@mgsoftwarebv/mg-dashboard-mcp 7.0.14 → 7.0.16

package/dist/index.js

@@ -6578,6 +6578,11 @@ var TOOL_MODULE_MAP = {
   "cursor-remote-run": "cursor_remote",
   ...TRIGGER_TOOL_MODULE_MAP
 };
+function normalizeAllowedTools(value) {
+  if (!Array.isArray(value)) return null;
+  const tools = value.filter((t) => typeof t === "string").map((t) => t.trim()).filter(Boolean);
+  return tools.length > 0 ? tools : null;
+}
 var authContext = null;
 var currentClientIp;
 function extractClientIp(req) {
@@ -6606,7 +6611,7 @@ async function validateApiKey(key) {
     return null;
   }
   const apiKeyRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE api_key_hash = ${keyHash} AND is_active = true
     LIMIT 1
@@ -6658,6 +6663,7 @@ async function validateApiKey(key) {
     apiKeyName: data.name || "Unknown",
     userId: data.created_by,
     allowedServerIds,
+    allowedTools: normalizeAllowedTools(data.allowed_tools),
     permissions,
     roleName
   };
@@ -6852,7 +6858,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     return null;
   }
   const apiRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE id = ${keyRow.api_key_id} AND is_active = true
     LIMIT 1
@@ -6906,6 +6912,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     apiKeyName: `${apiRow.name || "Unknown"} (ssh: ${keyRow.name})`,
     userId: apiRow.created_by,
     allowedServerIds,
+    allowedTools: normalizeAllowedTools(apiRow.allowed_tools),
     permissions,
     roleName
   };
@@ -9138,7 +9145,7 @@ function normaliseMigrationSql(sql25) {
   return sql25.replace(/\r\n/g, "\n").trim() + "\n";
 }
 function migrationSha256(sql25) {
-  return createHash("sha256").update(normaliseMigrationSql(sql25), "utf8").digest("hex");
+  return createHash("sha256").update(sql25.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -10398,7 +10405,9 @@ var TOOLS = [
 var MCP_VERSION = "7.0.5";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
+  const allowedTools = authContext.allowedTools;
   const accessible = TOOLS.filter((tool) => {
+    if (allowedTools && !allowedTools.includes(tool.name)) return false;
     const requiredModule = TOOL_MODULE_MAP[tool.name];
     if (!requiredModule) return true;
     return authContext.permissions.modules[requiredModule] === true;
@@ -10411,6 +10420,16 @@ async function handleCallTool(request) {
   }
   const { name, arguments: toolArgs } = request.params;
   const a = toolArgs || {};
+  if (authContext.allowedTools && !authContext.allowedTools.includes(name)) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Access denied: this API key is restricted to a specific tool allowlist and may not call "${name}". Allowed: ${authContext.allowedTools.join(", ")}`
+        }
+      ]
+    };
+  }
   const requiredModule = TOOL_MODULE_MAP[name];
   if (requiredModule && authContext.permissions.modules[requiredModule] !== true) {
     return {