@onereason/svenska-dagar-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Balazs Suhajda
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,99 @@
+# @onereason/svenska-dagar-mcp
+
+MCP server exposing the Swedish public holiday and calendar API ([sholiday.faboul.se](https://sholiday.faboul.se)) to Claude and other MCP clients.
+
+## Installation
+
+Add to your Claude Desktop config (`~/Library/Application Support/Claude/claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "svenska-dagar": {
+      "command": "npx",
+      "args": ["-y", "@onereason/svenska-dagar-mcp"]
+    }
+  }
+}
+```
+
+Restart Claude Desktop. The three tools below are then available in every conversation.
+
+## Tools
+
+### `get_swedish_day`
+
+Returns calendar data for a single date.
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `year` | integer | Year (1753–2100) |
+| `month` | integer | Month (1–12) |
+| `day` | integer | Day of month (1–31) |
+| `sanitize` | boolean | See [Security](#security) — default `true` |
+
+### `get_swedish_month`
+
+Returns calendar data for every day in a month.
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `year` | integer | Year (1753–2100) |
+| `month` | integer | Month (1–12) |
+| `sanitize` | boolean | Default `true` |
+
+### `get_swedish_year`
+
+Returns calendar data for every day in a year (~365 records). Prefer `get_swedish_month` when only a subset is needed.
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `year` | integer | Year (1753–2100) |
+| `sanitize` | boolean | Default `true` |
+
+## Response fields
+
+Each day record contains:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `datum` | string | Date (`YYYY-MM-DD`) |
+| `veckodag` | string | Weekday name in Swedish |
+| `vecka` | string | ISO week number |
+| `dag i vecka` | string | Day of week (1 = Monday) |
+| `arbetsfri dag` | `"Ja"` \| `"Nej"` | Work-free day |
+| `röd dag` | `"Ja"` \| `"Nej"` | Public holiday (red day) |
+| `namnsdag` | string[] | Name days (namnsdagar) |
+| `flaggdag` | string | Flag day name, or `""` |
+| `helgdag` | string | Holiday or named eve (e.g. `"Juldagen"`, `"Nyårsafton"`) — present only when applicable |
+| `helgdagsafton` | string | Eve before a red day (e.g. `"Pingstafton"`) — present only when applicable |
+| `klämdagen` | `"Ja"` | Squeeze day (klämdagen) — present only when applicable |
+| `dag före arbetsfri helgdag` | `"Ja"` | Day before a work-free holiday — present only when applicable |
+
+## Security
+
+All responses are sanitized before reaching the LLM by default:
+
+- **Field allowlist** — unknown fields are dropped
+- **Injection scan** — string values are checked against known prompt-injection patterns (ChatML tokens, role prefixes, markdown headers, etc.) and replaced with `[redacted: suspicious content]` if matched
+- **Length cap** — strings longer than 100 characters are redacted
+- **Enum coercion** — `"röd dag"` and `"arbetsfri dag"` are coerced to exactly `"Ja"` or `"Nej"`
+- **Hardcoded flags** — presence-only fields (`klämdagen`, `dag före arbetsfri helgdag`) are always written as `"Ja"` regardless of what the API sends
+- **Non-object responses** — if the upstream returns a string, array, or any non-object, an empty safe structure is returned instead of passing through raw content
+
+Pass `sanitize: false` to receive the raw upstream response (useful for debugging).
+
+## Development
+
+```bash
+npm install        # install dependencies
+npm run build      # compile TypeScript → dist/
+npm test           # run unit + integration tests (requires network for API tests)
+```
+
+**Running the server** requires Node.js ≥ 18 (native `fetch`).  
+**Running the tests** requires Node.js ≥ 22.6 (`--experimental-strip-types`).
+
+## License
+
+MIT

package/dist/sanitize.js

@@ -0,0 +1,84 @@
+// Max length for any single string value from the API.
+// Legitimate Swedish calendar strings (day names, holiday names) are never
+// longer than this. Anything longer is almost certainly injected content.
+const MAX_STRING_LEN = 100;
+// Patterns that appear in prompt injection payloads but never in calendar data.
