@mapbox/mcp-docs-server 0.3.0 → 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1 +1 @@
1
- {"version":3,"file":"BatchGetDocumentsTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,yCAAyC,CAAC;AAejD,qBAAa,qBAAsB,SAAQ,QAAQ,CACjD,OAAO,uBAAuB,CAC/B;IACC,IAAI,SAA8B;IAClC,WAAW,SACyP;IACpQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CACrB,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,cAAc,CAAC;CA8D3B"}
1
+ {"version":3,"file":"BatchGetDocumentsTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,yCAAyC,CAAC;AAiCjD,qBAAa,qBAAsB,SAAQ,QAAQ,CACjD,OAAO,uBAAuB,CAC/B;IACC,IAAI,SAA8B;IAClC,WAAW,SACyP;IACpQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CACrB,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,cAAc,CAAC;CA2E3B"}
@@ -7,10 +7,27 @@ const docCache_js_1 = require("../../utils/docCache.js");
7
7
  const docFetcher_js_1 = require("../../utils/docFetcher.js");
8
8
  const BaseTool_js_1 = require("../BaseTool.js");
9
9
  const BatchGetDocumentsTool_input_schema_js_1 = require("./BatchGetDocumentsTool.input.schema.js");
10
+ // Explicit allowlist of hostnames this docs tool is permitted to fetch.
11
+ // api.mapbox.com is intentionally excluded — it is a live API that requires
12
+ // auth tokens, not a documentation host. Allowing it would let callers poison
13
+ // the shared cache with token-authorized private responses under no-token keys.
14
+ const ALLOWED_DOC_HOSTNAMES = new Set([
15
+ 'docs.mapbox.com',
16
+ 'mapbox.com',
17
+ 'docs.tilestream.net'
18
+ ]);
10
19
  function isMapboxUrl(url) {
11
20
  try {
12
21
  const { hostname } = new URL(url);
13
- return hostname === 'mapbox.com' || hostname.endsWith('.mapbox.com');
22
+ return ALLOWED_DOC_HOSTNAMES.has(hostname);
23
+ }
24
+ catch {
25
+ return false;
26
+ }
27
+ }
28
+ function hasAccessToken(url) {
29
+ try {
30
+ return new URL(url).searchParams.has('access_token');
14
31
  }
15
32
  catch {
16
33
  return false;
@@ -38,7 +55,19 @@ class BatchGetDocumentsTool extends BaseTool_js_1.BaseTool {
38
55
  content: [
39
56
  {
40
57
  type: 'text',
41
- text: `Invalid URLs: only mapbox.com URLs are supported. Invalid: ${invalidUrls.join(', ')}`
58
+ text: `Invalid URLs: only mapbox.com documentation URLs are supported. Invalid: ${invalidUrls.join(', ')}`
59
+ }
60
+ ],
61
+ isError: true
62
+ };
63
+ }
64
+ const tokenUrls = input.urls.filter(hasAccessToken);
65
+ if (tokenUrls.length > 0) {
66
+ return {
67
+ content: [
68
+ {
69
+ type: 'text',
70
+ text: `Invalid URLs: URLs must not contain access_token. Invalid: ${tokenUrls.join(', ')}`
42
71
  }
43
72
  ],
44
73
  isError: true
@@ -1 +1 @@
1
- {"version":3,"file":"BatchGetDocumentsTool.js","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAGlC,yDAAsE;AACtE,6DAA4D;AAE5D,gDAA0C;AAC1C,mGAGiD;AAEjD,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAMD,MAAa,qBAAsB,SAAQ,sBAE1C;IACC,IAAI,GAAG,0BAA0B,CAAC;IAClC,WAAW,GACT,iQAAiQ,CAAC;IAC3P,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,iCAAiC;KACzC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,+DAAuB,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CACrB,KAA6B;QAE7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC7F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;QAEzD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAmB,EAAE;YAChD,MAAM,MAAM,GAAG,sBAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEpD,MAAM,GAAG,GAAG,IAAA,+BAAiB,EAAC,GAAG,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC1B,MAAM,OAAO,GAAG,MAAM,IAAA,+BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7D,sBAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;YAEL,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAA2B,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClB,KAAK,EACH,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,eAAe;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF;AArFD,sDAqFC"}
1
