(catalogTools.updateConfig.name, { description: catalogTools.updateConfig.description, inputSchema: catalogTools.updateConfig.inputSchemaZod }, (args) => catalogTools.updateConfig.execute(args));
     register(catalogTools.importTemplate.name, { description: catalogTools.importTemplate.description, inputSchema: catalogTools.importTemplate.inputSchemaZod }, (args) => catalogTools.importTemplate.execute(args));
+    // --- Price catalog tools (4) ---
+    register(priceCatalogTools.listPriceCatalogs.name, { description: priceCatalogTools.listPriceCatalogs.description, inputSchema: priceCatalogTools.listPriceCatalogs.inputSchemaZod }, (args) => priceCatalogTools.listPriceCatalogs.execute(args));
+    register(priceCatalogTools.getPriceCatalog.name, { description: priceCatalogTools.getPriceCatalog.description, inputSchema: priceCatalogTools.getPriceCatalog.inputSchemaZod }, (args) => priceCatalogTools.getPriceCatalog.execute(args));
+    register(priceCatalogTools.resolvePrice.name, { description: priceCatalogTools.resolvePrice.description, inputSchema: priceCatalogTools.resolvePrice.inputSchemaZod }, (args) => priceCatalogTools.resolvePrice.execute(args));
+    register(priceCatalogTools.seedPriceCatalog.name, { description: priceCatalogTools.seedPriceCatalog.description, inputSchema: priceCatalogTools.seedPriceCatalog.inputSchemaZod }, (args) => priceCatalogTools.seedPriceCatalog.execute(args));
     // --- Estimate tools (11) ---
     register(estimateTools.createReplacement.name, { description: estimateTools.createReplacement.description, inputSchema: estimateTools.createReplacement.inputSchemaZod }, (args) => estimateTools.createReplacement.execute(args));
     register(estimateTools.createRepair.name, { description: estimateTools.createRepair.description, inputSchema: estimateTools.createRepair.inputSchemaZod }, (args) => estimateTools.createRepair.execute(args));
@@ -46,6 +56,9 @@ export function createEstimatorServer() {
     register(estimateTools.updateEstimate.name, { description: estimateTools.updateEstimate.description, inputSchema: estimateTools.updateEstimate.inputSchemaZod }, (args) => estimateTools.updateEstimate.execute(args));
     register(estimateTools.deleteEstimate.name, { description: estimateTools.deleteEstimate.description, inputSchema: estimateTools.deleteEstimate.inputSchemaZod }, (args) => estimateTools.deleteEstimate.execute(args));
     register(estimateTools.duplicateEstimate.name, { description: estimateTools.duplicateEstimate.description, inputSchema: estimateTools.duplicateEstimate.inputSchemaZod }, (args) => estimateTools.duplicateEstimate.execute(args));
+    register(remodelEstimateTools.buildRemodelEstimate.name, { description: remodelEstimateTools.buildRemodelEstimate.description, inputSchema: remodelEstimateTools.buildRemodelEstimate.inputSchemaZod }, (args) => remodelEstimateTools.buildRemodelEstimate.execute(args));
+    register(remodelDeliverableTools.buildRemodelDeliverable.name, { description: remodelDeliverableTools.buildRemodelDeliverable.description, inputSchema: remodelDeliverableTools.buildRemodelDeliverable.inputSchemaZod }, (args) => remodelDeliverableTools.buildRemodelDeliverable.execute(args));
+    register(remodelDeliverableTools.draftRemodelDeliverable.name, { description: remodelDeliverableTools.draftRemodelDeliverable.description, inputSchema: remodelDeliverableTools.draftRemodelDeliverable.inputSchemaZod }, (args) => remodelDeliverableTools.draftRemodelDeliverable.execute(args));
     // --- Template tools (4) ---
     register(templateTools.saveTemplate.name, { description: templateTools.saveTemplate.description, inputSchema: templateTools.saveTemplate.inputSchemaZod }, (args) => templateTools.saveTemplate.execute(args));
     register(templateTools.listTemplates.name, { description: templateTools.listTemplates.description, inputSchema: templateTools.listTemplates.inputSchemaZod }, (args) => templateTools.listTemplates.execute(args));
@@ -62,6 +75,7 @@ export function createEstimatorServer() {
     register(statsPdfTools.getStats.name, { description: statsPdfTools.getStats.description, inputSchema: statsPdfTools.getStats.inputSchemaZod }, (args) => statsPdfTools.getStats.execute(args));
     register(statsPdfTools.exportPdf.name, { description: statsPdfTools.exportPdf.description, inputSchema: statsPdfTools.exportPdf.inputSchemaZod }, (args) => statsPdfTools.exportPdf.execute(args));
     register(statsPdfTools.updateOutputConfig.name, { description: statsPdfTools.updateOutputConfig.description, inputSchema: statsPdfTools.updateOutputConfig.inputSchemaZod }, (args) => statsPdfTools.updateOutputConfig.execute(args));
+    register(emailPdfTools.emailPdf.name, { description: emailPdfTools.emailPdf.description, inputSchema: emailPdfTools.emailPdf.inputSchemaZod }, (args) => emailPdfTools.emailPdf.execute(args));
     // --- Vision tools (2) ---
     register(visionTools.analyzePhotos.name, { description: visionTools.analyzePhotos.description, inputSchema: visionTools.analyzePhotos.inputSchemaZod }, (args) => visionTools.analyzePhotos.execute(args));
     register(visionTools.analyzeDocument.name, { description: visionTools.analyzeDocument.description, inputSchema: visionTools.analyzeDocument.inputSchemaZod }, (args) => visionTools.analyzeDocument.execute(args));
@@ -94,5 +108,7 @@ export function createEstimatorServer() {
     register(takeoffTools.requestEstimateApproval.name, { description: takeoffTools.requestEstimateApproval.description, inputSchema: takeoffTools.requestEstimateApproval.inputSchemaZod }, (args) => takeoffTools.requestEstimateApproval.execute(args));
     register(takeoffTools.approveEstimate.name, { description: takeoffTools.approveEstimate.description, inputSchema: takeoffTools.approveEstimate.inputSchemaZod }, (args) => takeoffTools.approveEstimate.execute(args));
     register(takeoffTools.getEstimateApproval.name, { description: takeoffTools.getEstimateApproval.description, inputSchema: takeoffTools.getEstimateApproval.inputSchemaZod }, (args) => takeoffTools.getEstimateApproval.execute(args));
+    // --- Intake tools (1) ---
+    register(intakeTools.normalizeRemodelIntake.name, { description: intakeTools.normalizeRemodelIntake.description, inputSchema: intakeTools.normalizeRemodelIntake.inputSchemaZod }, (args) => intakeTools.normalizeRemodelIntake.execute(args));
     return server;
 }

