brewpage-mcp 1.14.0 → 1.14.2

package/README.md

@@ -17,7 +17,7 @@ Choosing a host? See how BrewPage compares with GitHub Pages, Netlify Drop, Tiin
 ## Quick Start
 
 ```bash
-npx -y brewpage-mcp@1.14.0
+npx -y brewpage-mcp@1.14.2
 ```
 
 Requires Node.js 20 or newer. This starts the stdio server for an MCP client.
@@ -33,7 +33,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.14.0"]
+      "args": ["-y", "brewpage-mcp@1.14.2"]
     }
   }
 }
@@ -44,7 +44,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 Register a project-scoped stdio server:
 
 ```bash
-claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.14.0
+claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.14.2
 ```
 
 This writes `.mcp.json` in the project root. Use `--scope user` for user-scoped registration. See the [official Claude Code MCP guide](https://code.claude.com/docs/en/mcp).
@@ -58,7 +58,7 @@ Open **Settings > MCP** and add:
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.14.0"]
+      "args": ["-y", "brewpage-mcp@1.14.2"]
     }
   }
 }
@@ -72,7 +72,7 @@ Open the Cline MCP settings panel and add:
 {
   "brewpage": {
     "command": "npx",
-    "args": ["-y", "brewpage-mcp@1.14.0"]
+    "args": ["-y", "brewpage-mcp@1.14.2"]
   }
 }
 ```
@@ -80,7 +80,7 @@ Open the Cline MCP settings panel and add:
 ### Global Install
 
 ```bash
-npm install -g brewpage-mcp@1.14.0
+npm install -g brewpage-mcp@1.14.2
 brewpage-mcp
 ```
 
@@ -509,6 +509,14 @@ Every publish response includes an **owner token** -- the only credential that a
 
 ## Changelog
 
+## 1.14.2 -- 2026-10-26
+
+- MCP Registry entry lists the remote endpoint `https://brewpage.app/mcp` (Streamable HTTP, no auth) beside the npm package. Tools are unchanged.
+
+## 1.14.1 -- 2026-10-26
+
+- Security fix: `namespace`, `id` and `key` are encoded as single path segments; empty, `.` and `..` are refused before any request, so calls stay under `/api/<type>/`. Valid inputs are unchanged.
+
 ## 1.14.0 -- 2026-10-26
 
 - Remote mode: `node dist/http.js` serves stateless Streamable HTTP (see [Remote HTTP mode](#remote-http-mode)); stdio is unchanged. `User-Agent: brewpage-mcp/1.14.0` (`(remote)` in HTTP mode).

package/dist/tools.d.ts

@@ -1,6 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 export declare const DEFAULT_BASE_URL = "https://brewpage.app";
-export declare const USER_AGENT = "brewpage-mcp/1.14.0";
+export declare const USER_AGENT = "brewpage-mcp/1.14.2";
 export declare const OWNER_TOKEN_ENV = "BREWPAGE_OWNER_TOKEN";
 export interface ServerOptions {
     /** BrewPage origin for API calls; default https://brewpage.app. */
@@ -18,5 +18,9 @@ export interface ServerOptions {
     /** Transport for BrewPage API calls; default global fetch. */
     fetch?: typeof fetch;
 }
+/** `/api/<segments>` with each segment encoded; empty, `.` and `..` refused (URL parsing would resolve them away). */
+export declare function apiPath(...segments: string[]): string;
+/** Path plus URLSearchParams query; undefined values skipped, no `?` when empty. */
+export declare function withQuery(path: string, params: Array<[string, string | number | undefined]>): string;
 /** Fresh server with all tools; stdio builds one, stateless HTTP one per request. */
 export declare function createServer(options?: ServerOptions): McpServer;

package/dist/tools.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 export const DEFAULT_BASE_URL = "https://brewpage.app";
-export const USER_AGENT = "brewpage-mcp/1.14.0";
+export const USER_AGENT = "brewpage-mcp/1.14.2";
 export const OWNER_TOKEN_ENV = "BREWPAGE_OWNER_TOKEN";
 const READ_ONLY = { readOnlyHint: true };
 const DESTRUCTIVE = { readOnlyHint: false, destructiveHint: true };
@@ -21,6 +21,24 @@ const OLD_READ_ONLY_TEXT = ` Old publications (made before 5 October 2026) are r
 const WARNING_CODES = new Set(["secret-detected", "manage-link-disabled"]);
 /** MCP type name -> REST path segment. */
 const TYPE_SEGMENTS = { html: "html", site: "sites", file: "files", json: "json", kv: "kv" };
+/** `/api/<segments>` with each segment encoded; empty, `.` and `..` refused (URL parsing would resolve them away). */
+export function apiPath(...segments) {
+    for (const segment of segments) {
+        if (segment === "" || segment === "." || segment === "..") {
+            throw new Error(`Invalid path value ${JSON.stringify(segment)}: empty, "." and ".." are not allowed.`);
+        }
+    }
+    return `/api/${segments.map(encodeURIComponent).join("/")}`;
+}
+/** Path plus URLSearchParams query; undefined values skipped, no `?` when empty. */
+export function withQuery(path, params) {
+    const query = new URLSearchParams();
