@mgsoftwarebv/mg-dashboard-mcp 7.4.18 → 7.4.20

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { spawn } from 'child_process';
 import { readFileSync, existsSync, statSync, createReadStream } from 'fs';
-import { join, dirname, sep, isAbsolute } from 'path';
+import { dirname, sep, join, isAbsolute } from 'path';
 import { Client as Client$1 } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -13,6 +13,7 @@ import crypto, { randomUUID, createHash, randomBytes, createCipheriv, createDeci
 import { readFile, mkdtemp, writeFile, rm } from 'fs/promises';
 import { createServer } from 'http';
 import { tmpdir } from 'os';
+import { fileURLToPath } from 'url';
 import { AsyncLocalStorage } from 'async_hooks';
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
@@ -21,7 +22,6 @@ import { sql } from 'drizzle-orm';
 import { once } from 'events';
 import { lookup } from 'dns/promises';
 import { connect } from 'tls';
-import { fileURLToPath } from 'url';
 import { pgTable, timestamp, uuid, jsonb, boolean, text, customType, integer, date, real, index, uniqueIndex, pgEnum, check, bigint, doublePrecision, primaryKey, foreignKey } from 'drizzle-orm/pg-core';
 import { HeadObjectCommand, ListObjectsV2Command, DeleteObjectsCommand, S3Client, DeleteObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, CompleteMultipartUploadCommand, AbortMultipartUploadCommand, PutObjectCommand, GetObjectCommand, CopyObjectCommand } from '@aws-sdk/client-s3';
 
@@ -1316,151 +1316,6 @@ async function proxyJson(ctx, route, body) {
     content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
   };
 }
-var MCP_NPM_PACKAGE = "@mgsoftwarebv/mg-dashboard-mcp";
-var MCP_SKIP_SELF_UPDATE_ENV = "MG_MCP_SKIP_SELF_UPDATE";
-var MCP_SELF_UPDATE_TIMEOUT_MS = 2500;
-var MCP_REQUIRED_VERSION_PATH = "/api/mcp/required-version";
-var MG_DASHBOARD_ORIGIN_DEFAULT = "https://dashboard.mgsoftware.nl";
-function npmLatestUrl(pkg = MCP_NPM_PACKAGE) {
-  const slash = pkg.indexOf("/");
-  if (slash < 0) return `https://registry.npmjs.org/${pkg}/latest`;
-  return `https://registry.npmjs.org/${pkg.slice(0, slash)}%2f${pkg.slice(slash + 1)}/latest`;
-}
-function parseNpmVersion(value) {
-  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(value?.trim() ?? "");
-  if (!match) return null;
-  return [Number(match[1]), Number(match[2]), Number(match[3])];
-}
-function isNpmVersionBehind(installed, latest) {
-  const a = parseNpmVersion(installed);
-  const b = parseNpmVersion(latest);
-  if (!a || !b) return false;
-  if (a[0] !== b[0]) return a[0] < b[0];
-  if (a[1] !== b[1]) return a[1] < b[1];
-  return a[2] < b[2];
-}
-function packageRootFromModuleUrl(moduleUrl) {
-  const here = dirname(fileURLToPath(moduleUrl));
-  const base = here.split(sep).pop();
-  if (base === "dist" || base === "src") return join(here, "..");
-  return here;
-}
-function isLocalMonorepoCheckout(packageRoot) {
-  return existsSync(join(packageRoot, "../../apps/backoffice/package.json"));
-}
-function readInstalledMcpVersion(packageRoot = packageRootFromModuleUrl(import.meta.url)) {
-  try {
-    const raw = readFileSync(join(packageRoot, "package.json"), "utf8");
-    const parsed = JSON.parse(raw);
-    return typeof parsed.version === "string" ? parsed.version : null;
-  } catch {
-    return null;
-  }
-}
-function mcpRequiredVersionUrl(origin = MG_DASHBOARD_ORIGIN_DEFAULT) {
-  return `${origin.replace(/\/$/, "")}${MCP_REQUIRED_VERSION_PATH}`;
-}
-function parseDashboardRequiredVersion(json) {
-  if (!json || typeof json !== "object") return null;
-  const version = json.version;
-  if (typeof version !== "string") return null;
-  return parseNpmVersion(version) ? version.trim() : null;
-}
