@onereason/svenska-dagar-mcp 0.1.5 → 0.2.1

package/README.md

@@ -1,5 +1,7 @@
 # @onereason/svenska-dagar-mcp
 
+[![MCP Trust Score](https://mcptrustchecker.com/registry/onereason-svenska-dagar-mcp/badge.svg)](https://mcptrustchecker.com/registry/onereason-svenska-dagar-mcp)
+
 MCP server exposing the Swedish public holiday and calendar API ([sholiday.faboul.se](https://sholiday.faboul.se)) to Claude and other MCP clients.
 
 ## Installation
@@ -38,7 +40,6 @@ Returns calendar data for a single date.
 | `year` | integer | Year (1753–2100) |
 | `month` | integer | Month (1–12) |
 | `day` | integer | Day of month (1–31) |
-| `sanitize` | boolean | See [Security](#security) — default `true` |
 
 ### `get_swedish_month`
 
@@ -48,7 +49,6 @@ Returns calendar data for every day in a month.
 |-----------|------|-------------|
 | `year` | integer | Year (1753–2100) |
 | `month` | integer | Month (1–12) |
-| `sanitize` | boolean | Default `true` |
 
 ### `get_swedish_year`
 
@@ -57,7 +57,6 @@ Returns calendar data for every day in a year (~365 records). Prefer `get_swedis
 | Parameter | Type | Description |
 |-----------|------|-------------|
 | `year` | integer | Year (1753–2100) |
-| `sanitize` | boolean | Default `true` |
 
 ## Response fields
 
@@ -80,7 +79,8 @@ Each day record contains:
 
 ## Security
 
-All responses are sanitized before reaching the LLM by default:
+All responses are sanitized before reaching the LLM. Sanitization cannot be
+disabled through tool arguments:
 
 - **Field allowlist** — unknown fields are dropped
 - **Injection scan** — string values are checked against known prompt-injection patterns (ChatML tokens, role prefixes, markdown headers, etc.) and replaced with `[redacted: suspicious content]` if matched
@@ -88,8 +88,7 @@ All responses are sanitized before reaching the LLM by default:
 - **Enum coercion** — `"röd dag"` and `"arbetsfri dag"` are coerced to exactly `"Ja"` or `"Nej"`
 - **Hardcoded flags** — presence-only fields (`klämdagen`, `dag före arbetsfri helgdag`) are always written as `"Ja"` regardless of what the API sends
 - **Non-object responses** — if the upstream returns a string, array, or any non-object, an empty safe structure is returned instead of passing through raw content
-
-Pass `sanitize: false` to receive the raw upstream response (useful for debugging).
+- **Bounded upstream data** — non-JSON responses, redirects, payloads over 256 KiB, oversized record lists, invalid day records, and sanitized output over 128 KiB are rejected
 
