@llmindset/hf-mcp 0.3.2 → 0.3.3

package/src/space/commands/invoke.ts

@@ -5,7 +5,7 @@ import type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/proto
 import { analyzeSchemaComplexity, validateParameters, applyDefaults } from '../utils/schema-validator.js';
 import { formatComplexSchemaError, formatValidationError } from '../utils/parameter-formatter.js';
 import { callGradioToolWithHeaders } from '../utils/gradio-caller.js';
-import { parseGradioSchemaResponse, normalizeParsedTools } from '../utils/gradio-schema.js';
+import { fetchGradioSchema, fetchSpaceMetadata } from '../utils/space-http.js';
 
 /**
  * Invokes a Gradio space with provided parameters
@@ -112,90 +112,3 @@ export async function invokeSpace(
 		};
 	}
 }
-
-/**
- * Fetches space metadata from HuggingFace API
- */
-async function fetchSpaceMetadata(
-	spaceName: string,
-	hfToken?: string
-): Promise<{ subdomain: string; private: boolean }> {
-	const url = `https://huggingface.co/api/spaces/${spaceName}`;
-	const headers: Record<string, string> = {};
-
-	if (hfToken) {
-		headers['Authorization'] = `Bearer ${hfToken}`;
-	}
-
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), 10000);
-
-	try {
-		const response = await fetch(url, {
-			headers,
-			signal: controller.signal,
-		});
-
-		clearTimeout(timeoutId);
-
-		if (!response.ok) {
-			throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-		}
-
-		const info = (await response.json()) as {
-			subdomain?: string;
-			private?: boolean;
-		};
-
-		if (!info.subdomain) {
-			throw new Error('Space does not have a subdomain');
-		}
-
-		return {
-			subdomain: info.subdomain,
-			private: info.private || false,
-		};
-	} finally {
-		clearTimeout(timeoutId);
-	}
-}
-
-/**
- * Fetches schema from Gradio endpoint
- */
-async function fetchGradioSchema(subdomain: string, isPrivate: boolean, hfToken?: string): Promise<Tool[]> {
-	const schemaUrl = `https://${subdomain}.hf.space/gradio_api/mcp/schema`;
-
-	const headers: Record<string, string> = {
-		'Content-Type': 'application/json',
-	};
-
-	if (isPrivate && hfToken) {
-		headers['X-HF-Authorization'] = `Bearer ${hfToken}`;
-	}
-
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), 10000);
-
-	try {
-		const response = await fetch(schemaUrl, {
-			method: 'GET',
-			headers,
-			signal: controller.signal,
-		});
-
-		clearTimeout(timeoutId);
-
-		if (!response.ok) {
-			throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-		}
-
-		const schemaResponse = (await response.json()) as unknown;
-
-			// Parse schema response (handle both array and object formats)
-			const parsed = parseGradioSchemaResponse(schemaResponse);
-			return normalizeParsedTools(parsed);
-		} finally {
-			clearTimeout(timeoutId);
-		}
-	}

package/src/space/commands/view-parameters.ts

@@ -2,6 +2,7 @@ import type { ToolResult } from '../../types/tool-result.js';
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
 import { analyzeSchemaComplexity } from '../utils/schema-validator.js';
 import { formatParameters, formatComplexSchemaError } from '../utils/parameter-formatter.js';
+import { fetchGradioSchema, fetchSpaceMetadata } from '../utils/space-http.js';
 
 /**
  * Fetches space metadata and schema to discover parameters
@@ -56,7 +57,8 @@ export async function viewParameters(spaceName: string, hfToken?: string): Promi
 		let formattedError = `Error fetching parameters for space '${spaceName}': ${errorMessage}`;
 
 		if (is404) {
-			formattedError += '\n\nNote: The space MUST be an MCP enabled space. Use the `space_search` tool to find MCP enabled spaces.';
+			formattedError +=
+				'\n\nNote: The space MUST be an MCP enabled space. Use the `space_search` tool to find MCP enabled spaces.';
 		}
 
