@systemdox/mcp-server 0.1.23 → 0.1.25

package/dist/cli.js

@@ -10,6 +10,23 @@ var __export = (target, all) => {
 };
 
 // src/lib/config.ts
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol === "https:") return apiUrl;
+  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
+    return apiUrl;
+  }
+  throw new Error(
+    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+  );
+}
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;
   if (!apiKey) {
@@ -17,16 +34,22 @@ function loadConfig() {
       "SYSTEMDOX_API_KEY is required. Generate one at your SystemDox settings page."
     );
   }
+  const apiUrl = requireHttpsApiUrl(
+    process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT
+  );
   return {
     apiKey,
-    apiUrl: process.env.SYSTEMDOX_API_URL ?? "https://api.puglieseweb.com/systemdox",
+    apiUrl,
     cacheTtlMs: parseInt(process.env.SYSTEMDOX_CACHE_TTL ?? "300", 10) * 1e3,
     defaultOrg: process.env.SYSTEMDOX_DEFAULT_ORG
   };
 }
+var API_URL_DEFAULT, LOOPBACK_HOSTS;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
+    API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
   }
 });
 
@@ -1979,7 +2002,7 @@ var init_server = __esm({
     init_create_project_rule();
     init_get_prompt_templates();
     init_create_prompt_template();
-    SERVER_VERSION = true ? "0.1.23" : "0.0.0-dev";
+    SERVER_VERSION = true ? "0.1.25" : "0.0.0-dev";
   }
 });
 
@@ -2012,12 +2035,12 @@ var init_index = __esm({
 });
 
 // src/cli.ts
-import { readFile, writeFile } from "fs/promises";
+init_config();
+import { readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 import { createInterface } from "readline";
-var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
 function prompt(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
@@ -2093,7 +2116,11 @@ async function writeConfig(path, config2) {
     const { mkdir } = await import("fs/promises");
     await mkdir(dir, { recursive: true });
   }
-  await writeFile(path, JSON.stringify(config2, null, 2) + "\n");
+  await writeFile(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  try {
+    await chmod(path, 384);
+  } catch {
+  }
 }
 function serverEntry(apiKey, apiUrl) {
   const entry = {
@@ -2121,6 +2148,14 @@ async function setup() {
     `  API URL [${API_URL_DEFAULT}]: `
   );
   const apiUrl = apiUrlInput || API_URL_DEFAULT;
+  try {
+    requireHttpsApiUrl(apiUrl);
+  } catch (err) {
+    console.error(`
+  Error: ${err.message}
+`);
+    process.exit(1);
+  }
   console.log("\n  Validating API key...");
   const valid = await validateApiKey(apiKey, apiUrl);
   if (!valid) {

package/dist/http.js

@@ -1825,7 +1825,7 @@ function registerCreatePromptTemplate(server, apiClient) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.23" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.25" : "0.0.0-dev";
 function createServer(apiClient) {
   const server = new McpServer({
     name: "systemdox-mcp-server",

package/dist/index.js

@@ -4,6 +4,25 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol === "https:") return apiUrl;
+  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
+    return apiUrl;
+  }
+  throw new Error(
+    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+  );
+}
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;
   if (!apiKey) {
@@ -11,9 +30,12 @@ function loadConfig() {
       "SYSTEMDOX_API_KEY is required. Generate one at your SystemDox settings page."
     );
   }
+  const apiUrl = requireHttpsApiUrl(
+    process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT
+  );
   return {
     apiKey,
-    apiUrl: process.env.SYSTEMDOX_API_URL ?? "https://api.puglieseweb.com/systemdox",
+    apiUrl,
     cacheTtlMs: parseInt(process.env.SYSTEMDOX_CACHE_TTL ?? "300", 10) * 1e3,
     defaultOrg: process.env.SYSTEMDOX_DEFAULT_ORG
   };
@@ -1806,7 +1828,7 @@ function registerCreatePromptTemplate(server2, apiClient2) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.23" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.25" : "0.0.0-dev";
 function createServer(apiClient2) {
   const server2 = new McpServer({
     name: "systemdox-mcp-server",

package/dist/lib/config.d.ts

@@ -4,4 +4,15 @@ export interface ServerConfig {
     cacheTtlMs: number;
     defaultOrg: string | undefined;
 }
+export declare const API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+/**
+ * Fail closed on a non-https API URL. The API key travels as a bearer token in
+ * the Authorization header on every request, so an http:// URL would leak it in
+ * cleartext. Reject rather than downgrade. Returns the URL unchanged when valid.
+ *
+ * http://localhost is allowed: see LOOPBACK_HOSTS. Local development and the
+ * MCP release gate (scripts/mcp-release-gate.mjs, which boots the published
+ * server against an http stub on 127.0.0.1) both depend on it.
+ */
+export declare function requireHttpsApiUrl(apiUrl: string): string;
 export declare function loadConfig(): ServerConfig;

package/dist/lib/config.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+
+// src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol === "https:") return apiUrl;
+  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
+    return apiUrl;
+  }
+  throw new Error(
+    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+  );
+}
+function loadConfig() {
+  const apiKey = process.env.SYSTEMDOX_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "SYSTEMDOX_API_KEY is required. Generate one at your SystemDox settings page."
+    );
+  }
+  const apiUrl = requireHttpsApiUrl(
+    process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT
+  );
+  return {
+    apiKey,
+    apiUrl,
+    cacheTtlMs: parseInt(process.env.SYSTEMDOX_CACHE_TTL ?? "300", 10) * 1e3,
+    defaultOrg: process.env.SYSTEMDOX_DEFAULT_ORG
+  };
+}
+export {
+  API_URL_DEFAULT,
+  loadConfig,
+  requireHttpsApiUrl
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "mcpName": "io.github.puglieseweb/systemdox",
   "type": "module",
   "description": "Give AI coding agents your architecture context over MCP — checks, specs, ADRs, project rules, and docs from SystemDox, delivered at write time",