 ## Development
 
@@ -99,8 +98,8 @@ npm run build      # compile TypeScript → dist/
 npm test           # run unit + integration tests (requires network for API tests)
 ```
 
-**Running the server** requires Node.js ≥ 18 (native `fetch`).  
-**Running the tests** requires Node.js ≥ 22.6 (`--experimental-strip-types`).
+- **Running the server** requires a supported Node.js release ≥ 22.
+- **Running the tests** requires Node.js ≥ 22.6 (`--experimental-strip-types`).
 
 ## License
 

package/dist/sanitize.js

@@ -2,6 +2,14 @@
 // Legitimate Swedish calendar strings (day names, holiday names) are never
 // longer than this. Anything longer is almost certainly injected content.
 const MAX_STRING_LEN = 100;
+export const MAX_DAY_RECORDS = 366;
+export const MAX_NAME_DAYS_PER_DAY = 10;
+export const MAX_SERIALIZED_BYTES = 128 * 1024;
+export const RESPONSE_DAY_LIMITS = {
+    day: { min: 1, max: 1 },
+    month: { min: 0, max: 31 },
+    year: { min: 0, max: MAX_DAY_RECORDS },
+};
 // Patterns that appear in prompt injection payloads but never in calendar data.
 const INJECTION_PATTERNS = [
     /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|context|text)/i,
@@ -34,6 +42,11 @@ function jaOrNej(raw) {
     return raw === "Ja" ? "Ja" : "Nej";
 }
 function sanitizeDay(raw) {
+    const rawNameDays = raw["namnsdag"];
+    if (Array.isArray(rawNameDays)
+        && rawNameDays.length > MAX_NAME_DAYS_PER_DAY) {
+        throw new Error("upstream response contains too many name days");
+    }
     const day = {
         datum: safeStr(raw["datum"]),
         veckodag: safeStr(raw["veckodag"]),
@@ -41,8 +54,8 @@ function sanitizeDay(raw) {
         "röd dag": jaOrNej(raw["röd dag"]),
         vecka: safeStr(raw["vecka"]),
         "dag i vecka": safeStr(raw["dag i vecka"]),
-        namnsdag: Array.isArray(raw["namnsdag"])
-            ? raw["namnsdag"]
+        namnsdag: Array.isArray(rawNameDays)
+            ? rawNameDays
                 .map((n) => safeStr(n))
                 .filter((n) => !n.startsWith("[redacted"))
             : [],
@@ -61,15 +74,33 @@ function sanitizeDay(raw) {
         day["dag före arbetsfri helgdag"] = "Ja";
     return day;
 }
-export function sanitizeCalendarResponse(raw) {
+export function sanitizeCalendarResponse(raw, limits = RESPONSE_DAY_LIMITS.year) {
+    if (!Number.isSafeInteger(limits.min)
+        || !Number.isSafeInteger(limits.max)
+        || limits.min < 0
+        || limits.max < limits.min
+        || limits.max > MAX_DAY_RECORDS) {
+        throw new Error("invalid response day limits");
+    }
     // If the upstream returns a non-object (string, number, array at root level),
     // do NOT pass it through — return an empty safe structure instead.
     // A hijacked API could otherwise inject content via a raw string response
     // that would bypass all field-level sanitization.
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        if (limits.min > 0) {
+            throw new Error("upstream response contains an unexpected day count");
+        }
         return { version: "", startdatum: "", slutdatum: "", dagar: [] };
     }
     const obj = raw;
+    const rawDays = obj["dagar"];
+    const dayCount = Array.isArray(rawDays) ? rawDays.length : 0;
+    if (dayCount < limits.min) {
+        throw new Error("upstream response contains an unexpected day count");
+    }
+    if (dayCount > limits.max) {
+        throw new Error("upstream response contains too many day records");
+    }
     return {
         // Metadata: keep only the fields an LLM consumer actually needs.
         // Drop "cachetid" (unstable timestamp) and "uri" (mirrors our own request
@@ -77,8 +108,22 @@ export function sanitizeCalendarResponse(raw) {
         version: safeStr(obj["version"]),
         startdatum: safeStr(obj["startdatum"]),
         slutdatum: safeStr(obj["slutdatum"]),
-        dagar: Array.isArray(obj["dagar"])
-            ? obj["dagar"].map((d) => sanitizeDay(d))
+        dagar: Array.isArray(rawDays)
+            ? rawDays.map((day) => {
+                if (typeof day !== "object"
+                    || day === null
+                    || Array.isArray(day)) {
+                    throw new Error("upstream response contains an invalid day record");
+                }
+                return sanitizeDay(day);
+            })
             : [],
     };
 }
+export function serializeCalendarResponse(raw, limits = RESPONSE_DAY_LIMITS.year) {
+    const serialized = JSON.stringify(sanitizeCalendarResponse(raw, limits), null, 0);
+    if (new TextEncoder().encode(serialized).byteLength > MAX_SERIALIZED_BYTES) {
+        throw new Error("sanitized response is too large");
+    }
+    return serialized;
+}

package/dist/server.js

@@ -3,105 +3,23 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { validateYear, validateMonth, validateDay } from "./validate.js";
-import { sanitizeCalendarResponse } from "./sanitize.js";
-// Hardcoded HTTPS base — callers cannot override the scheme or host.
-const BASE_URL = "https://sholiday.faboul.se/dagar/v2.1";
-const TIMEOUT_MS = 10_000;
-// Shared input schema fragment added to every tool.
-const SANITIZE_SCHEMA = {