-async function fetchDashboardRequiredVersion(fetchFn, origin, timeoutMs = MCP_SELF_UPDATE_TIMEOUT_MS) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const response = await fetchFn(mcpRequiredVersionUrl(origin), {
-      signal: controller.signal,
-      headers: { Accept: "application/json", "cache-control": "no-store" }
-    });
-    if (!response.ok) return null;
-    return parseDashboardRequiredVersion(await response.json());
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function fetchLatestNpmVersion(fetchFn, pkg = MCP_NPM_PACKAGE, timeoutMs = MCP_SELF_UPDATE_TIMEOUT_MS) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const response = await fetchFn(npmLatestUrl(pkg), {
-      signal: controller.signal,
-      headers: { Accept: "application/json" }
-    });
-    if (!response.ok) return null;
-    const json = await response.json();
-    return typeof json.version === "string" ? json.version : null;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function shouldSkipMcpSelfUpdate(io = {}) {
-  const env = io.env ?? process.env;
-  if (env[MCP_SKIP_SELF_UPDATE_ENV] === "1") return true;
-  const packageRoot = packageRootFromModuleUrl(io.moduleUrl ?? import.meta.url);
-  const monorepo = io.monorepo ?? isLocalMonorepoCheckout(packageRoot);
-  return monorepo;
-}
-function buildNpxSelfUpdateArgs(latest, argv) {
-  const command = process.platform === "win32" ? "npx.cmd" : "npx";
-  return {
-    command,
-    args: ["-y", "--prefer-online", `${MCP_NPM_PACKAGE}@${latest}`, ...argv]
-  };
-}
-function waitForSpawnedChild(child) {
-  return new Promise((resolve) => {
-    child.on("error", () => resolve(1));
-    child.on("close", (code) => resolve(code ?? 1));
-  });
-}
-async function maybeReexecLatestMcp(io = {}) {
-  if (shouldSkipMcpSelfUpdate(io)) return false;
-  const packageRoot = packageRootFromModuleUrl(io.moduleUrl ?? import.meta.url);
-  const installed = io.installedVersion !== void 0 ? io.installedVersion : readInstalledMcpVersion(packageRoot);
-  if (!installed) return false;
-  const fetchFn = io.fetchFn ?? fetch;
-  const origin = (io.dashboardBaseUrl || io.env?.MG_DASHBOARD_BASE_URL || MG_DASHBOARD_ORIGIN_DEFAULT).replace(/\/$/, "");
-  const dashboardVersion = await fetchDashboardRequiredVersion(fetchFn, origin);
-  const npmVersion = dashboardVersion ? null : await fetchLatestNpmVersion(fetchFn);
-  const latest = dashboardVersion ?? npmVersion;
-  if (!latest || !isNpmVersionBehind(installed, latest)) return false;
-  const argv = io.argv ?? process.argv.slice(2);
-  const { command, args: args2 } = buildNpxSelfUpdateArgs(latest, argv);
-  const log = io.log ?? ((message) => console.error(message));
-  log(
-    `[mcp] ${MCP_NPM_PACKAGE}@${installed} is behind npm ${latest}; restarting via npx --prefer-online`
-  );
-  const spawnFn = io.spawnFn ?? spawn;
-  let spawnFailed = false;
-  const child = spawnFn(command, args2, {
-    stdio: "inherit",
-    env: {
-      ...process.env,
-      [MCP_SKIP_SELF_UPDATE_ENV]: "1"
-    },
-    shell: process.platform === "win32",
-    windowsHide: true
-  });
-  child.on?.("error", () => {
-    spawnFailed = true;
-  });
-  const wait = io.waitForChild ?? waitForSpawnedChild;
-  const code = await wait(child);
-  if (spawnFailed) {
-    log(
-      `[mcp] self-update spawn failed; continuing on ${MCP_NPM_PACKAGE}@${installed}`
-    );
-    return false;
-  }
-  if (code !== 0) process.exitCode = code;
-  return true;
-}
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 var AUTH_TAG_LENGTH = 16;
@@ -9174,6 +9029,11 @@ function normalizeAllowedTools(value) {
   const tools = value.filter((t) => typeof t === "string").map((t) => t.trim()).filter(Boolean);
   return tools.length > 0 ? tools : null;
 }
+function isMcpToolAllowed(name, allowed, denied) {
+  if (denied?.includes(name)) return false;