+    for (const [name, value] of params)
+        if (value !== undefined)
+            query.append(name, String(value));
+    const qs = query.toString();
+    return qs ? `${path}?${qs}` : path;
+}
 /** Only the last 4 characters: tokens never reach a transcript in full. */
 function maskToken(token) {
     return `…${token.slice(-4)}`;
@@ -162,7 +180,7 @@ export function createServer(options = {}) {
     const apiFetch = options.fetch ?? fetch;
     const server = new McpServer({
         name: "brewpage-mcp",
-        version: "1.14.0",
+        version: "1.14.2",
     });
     /** Caller argument first, then the configured default; `fromEnv` marks the configured one. */
     function ownerTokenFor(argument) {
@@ -266,9 +284,7 @@ export function createServer(options = {}) {
         },
     }, async ({ content, format, namespace, password, ttlDays, filename, showTopBar, deliveryMode, ownerToken }) => {
         const effectiveNamespace = resolveNamespace(namespace);
-        const qsParams = [`ns=${encodeURIComponent(effectiveNamespace)}`, `format=${encodeURIComponent(format.toLowerCase())}`];
-        if (ttlDays !== undefined)
-            qsParams.push(`ttl=${encodeURIComponent(String(ttlDays))}`);
+        const path = withQuery(apiPath("html"), [["ns", effectiveNamespace], ["format", format.toLowerCase()], ["ttl", ttlDays]]);
         const body = { content };
         if (filename)
             body.filename = filename;
@@ -282,7 +298,7 @@ export function createServer(options = {}) {
         const owner = ownerTokenFor(ownerToken).token;
         if (owner)
             headers["X-Owner-Token"] = owner;
-        const { ok, data } = await apiRequest("POST", `/api/html?${qsParams.join("&")}`, body, headers);
+        const { ok, data } = await apiRequest("POST", path, body, headers);
         if (!ok) {
             return {
                 content: [
@@ -328,7 +344,7 @@ export function createServer(options = {}) {
         const owner = ownerTokenFor(ownerToken).token;
         if (owner)
             headers["X-Owner-Token"] = owner;
-        const res = await bpFetch(`${baseUrl}/api/files?ns=${encodeURIComponent(effectiveNamespace)}`, {
+        const res = await bpFetch(`${baseUrl}${withQuery(apiPath("files"), [["ns", effectiveNamespace]])}`, {
             method: "POST",
             headers,
             body: formData,
@@ -369,7 +385,7 @@ export function createServer(options = {}) {
         const auth = ownerTokenFor(ownerToken);
         if (!auth.token)
             return textResult(NO_OWNER_TOKEN, true);
-        const path = `/api/${TYPE_SEGMENTS[type]}/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}/hosting`;
+        const path = apiPath(TYPE_SEGMENTS[type], namespace, id, "hosting");
         const { ok, status, data } = await apiRequest("PATCH", path, { deliveryMode, expectedVersion }, { "X-Owner-Token": auth.token });
         if (!ok)
             return ownerFailure("update hosting", status, data, auth.fromEnv);
@@ -392,7 +408,7 @@ export function createServer(options = {}) {
         const auth = ownerTokenFor(ownerToken);
         if (!auth.token)
             return textResult(NO_OWNER_TOKEN, true);
-        const path = `/api/${TYPE_SEGMENTS[type]}/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}`;
+        const path = apiPath(TYPE_SEGMENTS[type], namespace, id);
         const { ok, status, data } = await apiRequest("DELETE", path, undefined, { "X-Owner-Token": auth.token });
         if (!ok)
             return ownerFailure("delete", status, data, auth.fromEnv);
@@ -420,7 +436,7 @@ export function createServer(options = {}) {
         const headers = {};
         if (password)
             headers["X-Password"] = password;
-        const { ok, status, data, headers: responseHeaders } = await apiRequest("GET", `/api/html/${namespace}/${id}`, undefined, headers, "text");
+        const { ok, status, data, headers: responseHeaders } = await apiRequest("GET", apiPath("html", namespace, id), undefined, headers, "text");
         if (!ok) {
             let errorData = data;
             try {
@@ -464,7 +480,7 @@ export function createServer(options = {}) {
                 .describe("Optional IANA timezone id for the 'today' boundary, e.g. 'Europe/Lisbon'. Defaults to UTC. Invalid value falls back to UTC silently."),
         },
     }, async ({ tz }) => {
-        const path = tz ? `/api/stats?tz=${encodeURIComponent(tz)}` : "/api/stats";
+        const path = withQuery(apiPath("stats"), [["tz", tz || undefined]]);
         const { ok, data } = await apiRequest("GET", path);
         if (!ok) {
             return {
