@mkterswingman/yt-mcp 0.1.0 → 0.1.2

package/dist/auth/oauthFlow.js

@@ -9,9 +9,10 @@ function base64url(buf) {
         .replace(/=+$/, "");
 }
 export async function runOAuthFlow(authUrl) {
-    // 1. Generate PKCE
+    // 1. Generate PKCE + state
     const codeVerifier = base64url(randomBytes(32));
     const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
+    const state = base64url(randomBytes(32));
     // 2. Start temp HTTP server to get the actual port for redirect_uri
     const { server: httpServer, port } = await startCallbackServer();
     const redirectUri = `http://127.0.0.1:${port}`;
@@ -55,6 +56,7 @@ export async function runOAuthFlow(authUrl) {
                 const url = new URL(req.url ?? "/", `http://127.0.0.1`);
                 const code = url.searchParams.get("code");
                 const error = url.searchParams.get("error");
+                const returnedState = url.searchParams.get("state");
                 if (error) {
                     const safeError = error.replace(/[<>&"']/g, (c) => `&#${c.charCodeAt(0)};`);
                     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -68,6 +70,14 @@ export async function runOAuthFlow(authUrl) {
                     res.end("<h1>Waiting for authorization...</h1>");
                     return;
                 }
+                // Verify state to prevent CSRF
+                if (returnedState !== state) {
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end("<h1>Authorization failed</h1><p>State mismatch — possible CSRF attack.</p>");
+                    cleanup();
+                    reject(new Error("OAuth state mismatch"));
+                    return;
+                }
                 // Exchange code for tokens
                 const tokenBody = {
                     grant_type: "authorization_code",
@@ -111,7 +121,7 @@ export async function runOAuthFlow(authUrl) {
             }
         });
         // Open browser
-        const authorizeUrl = `${authUrl}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256`;
+        const authorizeUrl = `${authUrl}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256&state=${encodeURIComponent(state)}`;
         console.log("\n\x1b[1mOpen this URL in your browser to authorize:\x1b[0m");
         console.log(`\n  ${authorizeUrl}\n`);
         import("node:child_process").then(({ exec }) => {

package/dist/tools/remote.js

@@ -18,14 +18,25 @@ function createRemoteTool(server, def, tokenManager, apiUrl) {
         }
         let res;
         try {
-            res = await fetch(`${apiUrl}/${def.remotePath}`, {
-                method: "POST",
-                headers: {
-                    Authorization: `Bearer ${token}`,
-                    "Content-Type": "application/json",
-                },
-                body: JSON.stringify(params),
-            });
+            const method = def.method ?? "POST";
+            const url = new URL(`${apiUrl}/${def.remotePath}`);
+            const headers = {
+                Authorization: `Bearer ${token}`,
+            };
+            const fetchOptions = { method, headers };
+            if (method === "GET") {
+                // For GET requests, pass params as query string
+                for (const [key, value] of Object.entries(params)) {
+                    if (value !== undefined && value !== null) {
+                        url.searchParams.set(key, String(value));
+                    }
+                }
+            }
+            else {
+                headers["Content-Type"] = "application/json";
+                fetchOptions.body = JSON.stringify(params);
+            }
+            res = await fetch(url.toString(), fetchOptions);
         }
         catch (err) {
             return toolErr("REMOTE_ERROR", `Network error: ${err instanceof Error ? err.message : String(err)}`);
@@ -209,6 +220,7 @@ const REMOTE_TOOLS = [
             max_chars: z.number().int().min(500).max(50_000).optional(),
         },
         remotePath: "api/patch-notes",
+        method: "GET",
     },
 ];
 export function registerRemoteTools(server, config, tokenManager) {

package/dist/tools/subtitles.js

@@ -95,8 +95,10 @@ async function downloadSubtitle(videoId, lang, format) {
             error: result.stderr.slice(0, 500) || `yt-dlp exited with ${result.exitCode}`,
         };
     }
-    // Find the output file - yt-dlp appends lang and format extension
-    const possibleExts = [`${lang}.${format}`, `${lang}.vtt`, `${lang}.srt`, `${lang}.ttml`, `${lang}.srv3`];
+    // Find the output file - yt-dlp appends lang and format extension.
+    // For CSV: yt-dlp downloads as VTT first, so only search for VTT (not stale .csv from previous runs).
+    const searchFormat = format === "csv" ? "vtt" : format;
+    const possibleExts = [`${lang}.${searchFormat}`, `${lang}.vtt`, `${lang}.srt`, `${lang}.ttml`, `${lang}.srv3`];
     let foundFile;
     for (const ext of possibleExts) {
         const candidate = `${outTemplate}.${ext}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mkterswingman/yt-mcp",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "YouTube MCP client — local subtitles + remote API proxy",
   "type": "module",
   "bin": {