+const INJECTION_PATTERNS = [
+    /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|context|text)/i,
+    /\bsystem\s*:/i,
+    /\bassistant\s*:/i,
+    /\bhuman\s*:/i,
+    /\buser\s*:/i,
+    /<\|im_(start|end|sep)\|>/,
+    /\[INST\]|\[\/INST\]/i,
+    /<<SYS>>|<\/SYS>/i,
+    /^#{1,6}\s/m,
+    /```/,
+    /<\s*(script|system|prompt|instruction|command)\b/i,
+];
+export function isSuspicious(value) {
+    if (value.length > MAX_STRING_LEN)
+        return true;
+    return INJECTION_PATTERNS.some((re) => re.test(value));
+}
+function safeStr(raw) {
+    if (typeof raw !== "string")
+        return "[redacted: unexpected type]";
+    if (isSuspicious(raw))
+        return "[redacted: suspicious content]";
+    return raw;
+}
+// For "Ja"/"Nej" fields: only allow the two known values, never pass through
+// arbitrary strings (an attacker could otherwise use these as injection vectors).
+function jaOrNej(raw) {
+    return raw === "Ja" ? "Ja" : "Nej";
+}
+function sanitizeDay(raw) {
+    const day = {
+        datum: safeStr(raw["datum"]),
+        veckodag: safeStr(raw["veckodag"]),
+        "arbetsfri dag": jaOrNej(raw["arbetsfri dag"]),
+        "röd dag": jaOrNej(raw["röd dag"]),
+        vecka: safeStr(raw["vecka"]),
+        "dag i vecka": safeStr(raw["dag i vecka"]),
+        namnsdag: Array.isArray(raw["namnsdag"])
+            ? raw["namnsdag"]
+                .map((n) => safeStr(n))
+                .filter((n) => !n.startsWith("[redacted"))
+            : [],
+        flaggdag: safeStr(raw["flaggdag"] ?? ""),
+    };
+    // Optional text fields — present only when applicable.
+    if ("helgdag" in raw)
+        day["helgdag"] = safeStr(raw["helgdag"]);
+    if ("helgdagsafton" in raw)
+        day["helgdagsafton"] = safeStr(raw["helgdagsafton"]);
+    // Presence-only boolean flags — if they appear at all the value is always
+    // "Ja", so we hardcode it rather than forwarding whatever the API sent.
+    if ("klämdagen" in raw)
+        day["klämdagen"] = "Ja";
+    if ("dag före arbetsfri helgdag" in raw)
+        day["dag före arbetsfri helgdag"] = "Ja";
+    return day;
+}
+export function sanitizeCalendarResponse(raw) {
+    // If the upstream returns a non-object (string, number, array at root level),
+    // do NOT pass it through — return an empty safe structure instead.
+    // A hijacked API could otherwise inject content via a raw string response
+    // that would bypass all field-level sanitization.
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        return { version: "", startdatum: "", slutdatum: "", dagar: [] };
+    }
+    const obj = raw;
+    return {
+        // Metadata: keep only the fields an LLM consumer actually needs.
+        // Drop "cachetid" (unstable timestamp) and "uri" (mirrors our own request
+        // and could be used as an injection surface if the host is compromised).
+        version: safeStr(obj["version"]),
+        startdatum: safeStr(obj["startdatum"]),
+        slutdatum: safeStr(obj["slutdatum"]),
+        dagar: Array.isArray(obj["dagar"])
+            ? obj["dagar"].map((d) => sanitizeDay(d))
+            : [],
+    };
+}

package/dist/server.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { validateYear, validateMonth, validateDay } from "./validate.js";
+import { sanitizeCalendarResponse } from "./sanitize.js";
+// Hardcoded HTTPS base — callers cannot override the scheme or host.
+const BASE_URL = "https://sholiday.faboul.se/dagar/v2.1";
+const TIMEOUT_MS = 10_000;
+// Shared input schema fragment added to every tool.
+const SANITIZE_SCHEMA = {
+    sanitize: {
+        type: "boolean",
+        description: "When true (default), API response values are validated against known " +
+            "formats, unknown fields are dropped, and strings are scanned for prompt " +
+            "injection patterns before being returned. Set to false only if you need " +
+            "the raw upstream response.",
+    },
+};
+// ---------------------------------------------------------------------------
+// HTTP helper — path is always built from validated integers only.
+// No JSONP callback parameter is ever used.
