@onereason/svenska-dagar-mcp 0.1.5 → 0.2.0

package/README.md

@@ -38,7 +38,6 @@ Returns calendar data for a single date.
 | `year` | integer | Year (1753–2100) |
 | `month` | integer | Month (1–12) |
 | `day` | integer | Day of month (1–31) |
-| `sanitize` | boolean | See [Security](#security) — default `true` |
 
 ### `get_swedish_month`
 
@@ -48,7 +47,6 @@ Returns calendar data for every day in a month.
 |-----------|------|-------------|
 | `year` | integer | Year (1753–2100) |
 | `month` | integer | Month (1–12) |
-| `sanitize` | boolean | Default `true` |
 
 ### `get_swedish_year`
 
@@ -57,7 +55,6 @@ Returns calendar data for every day in a year (~365 records). Prefer `get_swedis
 | Parameter | Type | Description |
 |-----------|------|-------------|
 | `year` | integer | Year (1753–2100) |
-| `sanitize` | boolean | Default `true` |
 
 ## Response fields
 
@@ -80,7 +77,8 @@ Each day record contains:
 
 ## Security
 
-All responses are sanitized before reaching the LLM by default:
+All responses are sanitized before reaching the LLM. Sanitization cannot be
+disabled through tool arguments:
 
 - **Field allowlist** — unknown fields are dropped
 - **Injection scan** — string values are checked against known prompt-injection patterns (ChatML tokens, role prefixes, markdown headers, etc.) and replaced with `[redacted: suspicious content]` if matched
@@ -88,8 +86,7 @@ All responses are sanitized before reaching the LLM by default:
 - **Enum coercion** — `"röd dag"` and `"arbetsfri dag"` are coerced to exactly `"Ja"` or `"Nej"`
 - **Hardcoded flags** — presence-only fields (`klämdagen`, `dag före arbetsfri helgdag`) are always written as `"Ja"` regardless of what the API sends
 - **Non-object responses** — if the upstream returns a string, array, or any non-object, an empty safe structure is returned instead of passing through raw content
-
-Pass `sanitize: false` to receive the raw upstream response (useful for debugging).
+- **Bounded upstream reads** — non-JSON responses, redirects, and responses over 1 MB are rejected
 
