@loopstack/mcp-module 0.2.0

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/utils/url-security.d.ts

@@ -0,0 +1,8 @@
+export declare function hostMatchesAllowlist(hostname: string, allowedHosts: string[]): boolean;
+export declare function assertIpIsPublic(ip: string): void;
+export declare function assertResolvableHostIsPublic(host: string): Promise<void>;
+export declare function assertMcpUrlSafe(rawUrl: string, allowedHosts: string[], allowInsecureHttp: boolean, options?: {
+    skipDnsResolution?: boolean;
+    allowPrivateHosts?: boolean;
+}): Promise<URL>;
+//# sourceMappingURL=url-security.d.ts.map

package/dist/utils/url-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.d.ts","sourceRoot":"","sources":["../../src/utils/url-security.ts"],"names":[],"mappings":"AAiBA,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAgBtF;AA+GD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAWjD;AAKD,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB9E;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EAAE,EACtB,iBAAiB,EAAE,OAAO,EAC1B,OAAO,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE,OAAO,CAAC,GAAG,CAAC,CAkCd"}

package/dist/utils/url-security.js

@@ -0,0 +1,192 @@
+import * as dns from 'node:dns/promises';
+import * as net from 'node:net';
+import { domainToASCII } from 'node:url';
+import { McpUrlSecurityError } from '../errors.js';
+function toAscii(host) {
+    const ascii = domainToASCII(host);
+    return (ascii || host).toLowerCase();
+}
+function normalizePattern(pattern) {
+    const p = pattern.toLowerCase();
+    if (p.startsWith('*.'))
+        return `*.${toAscii(p.slice(2))}`;
+    return toAscii(p);
+}
+export function hostMatchesAllowlist(hostname, allowedHosts) {
+    const host = toAscii(hostname);
+    for (const pattern of allowedHosts) {
+        const p = normalizePattern(pattern);
+        if (p.startsWith('*.')) {
+            const root = p.slice(2);
+            if (host === root)
+                return true;
+            const suffix = `.${root}`;
+            if (host.endsWith(suffix) && host.length > suffix.length)
+                return true;
+        }
+        else if (host === p) {
+            return true;
+        }
+    }
+    return false;
+}
+function isPrivateIpv4(ip) {
+    const parts = ip.split('.').map((x) => Number(x));
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
+        return true;
+    }
+    const [a, b] = parts;
+    if (a === 0)
+        return true;
+    if (a === 10)
+        return true;
+    if (a === 127)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    return false;
+}
+function expandIpv6ToGroups(ip) {
+    let s = ip.toLowerCase().split('%')[0] ?? '';
+    const dotted = s.match(/^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (dotted) {
+        const v4 = dotted[2].split('.').map(Number);
+        if (v4.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+            return undefined;
+        const hi = (v4[0] << 8) | v4[1];
+        const lo = (v4[2] << 8) | v4[3];
+        s = `${dotted[1]}${hi.toString(16)}:${lo.toString(16)}`;
+    }
+    const halves = s.split('::');
+    if (halves.length > 2)
+        return undefined;
+    const head = halves[0] ? halves[0].split(':') : [];
+    let parts;
+    if (halves.length === 2) {
+        const tail = halves[1] ? halves[1].split(':') : [];
+        const missing = 8 - head.length - tail.length;
+        if (missing < 0)
+            return undefined;
+        parts = [...head, ...Array(missing).fill('0'), ...tail];
+    }
+    else {
+        parts = head;
+    }
+    if (parts.length !== 8)
+        return undefined;
+    const groups = [];
+    for (const p of parts) {
+        if (!/^[0-9a-f]{1,4}$/.test(p))
+            return undefined;
+        groups.push(parseInt(p, 16));
+    }
+    return groups;
+}
+function groupsToIpv4(hi, lo) {
+    return `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+}
+function embeddedIpv4(groups) {
+    if (groups[0] === 0x2002) {
+        return groupsToIpv4(groups[1], groups[2]);
+    }
+    if (groups[0] === 0 &&
+        groups[1] === 0 &&
+        groups[2] === 0 &&
+        groups[3] === 0 &&
+        groups[4] === 0 &&
+        groups[5] === 0xffff) {
+        return groupsToIpv4(groups[6], groups[7]);
+    }
+    return undefined;
+}
+function isPrivateIpv6(ip) {
+    const n = ip.toLowerCase();
+    if (n === '::1')
+        return true;
+    if (n === '::')
+        return true;
+    if (n.startsWith('fe80:'))
+        return true;
+    if (n.startsWith('64:ff9b:'))
+        return true;
+    const first = n.split(':')[0] ?? '';
+    if (first.startsWith('fc') || first.startsWith('fd'))
+        return true;
+    if (first.startsWith('ff'))
+        return true;
+    const groups = expandIpv6ToGroups(n);
+    if (groups) {
+        const v4 = embeddedIpv4(groups);
+        if (v4 !== undefined && isPrivateIpv4(v4))
+            return true;
+    }
+    return false;
+}
+export function assertIpIsPublic(ip) {
+    const family = net.isIP(ip);
+    if (family === 0) {
+        throw new McpUrlSecurityError('Invalid IP address from resolution.');
+    }
+    if (family === 4 && isPrivateIpv4(ip)) {
+        throw new McpUrlSecurityError('Refusing to connect to a non-public IPv4 address.');
+    }
+    if (family === 6 && isPrivateIpv6(ip)) {
+        throw new McpUrlSecurityError('Refusing to connect to a non-public IPv6 address.');
+    }
+}
+export async function assertResolvableHostIsPublic(host) {
+    if (net.isIP(host)) {
+        assertIpIsPublic(host);
+        return;
+    }
+    let records;
+    try {
+        records = await dns.lookup(host, { all: true });
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new McpUrlSecurityError(`DNS lookup failed for "${host}": ${msg}`);
+    }
+    if (records.length === 0) {
+        throw new McpUrlSecurityError(`No DNS records for "${host}".`);
+    }
+    for (const r of records) {
+        assertIpIsPublic(r.address);
+    }
+}
+export async function assertMcpUrlSafe(rawUrl, allowedHosts, allowInsecureHttp, options) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new McpUrlSecurityError('Invalid serverUrl.');
+    }
+    if (url.username || url.password) {
+        throw new McpUrlSecurityError('Userinfo in serverUrl is not allowed; use headers or headerEnv in tool config.');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new McpUrlSecurityError('Only http and https MCP URLs are supported.');
+    }
+    if (url.protocol === 'http:' && !allowInsecureHttp) {
+        throw new McpUrlSecurityError('HTTP is disabled; use https or set allowInsecureHttp on the tool injection config.');
+    }
+    const hostname = url.hostname;
+    if (!hostname) {
+        throw new McpUrlSecurityError('Missing hostname in serverUrl.');
+    }
+    if (!hostMatchesAllowlist(hostname, allowedHosts)) {
+        throw new McpUrlSecurityError(`Hostname "${hostname}" is not in allowedHosts.`);
+    }
+    if (!options?.skipDnsResolution && !options?.allowPrivateHosts) {
+        await assertResolvableHostIsPublic(hostname);
+    }
+    return url;
+}
+//# sourceMappingURL=url-security.js.map

