@stabgan/openrouter-mcp-multimodal 1.4.0 → 1.8.0

package/dist/tool-handlers/image-utils.js

@@ -0,0 +1,253 @@
+import path from 'path';
+import { promises as fs } from 'fs';
+import dns from 'node:dns/promises';
+const DEFAULT_MAX_DIMENSION = 800;
+const DEFAULT_JPEG_QUALITY = 80;
+const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_DOWNLOAD_BYTES = 25 * 1024 * 1024;
+const DEFAULT_MAX_REDIRECTS = 8;
+const DEFAULT_MAX_DATA_URL_BYTES = 20 * 1024 * 1024;
+function readEnvInt(name, fallback, min = 1) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === '')
+        return fallback;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) && n >= min ? n : fallback;
+}
+export function getMaxImageDimension() {
+    return readEnvInt('OPENROUTER_IMAGE_MAX_DIMENSION', DEFAULT_MAX_DIMENSION, 64);
+}
+export function getImageJpegQuality() {
+    return readEnvInt('OPENROUTER_IMAGE_JPEG_QUALITY', DEFAULT_JPEG_QUALITY, 1);
+}
+function getFetchTimeoutMs() {
+    return readEnvInt('OPENROUTER_IMAGE_FETCH_TIMEOUT_MS', DEFAULT_FETCH_TIMEOUT_MS, 1000);
+}
+function getMaxDownloadBytes() {
+    return readEnvInt('OPENROUTER_IMAGE_MAX_DOWNLOAD_BYTES', DEFAULT_MAX_DOWNLOAD_BYTES, 1024);
+}
+function getMaxRedirects() {
+    return readEnvInt('OPENROUTER_IMAGE_MAX_REDIRECTS', DEFAULT_MAX_REDIRECTS, 0);
+}
+function getMaxDataUrlBytes() {
+    return readEnvInt('OPENROUTER_IMAGE_MAX_DATA_URL_BYTES', DEFAULT_MAX_DATA_URL_BYTES, 1024);
+}
+let sharpFn = null;
+let loaded = false;
+async function loadSharp() {
+    if (!loaded) {
+        loaded = true;
+        try {
+            const mod = await import('sharp');
+            const fn = mod.default;
+            sharpFn = fn ?? mod;
+        }
+        catch {
+            console.error('sharp not available, images will be sent unprocessed');
+        }
+    }
+    return sharpFn;
+}
+export function getMimeType(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const map = {
+        '.png': 'image/png',
+        '.jpg': 'image/jpeg',
+        '.jpeg': 'image/jpeg',
+        '.webp': 'image/webp',
+        '.gif': 'image/gif',
+        '.bmp': 'image/bmp',
+    };
+    return map[ext] || 'image/jpeg';
+}
+function ipv4ToUint(ip) {
+    const parts = ip.split('.').map((p) => parseInt(p, 10));
+    if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) {
+        throw new Error('Invalid IPv4');
+    }
+    return ((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>> 0;
+}
+/** Blocks RFC1918, loopback, link-local, CGNAT, metadata (e.g. 169.254.169.254). */
+export function isBlockedIPv4(ip) {
+    const n = ipv4ToUint(ip);
+    if (n >>> 24 === 127)
+        return true;
+    if (n >>> 24 === 10)
+        return true;
+    if (n >>> 20 === 0xac1)
+        return true;
+    if (n >>> 16 === 0xc0a8)
+        return true;
+    if (n >>> 16 === 0xa9fe)
+        return true;
+    if (n >>> 24 === 0)
+        return true;
+    if (n >= 0x64400000 && n <= 0x647fffff)
+        return true;
+    return false;
+}
+function isBlockedIPv6(ip) {
+    const raw = ip.includes('%') ? ip.split('%')[0] : ip;
+    const x = raw.toLowerCase();
+    if (x === '::1')
+        return true;
+    if (x.startsWith('fe80:') || x.startsWith('fec0:'))
+        return true;
+    const first = x.split(':').find((p) => p.length > 0);
+    if (first) {
+        const v = parseInt(first, 16);
+        if (!Number.isNaN(v) && v >= 0xfc00 && v <= 0xfdff)
+            return true;
+    }
+    return false;
+}
+function isIPv4Literal(host) {
+    return /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+}
+/** Resolve hostname and ensure the resolved address is not private/link-local. */
+export async function assertUrlSafeForFetch(urlString) {
+    let url;
+    try {
+        url = new URL(urlString);
+    }
+    catch {
+        throw new Error('Invalid URL');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error('Only HTTP(S) image URLs are allowed');
+    }
+    if (url.username || url.password) {
+        throw new Error('URL with credentials is not allowed');
+    }
+    const host = url.hostname.toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        throw new Error('Blocked host');
+    }
+    if (isIPv4Literal(host)) {
+        if (isBlockedIPv4(host))