package/dist/tools/catalog-tools.js

@@ -25,7 +25,7 @@ const reviewImportSchema = z.object({
         .array(z.object({
         index: z.number(),
         action: z.enum(["keep", "skip", "edit"]),
-        edits: z.record(z.unknown()).optional(),
+        edits: z.record(z.string(), z.unknown()).optional(),
     }))
         .optional(),
 });

package/dist/tools/email-pdf-tools.d.ts

@@ -0,0 +1,45 @@
+import { z } from "zod";
+declare const emailPdfSchema: z.ZodObject<{
+    estimateId: z.ZodString;
+    recipient: z.ZodOptional<z.ZodString>;
+    subject: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+    confirmExternalRecipient: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    estimateId: string;
+    confirmExternalRecipient: boolean;
+    message?: string | undefined;
+    recipient?: string | undefined;
+    subject?: string | undefined;
+}, {
+    estimateId: string;
+    message?: string | undefined;
+    recipient?: string | undefined;
+    subject?: string | undefined;
+    confirmExternalRecipient?: boolean | undefined;
+}>;
+export declare const emailPdf: {
+    name: string;
+    description: string;
+    inputSchemaZod: z.ZodObject<{
+        estimateId: z.ZodString;
+        recipient: z.ZodOptional<z.ZodString>;
+        subject: z.ZodOptional<z.ZodString>;
+        message: z.ZodOptional<z.ZodString>;
+        confirmExternalRecipient: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    }, "strip", z.ZodTypeAny, {
+        estimateId: string;
+        confirmExternalRecipient: boolean;
+        message?: string | undefined;
+        recipient?: string | undefined;
+        subject?: string | undefined;
+    }, {
+        estimateId: string;
+        message?: string | undefined;
+        recipient?: string | undefined;
+        subject?: string | undefined;
+        confirmExternalRecipient?: boolean | undefined;
+    }>;
+    execute: (args: z.infer<typeof emailPdfSchema>) => Promise<string>;
+};
+export {};

package/dist/tools/email-pdf-tools.js

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import * as client from "../lib/kynver-client.js";
+const emailPdfSchema = z.object({
+    estimateId: z.string(),
+    recipient: z.string().email().optional(),
+    subject: z.string().min(1).max(200).optional(),
+    message: z.string().min(1).max(10_000).optional(),
+    confirmExternalRecipient: z.boolean().optional().default(false),
+});
+export const emailPdf = {
+    name: "estimator_email_pdf",
+    description: "Email an estimate PDF to a recipient. Fetches and attaches the PDF server-side (no secrets exposed). Defaults to the account owner's email when recipient is omitted. Estimate client emails and linked client records are trusted without extra confirmation; any other address requires confirmExternalRecipient=true after explicit user confirmation. Respects the estimate approval gate before customer send. Returns send status and audit metadata.",
+    inputSchemaZod: emailPdfSchema,
+    execute: async (args) => {
+        if (!client.hasApiKey())
+            return client.noApiKeyMessage();
+        const { estimateId, ...body } = args;
+        const data = await client.post(`/estimator/estimates/${estimateId}/email-pdf`, body);
+        return JSON.stringify(data);
+    },
+};