@softeria/ms-365-mcp-server 0.79.2 → 0.79.4

package/dist/cli.js

@@ -65,6 +65,16 @@ function parseArgs() {
   if (process.env.ENABLED_TOOLS) {
     options.enabledTools = process.env.ENABLED_TOOLS;
   }
+  if (options.enabledTools) {
+    try {
+      new RegExp(options.enabledTools, "i");
+    } catch {
+      console.error(
+        `Error: invalid --enabled-tools regex pattern: "${options.enabledTools}". Without a valid filter, all tools would be exposed.`
+      );
+      process.exit(1);
+    }
+  }
   if (process.env.MS365_MCP_ORG_MODE === "true" || process.env.MS365_MCP_ORG_MODE === "1") {
     options.orgMode = true;
   }

package/dist/server.js

@@ -225,18 +225,30 @@ class MicrosoftGraphServer {
         if (clientCodeChallenge && state) {
           const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
           const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+          const now = Date.now();
+          const maxAge = 10 * 60 * 1e3;
+          const maxEntries = 1e3;
+          for (const [key, value] of this.pkceStore) {
+            if (now - value.createdAt > maxAge) {
+              this.pkceStore.delete(key);
+            }
+          }
+          if (this.pkceStore.size >= maxEntries) {
+            logger.warn(
+              `PKCE store at capacity (${maxEntries} entries) \u2014 rejecting new authorization request`
+            );
+            res.status(503).json({
+              error: "server_busy",
+              error_description: "Too many pending authorization requests. Try again later."
+            });
+            return;
+          }
           this.pkceStore.set(state, {
             clientCodeChallenge,
             clientCodeChallengeMethod: clientCodeChallengeMethod || "S256",
             serverCodeVerifier,
             createdAt: Date.now()
           });
-          const now = Date.now();
-          for (const [key, value] of this.pkceStore) {
-            if (now - value.createdAt > 10 * 60 * 1e3) {
-              this.pkceStore.delete(key);
-            }
-          }
           microsoftAuthUrl.searchParams.set("code_challenge", serverCodeChallenge);
           microsoftAuthUrl.searchParams.set("code_challenge_method", "S256");
           logger.info("Two-leg PKCE: stored client challenge, generated server challenge", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.79.2",
+  "version": "0.79.4",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",