+ {"version":3,"file":"BatchGetDocumentsTool.js","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAGlC,yDAAsE;AACtE,6DAA4D;AAE5D,gDAA0C;AAC1C,mGAGiD;AAEjD,wEAAwE;AACxE,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;CACtB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAMD,MAAa,qBAAsB,SAAQ,sBAE1C;IACC,IAAI,GAAG,0BAA0B,CAAC;IAClC,WAAW,GACT,iQAAiQ,CAAC;IAC3P,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,iCAAiC;KACzC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,+DAAuB,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CACrB,KAA6B;QAE7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,4EAA4E,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC3G;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC3F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;QAEzD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAmB,EAAE;YAChD,MAAM,MAAM,GAAG,sBAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEpD,MAAM,GAAG,GAAG,IAAA,+BAAiB,EAAC,GAAG,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC1B,MAAM,OAAO,GAAG,MAAM,IAAA,+BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7D,sBAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;YAEL,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAA2B,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClB,KAAK,EACH,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,eAAe;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF;AAlGD,sDAkGC"}
@@ -1 +1 @@
1
- {"version":3,"file":"GetDocumentTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,mCAAmC,CAAC;AAW3C,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,OAAO,iBAAiB,CAAC;IACrE,IAAI,SAAuB;IAC3B,WAAW,SAC8P;IACzQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;CAkC1E"}
1
+ {"version":3,"file":"GetDocumentTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,mCAAmC,CAAC;AA6B3C,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,OAAO,iBAAiB,CAAC;IACrE,IAAI,SAAuB;IAC3B,WAAW,SAC8P;IACzQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;CA8C1E"}
@@ -7,10 +7,27 @@ const docCache_js_1 = require("../../utils/docCache.js");
7
7
  const docFetcher_js_1 = require("../../utils/docFetcher.js");
8
8
  const BaseTool_js_1 = require("../BaseTool.js");
9
9
  const GetDocumentTool_input_schema_js_1 = require("./GetDocumentTool.input.schema.js");
10
+ // Explicit allowlist of hostnames this docs tool is permitted to fetch.
11
+ // api.mapbox.com is intentionally excluded — it is a live API that requires
12
+ // auth tokens, not a documentation host. Allowing it would let callers poison
13
+ // the shared cache with token-authorized private responses under no-token keys.
14
+ const ALLOWED_DOC_HOSTNAMES = new Set([
15
+ 'docs.mapbox.com',
16
+ 'mapbox.com',
17
+ 'docs.tilestream.net'
18
+ ]);
10
19
  function isMapboxUrl(url) {
11
20
  try {
12
21
  const { hostname } = new URL(url);
13
- return hostname === 'mapbox.com' || hostname.endsWith('.mapbox.com');
22
+ return ALLOWED_DOC_HOSTNAMES.has(hostname);
23
+ }
24
+ catch {
25
+ return false;
26
+ }
27
+ }
28
+ function hasAccessToken(url) {
29
+ try {
30
+ return new URL(url).searchParams.has('access_token');
14
31
  }
15
32
  catch {
16
33
  return false;
@@ -37,7 +54,18 @@ class GetDocumentTool extends BaseTool_js_1.BaseTool {
37
54
  content: [
38
55
  {
39
56
  type: 'text',
40
- text: `Invalid URL: only mapbox.com URLs are supported. Received: ${input.url}`
57
+ text: `Invalid URL: only mapbox.com documentation URLs are supported. Received: ${input.url}`
58
+ }
59
+ ],
60
+ isError: true
61
+ };
62
+ }
63
+ if (hasAccessToken(input.url)) {
64
+ return {
65
+ content: [
66
+ {
67
+ type: 'text',
68
+ text: `Invalid URL: URLs must not contain access_token. Received: ${input.url}`
41
69
  }
42
70
  ],
43
71
  isError: true
@@ -1 +1 @@
1
- {"version":3,"file":"GetDocumentTool.js","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAGlC,yDAAmD;AACnD,6DAA4D;AAE5D,gDAA0C;AAC1C,uFAG2C;AAE3C,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAa,eAAgB,SAAQ,sBAAkC;IACrE,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GACT,sQAAsQ,CAAC;IAChQ,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,0BAA0B;KAClC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,mDAAiB,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,KAAuB;QAC7C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,KAAK,CAAC,GAAG,EAAE;qBAChF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,sBAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,+BAAe,EAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,sBAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAEjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,YAAY,EAAE,EAAE;iBACpE;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AArDD,0CAqDC"}
