@modootoday/pmcp 0.8.0 → 0.8.2

package/README.md

@@ -189,7 +189,19 @@ const skills = createSkillHttpHandler({
 export default { fetch: (request: Request) => skills.fetch(request) };
 ```
 
-Put Origin and Host validation in front of it when it is mounted bare.
+The handler checks requests before they reach MCP:
+
+| Option            | Default | Effect                                                                                                                                                                                                                                  |
+| ----------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `allowedOrigins`  | none    | A request with an `Origin` other than the server's own gets 403. Listed origins are served with CORS headers, and their preflight is answered. `"*"` admits any origin. Requests without `Origin` are not from a browser page and pass. |
+| `publicOrigins`   | none    | The server's own origins as browsers see them, when a proxy ends TLS and the request URL is `http://`. Without it, a same-site page behind such a proxy gets 403.                                                                       |
+| `allowedHosts`    | any     | When set, a `Host` outside the list gets 403 (DNS rebinding).                                                                                                                                                                           |
+| `maxRequestBytes` | 1 MiB   | A larger body gets 413; a declared length is refused before reading.                                                                                                                                                                    |
+| `rateLimit`       | off     | `{ perMinute }` per caller id; past it, 429 with `retry-after`.                                                                                                                                                                         |
+
+An MCP config (`.mcp.json`) is never served as written: every `env` and `headers` value is
+replaced with `<redacted>`, whichever entry reaches the file, and listed digests describe
+the redacted bytes.
 
 Pass `semantic: { cacheDir, localOnly: true }` to rank by meaning: the handler encodes
 the catalog at start with `@huggingface/transformers` and the multilingual model, so an

package/SECURITY.md

@@ -20,6 +20,11 @@ Inspect the plan with `--dry-run`; non-interactive application requires `--yes`.
 The CLI disables dependency install scripts for skill-package installation and
 checks catalog integrity against registry metadata before applying a plan.
 
+The server returns skill files as text or base64 and never runs them. An MCP config
+(`.mcp.json`) is served with every `env` and `headers` value redacted. The HTTP handler
+refuses browser origins it was not given, and caps request size; host names and a
+per-caller rate limit are options. Authentication and call records belong to the host.
+
 ## Supported versions
 
 Security fixes are released on the latest published version. Include the pmcp

package/dist/{chunk-WSTCBVXW.js → chunk-3JNWCUHA.js}

@@ -1,6 +1,6 @@
 import {
   openDatabase
-} from "./chunk-OPDVUHTK.js";
+} from "./chunk-IRQTGYHA.js";
 
 // src/embed.ts
 var DEFAULT_MODEL_ID = "Xenova/multilingual-e5-small";
@@ -157,4 +157,4 @@ export {
   encodeEntries,
   openEntryVectors
 };
-//# sourceMappingURL=chunk-WSTCBVXW.js.map
+//# sourceMappingURL=chunk-3JNWCUHA.js.map

package/dist/{chunk-OPDVUHTK.js → chunk-IRQTGYHA.js}

@@ -1,6 +1,6 @@
 import {
   normaliseIntent
-} from "./chunk-ZDV75HZN.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/cache.ts
 async function openDatabase(path) {
@@ -131,4 +131,4 @@ export {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
 };
-//# sourceMappingURL=chunk-OPDVUHTK.js.map
+//# sourceMappingURL=chunk-IRQTGYHA.js.map

package/dist/{chunk-M6LBYJDS.js → chunk-O2P5AIHX.js}