 		return {
@@ -67,138 +69,3 @@ export async function viewParameters(spaceName: string, hfToken?: string): Promi
 		};
 	}
 }
-
-/**
- * Fetches space metadata from HuggingFace API
- */
-async function fetchSpaceMetadata(
-	spaceName: string,
-	hfToken?: string
-): Promise<{ subdomain: string; private: boolean }> {
-	const url = `https://huggingface.co/api/spaces/${spaceName}`;
-	const headers: Record<string, string> = {};
-
-	if (hfToken) {
-		headers['Authorization'] = `Bearer ${hfToken}`;
-	}
-
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), 10000);
-
-	try {
-		const response = await fetch(url, {
-			headers,
-			signal: controller.signal,
-		});
-
-		clearTimeout(timeoutId);
-
-		if (!response.ok) {
-			throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-		}
-
-		const info = (await response.json()) as {
-			subdomain?: string;
-			private?: boolean;
-		};
-
-		if (!info.subdomain) {
-			throw new Error('Space does not have a subdomain');
-		}
-
-		return {
-			subdomain: info.subdomain,
-			private: info.private || false,
-		};
-	} finally {
-		clearTimeout(timeoutId);
-	}
-}
-
-/**
- * Fetches schema from Gradio endpoint
- */
-async function fetchGradioSchema(subdomain: string, isPrivate: boolean, hfToken?: string): Promise<Tool[]> {
-	const schemaUrl = `https://${subdomain}.hf.space/gradio_api/mcp/schema`;
-
-	const headers: Record<string, string> = {
-		'Content-Type': 'application/json',
-	};
-
-	if (isPrivate && hfToken) {
-		headers['X-HF-Authorization'] = `Bearer ${hfToken}`;
-	}
-
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), 10000);
-
-	try {
-		const response = await fetch(schemaUrl, {
-			method: 'GET',
-			headers,
-			signal: controller.signal,
-		});
-
-		clearTimeout(timeoutId);
-
-		if (!response.ok) {
-			throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-		}
-
-		const schemaResponse = (await response.json()) as unknown;
-
-		// Parse schema response (handle both array and object formats)
-		return parseSchemaResponse(schemaResponse);
-	} finally {
-		clearTimeout(timeoutId);
-	}
-}
-
-/**
- * Parses schema response and extracts tools
- */
-function parseSchemaResponse(schemaResponse: unknown): Tool[] {
-	const tools: Tool[] = [];
-
-	if (Array.isArray(schemaResponse)) {
-		// Array format: [{ name: "toolName", description: "...", inputSchema: {...} }, ...]
-		for (const item of schemaResponse) {
-			if (
-				typeof item === 'object' &&
-				item !== null &&
-				'name' in item &&
-				'inputSchema' in item
-			) {
-				const itemRecord = item as Record<string, unknown>;
-				if (typeof itemRecord.name === 'string') {
-					const tool = itemRecord as { name: string; description?: string; inputSchema: unknown };
-					tools.push({
-						name: tool.name,
-						description: tool.description || `${tool.name} tool`,
-						inputSchema: {
-							type: 'object',
-							...(tool.inputSchema as Record<string, unknown>),
-						},
-					});
-				}
-			}
-		}
-	} else if (typeof schemaResponse === 'object' && schemaResponse !== null) {
-		// Object format: { "toolName": { properties: {...}, required: [...] }, ... }
-		for (const [name, toolSchema] of Object.entries(schemaResponse)) {
-			if (typeof toolSchema === 'object' && toolSchema !== null) {
-				const schema = toolSchema as { description?: string };
-				tools.push({
-					name,
-					description: schema.description || `${name} tool`,
-					inputSchema: {
-						type: 'object',
-						...(toolSchema as Record<string, unknown>),
-					},
-				});
-			}
-		}
-	}
-
-	return tools.filter((tool) => !tool.name.toLowerCase().includes('<lambda'));
-}

package/src/space/dynamic-space-tool.ts

@@ -144,6 +144,10 @@ function getUsageInstructions(): string {
 	return isDynamicSpaceMode() ? DYNAMIC_USAGE_INSTRUCTIONS : USAGE_INSTRUCTIONS;
 }
 
+function formatUnknownOperationLine(requestedOperation?: string): string {
+	return `Unknown operation: "${requestedOperation ?? 'unknown'}"`;
+}
+
 /**
  * Space tool configuration
  * Returns dynamic config based on environment
@@ -222,7 +226,7 @@ export class SpaceTool {
 		const validOperations = getOperationNames();
 		if (!validOperations.includes(normalizedOperation)) {
 			return {
-				formatted: `Unknown operation: "${requestedOperation}"
+				formatted: `${formatUnknownOperationLine(requestedOperation)}
 Available operations: ${validOperations.join(', ')}
 