1
+ {"version":3,"file":"GetDocumentTool.js","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":";AAAA,6BAA6B;AAC7B,kCAAkC;;;AAGlC,yDAAmD;AACnD,6DAA4D;AAE5D,gDAA0C;AAC1C,uFAG2C;AAE3C,wEAAwE;AACxE,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;CACtB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAa,eAAgB,SAAQ,sBAAkC;IACrE,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GACT,sQAAsQ,CAAC;IAChQ,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,0BAA0B;KAClC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,mDAAiB,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,KAAuB;QAC7C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,4EAA4E,KAAK,CAAC,GAAG,EAAE;qBAC9F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,KAAK,CAAC,GAAG,EAAE;qBAChF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,sBAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,+BAAe,EAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,sBAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAEjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,YAAY,EAAE,EAAE;iBACpE;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAjED,0CAiEC"}
@@ -1,6 +1,6 @@
1
1
  {
2
- "sha": "ec5991be3207d8fcedb7fdf95278f941c48a129f",
3
- "tag": "v0.2.1-26-gec5991b",
2
+ "sha": "20c45c2a9f24ce2bb1df9dee894d9182dfc71f42",
3
+ "tag": "v0.3.0-8-g20c45c2",
4
4
  "branch": "HEAD",
5
- "version": "0.3.0"
5
+ "version": "0.3.1"
6
6
  }
@@ -1 +1 @@
1
- {"version":3,"file":"BatchGetDocumentsTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,yCAAyC,CAAC;AAejD,qBAAa,qBAAsB,SAAQ,QAAQ,CACjD,OAAO,uBAAuB,CAC/B;IACC,IAAI,SAA8B;IAClC,WAAW,SACyP;IACpQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CACrB,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,cAAc,CAAC;CA8D3B"}
1
+ {"version":3,"file":"BatchGetDocumentsTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,yCAAyC,CAAC;AAiCjD,qBAAa,qBAAsB,SAAQ,QAAQ,CACjD,OAAO,uBAAuB,CAC/B;IACC,IAAI,SAA8B;IAClC,WAAW,SACyP;IACpQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CACrB,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,cAAc,CAAC;CA2E3B"}
@@ -4,10 +4,27 @@ import { docCache, normalizeCacheKey } from '../../utils/docCache.js';
4
4
  import { fetchDocContent } from '../../utils/docFetcher.js';
5
5
  import { BaseTool } from '../BaseTool.js';
6
6
  import { BatchGetDocumentsSchema } from './BatchGetDocumentsTool.input.schema.js';
7
+ // Explicit allowlist of hostnames this docs tool is permitted to fetch.
8
+ // api.mapbox.com is intentionally excluded — it is a live API that requires
9
+ // auth tokens, not a documentation host. Allowing it would let callers poison
10
+ // the shared cache with token-authorized private responses under no-token keys.
11
+ const ALLOWED_DOC_HOSTNAMES = new Set([
12
+ 'docs.mapbox.com',
13
+ 'mapbox.com',
14
+ 'docs.tilestream.net'
15
+ ]);
7
16
  function isMapboxUrl(url) {
8
17
  try {
9
18
  const { hostname } = new URL(url);
10
- return hostname === 'mapbox.com' || hostname.endsWith('.mapbox.com');
19
+ return ALLOWED_DOC_HOSTNAMES.has(hostname);
20
+ }
21
+ catch {
22
+ return false;
23
+ }
24
+ }
25
+ function hasAccessToken(url) {
26
+ try {
27
+ return new URL(url).searchParams.has('access_token');
11
28
  }
12
29
  catch {
13
30
  return false;
@@ -35,7 +52,19 @@ export class BatchGetDocumentsTool extends BaseTool {
35
52
  content: [
36
53
  {
37
54
  type: 'text',
38
- text: `Invalid URLs: only mapbox.com URLs are supported. Invalid: ${invalidUrls.join(', ')}`
55
+ text: `Invalid URLs: only mapbox.com documentation URLs are supported. Invalid: ${invalidUrls.join(', ')}`
56
+ }
57
+ ],
58
+ isError: true
59
+ };
60
+ }
61
+ const tokenUrls = input.urls.filter(hasAccessToken);
62
+ if (tokenUrls.length > 0) {
63
+ return {
64
+ content: [
65
+ {
66
+ type: 'text',
67
+ text: `Invalid URLs: URLs must not contain access_token. Invalid: ${tokenUrls.join(', ')}`
39
68
  }
40
69
  ],
41
70
  isError: true
@@ -1 +1 @@
1