-    sanitize: {
-        type: "boolean",
-        description: "When true (default), API response values are validated against known " +
-            "formats, unknown fields are dropped, and strings are scanned for prompt " +
-            "injection patterns before being returned. Set to false only if you need " +
-            "the raw upstream response.",
-    },
-};
-// ---------------------------------------------------------------------------
-// HTTP helper — path is always built from validated integers only.
-// No JSONP callback parameter is ever used.
-// ---------------------------------------------------------------------------
-async function fetchCalendar(path) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-    try {
-        const response = await fetch(`${BASE_URL}/${path}`, {
-            signal: controller.signal,
-        });
-        if (!response.ok) {
-            throw new Error(`upstream returned HTTP ${response.status}`);
-        }
-        return await response.json();
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-function applyPolicy(data, sanitize) {
-    return JSON.stringify(sanitize ? sanitizeCalendarResponse(data) : data, null, 0);
-}
+import { RESPONSE_DAY_LIMITS, serializeCalendarResponse, } from "./sanitize.js";
+import { fetchCalendar } from "./upstream.js";
+import { TOOL_DEFINITIONS } from "./tools.js";
 // ---------------------------------------------------------------------------
 // MCP server
 // ---------------------------------------------------------------------------
-const server = new Server({ name: "svenska-dagar", version: "0.1.5" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "svenska-dagar", version: "0.2.1" }, { capabilities: { tools: {} } });
 // Tool descriptions are static strings — no API data is embedded in them.
 server.setRequestHandler(ListToolsRequestSchema, () => ({
-    tools: [
-        {
-            name: "get_swedish_day",
-            description: "Return Swedish calendar data for a single date: weekday name, week number, " +
-                "whether it is a work-free day (arbetsfri dag), a red day (röd dag / public holiday), " +
-                "a flag day (flaggdag), name days (namnsdag), holiday name (helgdag), " +
-                "holiday eve (helgdagsafton), and squeeze day (klämdagen).",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    year: { type: "integer", description: "Year (1753–2100)" },
-                    month: { type: "integer", description: "Month (1–12)" },
-                    day: { type: "integer", description: "Day of month (1–31)" },
-                    ...SANITIZE_SCHEMA,
-                },
-                required: ["year", "month", "day"],
-                additionalProperties: false,
-            },
-        },
-        {
-            name: "get_swedish_month",
-            description: "Return Swedish calendar data for every day in a calendar month. " +
-                "Each day entry contains the same fields as get_swedish_day.",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    year: { type: "integer", description: "Year (1753–2100)" },
-                    month: { type: "integer", description: "Month (1–12)" },
-                    ...SANITIZE_SCHEMA,
-                },
-                required: ["year", "month"],
-                additionalProperties: false,
-            },
-        },
-        {
-            name: "get_swedish_year",
-            description: "Return Swedish calendar data for every day in a calendar year (~365 records). " +
-                "Prefer get_swedish_month when only a subset of the year is needed.",
-            inputSchema: {
-                type: "object",
-                properties: {
-                    year: { type: "integer", description: "Year (1753–2100)" },
-                    ...SANITIZE_SCHEMA,
-                },
-                required: ["year"],
-                additionalProperties: false,
-            },
-        },
-    ],
+    tools: [...TOOL_DEFINITIONS],
 }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
     const { year, month, day } = args;
-    const sanitize = args["sanitize"] !== false;
     try {
         let data;
+        let dayLimits;
         if (name === "get_swedish_day") {
             validateYear(year);
             validateMonth(month);
@@ -110,6 +28,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const m = month;
             const d = day;
             data = await fetchCalendar(`${y}/${String(m).padStart(2, "0")}/${String(d).padStart(2, "0")}`);
+            dayLimits = RESPONSE_DAY_LIMITS.day;
         }
         else if (name === "get_swedish_month") {
             validateYear(year);
@@ -117,16 +36,21 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const y = year;
             const m = month;
             data = await fetchCalendar(`${y}/${String(m).padStart(2, "0")}`);
+            dayLimits = RESPONSE_DAY_LIMITS.month;
         }
         else if (name === "get_swedish_year") {
             validateYear(year);
             data = await fetchCalendar(String(year));
+            dayLimits = RESPONSE_DAY_LIMITS.year;
         }