+  if (allowed && allowed.length > 0) return allowed.includes(name);
+  return true;
+}
 var authContext = null;
 var currentClientIp;
 function extractClientIp(req) {
@@ -9202,7 +9062,7 @@ async function validateApiKey(key) {
     return null;
   }
   const apiKeyRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, denied_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE api_key_hash = ${keyHash} AND is_active = true
     LIMIT 1
@@ -9255,6 +9115,7 @@ async function validateApiKey(key) {
     userId: data.created_by,
     allowedServerIds,
     allowedTools: normalizeAllowedTools(data.allowed_tools),
+    deniedTools: normalizeAllowedTools(data.denied_tools),
     permissions,
     roleName
   };
@@ -9449,7 +9310,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     return null;
   }
   const apiRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, denied_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE id = ${keyRow.api_key_id} AND is_active = true
     LIMIT 1
@@ -9504,6 +9365,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     userId: apiRow.created_by,
     allowedServerIds,
     allowedTools: normalizeAllowedTools(apiRow.allowed_tools),
+    deniedTools: normalizeAllowedTools(apiRow.denied_tools),
     permissions,
     roleName
   };
@@ -13776,13 +13638,27 @@ var TOOLS = [
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
 ];
+function readInstalledMcpVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const base = here.split(sep).pop();
+    const packageRoot = base === "dist" || base === "src" ? join(here, "..") : here;
+    const parsed = JSON.parse(
+      readFileSync(join(packageRoot, "package.json"), "utf8")
+    );
+    return typeof parsed.version === "string" ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
 var MCP_VERSION = readInstalledMcpVersion() ?? "0.0.0";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const allowedTools = authContext.allowedTools;
   const isSuperadmin = authContext.roleName === "superadmin";
   const accessible = TOOLS.filter((tool) => {
-    if (allowedTools && !allowedTools.includes(tool.name)) return false;
+    if (!isMcpToolAllowed(tool.name, allowedTools, authContext.deniedTools))
+      return false;
     if (SUPERADMIN_ONLY_TOOLS.has(tool.name) && !isSuperadmin) return false;
     const requiredModule = TOOL_MODULE_MAP[tool.name];
     if (!requiredModule) return true;
@@ -13796,12 +13672,16 @@ async function handleCallTool(request) {
   }
   const { name, arguments: toolArgs } = request.params;
   const a = toolArgs || {};
-  if (authContext.allowedTools && !authContext.allowedTools.includes(name)) {
+  if (!isMcpToolAllowed(
+    name,
+    authContext.allowedTools,
+    authContext.deniedTools
+  )) {
     return {
       content: [
         {
           type: "text",
-          text: `Access denied: this API key is restricted to a specific tool allowlist and may not call "${name}". Allowed: ${authContext.allowedTools.join(", ")}`
+          text: `Access denied: this API key may not call "${name}".`
         }
       ]
     };
@@ -17541,11 +17421,6 @@ function createMcpServer() {
 var server = createMcpServer();
 async function main() {
   console.error("Starting MG Dashboard MCP Server...");
-  const replaced = await maybeReexecLatestMcp({
-    argv: process.argv.slice(2),
-    dashboardBaseUrl
-  });
-  if (replaced) return;
   const apiAuthContext = await validateApiKey(apiKey);
   if (!apiAuthContext) {
     console.error("API key validation failed");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mgsoftwarebv/mg-dashboard-mcp",
-  "version": "7.4.18",
+  "version": "7.4.20",
   "description": "MCP Server for MG Dashboard - SSH, SFTP, Docker, domains, DNS, and environment config tools for Cursor",
   "type": "module",
   "main": "dist/index.js",