@@ -2,7 +2,7 @@ import {
   frontmatterObject,
   readCatalog,
   specProblems
-} from "./chunk-ZDV75HZN.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/config.ts
 import { existsSync, readFileSync } from "fs";
@@ -1139,4 +1139,4 @@ export {
   validateSkillDir,
   validateCatalog
 };
-//# sourceMappingURL=chunk-M6LBYJDS.js.map
+//# sourceMappingURL=chunk-O2P5AIHX.js.map

package/dist/{chunk-ZDV75HZN.js → chunk-UGRHZHHC.js}

@@ -624,16 +624,49 @@ function registerSkillPrompts(server, tools) {
 // src/files/list.ts
 import { createHash } from "crypto";
 import { readFileSync as readFileSync3, readdirSync as readdirSync3, statSync } from "fs";
-import { basename as basename3, join as join3, relative as relative2, sep } from "path";
+import { basename as basename4, join as join3, relative as relative2, sep } from "path";
+
+// src/files/redact.ts
+import { basename as basename3 } from "path";
+var REDACTED = "<redacted>";
+var SECRET_MAPS = /* @__PURE__ */ new Set(["env", "headers"]);
+function redactValue(value) {
+  if (Array.isArray(value)) return value.map(redactValue);
+  if (value === null || typeof value !== "object") return value;
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) {
+    const isSecretMap = SECRET_MAPS.has(key.toLowerCase()) && inner !== null && typeof inner === "object" && !Array.isArray(inner);
+    out[key] = isSecretMap ? Object.fromEntries(Object.keys(inner).map((name) => [name, REDACTED])) : redactValue(inner);
+  }
+  return out;
+}
+function redactMcpConfig(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return `${JSON.stringify({ redacted: REDACTED, reason: "not valid JSON" }, null, 2)}
+`;
+  }
+  return `${JSON.stringify(redactValue(parsed), null, 2)}
+`;
+}
+var isMcpConfig = (path) => basename3(path) === ".mcp.json";
+function servedBytes(path, raw) {
+  if (!isMcpConfig(path)) return raw;
+  return Buffer.from(redactMcpConfig(raw.toString("utf8")), "utf8");
+}
+
+// src/files/list.ts
 var FILE_LIST_LIMIT = 200;
 var sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function describe(path, full) {
-  const bytes = readFileSync3(full);
+  const bytes = servedBytes(full, readFileSync3(full));
   return { path, bytes: bytes.length, sha256: sha256(bytes) };
 }
 function listSkillFiles(root, limit = FILE_LIST_LIMIT) {
   if (statSync(root).isFile()) {
-    return { files: [describe(basename3(root), root)], truncated: false };
+    return { files: [describe(basename4(root), root)], truncated: false };
   }
   const files = [];
   const stack = [root];
@@ -803,7 +836,7 @@ function readSkillFile(entry, wanted, budget = READ_BUDGET_BYTES) {
       detail: `${size} bytes > ${budget}`
     };
   }
-  const bytes = readFileSync4(resolved.target);
+  const bytes = servedBytes(resolved.target, readFileSync4(resolved.target));
   const { kind: kind2, mimeType } = classify(resolved.path, bytes);
   return {
     ok: true,
@@ -1130,7 +1163,9 @@ function createSkillTools(options) {
       const own = ownFile(entry);
       return {
         name: entry.name,
-        body: readBody(readFileSync6(entry.path, "utf8")),
+        body: readBody(
+          servedBytes(entry.path, readFileSync6(entry.path)).toString("utf8")
+        ),
         files: bundle.files.filter((file) => file.path !== own),
         filesTruncated: bundle.truncated
       };
@@ -1150,7 +1185,7 @@ function createSkillTools(options) {
 // src/extension/entry.ts
 import { createHash as createHash2 } from "crypto";
 import { readFileSync as readFileSync7, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
-import { basename as basename4, dirname as dirname5, join as join5, relative as relative4, sep as sep3 } from "path";
+import { basename as basename5, dirname as dirname5, join as join5, relative as relative4, sep as sep3 } from "path";
 var MAX_RESOURCES = 512;
 var MAX_SKILL_BYTES = 16 * 1024 * 1024;
 var digests = /* @__PURE__ */ new Map();
