@vibetools/dokploy-mcp 2.2.0 → 2.2.1

package/README.md

@@ -94,6 +94,26 @@ await dokploy.application.one({
 
 Without shaping params, behavior is identical to the raw Dokploy API -- fully backward compatible.
 
+## Secret redaction
+
+Git provider credentials (GitHub App private keys, client secrets, webhook secrets, Gitea/GitLab/Bitbucket tokens) are **automatically redacted** from all responses. Your AI agent sees `[REDACTED]` instead of the real values -- because leaking your private key into a context window is the kind of mistake you only make once.
+
+Affected procedures: `application.one`, `application.many`, `github.one`, `gitea.one`, `gitlab.one`, `bitbucket.one`, `github.githubProviders`, `gitProvider.getAll`.
+
+If you actually need the raw secrets (rotation scripts, migration, etc.), opt in explicitly:
+
+```js
+await dokploy.application.one({
+  applicationId: "id",
+  includeSecrets: true  // you asked for it
+})
+
+await dokploy.github.one({
+  githubId: "id",
+  includeSecrets: true
+})
+```
+
 ## Virtual helpers
 
 Code Mode includes MCP-side helpers for common multi-call patterns. They run inside `execute`, fan out to real Dokploy API calls, and charge every underlying call against the sandbox budget honestly.

package/dist/codemode/overrides/procedure-overrides.js

@@ -1,5 +1,77 @@
 import { procedureSchemas } from '../../generated/dokploy-schemas.js';
-const applicationOneMcpOnlyKeys = new Set(['select', 'includeDeployments', 'deploymentLimit']);
+// Keys that hold credentials in git-provider objects (github, gitea, gitlab, bitbucket).
+// Redacted by default — callers must pass includeSecrets: true to receive them.
+const gitProviderSecretKeys = new Set([
+    // GitHub App
+    'githubClientSecret',
+    'githubPrivateKey',
+    'githubWebhookSecret',
+    // Gitea
+    'clientSecret',
+    'accessToken',
+    'refreshToken',
+    // GitLab
+    'secret',
+    // Bitbucket
+    'appPassword',
+    'apiToken',
+    // SSH / generic
+    'privateKey',
+    'privateKeyPass',
+]);
+// Top-level keys on an application object that contain nested git-provider data
+const gitProviderNestingKeys = new Set(['github', 'gitea', 'gitlab', 'bitbucket']);
+function redactRecord(value) {
+    const redacted = {};
+    for (const [key, val] of Object.entries(value)) {
+        if (gitProviderSecretKeys.has(key)) {
+            redacted[key] = '[REDACTED]';
+        }
+        else if (isRecord(val)) {
+            redacted[key] = redactRecord(val);
+        }
+        else {
+            redacted[key] = val;
+        }
+    }
+    return redacted;
+}
+function redactGitProviderSecrets(data) {
+    if (!isRecord(data)) {
+        return data;
+    }
+    if (Array.isArray(data)) {
+        return data;
+    }
+    let changed = false;
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+        if (gitProviderSecretKeys.has(key)) {
+            result[key] = '[REDACTED]';
+            changed = true;
+        }
+        else if (gitProviderNestingKeys.has(key) && isRecord(value)) {
+            result[key] = redactRecord(value);
+            changed = true;
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return changed ? result : data;
+}
+function redactGitProviderArray(data) {
+    if (!Array.isArray(data)) {
+        return redactGitProviderSecrets(data);
+    }
+    return data.map((item) => redactGitProviderSecrets(item));
+}
+const applicationOneMcpOnlyKeys = new Set([
+    'select',
+    'includeDeployments',
+    'deploymentLimit',
+    'includeSecrets',
+]);
 const applicationOneInputSchema = {
     type: 'object',
     properties: {
@@ -19,6 +91,9 @@ const applicationOneInputSchema = {
         deploymentLimit: {
             type: 'integer',
         },
+        includeSecrets: {
+            type: 'boolean',
+        },
     },
     required: ['applicationId'],
     additionalProperties: false,
@@ -99,7 +174,28 @@ function transformApplicationOneResponse(data, input) {
         return data;
     }
     const selected = pickSelectedFields(data, input.select);
-    return applyDeploymentControls(selected, input);
+    const shaped = applyDeploymentControls(selected, input);
+    return input.includeSecrets === true ? shaped : redactGitProviderSecrets(shaped);
+}
+const includeSecretsMcpOnlyKeys = new Set(['includeSecrets']);
+function mapIncludeSecretsInput(input) {
+    return Object.fromEntries(Object.entries(input).filter(([key]) => !includeSecretsMcpOnlyKeys.has(key)));
+}
+function transformWithSecretGate(data, input) {
+    return input.includeSecrets === true ? data : redactGitProviderSecrets(data);
+}
+function transformArrayWithSecretGate(data, input) {
+    return input.includeSecrets === true ? data : redactGitProviderArray(data);
+}
+function withIncludeSecrets(schema) {
+    const properties = (schema.properties ?? {});
+    return {
+        ...schema,
+        properties: {
+            ...properties,
+            includeSecrets: { type: 'boolean' },
+        },
+    };
 }
 const procedureOverrides = {
     'application.one': {
@@ -108,6 +204,52 @@ const procedureOverrides = {
         validateInput: validateApplicationOneInput,
         transformResponse: transformApplicationOneResponse,
     },
+    'github.one': {
+        inputSchema: withIncludeSecrets({
+            type: 'object',
+            properties: { githubId: { type: 'string', minLength: 1 } },
+            required: ['githubId'],
+            additionalProperties: false,
+        }),
+        mapInput: mapIncludeSecretsInput,
+        transformResponse: transformWithSecretGate,
+    },
+    'github.githubProviders': {
+        transformResponse: transformArrayWithSecretGate,
+    },
+    'gitea.one': {
+        inputSchema: withIncludeSecrets({
+            type: 'object',
+            properties: { giteaId: { type: 'string', minLength: 1 } },
+            required: ['giteaId'],
+            additionalProperties: false,
+        }),
+        mapInput: mapIncludeSecretsInput,
+        transformResponse: transformWithSecretGate,
+    },
+    'gitlab.one': {
+        inputSchema: withIncludeSecrets({
+            type: 'object',
+            properties: { gitlabId: { type: 'string', minLength: 1 } },
+            required: ['gitlabId'],
+            additionalProperties: false,
+        }),
+        mapInput: mapIncludeSecretsInput,
+        transformResponse: transformWithSecretGate,
+    },
+    'bitbucket.one': {
+        inputSchema: withIncludeSecrets({
+            type: 'object',
+            properties: { bitbucketId: { type: 'string', minLength: 1 } },
+            required: ['bitbucketId'],
+            additionalProperties: false,
+        }),
+        mapInput: mapIncludeSecretsInput,
+        transformResponse: transformWithSecretGate,
+    },
+    'gitProvider.getAll': {
+        transformResponse: transformArrayWithSecretGate,
+    },
 };
 function getGeneratedProcedureSchema(procedure) {
     return procedureSchemas[procedure];

