@mctx-ai/mcp-server 0.5.1 → 0.5.2

package/dist/server.js

@@ -456,11 +456,12 @@ export function createServer(options = {}) {
       handler = resources.get(normalizedUri);
     } else {
       // Try template matching using uri.js module
-      // Canonicalize registered URIs for consistent matching
       for (const [registeredUri, h] of resources.entries()) {
-        // Canonicalize the registered URI for comparison
-        // This ensures consistent matching regardless of registration format
-        const normalizedRegisteredUri = canonicalizePath(registeredUri);
+        // Normalize registered URI for consistent matching (slash deduplication only)
+        // Don't apply security validation to developer-provided templates
+        const normalizedRegisteredUri = registeredUri
+          .replace(/\\/g, "/") // Convert backslashes to forward slashes
+          .replace(/\/+/g, "/"); // Remove duplicate slashes
         const match = matchUri(normalizedRegisteredUri, normalizedUri);
         if (match) {
           handler = h;
@@ -789,11 +790,9 @@ export function createServer(options = {}) {
         return handleLoggingSetLevel(params);
 
       default: {
-        {
-          const error = new Error("Method not found");
-          error.code = -32601;
-          throw error;
-        }
+        const error = new Error("Method not found");
+        error.code = -32601;
+        throw error;
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mctx-ai/mcp-server",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Build MCP servers with an Express-like API — no protocol knowledge required",
   "type": "module",
   "main": "./src/index.js",

package/src/server.js

@@ -456,11 +456,12 @@ export function createServer(options = {}) {
       handler = resources.get(normalizedUri);
     } else {
       // Try template matching using uri.js module
-      // Canonicalize registered URIs for consistent matching
       for (const [registeredUri, h] of resources.entries()) {
-        // Canonicalize the registered URI for comparison
-        // This ensures consistent matching regardless of registration format
-        const normalizedRegisteredUri = canonicalizePath(registeredUri);
+        // Normalize registered URI for consistent matching (slash deduplication only)
+        // Don't apply security validation to developer-provided templates
+        const normalizedRegisteredUri = registeredUri
+          .replace(/\\/g, "/") // Convert backslashes to forward slashes
+          .replace(/\/+/g, "/"); // Remove duplicate slashes
         const match = matchUri(normalizedRegisteredUri, normalizedUri);
         if (match) {
           handler = h;
@@ -789,11 +790,9 @@ export function createServer(options = {}) {
         return handleLoggingSetLevel(params);
 
       default: {
-        {
-          const error = new Error("Method not found");
-          error.code = -32601;
-          throw error;
-        }
+        const error = new Error("Method not found");
+        error.code = -32601;
+        throw error;
       }
     }
   }