@@ -1159,8 +1194,9 @@ function facts(path) {
   const key = `${stat.mtimeMs}:${stat.size}`;
   const cached = digests.get(path);
   if (cached?.key === key) return cached;
-  const digest = `sha256:${createHash2("sha256").update(readFileSync7(path)).digest("hex")}`;
-  const fresh = { key, digest, size: stat.size };
+  const bytes = servedBytes(path, readFileSync7(path));
+  const digest = `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
+  const fresh = { key, digest, size: bytes.length };
   digests.set(path, fresh);
   return fresh;
 }
@@ -1180,11 +1216,11 @@ function filesUnder(root) {
   return found.sort();
 }
 function extensionEntry(entry) {
-  if (kindOf(entry) !== "skill" || basename4(entry.path) !== "SKILL.md")
+  if (kindOf(entry) !== "skill" || basename5(entry.path) !== "SKILL.md")
     return null;
   const frontmatter = frontmatterObject(readFileSync7(entry.path, "utf8"));
   const root = dirname5(entry.path);
-  if (specProblems(frontmatter, basename4(root)).length > 0) return null;
+  if (specProblems(frontmatter, basename5(root)).length > 0) return null;
   if (frontmatter?.["name"] !== entry.slug) return null;
   const files = filesUnder(root);
   if (files === null) return null;
@@ -1554,7 +1590,7 @@ function registerReadTool(server, tools) {
 
 // src/mcp.ts
 var SERVER_NAME = "pmcp";
-var SERVER_VERSION = "0.8.0";
+var SERVER_VERSION = "0.8.2";
 function registerSkillTools(server, tools) {
   registerCatalogTool(server, tools);
   registerFindTool(server, tools);
@@ -1625,4 +1661,4 @@ export {
   registerSkillTools,
   createSkillServer
 };
-//# sourceMappingURL=chunk-ZDV75HZN.js.map
+//# sourceMappingURL=chunk-UGRHZHHC.js.map

package/dist/{chunk-LUBYOET7.js → chunk-UW7HTILA.js}

@@ -1,6 +1,6 @@
 import {
   createSkillServer
-} from "./chunk-ZDV75HZN.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/stdio.ts
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
@@ -38,4 +38,4 @@ export {
   serve,
   main
 };
-//# sourceMappingURL=chunk-LUBYOET7.js.map
+//# sourceMappingURL=chunk-UW7HTILA.js.map

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   loadEmbedder,
   openEntryVectors
-} from "./chunk-WSTCBVXW.js";
+} from "./chunk-3JNWCUHA.js";
 import {
   ConfigError,
   ProjectError,
@@ -17,15 +17,15 @@ import {
   splitFrontmatter,
   validateCatalog,
   validateSkillDir
-} from "./chunk-M6LBYJDS.js";
-import "./chunk-OPDVUHTK.js";
+} from "./chunk-O2P5AIHX.js";
+import "./chunk-IRQTGYHA.js";
 import {
   serve
-} from "./chunk-LUBYOET7.js";
+} from "./chunk-UW7HTILA.js";
 import {
   kindOf,
   readCatalog
-} from "./chunk-ZDV75HZN.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/cli/command.ts
 var ArgumentError = class extends Error {
@@ -2347,7 +2347,7 @@ function dispatch(argv, options = {}) {
   }
   return run(command, rest, { ui, env, cwd });
 }
-var VERSION = "0.8.0";
+var VERSION = "0.8.2";
 async function run(command, argv, context) {
   try {
     return await command.run({

package/dist/http.d.ts

@@ -37,6 +37,19 @@ interface LoadEmbedderOptions {
  */
 declare function loadEmbedder(modelId?: string, options?: LoadEmbedderOptions): Promise<Embedder | null>;
 
+/**
+ * Checks a hosted skills server makes before a request reaches MCP: which browser origins
+ * and Host names may call it, how large a request may be, and how often one caller may call.
+ * Requests without an Origin header are not from a browser page and are not origin-checked.
+ */
+declare const DEFAULT_MAX_REQUEST_BYTES: number;
+interface RateLimitOptions {
+    /** Requests one caller may make in a minute. */
+    readonly perMinute: number;
+    /** Injected by tests. */
+    readonly now?: () => number;
+}
+
 /**
  * The catalog over streamable HTTP, for a hosted skills server.
  *
@@ -75,6 +88,16 @@ interface SkillHttpOptions extends SkillServerOptions {
      * here, so "private" unless the host knows every caller sees the same list.