- {"version":3,"file":"BatchGetDocumentsTool.js","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAGlC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EAExB,MAAM,yCAAyC,CAAC;AAEjD,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAMD,MAAM,OAAO,qBAAsB,SAAQ,QAE1C;IACC,IAAI,GAAG,0BAA0B,CAAC;IAClC,WAAW,GACT,iQAAiQ,CAAC;IAC3P,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,iCAAiC;KACzC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CACrB,KAA6B;QAE7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC7F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;QAEzD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAmB,EAAE;YAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC1B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;YAEL,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAA2B,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClB,KAAK,EACH,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,eAAe;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF"}
1
+ {"version":3,"file":"BatchGetDocumentsTool.js","sourceRoot":"","sources":["../../../../src/tools/batch-get-documents-tool/BatchGetDocumentsTool.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAGlC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EAExB,MAAM,yCAAyC,CAAC;AAEjD,wEAAwE;AACxE,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;CACtB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAMD,MAAM,OAAO,qBAAsB,SAAQ,QAE1C;IACC,IAAI,GAAG,0BAA0B,CAAC;IAClC,WAAW,GACT,iQAAiQ,CAAC;IAC3P,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,iCAAiC;KACzC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CACrB,KAA6B;QAE7B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,4EAA4E,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC3G;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC3F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;QAEzD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAmB,EAAE;YAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC1B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;YAEL,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAA2B,EAAE;YACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClB,KAAK,EACH,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,eAAe;aACtB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF"}
@@ -1 +1 @@
1
- {"version":3,"file":"GetDocumentTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,mCAAmC,CAAC;AAW3C,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,OAAO,iBAAiB,CAAC;IACrE,IAAI,SAAuB;IAC3B,WAAW,SAC8P;IACzQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;CAkC1E"}
1
+ {"version":3,"file":"GetDocumentTool.d.ts","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,mCAAmC,CAAC;AA6B3C,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,OAAO,iBAAiB,CAAC;IACrE,IAAI,SAAuB;IAC3B,WAAW,SAC8P;IACzQ,QAAQ,CAAC,WAAW;;;;;;MAMlB;IAEF,OAAO,CAAC,WAAW,CAAc;gBAErB,MAAM,EAAE;QAAE,WAAW,EAAE,WAAW,CAAA;KAAE;cAKhC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;CA8C1E"}
@@ -4,10 +4,27 @@ import { docCache } from '../../utils/docCache.js';
4
4
  import { fetchDocContent } from '../../utils/docFetcher.js';
5
5
  import { BaseTool } from '../BaseTool.js';
6
6
  import { GetDocumentSchema } from './GetDocumentTool.input.schema.js';
7
+ // Explicit allowlist of hostnames this docs tool is permitted to fetch.
8
+ // api.mapbox.com is intentionally excluded — it is a live API that requires
9
+ // auth tokens, not a documentation host. Allowing it would let callers poison
10
+ // the shared cache with token-authorized private responses under no-token keys.
11
+ const ALLOWED_DOC_HOSTNAMES = new Set([
12
+ 'docs.mapbox.com',
13
+ 'mapbox.com',
14
+ 'docs.tilestream.net'
15
+ ]);
7
16
  function isMapboxUrl(url) {
8
17
  try {
9
18
  const { hostname } = new URL(url);
10
- return hostname === 'mapbox.com' || hostname.endsWith('.mapbox.com');
19
+ return ALLOWED_DOC_HOSTNAMES.has(hostname);
20
+ }
21
+ catch {
22
+ return false;
23
+ }
24
+ }
25
+ function hasAccessToken(url) {
26
+ try {
27
+ return new URL(url).searchParams.has('access_token');
11
28
  }
12
29
  catch {
13
30
  return false;
@@ -34,7 +51,18 @@ export class GetDocumentTool extends BaseTool {
34
51
  content: [
35
52
  {
36
53
  type: 'text',
37
- text: `Invalid URL: only mapbox.com URLs are supported. Received: ${input.url}`
54
