@systemdox/mcp-server 0.1.27 → 0.1.29

package/dist/cli.js

@@ -19,13 +19,12 @@ function requireHttpsApiUrl(apiUrl) {
       `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
     );
   }
-  if (parsed.protocol === "https:") return apiUrl;
-  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
-    return apiUrl;
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
   }
-  throw new Error(
-    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-  );
+  return apiUrl;
 }
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;
@@ -44,12 +43,11 @@ function loadConfig() {
     defaultOrg: process.env.SYSTEMDOX_DEFAULT_ORG
   };
 }
-var API_URL_DEFAULT, LOOPBACK_HOSTS;
+var API_URL_DEFAULT;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
     API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
-    LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
   }
 });
 
@@ -2002,7 +2000,7 @@ var init_server = __esm({
     init_create_project_rule();
     init_get_prompt_templates();
     init_create_prompt_template();
-    SERVER_VERSION = true ? "0.1.27" : "0.0.0-dev";
+    SERVER_VERSION = true ? "0.1.29" : "0.0.0-dev";
   }
 });
 

package/dist/http.js

@@ -117,6 +117,25 @@ var SystemDoxApiClient = class {
   }
 };
 
+// src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
+  }
+  return apiUrl;
+}
+
 // src/lib/metrics.ts
 var NAMESPACE = "SystemDox/Mcp";
 var METRIC_NAME = "McpToolCall";
@@ -1825,7 +1844,7 @@ function registerCreatePromptTemplate(server, apiClient) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.27" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.29" : "0.0.0-dev";
 function createServer(apiClient) {
   const server = new McpServer({
     name: "systemdox-mcp-server",
@@ -1896,9 +1915,16 @@ async function handler(event) {
   }
   const rawBody = event.isBase64Encoded ? Buffer.from(event.body ?? "", "base64").toString("utf8") : event.body ?? "";
   emitMcpToolCalls(keyTenant, rawBody);
+  let apiUrl;
+  try {
+    apiUrl = requireHttpsApiUrl(process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT);
+  } catch (err) {
+    console.error("Refusing to proxy MCP tool calls:", err);
+    return jsonError(500, "Server misconfigured: API URL must use https://");
+  }
   const apiClient = new SystemDoxApiClient({
     apiKey,
-    apiUrl: process.env.SYSTEMDOX_API_URL ?? "https://api.puglieseweb.com/systemdox",
+    apiUrl,
     cacheTtlMs: 0,
     // per-request client; never cache across invocations
     defaultOrg: void 0

package/dist/index.js

@@ -5,7 +5,6 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 
 // src/lib/config.ts
 var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
 function requireHttpsApiUrl(apiUrl) {
   let parsed;
   try {
@@ -15,13 +14,12 @@ function requireHttpsApiUrl(apiUrl) {
       `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
     );
   }
-  if (parsed.protocol === "https:") return apiUrl;
-  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
-    return apiUrl;
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
   }
-  throw new Error(
-    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-  );
+  return apiUrl;
 }
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;
@@ -1828,7 +1826,7 @@ function registerCreatePromptTemplate(server2, apiClient2) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.27" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.29" : "0.0.0-dev";
 function createServer(apiClient2) {
   const server2 = new McpServer({
     name: "systemdox-mcp-server",

package/dist/lib/config.d.ts

@@ -10,9 +10,12 @@ export declare const API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
  * the Authorization header on every request, so an http:// URL would leak it in
  * cleartext. Reject rather than downgrade. Returns the URL unchanged when valid.
  *
- * http://localhost is allowed: see LOOPBACK_HOSTS. Local development and the
- * MCP release gate (scripts/mcp-release-gate.mjs, which boots the published
- * server against an http stub on 127.0.0.1) both depend on it.
+ * The pin has NO exceptions, loopback included. A carve-out was tried and
+ * removed: it existed only because the release gate stood up a plain-http stub,
+ * and #1044 gave that stub TLS, so nothing in CI needs it. Local development
+ * against a local API should point at an https origin — the gate's per-run
+ * self-signed cert is a worked example. An exception in the shipped product to
+ * spare a dev a certificate is not a trade worth making.
  */
 export declare function requireHttpsApiUrl(apiUrl: string): string;
 export declare function loadConfig(): ServerConfig;

package/dist/lib/config.js

@@ -2,7 +2,6 @@
 
 // src/lib/config.ts
 var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
 function requireHttpsApiUrl(apiUrl) {
   let parsed;
   try {
@@ -12,13 +11,12 @@ function requireHttpsApiUrl(apiUrl) {
       `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
     );
   }
-  if (parsed.protocol === "https:") return apiUrl;
-  if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname)) {
-    return apiUrl;
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
   }
-  throw new Error(
-    `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
-  );
+  return apiUrl;
 }
 function loadConfig() {
   const apiKey = process.env.SYSTEMDOX_API_KEY;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "mcpName": "io.github.puglieseweb/systemdox",
   "type": "module",
   "description": "Give AI coding agents your architecture context over MCP — checks, specs, ADRs, project rules, and docs from SystemDox, delivered at write time",