@muvon/octofs 0.19.0 → 0.20.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +8 -4
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -13,7 +13,7 @@
13
13
 
14
14
  *Standalone Rust binary that exposes filesystem tools over the Model Context Protocol. Built on `rmcp` 3.x, `tokio`, and `axum`.*
15
15
 
16
- [Installation](#installation) · [Quick Start](#quick-start) · [Features](#features) · [Tools Reference](#mcp-tools-reference) · [Docs](doc/tools.md) · [Architecture](#architecture) · [Changelog](CHANGELOG.md)
16
+ [Installation](#installation) · [Quick Start](#quick-start) · [Features](#features) · [Tools Reference](#mcp-tools-reference) · [Docs](doc/tools.md) · [Architecture](#architecture) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Good first issues](https://github.com/Muvon/octofs/contribute)
17
17
 
18
18
  MCP Registry: [`io.github.Muvon/octofs`](https://registry.modelcontextprotocol.io)
19
19
 
@@ -269,13 +269,17 @@ octofs mcp
269
269
 
270
270
  #### HTTP
271
271
 
272
- Streamable HTTP transport for remote access or multi-client scenarios.
272
+ Streamable HTTP transport for remote access or multi-client scenarios. Every tool, `shell` included, is reachable by whoever can connect, so access is gated:
273
273
 
274
274
  ```bash
275
- octofs mcp --bind 0.0.0.0:12345
275
+ # Loopback, no token: requests carrying a browser Origin header are rejected
276
+ octofs mcp --bind 127.0.0.1:12345
277
+
278
+ # Any other address requires a bearer token; octofs refuses to start without one
279
+ OCTOFS_AUTH_TOKEN="$(openssl rand -hex 32)" octofs mcp --bind 0.0.0.0:12345
276
280
  ```
277
281
 
278
- Connect clients to `http://localhost:12345/mcp`.
282
+ Connect clients to `http://localhost:12345/mcp`; with a token they send `Authorization: Bearer <token>`. The server speaks plain HTTP, so put it behind TLS or an SSH tunnel when the token crosses a network. `--auth-token <TOKEN>` works too, but command-line arguments are visible to other local users.
279
283
 
280
284
  ### Working Directory
281
285
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@muvon/octofs",
3
- "version": "0.19.0",
3
+ "version": "0.20.1",
4
4
  "description": "Standalone MCP filesystem tools server \u2014 view, edit, shell, workdir.",
5
5
  "mcpName": "io.github.Muvon/octofs",
6
6
  "bin": {