+ text: `Invalid URL: only mapbox.com documentation URLs are supported. Received: ${input.url}`
55
+ }
56
+ ],
57
+ isError: true
58
+ };
59
+ }
60
+ if (hasAccessToken(input.url)) {
61
+ return {
62
+ content: [
63
+ {
64
+ type: 'text',
65
+ text: `Invalid URL: URLs must not contain access_token. Received: ${input.url}`
38
66
  }
39
67
  ],
40
68
  isError: true
@@ -1 +1 @@
1
- {"version":3,"file":"GetDocumentTool.js","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAGlC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,iBAAiB,EAElB,MAAM,mCAAmC,CAAC;AAE3C,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,QAAkC;IACrE,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GACT,sQAAsQ,CAAC;IAChQ,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,0BAA0B;KAClC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,KAAuB;QAC7C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,KAAK,CAAC,GAAG,EAAE;qBAChF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAEjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,YAAY,EAAE,EAAE;iBACpE;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
1
+ {"version":3,"file":"GetDocumentTool.js","sourceRoot":"","sources":["../../../../src/tools/get-document-tool/GetDocumentTool.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kCAAkC;AAGlC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,iBAAiB,EAElB,MAAM,mCAAmC,CAAC;AAE3C,wEAAwE;AACxE,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;CACtB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,QAAkC;IACrE,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GACT,sQAAsQ,CAAC;IAChQ,WAAW,GAAG;QACrB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,0BAA0B;KAClC,CAAC;IAEM,WAAW,CAAc;IAEjC,YAAY,MAAoC;QAC9C,KAAK,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACxC,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,KAAuB;QAC7C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,4EAA4E,KAAK,CAAC,GAAG,EAAE;qBAC9F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8DAA8D,KAAK,CAAC,GAAG,EAAE;qBAChF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAEjC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,YAAY,EAAE,EAAE;iBACpE;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
@@ -1,6 +1,6 @@
1
1
  {
2
- "sha": "ec5991be3207d8fcedb7fdf95278f941c48a129f",
3
- "tag": "v0.2.1-26-gec5991b",
2
+ "sha": "20c45c2a9f24ce2bb1df9dee894d9182dfc71f42",
3
+ "tag": "v0.3.0-8-g20c45c2",
4
4
  "branch": "HEAD",
5
- "version": "0.3.0"
5
+ "version": "0.3.1"
6
6
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mapbox/mcp-docs-server",
3
- "version": "0.3.0",
3
+ "version": "0.3.1",
4
4
  "description": "Mapbox MCP documentation server",
5
5
  "mcpName": "io.github.mapbox/mcp-docs-server",
6
6
  "main": "./dist/commonjs/index.js",
@@ -19,7 +19,6 @@
19
19
  "inspect:dev": "npx @modelcontextprotocol/inspector npx -y tsx src/index.ts",
20
20
  "lint": "eslint \"./src/**/*.{ts,tsx}\" \"./test/**/*.{ts,tsx}\" --no-error-on-unmatched-pattern",
21
21
  "lint:fix": "eslint \"./src/**/*.{ts,tsx}\" \"./test/**/*.{ts,tsx}\" --no-error-on-unmatched-pattern --fix",
22
- "prepare": "node -e \"if(!process.env.CI&&process.env.HUSKY!=='0'){require('child_process').execSync('husky && node .husky/setup-hooks.js',{stdio:'inherit'})}\"",
23
22
  "spellcheck": "cspell \"*.md\" \"src/**/*.ts\" \"test/**/*.ts\"",
24
23
  "sync-manifest": "node scripts/sync-manifest-version.cjs",
25
24
  "test": "vitest"
@@ -48,12 +47,12 @@
48
47
  "dependencies": {
49
48
  "@modelcontextprotocol/sdk": "^1.29.0",
50
49
  "@opentelemetry/api": "^1.9.1",
51
- "@opentelemetry/auto-instrumentations-node": "^0.72.0",
52
- "@opentelemetry/exporter-trace-otlp-http": "^0.214.0",
53
- "@opentelemetry/instrumentation": "^0.214.0",
54
- "@opentelemetry/resources": "^2.6.1",
55
- "@opentelemetry/sdk-node": "^0.214.0",
56
- "@opentelemetry/sdk-trace-base": "^2.6.1",
50
+ "@opentelemetry/auto-instrumentations-node": "^0.74.0",
51
+ "@opentelemetry/exporter-trace-otlp-http": "^0.216.0",
52
+ "@opentelemetry/instrumentation": "^0.216.0",
53
+ "@opentelemetry/resources": "^2.7.1",
54
+ "@opentelemetry/sdk-node": "^0.216.0",
55
+ "@opentelemetry/sdk-trace-base": "^2.7.1",
57
56
  "@opentelemetry/semantic-conventions": "^1.40.0",
58
57
  "zod": "^4.3.6"
59
58
  },