@mgsoftwarebv/mg-dashboard-mcp 7.4.19 → 7.4.20

package/dist/index.js

@@ -9029,6 +9029,11 @@ function normalizeAllowedTools(value) {
   const tools = value.filter((t) => typeof t === "string").map((t) => t.trim()).filter(Boolean);
   return tools.length > 0 ? tools : null;
 }
+function isMcpToolAllowed(name, allowed, denied) {
+  if (denied?.includes(name)) return false;
+  if (allowed && allowed.length > 0) return allowed.includes(name);
+  return true;
+}
 var authContext = null;
 var currentClientIp;
 function extractClientIp(req) {
@@ -9057,7 +9062,7 @@ async function validateApiKey(key) {
     return null;
   }
   const apiKeyRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, denied_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE api_key_hash = ${keyHash} AND is_active = true
     LIMIT 1
@@ -9110,6 +9115,7 @@ async function validateApiKey(key) {
     userId: data.created_by,
     allowedServerIds,
     allowedTools: normalizeAllowedTools(data.allowed_tools),
+    deniedTools: normalizeAllowedTools(data.denied_tools),
     permissions,
     roleName
   };
@@ -9304,7 +9310,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     return null;
   }
   const apiRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, denied_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE id = ${keyRow.api_key_id} AND is_active = true
     LIMIT 1
@@ -9359,6 +9365,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     userId: apiRow.created_by,
     allowedServerIds,
     allowedTools: normalizeAllowedTools(apiRow.allowed_tools),
+    deniedTools: normalizeAllowedTools(apiRow.denied_tools),
     permissions,
     roleName
   };
@@ -13650,7 +13657,8 @@ async function handleListTools() {
   const allowedTools = authContext.allowedTools;
   const isSuperadmin = authContext.roleName === "superadmin";
   const accessible = TOOLS.filter((tool) => {
-    if (allowedTools && !allowedTools.includes(tool.name)) return false;
+    if (!isMcpToolAllowed(tool.name, allowedTools, authContext.deniedTools))
+      return false;
     if (SUPERADMIN_ONLY_TOOLS.has(tool.name) && !isSuperadmin) return false;
     const requiredModule = TOOL_MODULE_MAP[tool.name];
     if (!requiredModule) return true;
@@ -13664,12 +13672,16 @@ async function handleCallTool(request) {
   }
   const { name, arguments: toolArgs } = request.params;
   const a = toolArgs || {};
-  if (authContext.allowedTools && !authContext.allowedTools.includes(name)) {
+  if (!isMcpToolAllowed(
+    name,
+    authContext.allowedTools,
+    authContext.deniedTools
+  )) {
     return {
       content: [
         {
           type: "text",
-          text: `Access denied: this API key is restricted to a specific tool allowlist and may not call "${name}". Allowed: ${authContext.allowedTools.join(", ")}`
+          text: `Access denied: this API key may not call "${name}".`
         }
       ]
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mgsoftwarebv/mg-dashboard-mcp",
-  "version": "7.4.19",
+  "version": "7.4.20",
   "description": "MCP Server for MG Dashboard - SSH, SFTP, Docker, domains, DNS, and environment config tools for Cursor",
   "type": "module",
   "main": "dist/index.js",