actual-mcp-server 0.22.11 → 0.22.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +4 -4
  2. package/dist/src/lib/oidc-scopes.js +3 -3
  3. package/dist/src/server/httpServer.js +1 -1
  4. package/package.json +5 -5
package/README.md CHANGED
@@ -9,7 +9,7 @@
9
9
  [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
10
10
  [![Node.js Version](https://img.shields.io/badge/node-%3E%3D22.0.0-brightgreen)](https://nodejs.org/)
11
11
  [![TypeScript](https://img.shields.io/badge/TypeScript-7.0-blue)](https://www.typescriptlang.org/)
12
- [![MCP Protocol](https://img.shields.io/badge/MCP-1.30-orange)](https://modelcontextprotocol.io/)
12
+ [![MCP Protocol](https://img.shields.io/badge/MCP-1.32-orange)](https://modelcontextprotocol.io/)
13
13
  [![Docker Pulls](https://img.shields.io/docker/pulls/agigante80/actual-mcp-server)](https://hub.docker.com/r/agigante80/actual-mcp-server)
14
14
  [![Docker Image Size](https://img.shields.io/docker/image-size/agigante80/actual-mcp-server/latest)](https://hub.docker.com/r/agigante80/actual-mcp-server)
15
15
  [![Unraid Community Apps](https://img.shields.io/badge/Unraid-Community%20Apps-f15a2c?logo=unraid&logoColor=white)](https://ca.unraid.net/apps/actual-mcp-server-0bghkvs0c7c8bg)
@@ -513,7 +513,7 @@ All configuration is via environment variables. Copy `.env.example` to `.env` to
513
513
  | `OIDC_JWKS_TRUSTED_HOSTS` | _(none)_ | No | Opt-in cross-origin JWKS hosts, comma-separated `host` or `host:port` (#254). For IdPs whose `jwks_uri` lives on another host, e.g. Google needs `www.googleapis.com`. Exact match, no wildcards; empty default keeps same-origin-only |
514
514
  | `OIDC_JWKS_URI` | _(none)_ | No | Direct JWKS URL that bypasses OpenID discovery (#462), for issuers with no discovery document (Cloudflare Access: `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`). Same https, credentials and origin-or-trusted-host rules as a discovered `jwks_uri`, plus no query or fragment. When set, `/.well-known/oauth-authorization-server` is not served and `AUTH_BUDGET_ACL_IDENTITY_SOURCE=userinfo` is refused |
515
515
  | `OIDC_TOKEN_SOURCE` | `authorization` | No | Where the bearer JWT is read from (#462): `authorization` (default) or `cf-access-jwt-assertion` for an MCP server behind Cloudflare Access with Managed OAuth (the edge forwards the signed Access JWT in that header; `Authorization` is then never consulted, `OIDC_SCOPES` must be empty, `OIDC_SCOPES_SUPPORTED` is allowed, and the origin must be reachable only via Cloudflare). See the Cloudflare recipe in `docs/guides/AI_CLIENT_SETUP.md` |
516
- | `OIDC_SCOPES` | _(none)_ | No | Comma-separated required (enforced) scopes, also advertised. Leave empty when the IdP's JWTs carry no `scope` claim (Casdoor, Cloudflare Access for SaaS) |
516
+ | `OIDC_SCOPES` | _(none)_ | No | Comma-separated required (enforced) scopes, also advertised. Leave empty when the IdP's JWTs carry no `scope` claim (Cloudflare Access for SaaS, or Casdoor when the client requests no scope) |
517
517
  | `OIDC_SCOPES_SUPPORTED` | _(none)_ | No | Comma-separated scopes advertised in `scopes_supported` but not enforced. Use when the IdP's JWTs carry no `scope` claim but the client needs a scope such as `offline_access` advertised (e.g. Gemini with Cloudflare Access for SaaS). Required scopes from `OIDC_SCOPES` are always advertised too |
518
518
  | `AUTH_BUDGET_ACL` | _(none)_ | No | Per-user budget ACL; see [AI Client Setup](docs/guides/AI_CLIENT_SETUP.md#oidc-authentication-multi-user) |
519
519