         else {
             throw new Error(`unknown tool: ${name}`);
         }
         return {
-            content: [{ type: "text", text: applyPolicy(data, sanitize) }],
+            content: [{
+                    type: "text",
+                    text: serializeCalendarResponse(data, dayLimits),
+                }],
         };
     }
     catch (err) {

package/dist/tools.js

@@ -0,0 +1,46 @@
+export const TOOL_DEFINITIONS = [
+    {
+        name: "get_swedish_day",
+        description: "Return Swedish calendar data for a single date: weekday name, week number, " +
+            "whether it is a work-free day (arbetsfri dag), a red day (röd dag / public holiday), " +
+            "a flag day (flaggdag), name days (namnsdag), holiday name (helgdag), " +
+            "holiday eve (helgdagsafton), and squeeze day (klämdagen).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                year: { type: "integer", description: "Year (1753–2100)" },
+                month: { type: "integer", description: "Month (1–12)" },
+                day: { type: "integer", description: "Day of month (1–31)" },
+            },
+            required: ["year", "month", "day"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "get_swedish_month",
+        description: "Return Swedish calendar data for every day in a calendar month. " +
+            "Each day entry contains the same fields as get_swedish_day.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                year: { type: "integer", description: "Year (1753–2100)" },
+                month: { type: "integer", description: "Month (1–12)" },
+            },
+            required: ["year", "month"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "get_swedish_year",
+        description: "Return Swedish calendar data for every day in a calendar year (~365 records). " +
+            "Prefer get_swedish_month when only a subset of the year is needed.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                year: { type: "integer", description: "Year (1753–2100)" },
+            },
+            required: ["year"],
+            additionalProperties: false,
+        },
+    },
+];

package/dist/upstream.js

@@ -0,0 +1,75 @@
+const BASE_URL = "https://sholiday.faboul.se/dagar/v2.1";
+const TIMEOUT_MS = 10_000;
+export const MAX_RESPONSE_BYTES = 256 * 1024;
+export async function readJsonResponse(response) {
+    if (!response.ok) {
+        throw new Error(`upstream returned HTTP ${response.status}`);
+    }
+    const mediaType = response.headers
+        .get("content-type")
+        ?.split(";", 1)[0]
+        ?.trim()
+        .toLowerCase();
+    if (mediaType !== "application/json") {
+        throw new Error("upstream returned an unexpected content type");
+    }
+    const contentLength = response.headers.get("content-length");
+    if (contentLength !== null) {
+        const declaredLength = Number(contentLength);
+        if (!Number.isSafeInteger(declaredLength) || declaredLength < 0) {
+            throw new Error("upstream returned an invalid content length");
+        }
+        if (declaredLength > MAX_RESPONSE_BYTES) {
+            throw new Error("upstream response is too large");
+        }
+    }
+    if (response.body === null) {
+        throw new Error("upstream returned an empty response");
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            totalBytes += value.byteLength;
+            if (totalBytes > MAX_RESPONSE_BYTES) {
+                await reader.cancel();
+                throw new Error("upstream response is too large");
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const body = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(body));
+    }
+    catch {
+        throw new Error("upstream returned invalid JSON");
+    }
+}
+export async function fetchCalendar(path) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    try {
+        const response = await fetch(`${BASE_URL}/${path}`, {
+            headers: { accept: "application/json" },
+            redirect: "error",
+            signal: controller.signal,
+        });
+        return await readJsonResponse(response);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onereason/svenska-dagar-mcp",
-  "version": "0.1.5",
+  "version": "0.2.1",
   "description": "MCP server for the Swedish public holiday and calendar API (sholiday.faboul.se)",
   "keywords": [
     "mcp",
@@ -18,7 +18,7 @@
     "svenska-dagar-mcp": "dist/server.js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "repository": {
     "type": "git",
@@ -32,13 +32,13 @@
     "build": "tsc && chmod 755 dist/server.js",
     "prepublishOnly": "npm run build",
     "start": "node dist/server.js",
-    "test": "node --experimental-strip-types --test test/unit.test.ts test/sanitize.test.ts test/api.test.ts"
+    "test": "node --experimental-strip-types --test test/unit.test.ts test/sanitize.test.ts test/security-boundary.test.ts test/api.test.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0"
   },
   "devDependencies": {
-    "@types/node": "25.9.1",
-    "typescript": "6.0.3"
+    "@types/node": "22.20.3",
+    "typescript": "7.0.2"
   }
 }