package/dist/utils/url-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.js","sourceRoot":"","sources":["../../src/utils/url-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,mBAAmB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAGD,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,YAAsB;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;QACxE,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IAErB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,kBAAkB,CAAC,EAAU;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7C,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACtE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1E,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,KAAe,CAAC;IACpB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9C,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAClC,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAU,EAAE,EAAU;IAC1C,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AAC7E,CAAC;AAOD,SAAS,YAAY,CAAC,MAAgB;IACpC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,IACE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EACpB,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3B,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,SAAS,IAAI,aAAa,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACzD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAAY;IAC7D,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,YAAsB,EACtB,iBAA0B,EAC1B,OAAsE;IAEtE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAAC,gFAAgF,CAAC,CAAC;IAClH,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAAC,oFAAoF,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,mBAAmB,CAAC,aAAa,QAAQ,2BAA2B,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,iBAAiB,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC/D,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@loopstack/mcp-module",
+  "displayName": "Loopstack MCP Module",
+  "description": "Workflow tools to list and call tools on remote MCP servers over Streamable HTTP, with host allowlisting and SSRF mitigations.",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "loopstack",
+    "tool"
+  ],
+  "version": "0.2.0",
+  "license": "MIT",
+  "author": {
+    "name": "Jakob Klippel",
+    "url": "https://www.linkedin.com/in/jakob-klippel/"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "nest build",
+    "compile": "tsc --noEmit",
+    "format": "prettier --write .",
+    "lint": "eslint .",
+    "test": "vitest run",
+    "watch": "nest build --watch"
+  },
+  "dependencies": {
+    "@loopstack/common": "^0.30.0",
+    "@loopstack/core": "^0.30.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@nestjs/common": "^11.1.19",
+    "@nestjs/core": "^11.1.19",
+    "zod": "^4.3.6"
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "vitest": "^4.1.6",
+    "@swc/core": "^1.15.33",
+    "unplugin-swc": "^1.5.9"
+  }
+}