@yamo/mcp-server 1.3.9 → 1.3.10

package/dist/index.js

@@ -47,7 +47,7 @@ const crypto_1 = __importDefault(require("crypto"));
 const path_1 = __importDefault(require("path"));
 const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(__dirname, '../package.json'), 'utf8'));
 dotenv.config();
-// Validation helper for bytes32 hashes (Part 3: Security Fixes)
+// Validation helpers
 function validateBytes32(value, fieldName) {
     if (!value.match(/^0x[a-fA-F0-9]{64}$/)) {
         throw new Error(`${fieldName} must be a valid bytes32 hash (0x + 64 hex chars). ` +
@@ -55,6 +55,21 @@ function validateBytes32(value, fieldName) {
             `\nDo NOT include algorithm prefixes like "sha256:"`);
     }
 }
+function validateEthereumAddress(address, fieldName) {
+    if (!address || !address.match(/^0x[a-fA-F0-9]{40}$/)) {
+        throw new Error(`${fieldName} must be a valid Ethereum address (0x + 40 hex characters)`);
+    }
+}
+function validateEnvironment() {
+    const requiredEnvVars = ['CONTRACT_ADDRESS', 'RPC_URL', 'PRIVATE_KEY'];
+    const missing = requiredEnvVars.filter(v => !process.env[v]);
+    if (missing.length > 0) {
+        throw new Error(`Missing required environment variables: ${missing.join(', ')}`);
+    }
+    // Validate contract address format
+    const contractAddress = process.env.CONTRACT_ADDRESS;
+    validateEthereumAddress(contractAddress, 'CONTRACT_ADDRESS');
+}
 const SUBMIT_BLOCK_TOOL = {
     name: "yamo_submit_block",
     description: `Submits a YAMO block to the YAMORegistry smart contract.
@@ -253,6 +268,8 @@ class YamoMcpServer {
     // Cache for chain continuation: latest submitted block's contentHash
     latestContentHash = null;
     constructor() {
+        // Validate environment variables at startup
+        validateEnvironment();
         this.server = new index_js_1.Server({ name: "yamo", version: pkg.version }, { capabilities: { tools: {} } });
         this.ipfs = new core_1.IpfsManager();
         this.chain = new core_1.YamoChainClient();
@@ -270,24 +287,29 @@ class YamoMcpServer {
                     // Process files - auto-read if they're file paths (with security fix)
                     let processedFiles = files;
                     if (files && Array.isArray(files)) {
-                        processedFiles = files.map((file) => {
+                        processedFiles = await Promise.all(files.map(async (file) => {
                             // Check if content is a file path that exists
                             if (typeof file.content === 'string' && fs_1.default.existsSync(file.content)) {
-                                // Security: Resolve to absolute path and restrict to cwd (Part 3: Security Fixes)
-                                const filePath = path_1.default.resolve(file.content);
-                                const allowedDir = process.cwd();
+                                // Security: Resolve symlinks and restrict to cwd (prevents symlink attacks and TOCTOU)
+                                const filePath = fs_1.default.realpathSync(file.content);
+                                const allowedDir = fs_1.default.realpathSync(process.cwd());
+                                // Check for symlinks
+                                const stats = fs_1.default.lstatSync(file.content);
+                                if (stats.isSymbolicLink()) {
+                                    throw new Error(`Symbolic links are not allowed: ${file.content}`);
+                                }
                                 if (!filePath.startsWith(allowedDir)) {
                                     throw new Error(`File path outside allowed directory: ${file.content}`);
                                 }
                                 console.error(`[DEBUG] Auto-reading file from path: ${file.content}`);
                                 return {
                                     name: file.name,
-                                    content: fs_1.default.readFileSync(filePath, 'utf8')
+                                    content: await fs_1.default.promises.readFile(filePath, 'utf8')
                                 };
                             }
                             // Otherwise use content as-is
                             return file;
-                        });
+                        }));
                     }
                     // Input validation (Part 3: Security Fixes)
                     validateBytes32(contentHash, "contentHash");
@@ -315,7 +337,7 @@ class YamoMcpServer {
                             }
                         }
                     }
-                    else {
+                    else if (previousBlock) {
                         validateBytes32(previousBlock, "previousBlock");
                     }
                     let ipfsCID = undefined;
@@ -357,7 +379,7 @@ class YamoMcpServer {
                                         blockId,
                                         hint: "Verify the blockId or check if the block was submitted"
                                     }, null, 2) }],
-                            isError: false,
+                            isError: true,
                         };
                     }
                     return {
@@ -386,7 +408,7 @@ class YamoMcpServer {
                                         error: "No blocks found on-chain",
                                         hint: "The chain may be empty. Try submitting a genesis block first."
                                     }, null, 2) }],
-                            isError: false,
+                            isError: true,
                         };
                     }
                     return {
@@ -418,7 +440,7 @@ class YamoMcpServer {
                                         blockId,
                                         hint: "Cannot audit non-existent block"
                                     }, null, 2) }],
-                            isError: false,
+                            isError: true,
                         };
                     }
                     // If no IPFS CID, can't audit content

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yamo/mcp-server",
-  "version": "1.3.9",
+  "version": "1.3.10",
   "description": "YAMO Protocol v0.4 - Model Context Protocol server for AI agents",
   "main": "dist/index.js",
   "type": "commonjs",