 Call this tool with no operation for full usage instructions.`,
@@ -249,7 +253,7 @@ Call this tool with no operation for full usage instructions.`,
 
 				default:
 					return {
-						formatted: `Unknown operation: "${requestedOperation}"`,
+						formatted: formatUnknownOperationLine(requestedOperation),
 						totalResults: 0,
 						resultsShared: 0,
 						isError: true,

package/src/space/utils/gradio-caller.ts

@@ -3,10 +3,17 @@ import {
 	StreamableHTTPClientTransport,
 	type StreamableHTTPClientTransportOptions,
 } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { CallToolResultSchema, type CallToolResult, type ServerNotification, type ServerRequest } from '@modelcontextprotocol/sdk/types.js';
+import {
+	CallToolResultSchema,
+	type CallToolResult,
+	type ServerNotification,
+	type ServerRequest,
+} from '@modelcontextprotocol/sdk/types.js';
 import { Protocol, type RequestHandlerExtra, type RequestOptions } from '@modelcontextprotocol/sdk/shared/protocol.js';
 import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { logger } from '../../logger.js';
+import { fetchWithProfile, NETWORK_FETCH_PROFILES } from '../../network/fetch-profile.js';
+import { createGradioMcpPolicy, parseAndValidateUrl } from '../../network/url-policy.js';
 
 class GradioClient extends Client {
 	override async connect(transport: Transport, _options?: RequestOptions): Promise<void> {
@@ -102,6 +109,10 @@ export async function callGradioToolWithHeaders(
 	extra: RequestHandlerExtra<ServerRequest, ServerNotification> | undefined,
 	options: GradioCallOptions = {}
 ): Promise<GradioCallResult> {
+	const validatedMcpUrl = parseAndValidateUrl(mcpUrl, createGradioMcpPolicy());
+	const protocol = validatedMcpUrl.protocol === 'http:' ? 'http:' : 'https:';
+	const mcpRequestProfile = NETWORK_FETCH_PROFILES.gradioMcpHost(validatedMcpUrl.hostname, protocol);
+
 	const capturedHeaders: Record<string, string> = {};
 	let loggedHeader = false;
 
@@ -154,7 +165,9 @@ export async function callGradioToolWithHeaders(
 			hasBody: Boolean(init?.body),
 			requestSummary,
 		});
-		const response = await fetch(url, init);
+		const { response } = await fetchWithProfile(url.toString(), mcpRequestProfile, {
+			requestInit: init,
+		});
 		logger.trace('[gradio] upstream response', {
 			method,
 			url: url.toString(),
@@ -196,22 +209,22 @@ export async function callGradioToolWithHeaders(
 	}
 
 	logger.trace('[gradio] connecting streamable client', {
-		mcpUrl,
+		mcpUrl: validatedMcpUrl.toString(),
 		hasToken: Boolean(hfToken),
 		skipInitialize,
 	});
-	const transport = new StreamableHTTPClientTransport(new URL(mcpUrl), transportOptions);
+	const transport = new StreamableHTTPClientTransport(validatedMcpUrl, transportOptions);
 	let isClosing = false;
 	transport.onmessage = (message) => {
 		const messageInfo =
 			message && typeof message === 'object'
 				? {
-					hasId: 'id' in message,
-					id: (message as { id?: unknown }).id ?? null,
-					method: 'method' in message ? (message as { method?: unknown }).method : null,
-					isResult: 'result' in message,
-					isError: 'error' in message,
-				}
+						hasId: 'id' in message,
+						id: (message as { id?: unknown }).id ?? null,
+						method: 'method' in message ? (message as { method?: unknown }).method : null,
+						isResult: 'result' in message,
+						isError: 'error' in message,
+					}
 				: { messageType: typeof message };
 		logger.trace('[gradio] transport message', messageInfo);
 	};
@@ -228,13 +241,13 @@ export async function callGradioToolWithHeaders(
 	let connectCompleted = false;
 	const connectWatchdog = setTimeout(() => {
 		if (!connectCompleted) {
-			logger.trace('[gradio] connect still pending', { mcpUrl });
+			logger.trace('[gradio] connect still pending', { mcpUrl: validatedMcpUrl.toString() });
 		}
 	}, 15000);
 	await remoteClient.connect(transport);
 	connectCompleted = true;
 	clearTimeout(connectWatchdog);
-	logger.trace('[gradio] connected streamable client', { mcpUrl });
+	logger.trace('[gradio] connected streamable client', { mcpUrl: validatedMcpUrl.toString() });
 