 ## Development
 
@@ -99,8 +96,8 @@ npm run build      # compile TypeScript → dist/
 npm test           # run unit + integration tests (requires network for API tests)
 ```
 
-**Running the server** requires Node.js ≥ 18 (native `fetch`).  
-**Running the tests** requires Node.js ≥ 22.6 (`--experimental-strip-types`).
+- **Running the server** requires a supported Node.js release ≥ 22.
+- **Running the tests** requires Node.js ≥ 22.6 (`--experimental-strip-types`).
 
 ## License
 

package/dist/sanitize.js

@@ -82,3 +82,6 @@ export function sanitizeCalendarResponse(raw) {
             : [],
     };
 }
+export function serializeCalendarResponse(raw) {
+    return JSON.stringify(sanitizeCalendarResponse(raw), null, 0);
+}

package/dist/server.js

@@ -3,103 +3,20 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { validateYear, validateMonth, validateDay } from "./validate.js";
-import { sanitizeCalendarResponse } from "./sanitize.js";
-// Hardcoded HTTPS base — callers cannot override the scheme or host.
-const BASE_URL = "https://sholiday.faboul.se/dagar/v2.1";
-const TIMEOUT_MS = 10_000;
-// Shared input schema fragment added to every tool.
-const SANITIZE_SCHEMA = {
-    sanitize: {
-        type: "boolean",
-        description: "When true (default), API response values are validated against known " +
-            "formats, unknown fields are dropped, and strings are scanned for prompt " +
-            "injection patterns before being returned. Set to false only if you need " +
-            "the raw upstream response.",
-    },
-};
-// ---------------------------------------------------------------------------
-// HTTP helper — path is always built from validated integers only.
-// No JSONP callback parameter is ever used.
-// ---------------------------------------------------------------------------
-async function fetchCalendar(path) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-    try {
-        const response = await fetch(`${BASE_URL}/${path}`, {
-            signal: controller.signal,
-        });
-        if (!response.ok) {
-            throw new Error(`upstream returned HTTP ${response.status}`);
-        }
-        return await response.json();
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-function applyPolicy(data, sanitize) {
-    return JSON.stringify(sanitize ? sanitizeCalendarResponse(data) : data, null, 0);
-}
+import { serializeCalendarResponse } from "./sanitize.js";
+import { fetchCalendar } from "./upstream.js";
+import { TOOL_DEFINITIONS } from "./tools.js";
 // ---------------------------------------------------------------------------
 // MCP server
 // ---------------------------------------------------------------------------
-const server = new Server({ name: "svenska-dagar", version: "0.1.5" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "svenska-dagar", version: "0.2.0" }, { capabilities: { tools: {} } });
 // Tool descriptions are static strings — no API data is embedded in them.
 server.setRequestHandler(ListToolsRequestSchema, () => ({
-    tools: [
-        {
-            name: "get_swedish_day",
-            description: "Return Swedish calendar data for a single date: weekday name, week number, " +
-                "whether it is a work-free day (arbetsfri dag), a red day (röd dag / public holiday), " +
-                "a flag day (flaggdag), name days (namnsdag), holiday name (helgdag), " +
-                "holiday eve (helgdagsafton), and squeeze day (klämdagen).",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    year: { type: "integer", description: "Year (1753–2100)" },
-                    month: { type: "integer", description: "Month (1–12)" },
-                    day: { type: "integer", description: "Day of month (1–31)" },
-                    ...SANITIZE_SCHEMA,
-                },
-                required: ["year", "month", "day"],
-                additionalProperties: false,
-            },
-        },
-        {
-            name: "get_swedish_month",
-            description: "Return Swedish calendar data for every day in a calendar month. " +
-                "Each day entry contains the same fields as get_swedish_day.",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    year: { type: "integer", description: "Year (1753–2100)" },
-                    month: { type: "integer", description: "Month (1–12)" },
-                    ...SANITIZE_SCHEMA,
-                },
-                required: ["year", "month"],
-                additionalProperties: false,
-            },
-        },
-        {
-            name: "get_swedish_year",
-            description: "Return Swedish calendar data for every day in a calendar year (~365 records). " +
-                "Prefer get_swedish_month when only a subset of the year is needed.",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    year: { type: "integer", description: "Year (1753–2100)" },
-                    ...SANITIZE_SCHEMA,
-                },
-                required: ["year"],
-                additionalProperties: false,
-            },
-        },
-    ],
+    tools: [...TOOL_DEFINITIONS],
 }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
     const { year, month, day } = args;
-    const sanitize = args["sanitize"] !== false;
     try {
         let data;
         if (name === "get_swedish_day") {
@@ -126,7 +43,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             throw new Error(`unknown tool: ${name}`);
         }
         return {
-            content: [{ type: "text", text: applyPolicy(data, sanitize) }],
+            content: [{ type: "text", text: serializeCalendarResponse(data) }],
         };
     }
     catch (err) {

package/dist/tools.js

@@ -0,0 +1,46 @@
+export const TOOL_DEFINITIONS = [
+    {
+        name: "get_swedish_day",
+        description: "Return Swedish calendar data for a single date: weekday name, week number, " +
+            "whether it is a work-free day (arbetsfri dag), a red day (röd dag / public holiday), " +
+            "a flag day (flaggdag), name days (namnsdag), holiday name (helgdag), " +
+            "holiday eve (helgdagsafton), and squeeze day (klämdagen).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                year: { type: "integer", description: "Year (1753–2100)" },
+                month: { type: "integer", description: "Month (1–12)" },
+                day: { type: "integer", description: "Day of month (1–31)" },
+            },
+            required: ["year", "month", "day"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "get_swedish_month",
+        description: "Return Swedish calendar data for every day in a calendar month. " +
+            "Each day entry contains the same fields as get_swedish_day.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                year: { type: "integer", description: "Year (1753–2100)" },
+                month: { type: "integer", description: "Month (1–12)" },
+            },
+            required: ["year", "month"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "get_swedish_year",
+        description: "Return Swedish calendar data for every day in a calendar year (~365 records). " +
+            "Prefer get_swedish_month when only a subset of the year is needed.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                year: { type: "integer", description: "Year (1753–2100)" },
+            },
+            required: ["year"],
+            additionalProperties: false,
+        },
+    },
+];

package/dist/upstream.js

@@ -0,0 +1,75 @@
+const BASE_URL = "https://sholiday.faboul.se/dagar/v2.1";
+const TIMEOUT_MS = 10_000;
+export const MAX_RESPONSE_BYTES = 1_000_000;
+export async function readJsonResponse(response) {
+    if (!response.ok) {
+        throw new Error(`upstream returned HTTP ${response.status}`);
+    }
+    const mediaType = response.headers
+        .get("content-type")
+        ?.split(";", 1)[0]
+        ?.trim()
+        .toLowerCase();
+    if (mediaType !== "application/json") {
+        throw new Error("upstream returned an unexpected content type");
+    }
+    const contentLength = response.headers.get("content-length");
+    if (contentLength !== null) {
+        const declaredLength = Number(contentLength);
+        if (!Number.isSafeInteger(declaredLength) || declaredLength < 0) {
+            throw new Error("upstream returned an invalid content length");
+        }
+        if (declaredLength > MAX_RESPONSE_BYTES) {
+            throw new Error("upstream response is too large");
+        }
+    }
+    if (response.body === null) {
+        throw new Error("upstream returned an empty response");
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            totalBytes += value.byteLength;
+            if (totalBytes > MAX_RESPONSE_BYTES) {
+                await reader.cancel();
+                throw new Error("upstream response is too large");
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const body = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(body));
+    }
+    catch {
+        throw new Error("upstream returned invalid JSON");
+    }
+}
+export async function fetchCalendar(path) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    try {
+        const response = await fetch(`${BASE_URL}/${path}`, {
+            headers: { accept: "application/json" },
+            redirect: "error",
+            signal: controller.signal,
+        });
+        return await readJsonResponse(response);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onereason/svenska-dagar-mcp",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "MCP server for the Swedish public holiday and calendar API (sholiday.faboul.se)",
   "keywords": [
     "mcp",
@@ -18,7 +18,7 @@
     "svenska-dagar-mcp": "dist/server.js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "repository": {
     "type": "git",
@@ -32,13 +32,13 @@
     "build": "tsc && chmod 755 dist/server.js",
     "prepublishOnly": "npm run build",
     "start": "node dist/server.js",
-    "test": "node --experimental-strip-types --test test/unit.test.ts test/sanitize.test.ts test/api.test.ts"
+    "test": "node --experimental-strip-types --test test/unit.test.ts test/sanitize.test.ts test/security-boundary.test.ts test/api.test.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0"
   },
   "devDependencies": {
-    "@types/node": "25.9.1",
+    "@types/node": "22.20.3",
     "typescript": "6.0.3"
   }
 }