@@ -551,14 +567,7 @@ export function createServer(options = {}) {
         if (deliveryMode)
             headers["X-Delivery-Mode"] = deliveryMode;
         const effectiveNamespace = resolveNamespace(namespace);
-        const qsParams = [];
-        if (entry)
-            qsParams.push(`entry=${encodeURIComponent(entry)}`);
-        qsParams.push(`ns=${encodeURIComponent(effectiveNamespace)}`);
-        if (ttlDays)
-            qsParams.push(`ttl=${encodeURIComponent(String(ttlDays))}`);
-        const qs = qsParams.length ? `?${qsParams.join("&")}` : "";
-        const url = `${baseUrl}/api/sites${qs}`;
+        const url = baseUrl + withQuery(apiPath("sites"), [["entry", entry || undefined], ["ns", effectiveNamespace], ["ttl", ttlDays || undefined]]);
         const res = await bpFetch(url, { method: "POST", headers, body: formData });
         const data = await res.json().catch(() => null);
         if (!res.ok) {
@@ -657,15 +666,8 @@ export function createServer(options = {}) {
         if (!auth.token)
             return textResult(NO_OWNER_TOKEN, true);
         const headers = { "X-Owner-Token": auth.token };
-        const qsParams = [];
-        if (entry)
-            qsParams.push(`entry=${encodeURIComponent(entry)}`);
-        if (ttlDays)
-            qsParams.push(`ttl=${encodeURIComponent(String(ttlDays))}`);
-        if (tags && tags.length)
-            qsParams.push(`tags=${encodeURIComponent(tags.join(","))}`);
-        const qs = qsParams.length ? `?${qsParams.join("&")}` : "";
-        const url = `${baseUrl}/api/sites/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}${qs}`;
+        const url = baseUrl + withQuery(apiPath("sites", namespace, id), [["entry", entry || undefined],
+            ["ttl", ttlDays || undefined], ["tags", tags && tags.length ? tags.join(",") : undefined]]);
         const res = await bpFetch(url, { method: "PUT", headers, body: formData });
         const data = await res.json().catch(() => null);
         if (!res.ok)
@@ -718,7 +720,7 @@ export function createServer(options = {}) {
         const auth = ownerTokenFor(ownerToken);
         if (!auth.token)
             return textResult(NO_OWNER_TOKEN, true);
-        const path = `/api/html/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}`;
+        const path = apiPath("html", namespace, id);
         const { ok, status, data } = await apiRequest("PUT", path, body, {
             "X-Owner-Token": auth.token,
         });
@@ -760,15 +762,7 @@ export function createServer(options = {}) {
     }, async ({ json, namespace, password, ttlDays, tags, ownerToken, deliveryMode }) => {
         const jsonString = typeof json === "string" ? json : JSON.stringify(json);
         const effectiveNamespace = resolveNamespace(namespace);
-        const qsParams = [];
-        qsParams.push(`ns=${encodeURIComponent(effectiveNamespace)}`);
-        if (ttlDays !== undefined)
-            qsParams.push(`ttl=${encodeURIComponent(String(ttlDays))}`);
-        if (tags && tags.length) {
-            for (const t of tags)
-                qsParams.push(`tags=${encodeURIComponent(t)}`);
-        }
-        const qs = qsParams.length ? `?${qsParams.join("&")}` : "";
+        const path = withQuery(apiPath("json"), [["ns", effectiveNamespace], ["ttl", ttlDays], ...(tags ?? []).map((t) => ["tags", t])]);
         const headers = { "Content-Type": "application/json" };
         if (password)
             headers["X-Password"] = password;
@@ -777,7 +771,7 @@ export function createServer(options = {}) {
             headers["X-Owner-Token"] = owner;
         if (deliveryMode)
             headers["X-Delivery-Mode"] = deliveryMode;
-        const res = await bpFetch(`${baseUrl}/api/json${qs}`, {
+        const res = await bpFetch(`${baseUrl}${path}`, {
             method: "POST",
             headers,
             body: jsonString,
@@ -818,7 +812,7 @@ export function createServer(options = {}) {
         const headers = {};
         if (password)
             headers["X-Password"] = password;
-        const path = `/api/json/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}`;
+        const path = apiPath("json", namespace, id);
         const { ok, status, data } = await apiRequest("GET", path, undefined, headers);
         if (!ok) {
             return {
@@ -856,7 +850,7 @@ export function createServer(options = {}) {
         const auth = ownerTokenFor(ownerToken);
         if (!auth.token)
             return textResult(NO_OWNER_TOKEN, true);
-        const url = `${baseUrl}/api/json/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}`;
+        const url = baseUrl + apiPath("json", namespace, id);
