brightspace-mcp-server 5.0.9 → 5.0.11

package/build/index.js

@@ -30,6 +30,20 @@ const PKG_VERSION = (() => {
 })();
 // ── Subcommand routing (before any MCP initialization) ──────────────
 const subcommand = process.argv[2];
+const COMMANDS = ['setup', 'auth', 'doctor', 'http'];
+// A mistyped command (`htp`) must not quietly start a stdio server that sits
+// waiting on stdin. Flags alone still mean the default stdio server.
+if (subcommand !== undefined && !subcommand.startsWith('-') && !COMMANDS.includes(subcommand)) {
+    process.stderr.write(`Unknown command: ${subcommand}\n\n` +
+        'Usage: brightspace-mcp-server [command]\n\n' +
+        'Commands:\n' +
+        '  (none)   run the MCP server on stdio (what MCP clients launch)\n' +
+        '  http     run one shared MCP server on localhost\n' +
+        '  setup    configure your school and sign-in\n' +
+        '  auth     sign in to Brightspace now\n' +
+        '  doctor   check the install and configuration\n');
+    process.exit(2);
+}
 if (subcommand === 'setup') {
     await import('./setup.js');
 }

package/build/utils/mcp-client-cli.js

@@ -51,15 +51,21 @@ function isSharedServerUrl(url) {
 export function classifyRegistration(entry, platform = process.platform) {
     if (entry === undefined)
         return { state: "missing" };
-    if (entry === null || typeof entry !== "object") {
-        return { state: "different", current: "(an entry setup could not read)" };
-    }
+    const unreadable = { state: "different", current: "(an entry setup could not read)" };
+    if (entry === null || typeof entry !== "object")
+        return unreadable;
     const { command, args, url } = entry;
     if (typeof command !== "string" && typeof url === "string") {
-        return isSharedServerUrl(url) ? { state: "shared_http", url } : { state: "different", current: url };
+        // Shown without user-info, query or fragment: a token in the URL must not
+        // reach the setup message or the prepare JSON (#295).
+        const shown = displayUrl(url);
+        if (shown === null)
+            return unreadable;
+        return isSharedServerUrl(url) ? { state: "shared_http", url: shown } : { state: "different", current: shown };
     }
     if (typeof command !== "string") {
-        return { state: "different", current: JSON.stringify(entry) };
+        const transport = describeTransport(entry);
+        return transport === null ? unreadable : { state: "different", current: transport };
     }
     const argv = [command, ...(Array.isArray(args) ? args.map(String) : [])];
     const expected = serverCommand(platform);
@@ -68,6 +74,35 @@ export function classifyRegistration(entry, platform = process.platform) {
     }
     return { state: "different", current: argv.join(" ") };
 }
+/**
+ * A URL with its user-info, query and fragment removed, which is where a
+ * token in a URL rides. Null when it doesn't parse.
+ */
+function displayUrl(url) {
+    if (!URL.canParse(url))
+        return null;
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.href;
+}
+/**
+ * A commandless entry with no string `url` (Windsurf's `serverUrl`, Gemini's
+ * `httpUrl`), reduced to its transport label and its cleaned URL. Everything
+ * else (headers, env, credential helpers, unknown fields) can carry secrets,
+ * so it never prints.
+ */
+function describeTransport(entry) {
+    const { type, serverUrl, httpUrl } = entry;
+    const raw = typeof serverUrl === "string" ? serverUrl : typeof httpUrl === "string" ? httpUrl : null;
+    const shown = raw === null ? null : displayUrl(raw);
+    if (shown === null)
+        return null;
+    const label = typeof type === "string" && /^[\w-]+$/.test(type) ? { type } : {};
+    return JSON.stringify({ ...label, url: shown });
+}
 function readJsonFile(filePath) {
     try {
         return JSON.parse(fs.readFileSync(filePath, "utf-8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.0.9",
+  "version": "5.0.11",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",