      */
     readonly cacheScope?: "public" | "private";
+    /** Browser origins, besides the server's own, whose pages may call; others get 403. "*" admits any. */
+    readonly allowedOrigins?: readonly string[];
+    /** The server's own public origins when a proxy ends TLS, e.g. "https://skills.example.com". */
+    readonly publicOrigins?: readonly string[];
+    /** Host header values the server answers to; unset means any. */
+    readonly allowedHosts?: readonly string[];
+    /** Largest request body accepted; larger ones get 413. */
+    readonly maxRequestBytes?: number;
+    /** Per-caller request ceiling; unset means the host limits rate itself. */
+    readonly rateLimit?: RateLimitOptions;
 }
 declare const DEFAULT_TIERS: readonly string[];
 declare function visibleTo(entries: readonly SkillEntry[], tiers: readonly string[]): SkillEntry[];
@@ -87,4 +110,4 @@ interface SkillHttpHandler {
 }
 declare function createSkillHttpHandler(options: SkillHttpOptions): SkillHttpHandler;
 
-export { DEFAULT_MODEL_ID, DEFAULT_TIERS, Embedder, type SkillCaller, type SkillHttpHandler, type SkillHttpOptions, type SkillHttpSemanticOptions, createSkillHttpHandler, loadEmbedder, visibleTo };
+export { DEFAULT_MAX_REQUEST_BYTES, DEFAULT_MODEL_ID, DEFAULT_TIERS, Embedder, type RateLimitOptions, type SkillCaller, type SkillHttpHandler, type SkillHttpOptions, type SkillHttpSemanticOptions, createSkillHttpHandler, loadEmbedder, visibleTo };

package/dist/http.js

@@ -2,17 +2,124 @@ import {
   DEFAULT_MODEL_ID,
   encodeEntries,
   loadEmbedder
-} from "./chunk-WSTCBVXW.js";
-import "./chunk-OPDVUHTK.js";
+} from "./chunk-3JNWCUHA.js";
+import "./chunk-IRQTGYHA.js";
 import {
   createSkillServer,
   readCatalog
-} from "./chunk-ZDV75HZN.js";
+} from "./chunk-UGRHZHHC.js";
 
 // src/http.ts
 import {
   createMcpHandler
 } from "@modelcontextprotocol/server";
+
+// src/http-guard.ts
+var DEFAULT_MAX_REQUEST_BYTES = 1024 * 1024;
+var RATE_WINDOW_MS = 6e4;
+var CORS_ALLOW_HEADERS = "authorization, content-type, accept, mcp-session-id, mcp-protocol-version, last-event-id";
+var json = (status, body, headers = {}) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json", ...headers }
+});
+function checkOrigin(request, allowedOrigins = [], publicOrigins = []) {
+  const origin = request.headers.get("origin");
+  if (origin === null) return { kind: "none" };
+  if (origin === new URL(request.url).origin || publicOrigins.includes(origin)) {
+    return { kind: "same" };
+  }
+  if (allowedOrigins.includes(origin) || allowedOrigins.includes("*")) {
+    return { kind: "allowed", origin };
+  }
+  return {
+    kind: "refused",
+    response: json(403, { error: "origin_not_allowed" })
+  };
+}
+function checkHost(request, allowedHosts) {
+  if (!allowedHosts) return void 0;
+  const host = request.headers.get("host") ?? new URL(request.url).host;
+  return allowedHosts.includes(host) ? void 0 : json(403, { error: "host_not_allowed" });
+}
+function corsHeaders(origin) {
+  return {
+    "access-control-allow-origin": origin,
+    "access-control-expose-headers": "mcp-session-id, www-authenticate",
+    vary: "Origin"
+  };
+}
+function preflight(origin) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      ...corsHeaders(origin),
+      "access-control-allow-methods": "GET, POST, DELETE, OPTIONS",
+      "access-control-allow-headers": CORS_ALLOW_HEADERS,
+      "access-control-max-age": "600"
+    }
+  });
+}
+function withHeaders(response, headers) {
+  const merged = new Headers(response.headers);
+  for (const [name, value] of Object.entries(headers)) merged.set(name, value);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: merged
+  });
+}
+var tooLarge = (max) => json(413, { error: "request_too_large", limit: max });
+async function capBody(request, max) {
+  const declared = Number(request.headers.get("content-length") ?? NaN);
+  if (Number.isFinite(declared) && declared > max) return tooLarge(max);
+  if (!request.body) return request;
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > max) {
+      await reader.cancel();
+      return tooLarge(max);
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Request(request.url, {
+    method: request.method,
+    headers: request.headers,
+    body
+  });
+}
+function createRateLimiter(options) {
+  const now = options.now ?? Date.now;
+  const windows = /* @__PURE__ */ new Map();
+  return (callerId) => {
+    const t = now();
+    const window = windows.get(callerId);