         const res = await bpFetch(url, {
             method: "PUT",
             headers: {
@@ -903,15 +897,7 @@ export function createServer(options = {}) {
     }, async ({ key, value, namespace, password, ttlDays, tags, ownerToken, deliveryMode }) => {
         const body = { key, value };
         const effectiveNamespace = resolveNamespace(namespace);
-        const qsParams = [];
-        qsParams.push(`ns=${encodeURIComponent(effectiveNamespace)}`);
-        if (ttlDays !== undefined)
-            qsParams.push(`ttl=${encodeURIComponent(String(ttlDays))}`);
-        if (tags && tags.length) {
-            for (const t of tags)
-                qsParams.push(`tags=${encodeURIComponent(t)}`);
-        }
-        const qs = qsParams.length ? `?${qsParams.join("&")}` : "";
+        const path = withQuery(apiPath("kv"), [["ns", effectiveNamespace], ["ttl", ttlDays], ...(tags ?? []).map((t) => ["tags", t])]);
         const headers = {};
         if (password)
             headers["X-Password"] = password;
@@ -920,7 +906,7 @@ export function createServer(options = {}) {
             headers["X-Owner-Token"] = owner;
         if (deliveryMode)
             headers["X-Delivery-Mode"] = deliveryMode;
-        const { ok, status, data } = await apiRequest("POST", `/api/kv${qs}`, body, headers);
+        const { ok, status, data } = await apiRequest("POST", path, body, headers);
         if (!ok) {
             return {
                 content: [
@@ -956,7 +942,7 @@ export function createServer(options = {}) {
         const auth = ownerTokenFor(ownerToken);
         if (!auth.token)
             return textResult(NO_OWNER_TOKEN, true);
-        const path = `/api/kv/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}/${encodeURIComponent(key)}`;
+        const path = apiPath("kv", namespace, id, key);
         const { ok, status, data } = await apiRequest("PUT", path, body, {
             "X-Owner-Token": auth.token,
         });
@@ -987,7 +973,7 @@ export function createServer(options = {}) {
         const headers = {};
         if (password)
             headers["X-Password"] = password;
-        const path = `/api/kv/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}/${encodeURIComponent(key)}`;
+        const path = apiPath("kv", namespace, id, key);
         const { ok, status, data } = await apiRequest("GET", path, undefined, headers);
         if (!ok) {
             return {
@@ -1073,22 +1059,12 @@ export function createServer(options = {}) {
         const auth = ownerTokenFor(ownerToken);
         if (mine === true && !auth.token)
             return textResult(NO_OWNER_TOKEN, true);
-        const qsParams = [];
-        if (q !== undefined)
-            qsParams.push(`q=${encodeURIComponent(q)}`);
-        if (page !== undefined)
-            qsParams.push(`page=${encodeURIComponent(String(page))}`);
-        if (size !== undefined)
-            qsParams.push(`size=${encodeURIComponent(String(size))}`);
-        if (sort)
-            qsParams.push(`sort=${encodeURIComponent(sort)}`);
-        if (mine === true)
-            qsParams.push("mine=true");
-        const qs = qsParams.length ? `?${qsParams.join("&")}` : "";
+        const path = withQuery(apiPath("gallery"), [["q", q], ["page", page], ["size", size],
+            ["sort", sort || undefined], ["mine", mine === true ? "true" : undefined]]);
         const headers = {};
         if (mine === true && auth.token)
             headers["X-Owner-Token"] = auth.token;
-        const { ok, status, data } = await apiRequest("GET", `/api/gallery${qs}`, undefined, headers);
+        const { ok, status, data } = await apiRequest("GET", path, undefined, headers);
         if (!ok) {
             return {
                 content: [
@@ -1123,7 +1099,7 @@ export function createServer(options = {}) {
         const auth = ownerTokenFor(ownerToken);
         if (!auth.token)
             return textResult(NO_OWNER_TOKEN, true);
-        const path = `/api/${TYPE_SEGMENTS[type]}/${encodeURIComponent(namespace)}/${encodeURIComponent(id)}/visibility`;
+        const path = apiPath(TYPE_SEGMENTS[type], namespace, id, "visibility");
         const { ok, status, data } = await apiRequest("POST", path, { listed }, { "X-Owner-Token": auth.token });
         if (!ok)
             return ownerFailure("set visibility", status, data, auth.fromEnv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brewpage-mcp",
-  "version": "1.14.0",
+  "version": "1.14.2",
   "mcpName": "io.github.kochetkov-ma/brewpage-mcp",
   "description": "MCP server for BrewPage — publish and manage HTML, sites, KV, JSON and files from AI assistants",
   "type": "module",