@typeroll/mcp-server 0.42.0 → 0.42.1

package/dist/public-http.js

@@ -0,0 +1,92 @@
+import dns from 'node:dns/promises';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import { Readable } from 'node:stream';
+const blockedV4 = new net.BlockList();
+for (const [address, prefix] of [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
+    ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24], ['203.0.113.0', 24],
+    ['224.0.0.0', 3],
+])
+    blockedV4.addSubnet(address, prefix, 'ipv4');
+const globalV6 = new net.BlockList();
+globalV6.addSubnet('2000::', 3, 'ipv6');
+const blockedV6 = new net.BlockList();
+blockedV6.addSubnet('2001::', 23, 'ipv6');
+blockedV6.addSubnet('2001:db8::', 32, 'ipv6');
+blockedV6.addSubnet('2002::', 16, 'ipv6');
+function isPublicAddress(address) {
+    if (net.isIPv4(address))
+        return !blockedV4.check(address, 'ipv4');
+    if (net.isIPv6(address))
+        return globalV6.check(address, 'ipv6') && !blockedV6.check(address, 'ipv6');
+    return false;
+}
+async function destination(url) {
+    if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password) {
+        throw new Error('Source URL must use public HTTP(S) without credentials');
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    if (hostname === 'localhost' || hostname.endsWith('.localhost') || hostname.endsWith('.local')) {
+        throw new Error('Source URL must use a public address');
+    }
+    const family = net.isIP(hostname);
+    const addresses = family ? [{ address: hostname, family }] : await dns.lookup(hostname, { all: true, verbatim: true });
+    if (!addresses.length || addresses.some(({ address }) => !isPublicAddress(address))) {
+        throw new Error('Source URL must use a public address');
+    }
+    return addresses[0];
+}
+/** Connect directly to the checked IP, keeping the original Host and TLS name. */
+function requestPinned(url, address) {
+    return new Promise((resolve, reject) => {
+        const transport = url.protocol === 'https:' ? https : http;
+        const req = transport.request(url, {
+            method: 'GET',
+            agent: false,
+            signal: AbortSignal.timeout(30_000),
+            headers: { 'Accept-Encoding': 'identity', 'User-Agent': 'Typeroll-Media-Import/1.0' },
+            // Never resolve again after validation, including on dual-stack hosts.
+            lookup: (_hostname, options, callback) => {
+                if (options.all)
+                    callback(null, [address]);
+                else
+                    callback(null, address.address, address.family);
+            },
+        }, (incoming) => {
+            const headers = new Headers();
+            for (const [name, value] of Object.entries(incoming.headers)) {
+                if (Array.isArray(value))
+                    value.forEach((item) => headers.append(name, item));
+                else if (value !== undefined)
+                    headers.set(name, value);
+            }
+            const status = incoming.statusCode ?? 502;
+            const noBody = [204, 205, 304].includes(status);
+            if (noBody)
+                incoming.resume();
+            resolve(new Response(noBody ? null : Readable.toWeb(incoming), { status, headers }));
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+/** Every redirect is a fresh trust decision; fetch's automatic redirects are unsafe here. */
+export async function fetchPublicSource(rawUrl) {
+    let url = new URL(rawUrl);
+    for (let redirects = 0;; redirects++) {
+        const address = await destination(url);
+        const response = await requestPinned(url, address);
+        if (![301, 302, 303, 307, 308].includes(response.status))
+            return response;
+        await response.body?.cancel();
+        if (redirects >= 5)
+            throw new Error('Source URL has too many redirects');
+        const location = response.headers.get('location');
+        if (!location)
+            throw new Error('Source redirect has no destination');
+        url = new URL(location, url);
+    }
+}

package/dist/tools/media.js

@@ -1,5 +1,6 @@
 // Media tools (list + signed upload URL + metadata patch).
 import { z } from 'zod';
+import { fetchPublicSource } from '../public-http.js';
 import { ok, withErrorBoundary } from './helpers.js';
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 // Best-effort content-type inference from the URL extension. The server's
@@ -39,6 +40,7 @@ function filenameFromUrl(url, fallback) {
 async function readSourceBytes(response) {
     const declared = Number(response.headers.get('content-length'));
     if (Number.isFinite(declared) && declared > MAX_UPLOAD_BYTES) {
+        await response.body?.cancel();
         throw new Error(`Source file too large (max ${MAX_UPLOAD_BYTES} bytes)`);
     }
     if (!response.body)
@@ -67,9 +69,11 @@ async function readSourceBytes(response) {
 }
 async function uploadFromUrl(args, deps) {
     const filename = filenameFromUrl(args.source_url, args.filename);
-    const sourceRes = await fetch(args.source_url);
-    if (!sourceRes.ok)
+    const sourceRes = await fetchPublicSource(args.source_url);
+    if (!sourceRes.ok) {
+        await sourceRes.body?.cancel();
         throw new Error(`Failed to fetch source URL: ${sourceRes.status} ${sourceRes.statusText}`);
+    }
     const buf = await readSourceBytes(sourceRes);
     const sourceCt = sourceRes.headers.get('content-type')?.split(';')[0]?.trim();
     const contentType = args.content_type ?? sourceCt ?? inferContentType(filename);
@@ -133,7 +137,7 @@ export const mediaTools = [
     },
     {
         name: 'upload_media_from_url',
-        description: 'Fetch an image (or PDF) from any public URL and push it to the site\'s media library in one call. The bytes pass through the agent\'s machine — they do NOT go through the Typeroll API — so this works whenever your agent can `fetch()` the source. Integrity-safe: the bytes are streamed, never transcribed as base64 through the model, so (unlike a large `upload_media_inline` payload) they can\'t be silently corrupted in transit. Returns { media_id, cdn_url, filename }.',
+        description: 'Fetch an image (or PDF) from any public URL and push it to the site\'s media library in one call. The MCP server downloads the source from verified public HTTP(S) destinations; private addresses and unsafe redirects are refused. Integrity-safe: the bytes are streamed, never transcribed as base64 through the model, so (unlike a large `upload_media_inline` payload) they can\'t be silently corrupted in transit. Returns { media_id, cdn_url, filename }.',
         inputSchema: {
             source_url: z.string().url().describe('Public URL to download the image from.'),
             filename: z.string().optional().describe('Override the filename used on R2. Defaults to the last path segment of source_url.'),

package/dist/version.js

@@ -8,4 +8,4 @@
 //
 // Keep it in lockstep with package.json: tests/version.test.ts asserts
 // VERSION === package.json.version, so a bump that forgets this line fails CI.
-export const VERSION = '0.42.0';
+export const VERSION = '0.42.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typeroll/mcp-server",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "description": "Model Context Protocol server for the Typeroll public API. Use with Claude Code or any MCP-compatible client to manage a Typeroll site.",
   "license": "MIT",
   "repository": {