@okostream/mcp 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.5.1 - 2026-07-10
+
+- Replaced hand-maintained remote-image IP ranges with a tested public-unicast policy covering IPv4, IPv6, mapped, reserved, documentation, benchmark, multicast, and private address classes.
+
 ## 0.5.0 - 2026-07-10
 
 - Isolated every API key behind a synthetic Firebase identity with immediate revocation across Firestore, main RTDB, and chat RTDB.

package/dist/networkPolicy.js

@@ -0,0 +1,18 @@
+import ipaddr from "ipaddr.js";
+export function normalizeIpLiteralHostname(hostname) {
+    return hostname.startsWith("[") && hostname.endsWith("]")
+        ? hostname.slice(1, -1)
+        : hostname;
+}
+export function ipLiteralFamily(address) {
+    const normalized = normalizeIpLiteralHostname(address);
+    if (!ipaddr.isValid(normalized))
+        return 0;
+    return ipaddr.parse(normalized).kind() === "ipv4" ? 4 : 6;
+}
+export function isPublicUnicastAddress(address) {
+    const normalized = normalizeIpLiteralHostname(address);
+    if (!ipaddr.isValid(normalized))
+        return false;
+    return ipaddr.parse(normalized).range() === "unicast";
+}

package/dist/server.js

@@ -23,7 +23,7 @@ if (process.argv.includes("--help")) {
 }
 const server = new McpServer({
     name: "oko-mcp-server",
-    version: "0.5.0",
+    version: "0.5.1",
 }, {
     instructions: OKO_MCP_INSTRUCTIONS,
 });

package/dist/tools.js

@@ -1,6 +1,5 @@
 import { lookup } from "node:dns/promises";
 import { stat, readFile, realpath } from "node:fs/promises";
-import { isIP } from "node:net";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -12,6 +11,7 @@ import { get, endBefore, limitToLast, orderByKey, push, query as dbQuery, ref, r
 import { httpsCallable } from "firebase/functions";
 import { ensureAuth, currentScopes } from "./auth.js";
 import { env } from "./env.js";
+import { ipLiteralFamily, isPublicUnicastAddress, normalizeIpLiteralHostname, } from "./networkPolicy.js";
 import { chatRtdb, firestore, functions, rtdb } from "./firebase.js";
 import { csvCell, requireConfirm, safeString, serialize, textResult } from "./utils.js";
 import { detectAndNormalize, extractIframeSrc } from "./videoUrl.js";
@@ -372,33 +372,6 @@ function isBlockedHostname(hostname) {
     const host = hostname.toLowerCase();
     return host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local");
 }
-function isBlockedIp(address) {
-    const normalized = address.toLowerCase().startsWith("::ffff:")
-        ? address.slice(7)
-        : address;
-    const version = isIP(normalized);
-    if (version === 4) {
-        const [a = -1, b = -1] = normalized.split(".").map((part) => Number(part));
-        return a === 0
-            || a === 10
-            || a === 127
-            || (a === 100 && b >= 64 && b <= 127)
-            || (a === 169 && b === 254)
-            || (a === 172 && b >= 16 && b <= 31)
-            || (a === 192 && b === 168)
-            || (a === 198 && (b === 18 || b === 19))
-            || a >= 224;
-    }
-    if (version === 6) {
-        return normalized === "::"
-            || normalized === "::1"
-            || normalized.startsWith("fc")
-            || normalized.startsWith("fd")
-            || normalized.startsWith("fe80:")
-            || normalized.startsWith("ff");
-    }
-    return false;
-}
 async function resolveRemoteImageAddress(url) {
     if (url.protocol !== "https:") {
         throw new Error("Image URL must use https://.");
@@ -409,15 +382,17 @@ async function resolveRemoteImageAddress(url) {
     if (isBlockedHostname(url.hostname)) {
         throw new Error("Image URL host is not allowed. Use a public HTTPS image URL.");
     }
-    if (isIP(url.hostname)) {
-        if (isBlockedIp(url.hostname)) {
+    const literalAddress = normalizeIpLiteralHostname(url.hostname);
+    const literalFamily = ipLiteralFamily(literalAddress);
+    if (literalFamily !== 0) {
+        if (!isPublicUnicastAddress(literalAddress)) {
             throw new Error("Image URL points to a private/local IP address, which is not allowed.");
         }
-        return { address: url.hostname, family: isIP(url.hostname) };
+        return { address: literalAddress, family: literalFamily };
     }
     const addresses = await lookup(url.hostname, { all: true });
-    if (addresses.length === 0 || addresses.some((item) => isBlockedIp(item.address))) {
-        throw new Error("Image URL resolves to a private/local IP address, which is not allowed.");
+    if (addresses.length === 0 || addresses.some((item) => !isPublicUnicastAddress(item.address))) {
+        throw new Error("Image URL resolves to a non-public IP address, which is not allowed.");
     }
     const selected = addresses[0];
     if (!selected || (selected.family !== 4 && selected.family !== 6)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okostream/mcp",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "MCP server for managing OKO Stream webinars as an organizer.",
   "license": "UNLICENSED",
   "type": "module",
@@ -36,6 +36,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.2.3",
     "firebase": "^12.16.0",
+    "ipaddr.js": "2.4.0",
     "sharp": "^0.35.3",
     "undici": "7.28.0",
     "zod": "^3.25.76"