  | `AUTH_BUDGET_ACL_SOURCE` | `static` | No | `static` uses the `AUTH_BUDGET_ACL` map above. `actual` derives the ACL from the Actual server's own per-file access list, so revoking someone in Actual takes effect here without a config edit. Requires a multi-user (OpenID) Actual server that was password-bootstrapped first |
@@ -668,7 +668,7 @@ AUTH_PROVIDER=oidc
668
668
  OIDC_ISSUER=https://sso.yourdomain.com
669
669
  OIDC_RESOURCE=https://actual-mcp.yourdomain.com/http # this server's public MCP URL (the expected 'aud')
670
670
  OIDC_ACCEPTED_AUDIENCES=your-client-id # only if your IdP puts the client id in 'aud' (#245)
671
- OIDC_SCOPES= # leave empty for Casdoor / Cloudflare Access for SaaS
671
+ OIDC_SCOPES= # leave empty when the tokens carry no scope claim
672
672
  # OIDC_SCOPES_SUPPORTED=openid,offline_access # extra scopes advertised in discovery without enforcement (#472)
673
673
  ```
674
674
 
@@ -789,7 +789,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
789
789
 
790
790
  ---
791
791
 
792
- **Version:** 0.22.11 | **Tool Count:** 82 (verified LibreChat-compatible)
792
+ **Version:** 0.22.13 | **Tool Count:** 82 (verified LibreChat-compatible)
793
793
 
794
794
  ## Sponsor
795
795
 
package/dist/src/lib/oidc-scopes.js CHANGED
@@ -4,9 +4,9 @@
4
4
  * Separates scopes advertised in discovery (RFC 9728 `scopes_supported`) from
5
5
  * scopes required (enforced) on incoming access tokens (`requiredScopes`).
6
6
  *
7
- * Some IdPs (such as Cloudflare Access for SaaS or Casdoor) issue JWTs without
8
- * a `scope` claim, while clients (such as Google Gemini) require `offline_access`
9
- * to be advertised in discovery in order to request and receive a refresh token.
7
+ * Some IdPs (such as Cloudflare Access for SaaS, or Casdoor when the client requests
8
+ * no scope) issue JWTs without a `scope` claim, while clients (such as Google Gemini)
9
+ * require `offline_access` to be advertised in discovery in order to request and receive a refresh token.
10
10
  *
11
11
  * Pure and side-effect-free for hermetic unit testing.
12
12
  */
package/dist/src/server/httpServer.js CHANGED
@@ -104,7 +104,7 @@ advertisedUrl) {
104
104
  'without audience enforcement, which would allow cross-relying-party token replay (#160/#245).');
105
105
  }
106
106
  // Custom jose-based JWT verifier that bypasses mcp-auth's strict PKCE/discovery
107
- // validation that fails when the IdP (e.g. Casdoor v2.13) doesn't advertise
107
+ // validation that fails when the IdP (e.g. Casdoor before v2.316.1) doesn't advertise
108
108
  // code_challenge_methods_supported in its discovery document.
109
109
  // #244: resolve the JWKS URI from the issuer's OpenID discovery document
110
110
  // instead of a hardcoded `${OIDC_ISSUER}/.well-known/jwks` (which 404s for
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "actual-mcp-server",
3
3
  "displayName": "Actual MCP Server",
4
- "version": "0.22.11",
4
+ "version": "0.22.13",
5
5
  "engines": {
6
6
  "node": ">=22.0.0",
7
7
  "npm": ">=10.0.0"
@@ -69,9 +69,9 @@
69
69
  },
70
70
  "dependencies": {
71
71
  "@actual-app/api": "^26.9.0",
72
- "@modelcontextprotocol/sdk": "^1.30.1",
72
+ "@modelcontextprotocol/sdk": "^1.32.1",
73
73
  "debug": "^4.4.3",
74
- "dotenv": "^18.0.3",
74
+ "dotenv": "^18.0.6",
75
75
  "express": "^5.2.1",
76
76
  "fuse.js": "^7.4.2",
77
77
  "jose": "^6.2.12",
@@ -86,8 +86,8 @@
86
86
  "devDependencies": {
87
87
  "@playwright/test": "^1.63.0",
88
88
  "@types/express": "^5.0.3",
89
- "@types/node": "^26.6.3",
90
- "knip": "^6.38.0",
89
+ "@types/node": "^26.6.4",
90
+ "knip": "^6.40.0",
91
91
  "node-fetch": "^3.3.2",
92
92
  "tsconfig-paths": "^4.2.0",
93
93
  "typescript": "^7.0.2"