@onereason/svenska-dagar-mcp 0.2.0 → 0.2.2

package/README.md

@@ -86,16 +86,23 @@ disabled through tool arguments:
 - **Enum coercion** — `"röd dag"` and `"arbetsfri dag"` are coerced to exactly `"Ja"` or `"Nej"`
 - **Hardcoded flags** — presence-only fields (`klämdagen`, `dag före arbetsfri helgdag`) are always written as `"Ja"` regardless of what the API sends
 - **Non-object responses** — if the upstream returns a string, array, or any non-object, an empty safe structure is returned instead of passing through raw content
-- **Bounded upstream reads** — non-JSON responses, redirects, and responses over 1 MB are rejected
+- **Bounded upstream data** — non-JSON responses, redirects, payloads over 256 KiB, oversized record lists, invalid day records, and sanitized output over 128 KiB are rejected
 
 ## Development
 
 ```bash
 npm install        # install dependencies
 npm run build      # compile TypeScript → dist/
-npm test           # run unit + integration tests (requires network for API tests)
+npm test           # run network-independent unit and security-boundary tests
+npm run test:api   # run live integration tests (requires access to the upstream API)
 ```
 
+Required CI runs the network-independent tests, build, dependency audit, and
+signature verification on Node.js 22 and 24. Live integration tests run separately
+through the manually triggered **Live API tests** workflow in GitHub Actions.
+Upstream outages or access restrictions still fail live tests, but do not block
+pull requests.
+
 - **Running the server** requires a supported Node.js release ≥ 22.
 - **Running the tests** requires Node.js ≥ 22.6 (`--experimental-strip-types`).
 

package/dist/sanitize.js

@@ -2,6 +2,14 @@
 // Legitimate Swedish calendar strings (day names, holiday names) are never
 // longer than this. Anything longer is almost certainly injected content.
 const MAX_STRING_LEN = 100;
+export const MAX_DAY_RECORDS = 366;
+export const MAX_NAME_DAYS_PER_DAY = 10;
+export const MAX_SERIALIZED_BYTES = 128 * 1024;
+export const RESPONSE_DAY_LIMITS = {
+    day: { min: 1, max: 1 },
+    month: { min: 0, max: 31 },
+    year: { min: 0, max: MAX_DAY_RECORDS },
+};
 // Patterns that appear in prompt injection payloads but never in calendar data.
 const INJECTION_PATTERNS = [
     /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|context|text)/i,
@@ -34,6 +42,11 @@ function jaOrNej(raw) {
     return raw === "Ja" ? "Ja" : "Nej";
 }
 function sanitizeDay(raw) {
+    const rawNameDays = raw["namnsdag"];
+    if (Array.isArray(rawNameDays)
+        && rawNameDays.length > MAX_NAME_DAYS_PER_DAY) {
+        throw new Error("upstream response contains too many name days");
+    }
     const day = {
         datum: safeStr(raw["datum"]),
         veckodag: safeStr(raw["veckodag"]),
@@ -41,8 +54,8 @@ function sanitizeDay(raw) {
         "röd dag": jaOrNej(raw["röd dag"]),
         vecka: safeStr(raw["vecka"]),
         "dag i vecka": safeStr(raw["dag i vecka"]),
-        namnsdag: Array.isArray(raw["namnsdag"])
-            ? raw["namnsdag"]
+        namnsdag: Array.isArray(rawNameDays)
+            ? rawNameDays
                 .map((n) => safeStr(n))
                 .filter((n) => !n.startsWith("[redacted"))
             : [],
@@ -61,15 +74,33 @@ function sanitizeDay(raw) {
         day["dag före arbetsfri helgdag"] = "Ja";
     return day;
 }
-export function sanitizeCalendarResponse(raw) {
+export function sanitizeCalendarResponse(raw, limits = RESPONSE_DAY_LIMITS.year) {
+    if (!Number.isSafeInteger(limits.min)
+        || !Number.isSafeInteger(limits.max)
+        || limits.min < 0
+        || limits.max < limits.min
+        || limits.max > MAX_DAY_RECORDS) {
+        throw new Error("invalid response day limits");
+    }
     // If the upstream returns a non-object (string, number, array at root level),
     // do NOT pass it through — return an empty safe structure instead.
     // A hijacked API could otherwise inject content via a raw string response
     // that would bypass all field-level sanitization.
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        if (limits.min > 0) {
+            throw new Error("upstream response contains an unexpected day count");
+        }
         return { version: "", startdatum: "", slutdatum: "", dagar: [] };
     }
     const obj = raw;
+    const rawDays = obj["dagar"];
+    const dayCount = Array.isArray(rawDays) ? rawDays.length : 0;
+    if (dayCount < limits.min) {
+        throw new Error("upstream response contains an unexpected day count");
+    }
+    if (dayCount > limits.max) {
+        throw new Error("upstream response contains too many day records");
+    }
     return {
         // Metadata: keep only the fields an LLM consumer actually needs.
         // Drop "cachetid" (unstable timestamp) and "uri" (mirrors our own request
@@ -77,11 +108,22 @@ export function sanitizeCalendarResponse(raw) {
         version: safeStr(obj["version"]),
         startdatum: safeStr(obj["startdatum"]),
         slutdatum: safeStr(obj["slutdatum"]),
-        dagar: Array.isArray(obj["dagar"])
-            ? obj["dagar"].map((d) => sanitizeDay(d))
+        dagar: Array.isArray(rawDays)
+            ? rawDays.map((day) => {
+                if (typeof day !== "object"
+                    || day === null
+                    || Array.isArray(day)) {
+                    throw new Error("upstream response contains an invalid day record");
+                }
+                return sanitizeDay(day);
+            })
             : [],
     };
 }
-export function serializeCalendarResponse(raw) {
-    return JSON.stringify(sanitizeCalendarResponse(raw), null, 0);
+export function serializeCalendarResponse(raw, limits = RESPONSE_DAY_LIMITS.year) {
+    const serialized = JSON.stringify(sanitizeCalendarResponse(raw, limits), null, 0);
+    if (new TextEncoder().encode(serialized).byteLength > MAX_SERIALIZED_BYTES) {
+        throw new Error("sanitized response is too large");
+    }
+    return serialized;
 }

