@systemdox/mcp-server 0.1.24 → 0.1.25

package/dist/cli.js

@@ -19,12 +19,13 @@ function requireHttpsApiUrl(apiUrl) {
       `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
     );
   }
-  if (parsed.protocol !== "https:") {
-    throw new Error(
-      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-    );
+  if (parsed.protocol === "https:") return apiUrl;
+  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
+    return apiUrl;
   }
-  return apiUrl;
+  throw new Error(
+    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+  );
 }
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;
@@ -43,11 +44,12 @@ function loadConfig() {
     defaultOrg: process.env.SYSTEMDOX_DEFAULT_ORG
   };
 }
-var API_URL_DEFAULT;
+var API_URL_DEFAULT, LOOPBACK_HOSTS;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
     API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
   }
 });
 
@@ -2000,7 +2002,7 @@ var init_server = __esm({
     init_create_project_rule();
     init_get_prompt_templates();
     init_create_prompt_template();
-    SERVER_VERSION = true ? "0.1.24" : "0.0.0-dev";
+    SERVER_VERSION = true ? "0.1.25" : "0.0.0-dev";
   }
 });
 

package/dist/http.js

@@ -1825,7 +1825,7 @@ function registerCreatePromptTemplate(server, apiClient) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.24" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.25" : "0.0.0-dev";
 function createServer(apiClient) {
   const server = new McpServer({
     name: "systemdox-mcp-server",

package/dist/index.js

@@ -5,6 +5,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 
 // src/lib/config.ts
 var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
 function requireHttpsApiUrl(apiUrl) {
   let parsed;
   try {
@@ -14,12 +15,13 @@ function requireHttpsApiUrl(apiUrl) {
       `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
     );
   }
-  if (parsed.protocol !== "https:") {
-    throw new Error(
-      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-    );
+  if (parsed.protocol === "https:") return apiUrl;
+  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
+    return apiUrl;
   }
-  return apiUrl;
+  throw new Error(
+    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+  );
 }
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;
@@ -1826,7 +1828,7 @@ function registerCreatePromptTemplate(server2, apiClient2) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.24" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.25" : "0.0.0-dev";
 function createServer(apiClient2) {
   const server2 = new McpServer({
     name: "systemdox-mcp-server",

package/dist/lib/config.d.ts

@@ -9,6 +9,10 @@ export declare const API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
  * Fail closed on a non-https API URL. The API key travels as a bearer token in
  * the Authorization header on every request, so an http:// URL would leak it in
  * cleartext. Reject rather than downgrade. Returns the URL unchanged when valid.
+ *
+ * http://localhost is allowed: see LOOPBACK_HOSTS. Local development and the
+ * MCP release gate (scripts/mcp-release-gate.mjs, which boots the published
+ * server against an http stub on 127.0.0.1) both depend on it.
  */
 export declare function requireHttpsApiUrl(apiUrl: string): string;
 export declare function loadConfig(): ServerConfig;

package/dist/lib/config.js

@@ -2,6 +2,7 @@
 
 // src/lib/config.ts
 var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
 function requireHttpsApiUrl(apiUrl) {
   let parsed;
   try {
@@ -11,12 +12,13 @@ function requireHttpsApiUrl(apiUrl) {
       `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
     );
   }
-  if (parsed.protocol !== "https:") {
-    throw new Error(
-      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-    );
+  if (parsed.protocol === "https:") return apiUrl;
+  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
+    return apiUrl;
   }
-  return apiUrl;
+  throw new Error(
+    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+  );
 }
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "mcpName": "io.github.puglieseweb/systemdox",
   "type": "module",
   "description": "Give AI coding agents your architecture context over MCP — checks, specs, ADRs, project rules, and docs from SystemDox, delivered at write time",