+// ---------------------------------------------------------------------------
+async function fetchCalendar(path) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    try {
+        const response = await fetch(`${BASE_URL}/${path}`, {
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            throw new Error(`upstream returned HTTP ${response.status}`);
+        }
+        return await response.json();
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function applyPolicy(data, sanitize) {
+    return JSON.stringify(sanitize ? sanitizeCalendarResponse(data) : data, null, 0);
+}
+// ---------------------------------------------------------------------------
+// MCP server
+// ---------------------------------------------------------------------------
+const server = new Server({ name: "svenska-dagar", version: "0.1.0" }, { capabilities: { tools: {} } });
+// Tool descriptions are static strings — no API data is embedded in them.
+server.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: [
+        {
+            name: "get_swedish_day",
+            description: "Return Swedish calendar data for a single date: weekday name, week number, " +
+                "whether it is a work-free day (arbetsfri dag), a red day (röd dag / public holiday), " +
+                "a flag day (flaggdag), name days (namnsdag), holiday name (helgdag), " +
+                "holiday eve (helgdagsafton), and squeeze day (klämdagen).",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    year: { type: "integer", description: "Year (1753–2100)" },
+                    month: { type: "integer", description: "Month (1–12)" },
+                    day: { type: "integer", description: "Day of month (1–31)" },
+                    ...SANITIZE_SCHEMA,
+                },
+                required: ["year", "month", "day"],
+                additionalProperties: false,
+            },
+        },
+        {
+            name: "get_swedish_month",
+            description: "Return Swedish calendar data for every day in a calendar month. " +
+                "Each day entry contains the same fields as get_swedish_day.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    year: { type: "integer", description: "Year (1753–2100)" },
+                    month: { type: "integer", description: "Month (1–12)" },
+                    ...SANITIZE_SCHEMA,
+                },
+                required: ["year", "month"],
+                additionalProperties: false,
+            },
+        },
+        {
+            name: "get_swedish_year",
+            description: "Return Swedish calendar data for every day in a calendar year (~365 records). " +
+                "Prefer get_swedish_month when only a subset of the year is needed.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    year: { type: "integer", description: "Year (1753–2100)" },
+                    ...SANITIZE_SCHEMA,
+                },
+                required: ["year"],
+                additionalProperties: false,
+            },
+        },
+    ],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args = {} } = request.params;
+    const { year, month, day } = args;
+    const sanitize = args["sanitize"] !== false;
+    try {
+        let data;
+        if (name === "get_swedish_day") {
+            validateYear(year);
+            validateMonth(month);
+            validateDay(day);
+            const y = year;
+            const m = month;
+            const d = day;
+            data = await fetchCalendar(`${y}/${String(m).padStart(2, "0")}/${String(d).padStart(2, "0")}`);
+        }
+        else if (name === "get_swedish_month") {
+            validateYear(year);
+            validateMonth(month);
+            const y = year;
+            const m = month;
+            data = await fetchCalendar(`${y}/${String(m).padStart(2, "0")}`);
+        }
+        else if (name === "get_swedish_year") {
+            validateYear(year);
+            data = await fetchCalendar(String(year));
+        }
+        else {
+            throw new Error(`unknown tool: ${name}`);
+        }
+        return {
+            content: [{ type: "text", text: applyPolicy(data, sanitize) }],
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: "text", text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/dist/validate.js

@@ -0,0 +1,15 @@
+export function validateYear(year) {
+    if (!Number.isInteger(year) || year < 1753 || year > 2100) {
+        throw new Error(`year must be an integer between 1753 and 2100, got ${year}`);
+    }
+}
+export function validateMonth(month) {
+    if (!Number.isInteger(month) || month < 1 || month > 12) {
+        throw new Error(`month must be an integer between 1 and 12, got ${month}`);
+    }
+}
+export function validateDay(day) {
+    if (!Number.isInteger(day) || day < 1 || day > 31) {
+        throw new Error(`day must be an integer between 1 and 31, got ${day}`);
+    }
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@onereason/svenska-dagar-mcp",
+  "version": "0.1.0",
+  "description": "MCP server for the Swedish public holiday and calendar API (sholiday.faboul.se)",
+  "keywords": ["mcp", "swedish", "calendar", "holidays", "namnsdagar"],
+  "license": "MIT",
+  "type": "module",
+  "files": ["dist"],
+  "bin": {
+    "svenska-dagar-mcp": "./dist/server.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/suhajdab/svenska-dagar-mcp.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build",
+    "start": "node dist/server.js",
+    "test": "node --experimental-strip-types --test test/unit.test.ts test/sanitize.test.ts test/api.test.ts"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0"
+  },
+  "devDependencies": {
+    "@types/node": "22.15.21",
+    "typescript": "5.8.3"
+  }
+}