 	try {
 		// Check if the client is requesting progress notifications

package/src/space/utils/space-http.ts

@@ -0,0 +1,75 @@
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import { fetchWithProfile, NETWORK_FETCH_PROFILES } from '../../network/fetch-profile.js';
+import { normalizeParsedTools, parseGradioSchemaResponse } from './gradio-schema.js';
+
+const SPACE_HTTP_TIMEOUT_MS = 10_000;
+
+export interface SpaceMetadata {
+	subdomain: string;
+	private: boolean;
+}
+
+export async function fetchSpaceMetadata(spaceName: string, hfToken?: string): Promise<SpaceMetadata> {
+	const url = `https://huggingface.co/api/spaces/${spaceName}`;
+	const headers: Record<string, string> = {};
+
+	if (hfToken) {
+		headers['Authorization'] = `Bearer ${hfToken}`;
+	}
+
+	const { response } = await fetchWithProfile(url, NETWORK_FETCH_PROFILES.hfHub(), {
+		timeoutMs: SPACE_HTTP_TIMEOUT_MS,
+		requestInit: {
+			headers,
+		},
+	});
+
+	if (!response.ok) {
+		throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+	}
+
+	const info = (await response.json()) as {
+		subdomain?: string;
+		private?: boolean;
+	};
+
+	if (!info.subdomain) {
+		throw new Error('Space does not have a subdomain');
+	}
+
+	return {
+		subdomain: info.subdomain,
+		private: info.private || false,
+	};
+}
+
+export async function fetchGradioSchema(subdomain: string, isPrivate: boolean, hfToken?: string): Promise<Tool[]> {
+	const schemaUrl = `https://${subdomain}.hf.space/gradio_api/mcp/schema`;
+
+	const headers: Record<string, string> = {
+		'Content-Type': 'application/json',
+	};
+
+	if (isPrivate && hfToken) {
+		headers['X-HF-Authorization'] = `Bearer ${hfToken}`;
+	}
+
+	const { response } = await fetchWithProfile(
+		schemaUrl,
+		NETWORK_FETCH_PROFILES.gradioSchemaHost(`${subdomain}.hf.space`),
+		{
+			timeoutMs: SPACE_HTTP_TIMEOUT_MS,
+			requestInit: {
+				method: 'GET',
+				headers,
+			},
+		}
+	);
+
+	if (!response.ok) {
+		throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+	}
+
+	const schemaResponse = (await response.json()) as unknown;
+	return normalizeParsedTools(parseGradioSchemaResponse(schemaResponse));
+}

package/src/space-files.ts

@@ -3,6 +3,7 @@ import { listFiles, spaceInfo } from '@huggingface/hub';
 import { formatBytes, escapeMarkdown } from './utilities.js';
 import { HfApiError } from './hf-api-call.js';
 import { explain } from './error-messages.js';
+import { getFileIcon } from './file-icons.js';
 
 // Define the FileWithUrl interface
 export interface FileWithUrl {
@@ -226,7 +227,7 @@ export class SpaceFilesTool {
 			for (const file of dirFiles) {
 				const fileName = file.path.split('/').pop() || file.path;
 				const indent = dir === '/' ? '' : '    ';
-				const icon = this.getFileIcon(fileName);
+				const icon = getFileIcon(fileName);
 				const lastMod = file.lastModified ? new Date(file.lastModified).toLocaleDateString() : '-';
 
 				markdown += `| ${indent}${icon} ${escapeMarkdown(fileName)} | ${file.sizeFormatted} | ${file.lfs ? 'LFS' : 'Regular'} | ${lastMod} | ${file.url} |\n`;
@@ -265,7 +266,7 @@ export class SpaceFilesTool {
 
 		for (const file of files) {
 			const fileName = file.path.split('/').pop() || file.path;
-			const icon = this.getFileIcon(fileName);
+			const icon = getFileIcon(fileName);
 			markdown += `| ${icon} ${escapeMarkdown(fileName)} | ${escapeMarkdown(file.path)} | ${file.sizeFormatted} | [Link](${file.url}) |\n`;
 		}
 
@@ -283,43 +284,4 @@ export class SpaceFilesTool {
 
 		return this.generateDetailedMarkdown(spaceName, fileType);
 	}
-
-	/**
-	 * Get file icon based on extension
-	 */
-	private getFileIcon(filename: string): string {
-		const ext = filename.split('.').pop()?.toLowerCase();
-		const iconMap: Record<string, string> = {
-			py: '🐍',
-			js: '📜',
-			ts: '📘',
-			md: '📝',
-			txt: '📄',
-			json: '📊',
-			yaml: '⚙️',
-			yml: '⚙️',
-			png: '🖼️',
-			jpg: '🖼️',
-			jpeg: '🖼️',
-			gif: '🖼️',
-			svg: '🎨',
-			mp4: '🎬',
-			mp3: '🎵',
-			pdf: '📕',
-			zip: '📦',
-			tar: '📦',
-			gz: '📦',
-			html: '🌐',
-			css: '🎨',
-			ipynb: '📓',
-			csv: '📊',
-			parquet: '🗄️',
-			safetensors: '🤖',
-			bin: '💾',
-			pkl: '🥒',
-			h5: '🗃️',
-		};
-
-		return iconMap[ext || ''] || '📄';
-	}
 }

