@uteamup/mcp-server 2.6.7-beta.9 → 2.6.9-beta.9

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.6.9-beta.9](https://github.com/UteamUP/uteamup-mcp/compare/2.6.8-beta.9...2.6.9-beta.9) (2026-11-06)
+
+
+### Bug Fixes
+
+* **security:** disallow UTEAMUP_INSECURE_TLS on production hosts ([32a786b](https://github.com/UteamUP/uteamup-mcp/commit/32a786b2b7ee1b99b79734c2f127271e05ef3f5f))
+* **security:** honour UTEAMUP_INSECURE_TLS only for loopback hosts ([09cdc0e](https://github.com/UteamUP/uteamup-mcp/commit/09cdc0ec8c1ab834da6a6725f0e7da5648d2668e))
+
+
+### Tests
+
+* **archive:** cover the archive and restore MCP tools of every archivable record ([db9ebfd](https://github.com/UteamUP/uteamup-mcp/commit/db9ebfd89e6ec4030a6692560d9077bf117aa184))
+* cover the tenant lifecycle settings MCP tools ([1ad3964](https://github.com/UteamUP/uteamup-mcp/commit/1ad396448355cb2eeb752e00e8cb2ded75329d36))
+* **inventory:** cover the archive and restore tools and asset-free bulk delete ([a4cd46d](https://github.com/UteamUP/uteamup-mcp/commit/a4cd46db50c828188c6b0b1ff5e7f70f92b21a26))
+
+## [2.6.8-beta.9](https://github.com/UteamUP/uteamup-mcp/compare/2.6.7-beta.9...2.6.8-beta.9) (2026-11-05)
+
+
+### Tests
+
+* Cover public part comment proxy contracts ([edb13ae](https://github.com/UteamUP/uteamup-mcp/commit/edb13ae1e8970c437c2c90c6ce1066728961937a))
+* cover the tenant billing lifecycle MCP tools ([7b5ae4a](https://github.com/UteamUP/uteamup-mcp/commit/7b5ae4a6bc54bc79e7333abd217287c631b6f74e))
+* **tenant-home:** enhance tenant tests to preserve memberships and handle API-key enumeration ([57853d9](https://github.com/UteamUP/uteamup-mcp/commit/57853d936ee066f7604ff53bd69d57a5866484be))
+
 ## [2.6.7-beta.9](https://github.com/UteamUP/uteamup-mcp/compare/2.6.6-beta.9...2.6.7-beta.9) (2026-11-04)
 
 

package/lib/config.js

@@ -3,8 +3,25 @@
  * Validates environment variables and provides type-safe configuration
  */
 
+const net = require('net');
 const { z } = require('zod');
 const { normalizeBackendBaseUrl } = require('./transport-security');
+const { warn } = require('./logger');
+
+/**
+ * Mirrors the CLI's skipTLSVerifyFor (uteamup_cli/internal/auth/oauth.go): a
+ * self-signed certificate is only normal on loopback, where there is no network
+ * path on which to intercept the bearer token.
+ *
+ * @param {string} hostname - WHATWG URL hostname (lower-cased, IPs canonicalized)
+ * @returns {boolean}
+ */
+function isLoopbackHost(hostname) {
+  if (hostname === 'localhost' || hostname === '[::1]') {
+    return true;
+  }
+  return net.isIPv4(hostname) && hostname.startsWith('127.');
+}
 
 // Configuration schema
 const configSchema = z.object({
@@ -95,15 +112,17 @@ const configSchema = z.object({
 
   // UTEAMUP-SEC-2026-05-02-008: explicit opt-in to disable TLS verification
   // for self-signed dev certs. Without this flag the MCP proxy validates
-  // TLS like any other production HTTPS client. Defense-in-depth: even when
-  // set, the flag is ignored for the production host (api.uteamup.com).
+  // TLS like any other production HTTPS client. Even when set, the flag is
+  // honoured only for a loopback backend and ignored, with a warning, elsewhere.
   insecureTLS: z.boolean()
     .default(false)
-    .describe('Disable TLS certificate verification (dev only — never set against api.uteamup.com)')
+    .describe('Disable TLS certificate verification (loopback backends only)')
 }).transform(config => {
-  // Apply the production policy after URL parsing has canonicalized the host.
-  const hostname = new URL(config.baseUrl).hostname.replace(/\.$/, '');
-  if (hostname === 'api.uteamup.com') {
+  // Apply the policy after URL parsing has canonicalized the host.
+  if (config.insecureTLS && !isLoopbackHost(new URL(config.baseUrl).hostname)) {
+    warn('UTEAMUP_INSECURE_TLS ignored: TLS verification can only be disabled for a loopback backend', {
+      baseUrl: config.baseUrl
+    });
     config.insecureTLS = false;
   }
   return config;

package/openapi-actions.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "UteamUP CMMS Read-Only Assistant Actions",
     "description": "OpenAPI 3.1.0 Action schema for ChatGPT Custom GPTs (GPT Store) and Google Gemini / Vertex AI Extensions. Invokes the UteamUP read-only MCP endpoint (/mcp/read-only) to list and search assets and work orders using the caller's tenant-scoped permissions.",
-    "version": "2.6.7-beta.9",
+    "version": "2.6.9-beta.9",
     "x-logo": {
       "url": "https://raw.githubusercontent.com/UteamUP/uteamup-mcp/main/assets/logo.png",
       "altText": "UteamUP CMMS"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uteamup/mcp-server",
-  "version": "2.6.7-beta.9",
+  "version": "2.6.9-beta.9",
   "mcpName": "io.github.UteamUP/mcp-server",
   "description": "MCP server client for UteamUP - enables Claude Desktop/Code integration with automatic OAuth 2.0 authentication",
   "main": "index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.UteamUP/mcp-server",
   "title": "UteamUP CMMS",
   "description": "Connect AI assistants to UteamUP CMMS for work orders, assets, maintenance, and inventory.",
-  "version": "2.6.7-beta.9",
+  "version": "2.6.9-beta.9",
   "websiteUrl": "https://uteamup.com",
   "icons": [
     {
@@ -30,7 +30,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@uteamup/mcp-server",
-      "version": "2.6.7-beta.9",
+      "version": "2.6.9-beta.9",
       "transport": {
         "type": "stdio"
       },