@xrpl-utilities/mcp 0.2.20 → 0.2.22

package/dist/server.js

@@ -67,8 +67,16 @@ export function buildServer(opts = {}) {
     server.setRequestHandler(ListResourcesRequestSchema, async () => ({
         resources,
     }));
+    // Allow-list of registered resource URIs. ReadResource must reject any
+    // URI not in this set so a malicious caller can't turn the hosted MCP
+    // endpoint into an SSRF proxy (cloud-metadata fetch, internal-network
+    // probe, arbitrary outbound HTTP from the Railway egress IP).
+    const allowedResourceUris = new Set(resources.map((r) => r.uri));
     server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
         const uri = req.params.uri;
+        if (!allowedResourceUris.has(uri)) {
+            throw new Error(`unknown resource: ${uri}`);
+        }
         const ctl = new AbortController();
         const tId = setTimeout(() => ctl.abort(), 10_000);
         try {

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAwB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,MAAM,UAAU,WAAW,CAAC,OAAwB,EAAE;IACpD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAC/C,CAAC;IAEF,6EAA6E;IAC7E,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/D,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBAC5E;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,sCAAuC,CAAW,CAAC,OAAO,EAAE;qBACnE;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,gDAAgD;IAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACxC;YACE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,cAAc;YAC/B,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,cAAc;YAC9B,WAAW,EAAE,qCAAqC,CAAC,CAAC,KAAK,yEAAyE;SACnI;QACD;YACE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,SAAS;YAC1B,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,UAAU;YAC1B,WAAW,EAAE,gCAAgC,CAAC,CAAC,KAAK,yDAAyD;SAC9G;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAChE,SAAS;KACV,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO;gBACL,QAAQ,EAAE;oBACR;wBACE,GAAG;wBACH,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB;wBAC7D,IAAI;qBACL;iBACF;aACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAwB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,MAAM,UAAU,WAAW,CAAC,OAAwB,EAAE;IACpD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAC/C,CAAC;IAEF,6EAA6E;IAC7E,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/D,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;qBAC5E;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,sCAAuC,CAAW,CAAC,OAAO,EAAE;qBACnE;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,gDAAgD;IAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACxC;YACE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,cAAc;YAC/B,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,cAAc;YAC9B,WAAW,EAAE,qCAAqC,CAAC,CAAC,KAAK,yEAAyE;SACnI;QACD;YACE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,SAAS;YAC1B,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,UAAU;YAC1B,WAAW,EAAE,gCAAgC,CAAC,CAAC,KAAK,yDAAyD;SAC9G;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAChE,SAAS;KACV,CAAC,CAAC,CAAC;IAEJ,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjE,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO;gBACL,QAAQ,EAAE;oBACR;wBACE,GAAG;wBACH,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB;wBAC7D,IAAI;qBACL;iBACF;aACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/flows.js

@@ -12,7 +12,7 @@ export const flows = {
     label: "XR-Flows",
     baseUrl: "https://flows.xrpl-utilities.io",
     manifestUrl: "https://flows.xrpl-utilities.io/agents.json",
-    knownSchemaVersions: ["1.0.0", "1.1.0", "1.2.0", "1.3.0", "1.4.0", "1.5.0", "1.6.0", "1.7.0", "1.8.0", "1.9.0", "1.10.0", "1.11.0", "1.12.0"],
+    knownSchemaVersions: ["1.0.0", "1.1.0", "1.2.0", "1.3.0", "1.4.0", "1.5.0", "1.6.0", "1.7.0", "1.8.0", "1.9.0", "1.10.0", "1.11.0", "1.12.0", "1.13.0"],
     tools: [
         {
             name: "xrpl_flows_scan",

package/dist/services/flows.js.map

@@ -1 +1 @@
-{"version":3,"file":"flows.js","sourceRoot":"","sources":["../../src/services/flows.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,KAAK,GAAe;IAC/B,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,iCAAiC;IAC1C,WAAW,EAAE,6CAA6C;IAC1D,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAC7I,KAAK,EAAE;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EACT,+DAA+D;gBAC/D,gEAAgE;gBAChE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,4DAA4D;gBAC5D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,sDAAsD;gBACtD,4CAA4C;YAC9C,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE;wBACN,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,yDAAyD;4BACzD,uDAAuD;4BACvD,mCAAmC;qBACtC;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,mCAAmC;qBACjD;iBACF;gBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;gBACpB,oBAAoB,EAAE,KAAK;aAC5B;YACD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,aAAa;YACvB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,CAAC,mBAAmB,CAAC;SACjC;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EACT,mEAAmE;gBACnE,oEAAoE;gBACpE,kEAAkE;gBAClE,8DAA8D;gBAC9D,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,+DAA+D;gBAC/D,kEAAkE;gBAClE,iCAAiC;YACnC,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,CAAC;wBACV,OAAO,EAAE,EAAE;wBACX,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,+CAA+C;qBAC7D;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;YACD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,MAAM;SACjB;QACD;YACE,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACT,iEAAiE;gBACjE,+DAA+D;gBAC/D,4DAA4D;gBAC5D,kEAAkE;gBAClE,4DAA4D;gBAC5D,8DAA8D;gBAC9D,kEAAkE;gBAClE,4BAA4B;YAC9B,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,oBAAoB,EAAE,KAAK;aAC5B;YACD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,MAAM;SACjB;KACF;CACF,CAAC"}
+{"version":3,"file":"flows.js","sourceRoot":"","sources":["../../src/services/flows.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,KAAK,GAAe;IAC/B,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,iCAAiC;IAC1C,WAAW,EAAE,6CAA6C;IAC1D,mBAAmB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACvJ,KAAK,EAAE;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EACT,+DAA+D;gBAC/D,gEAAgE;gBAChE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,4DAA4D;gBAC5D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,sDAAsD;gBACtD,4CAA4C;YAC9C,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE;wBACN,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,yDAAyD;4BACzD,uDAAuD;4BACvD,mCAAmC;qBACtC;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,mCAAmC;qBACjD;iBACF;gBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;gBACpB,oBAAoB,EAAE,KAAK;aAC5B;YACD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,aAAa;YACvB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,CAAC,mBAAmB,CAAC;SACjC;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EACT,mEAAmE;gBACnE,oEAAoE;gBACpE,kEAAkE;gBAClE,8DAA8D;gBAC9D,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,+DAA+D;gBAC/D,kEAAkE;gBAClE,iCAAiC;YACnC,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,CAAC;wBACV,OAAO,EAAE,EAAE;wBACX,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,+CAA+C;qBAC7D;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;YACD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,MAAM;SACjB;QACD;YACE,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACT,iEAAiE;gBACjE,+DAA+D;gBAC/D,4DAA4D;gBAC5D,kEAAkE;gBAClE,4DAA4D;gBAC5D,8DAA8D;gBAC9D,kEAAkE;gBAClE,4BAA4B;YAC9B,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,oBAAoB,EAAE,KAAK;aAC5B;YACD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,MAAM;SACjB;KACF;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xrpl-utilities/mcp",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "description": "Model Context Protocol server for the XRPL-Utilities portfolio: Sentinel (wallet classifier), Pulse (signal feed), Telemetry (supply + utility floor), Trust (XLS-70/80/81 directory), Vault (RWA tracker), and Flows (ETF AUM ↔ XRPL flow correlation). Exposes each service's read endpoints as MCP tools so AI agents can discover and use them via stdio (Claude Desktop) or HTTP/SSE (hosted at mcp.xrpl-utilities.io). Stateless passthrough — caller provides their own x402 payment header.",
   "license": "MIT",
   "type": "module",