package/test/fetch-guard.spec.ts

@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SRC_ROOT = join(process.cwd(), 'src');
+
+function collectTsFiles(root: string): string[] {
+	const entries = readdirSync(root);
+	const files: string[] = [];
+
+	for (const entry of entries) {
+		const fullPath = join(root, entry);
+		const stat = statSync(fullPath);
+		if (stat.isDirectory()) {
+			files.push(...collectTsFiles(fullPath));
+			continue;
+		}
+
+		if (fullPath.endsWith('.ts')) {
+			files.push(fullPath);
+		}
+	}
+
+	return files;
+}
+
+function hasDirectFetchCall(content: string): boolean {
+	const regex = /fetch\s*\(/g;
+	let match: RegExpExecArray | null;
+
+	while ((match = regex.exec(content)) !== null) {
+		const index = match.index;
+		const previousChar = index > 0 ? content[index - 1] : '';
+
+		if (/[\w$.]/.test(previousChar)) {
+			continue;
+		}
+
+		const prefix = content.slice(Math.max(0, index - 20), index);
+		if (/\basync\s+$/.test(prefix) || /\bfunction\s+$/.test(prefix)) {
+			continue;
+		}
+
+		return true;
+	}
+
+	return false;
+}
+
+describe('fetch usage guard', () => {
+	it('only allows direct fetch calls in network/safe-fetch.ts', () => {
+		const allowedSuffixes = new Set(['/network/safe-fetch.ts']);
+		const offenders: string[] = [];
+		const files = collectTsFiles(SRC_ROOT);
+
+		for (const file of files) {
+			const content = readFileSync(file, 'utf8');
+			if (!hasDirectFetchCall(content)) {
+				continue;
+			}
+
+			const normalized = file.replace(SRC_ROOT, '').replace(/\\/g, '/');
+			if (!allowedSuffixes.has(normalized)) {
+				offenders.push(normalized);
+			}
+		}
+
+		expect(offenders).toEqual([]);
+	});
+});

package/test/jobs/sse-handler.spec.ts

@@ -0,0 +1,60 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { fetchJobLogs } from '../../src/jobs/sse-handler.js';
+import { safeFetch } from '../../src/network/safe-fetch.js';
+
+vi.mock('../../src/network/safe-fetch.js', () => ({
+	safeFetch: vi.fn(),
+}));
+
+function createSseResponse(read: () => Promise<ReadableStreamReadResult<Uint8Array>>): Response {
+	return {
+		ok: true,
+		body: {
+			getReader: () => ({
+				read,
+				cancel: vi.fn().mockResolvedValue(undefined),
+			}),
+		},
+	} as unknown as Response;
+}
+
+describe('fetchJobLogs', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it('treats timeout-aborted SSE reads as expected truncation', async () => {
+		const abortedRead = async (): Promise<ReadableStreamReadResult<Uint8Array>> => {
+			await new Promise((resolve) => setTimeout(resolve, 20));
+			throw new DOMException('The operation was aborted.', 'AbortError');
+		};
+
+		vi.mocked(safeFetch).mockResolvedValue({
+			response: createSseResponse(abortedRead),
+			finalUrl: new URL('https://example.com/logs'),
+			redirectsFollowed: 0,
+		});
+
+		const result = await fetchJobLogs('https://example.com/logs', { maxDuration: 1, maxLines: 5 });
+
+		expect(result).toEqual({
+			logs: [],
+			finished: false,
+			truncated: true,
+		});
+	});
+
+	it('throws non-timeout stream errors', async () => {
+		const failingRead = async (): Promise<ReadableStreamReadResult<Uint8Array>> => {
+			throw new Error('stream read failed');
+		};
+
+		vi.mocked(safeFetch).mockResolvedValue({
+			response: createSseResponse(failingRead),
+			finalUrl: new URL('https://example.com/logs'),
+			redirectsFollowed: 0,
+		});
+
+		await expect(fetchJobLogs('https://example.com/logs', { maxDuration: 100 })).rejects.toThrow('stream read failed');
+	});
+});

package/dist/space/utils/result-formatter.d.ts

@@ -1,4 +0,0 @@
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
-export declare function formatToolResult(result: CallToolResult): string;
-export declare function formatWarnings(warnings: string[]): string;
-//# sourceMappingURL=result-formatter.d.ts.map

package/dist/space/utils/result-formatter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"result-formatter.d.ts","sourceRoot":"","sources":["../../../src/space/utils/result-formatter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAUzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAa/D;AAmMD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAOzD"}