package/dist/server.js

@@ -3,13 +3,13 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { validateYear, validateMonth, validateDay } from "./validate.js";
-import { serializeCalendarResponse } from "./sanitize.js";
+import { RESPONSE_DAY_LIMITS, serializeCalendarResponse, } from "./sanitize.js";
 import { fetchCalendar } from "./upstream.js";
 import { TOOL_DEFINITIONS } from "./tools.js";
 // ---------------------------------------------------------------------------
 // MCP server
 // ---------------------------------------------------------------------------
-const server = new Server({ name: "svenska-dagar", version: "0.2.0" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "svenska-dagar", version: "0.2.1" }, { capabilities: { tools: {} } });
 // Tool descriptions are static strings — no API data is embedded in them.
 server.setRequestHandler(ListToolsRequestSchema, () => ({
     tools: [...TOOL_DEFINITIONS],
@@ -19,6 +19,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { year, month, day } = args;
     try {
         let data;
+        let dayLimits;
         if (name === "get_swedish_day") {
             validateYear(year);
             validateMonth(month);
@@ -27,6 +28,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const m = month;
             const d = day;
             data = await fetchCalendar(`${y}/${String(m).padStart(2, "0")}/${String(d).padStart(2, "0")}`);
+            dayLimits = RESPONSE_DAY_LIMITS.day;
         }
         else if (name === "get_swedish_month") {
             validateYear(year);
@@ -34,16 +36,21 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const y = year;
             const m = month;
             data = await fetchCalendar(`${y}/${String(m).padStart(2, "0")}`);
+            dayLimits = RESPONSE_DAY_LIMITS.month;
         }
         else if (name === "get_swedish_year") {
             validateYear(year);
             data = await fetchCalendar(String(year));
+            dayLimits = RESPONSE_DAY_LIMITS.year;
         }
         else {
             throw new Error(`unknown tool: ${name}`);
         }
         return {
-            content: [{ type: "text", text: serializeCalendarResponse(data) }],
+            content: [{
+                    type: "text",
+                    text: serializeCalendarResponse(data, dayLimits),
+                }],
         };
     }
     catch (err) {

package/dist/upstream.js

@@ -1,6 +1,6 @@
 const BASE_URL = "https://sholiday.faboul.se/dagar/v2.1";
 const TIMEOUT_MS = 10_000;
-export const MAX_RESPONSE_BYTES = 1_000_000;
+export const MAX_RESPONSE_BYTES = 256 * 1024;
 export async function readJsonResponse(response) {
     if (!response.ok) {
         throw new Error(`upstream returned HTTP ${response.status}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onereason/svenska-dagar-mcp",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "MCP server for the Swedish public holiday and calendar API (sholiday.faboul.se)",
   "keywords": [
     "mcp",
@@ -32,13 +32,14 @@
     "build": "tsc && chmod 755 dist/server.js",
     "prepublishOnly": "npm run build",
     "start": "node dist/server.js",
-    "test": "node --experimental-strip-types --test test/unit.test.ts test/sanitize.test.ts test/security-boundary.test.ts test/api.test.ts"
+    "test": "node --experimental-strip-types --test test/unit.test.ts test/sanitize.test.ts test/security-boundary.test.ts",
+    "test:api": "node --experimental-strip-types --test test/api.test.ts"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.30.0"
+    "@modelcontextprotocol/sdk": "1.32.2"
   },
   "devDependencies": {
-    "@types/node": "22.20.3",
-    "typescript": "6.0.3"
+    "@types/node": "22.20.4",
+    "typescript": "7.0.2"
   }
 }