+            throw new Error('Blocked host');
+        return url;
+    }
+    if (host.includes(':') && !host.startsWith('[')) {
+        if (isBlockedIPv6(host))
+            throw new Error('Blocked host');
+        return url;
+    }
+    let lookupHost = host;
+    if (host.startsWith('[') && host.endsWith(']')) {
+        lookupHost = host.slice(1, -1);
+        if (isBlockedIPv6(lookupHost))
+            throw new Error('Blocked host');
+        return url;
+    }
+    const records = await dns.lookup(lookupHost, { all: true, verbatim: true });
+    if (!records.length)
+        throw new Error('Could not resolve host');
+    for (const r of records) {
+        const { address, family } = r;
+        if (family === 4) {
+            if (isBlockedIPv4(address))
+                throw new Error('Blocked host');
+        }
+        else if (family === 6) {
+            if (isBlockedIPv6(address))
+                throw new Error('Blocked host');
+        }
+    }
+    return url;
+}
+async function readResponseBodyWithLimit(res, maxBytes) {
+    const reader = res.body?.getReader();
+    if (!reader) {
+        const buf = Buffer.from(await res.arrayBuffer());
+        if (buf.length > maxBytes)
+            throw new Error('Response too large');
+        return buf;
+    }
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes)
+            throw new Error('Response too large');
+        chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks);
+}
+export async function fetchHttpImage(urlString) {
+    const maxBytes = getMaxDownloadBytes();
+    const timeoutMs = getFetchTimeoutMs();
+    const maxRedirects = getMaxRedirects();
+    let current = urlString;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+        const validated = await assertUrlSafeForFetch(current);
+        const target = validated.href;
+        const controller = new AbortController();
+        const t = setTimeout(() => controller.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(target, { redirect: 'manual', signal: controller.signal });
+        }
+        finally {
+            clearTimeout(t);
+        }
+        if (res.status >= 300 && res.status < 400) {
+            const loc = res.headers.get('location');
+            if (!loc)
+                throw new Error('Redirect without Location header');
+            current = new URL(loc, target).href;
+            continue;
+        }
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+        return readResponseBodyWithLimit(res, maxBytes);
+    }
+    throw new Error('Too many redirects');
+}
+export async function fetchImage(source) {
+    if (source.startsWith('data:')) {
+        const match = source.match(/^data:[^;]+;base64,(.+)$/);
+        if (!match)
+            throw new Error('Invalid data URL');
+        const b64 = match[1];
+        const approxBytes = Math.ceil((b64.length * 3) / 4);
+        if (approxBytes > getMaxDataUrlBytes())
+            throw new Error('Data URL too large');
+        return Buffer.from(b64, 'base64');
+    }
+    if (source.startsWith('http://') || source.startsWith('https://')) {
+        return fetchHttpImage(source);
+    }
+    return fs.readFile(source);
+}
+export async function optimizeImage(buffer) {
+    const sharp = await loadSharp();
+    if (!sharp)
+        return buffer.toString('base64');
+    const maxDim = getMaxImageDimension();
+    const quality = getImageJpegQuality();
+    try {
+        const meta = await sharp(buffer).metadata();
+        let pipeline = sharp(buffer);
+        if (meta.width && meta.height && Math.max(meta.width, meta.height) > maxDim) {
+            const opts = meta.width > meta.height ? { width: maxDim } : { height: maxDim };
+            pipeline = pipeline.resize(opts);
+        }
+        const out = await pipeline.jpeg({ quality }).toBuffer();
+        return out.toString('base64');
+    }
+    catch {
+        return buffer.toString('base64');
+    }
+}
+export async function prepareImageUrl(source) {
+    if (source.startsWith('data:'))
+        return source;
+    const buffer = await fetchImage(source);
+    const base64 = await optimizeImage(buffer);
+    const mime = source.startsWith('http') ? 'image/jpeg' : getMimeType(source);
+    return `data:${mime};base64,${base64}`;
+}