+    if (!window || t - window.start >= RATE_WINDOW_MS) {
+      windows.set(callerId, { start: t, count: 1 });
+      return void 0;
+    }
+    window.count += 1;
+    if (window.count <= options.perMinute) return void 0;
+    const retry = Math.ceil((window.start + RATE_WINDOW_MS - t) / 1e3);
+    return json(
+      429,
+      { error: "rate_limited" },
+      { "retry-after": String(Math.max(retry, 1)) }
+    );
+  };
+}
+
+// src/http.ts
 var DEFAULT_TIERS = ["open", "free"];
 function visibleTo(entries, tiers) {
   const allowed = new Set(tiers);
@@ -57,26 +164,47 @@ function createSkillHttpHandler(options) {
     handlers.set(key, handler);
     return handler;
   };
-  return {
-    async fetch(request) {
-      const caller = await options.authorize(request);
-      if (!caller) {
-        return new Response(JSON.stringify({ error: "unauthorized" }), {
-          status: 401,
-          headers: {
-            "content-type": "application/json",
-            "www-authenticate": options.challenge ?? "Bearer"
-          }
-        });
-      }
-      return handlerFor(tiersFor(caller)).fetch(request, {
-        authInfo: {
-          token: "",
-          clientId: caller.id,
-          scopes: [],
-          extra: { ...caller.claims }
+  const limit = options.rateLimit ? createRateLimiter(options.rateLimit) : void 0;
+  const serve = async (request) => {
+    const capped = await capBody(
+      request,
+      options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES
+    );
+    if (capped instanceof Response) return capped;
+    const caller = await options.authorize(capped);
+    if (!caller) {
+      return new Response(JSON.stringify({ error: "unauthorized" }), {
+        status: 401,
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": options.challenge ?? "Bearer"
         }
       });
+    }
+    const limited = limit?.(caller.id);
+    if (limited) return limited;
+    return handlerFor(tiersFor(caller)).fetch(capped, {
+      authInfo: {
+        token: "",
+        clientId: caller.id,
+        scopes: [],
+        extra: { ...caller.claims }
+      }
+    });
+  };
+  return {
+    async fetch(request) {
+      const wrongHost = checkHost(request, options.allowedHosts);
+      if (wrongHost) return wrongHost;
+      const origin = checkOrigin(
+        request,
+        options.allowedOrigins,
+        options.publicOrigins
+      );
+      if (origin.kind === "refused") return origin.response;
+      if (origin.kind !== "allowed") return serve(request);
+      if (request.method === "OPTIONS") return preflight(origin.origin);
+      return withHeaders(await serve(request), corsHeaders(origin.origin));
     },
     reload() {
       all = load(options);
@@ -88,6 +216,7 @@ function createSkillHttpHandler(options) {
   };
 }
 export {
+  DEFAULT_MAX_REQUEST_BYTES,
   DEFAULT_MODEL_ID,
   DEFAULT_TIERS,
   createSkillHttpHandler,

package/dist/index.d.ts

@@ -304,7 +304,7 @@ declare function resolveSkillFileUri(uri: string, entries: readonly SkillEntry[]
 
 /** Reported to the host on connect. */
 declare const SERVER_NAME = "pmcp";
-declare const SERVER_VERSION = "0.8.0";
+declare const SERVER_VERSION = "0.8.2";
 /**
  * Registers the skill_* tools on a server.
  *

package/dist/index.js

@@ -14,11 +14,11 @@ import {
   readSpec,
   validateCatalog,
   validateSkillDir
-} from "./chunk-M6LBYJDS.js";
+} from "./chunk-O2P5AIHX.js";
 import {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
-} from "./chunk-OPDVUHTK.js";
+} from "./chunk-IRQTGYHA.js";
 import {
   ASSET_KINDS,
   CATALOG_PAGE_MAX,
@@ -70,7 +70,7 @@ import {
   skillFileUri,
   specProblems,
   withoutBody
-} from "./chunk-ZDV75HZN.js";
+} from "./chunk-UGRHZHHC.js";
 export {
   ASSET_KINDS,
   CATALOG_PAGE_MAX,

package/dist/stdio.js

@@ -3,8 +3,8 @@ import {
   main,
   resolveRoots,
   serve
-} from "./chunk-LUBYOET7.js";
-import "./chunk-ZDV75HZN.js";
+} from "./chunk-UW7HTILA.js";
+import "./chunk-UGRHZHHC.js";
 export {
   main,
   resolveRoots,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/pmcp",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "license": "Elastic-2.0",
   "author": "modootoday",
   "description": "An MCP server that finds the skills your installed packages already ship. Reads SKILL.md out of node_modules by shape rather than by path, so it sees the skills, .agent, .claude, .gemini and .codex conventions alike, and keeps session startup flat as the number of installed skills grows.",