package/dist/codemode/overrides/virtual-procedures.js

@@ -20,6 +20,9 @@ function createApplicationManyInputSchema() {
             deploymentLimit: {
                 type: 'integer',
             },
+            includeSecrets: {
+                type: 'boolean',
+            },
         },
         required: ['applicationIds'],
         additionalProperties: false,
@@ -93,6 +96,9 @@ function buildApplicationOneInput(applicationId, input) {
     if ('deploymentLimit' in input) {
         nextInput.deploymentLimit = input.deploymentLimit;
     }
+    if ('includeSecrets' in input) {
+        nextInput.includeSecrets = input.includeSecrets;
+    }
     return nextInput;
 }
 async function executeApplicationMany(input, context) {
@@ -257,7 +263,7 @@ const virtualProcedureDefinitions = {
             description: 'MCP-only virtual helper that fans out to application.one while preserving input order and execute call budgeting.',
             inputKind: 'body',
             requiredInputs: ['applicationIds'],
-            optionalInputs: ['select', 'includeDeployments', 'deploymentLimit'],
+            optionalInputs: ['select', 'includeDeployments', 'deploymentLimit', 'includeSecrets'],
             response: {
                 type: 'object',
                 keys: ['items', 'total'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibetools/dokploy-mcp",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Dokploy MCP server with Code Mode by default",
   "type": "module",
   "exports": {