package/dist/tool-handlers/search-models.d.ts

@@ -1,23 +1,16 @@
 import { ModelCache } from '../model-cache.js';
 import { OpenRouterAPIClient } from '../openrouter-api.js';
-export interface SearchModelsToolRequest {
+export interface SearchModelsArgs {
     query?: string;
     provider?: string;
-    minContextLength?: number | string;
-    maxContextLength?: number | string;
-    maxPromptPrice?: number | string;
-    maxCompletionPrice?: number | string;
     capabilities?: {
-        functions?: boolean;
-        tools?: boolean;
         vision?: boolean;
-        json_mode?: boolean;
     };
-    limit?: number | string;
+    limit?: number;
 }
 export declare function handleSearchModels(request: {
     params: {
-        arguments: SearchModelsToolRequest;
+        arguments: SearchModelsArgs;
     };
 }, apiClient: OpenRouterAPIClient, modelCache: ModelCache): Promise<{
     content: {

package/dist/tool-handlers/search-models.js

@@ -1,44 +1,13 @@
 export async function handleSearchModels(request, apiClient, modelCache) {
-    const args = request.params.arguments;
     try {
-        // Refresh the cache if needed
-        if (!modelCache.isCacheValid()) {
-            const models = await apiClient.getModels();
-            modelCache.setModels(models);
+        if (!modelCache.isValid()) {
+            modelCache.setModels(await apiClient.getModels());
         }
-        // Search models based on criteria
-        const results = modelCache.searchModels({
-            query: args.query,
-            provider: args.provider,
-            minContextLength: args.minContextLength,
-            maxContextLength: args.maxContextLength,
-            maxPromptPrice: args.maxPromptPrice,
-            maxCompletionPrice: args.maxCompletionPrice,
-            capabilities: args.capabilities,
-            limit: args.limit || 10,
-        });
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify(results, null, 2),
-                },
-            ],
-        };
+        const results = modelCache.search(request.params.arguments);
+        return { content: [{ type: 'text', text: JSON.stringify(results, null, 2) }] };
     }
     catch (error) {
-        if (error instanceof Error) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `Error searching models: ${error.message}`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        throw error;
+        const msg = error instanceof Error ? error.message : String(error);
+        return { content: [{ type: 'text', text: `Error: ${msg}` }], isError: true };
     }
 }
-//# sourceMappingURL=search-models.js.map

package/dist/tool-handlers/validate-model.d.ts

@@ -1,12 +1,12 @@
 import { ModelCache } from '../model-cache.js';
-export interface ValidateModelToolRequest {
-    model: string;
-}
+import { OpenRouterAPIClient } from '../openrouter-api.js';
 export declare function handleValidateModel(request: {
     params: {
-        arguments: ValidateModelToolRequest;
+        arguments: {
+            model: string;
+        };
     };
-}, modelCache: ModelCache): Promise<{
+}, modelCache: ModelCache, apiClient?: OpenRouterAPIClient): Promise<{
     content: {
         type: string;
         text: string;

package/dist/tool-handlers/validate-model.js

@@ -1,40 +1,16 @@
-export async function handleValidateModel(request, modelCache) {
-    const args = request.params.arguments;
-    try {
-        if (!modelCache.isCacheValid()) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: 'Model cache is empty or expired. Please call search_models first to populate the cache.',
-                    },
-                ],
-                isError: true,
-            };
-        }
-        const isValid = modelCache.hasModel(args.model);
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({ valid: isValid }),
-                },
-            ],
-        };
+export async function handleValidateModel(request, modelCache, apiClient) {
+    if (!modelCache.isValid() && apiClient) {
+        modelCache.setModels(await apiClient.getModels());
     }
-    catch (error) {
-        if (error instanceof Error) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `Error validating model: ${error.message}`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        throw error;
+    if (!modelCache.isValid()) {
+        return { content: [{ type: 'text', text: 'No model data available.' }], isError: true };
     }
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify({ valid: modelCache.has(request.params.arguments.model) }),
+            },
+        ],
+    };
 }
-//# sourceMappingURL=validate-model.js.map

package/dist/tool-handlers.d.ts

@@ -1,10 +1,9 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 export declare class ToolHandlers {
-    private server;
     private openai;
     private modelCache;
     private apiClient;
     private defaultModel?;
     constructor(server: Server, apiKey: string, defaultModel?: string);
-    private setupToolHandlers;
+    private register;
 }