cf-memory-mcp 3.9.7 → 3.9.8

package/README.md

@@ -137,6 +137,12 @@ That deploys the active worker and applies the simplified D1 schema and required
 - [bin/cf-memory-mcp.js](/Users/johnlam/cf-memory-mcp/bin/cf-memory-mcp.js)
 - [bin/cf-memory-mcp-indexer.js](/Users/johnlam/cf-memory-mcp/bin/cf-memory-mcp-indexer.js)
 
+## Security
+
+The bridge (`bin/cf-memory-mcp.js`) reads local files for several tools — `get_file_content`, `refresh_files`, `find_stale_files`, `refresh_stale`, and the staleness annotation pass on `retrieve_context` results. Every one of those code paths confines file access to the resolved project root via `fs.realpathSync` + relative-path check, so absolute paths, `..` traversal, and in-root symlinks pointing outside are all rejected before any read. Locked in by the test suite under `tests/bridge.test.ts`.
+
+If you find a path that escapes the project root despite this, please open an issue with a reproduction.
+
 ## Notes
 
 - The simplified worker is the active product path.

package/bin/cf-memory-mcp.js

@@ -1168,7 +1168,24 @@ class CFMemoryMCP {
     }
 
     async handleIndexProject(message) {
-        const { project_path, project_name, include_patterns, exclude_patterns, force_reindex } = message.params.arguments;
+        const args = message.params?.arguments || {};
+        const { project_path, project_name, include_patterns, exclude_patterns, force_reindex } = args;
+
+        // Boundary validation: bad inputs were producing unhelpful Node errors
+        // ("path must be string"). Return a clean MCP error with the hint
+        // instead so the model can self-correct.
+        if (typeof project_path !== 'string' || !project_path.trim()) {
+            process.stdout.write(JSON.stringify({
+                jsonrpc: '2.0',
+                id: message.id,
+                result: { content: [{ type: 'text', text: JSON.stringify({
+                    error: 'project_path is required',
+                    hint: 'Pass project_path as an absolute or relative filesystem path to the project root (e.g., "/Users/me/code/myrepo" or ".").',
+                }, null, 2) }] },
+            }) + '\n');
+            return;
+        }
+
         const resolvedPath = path.resolve(project_path);
         const name = project_name || path.basename(resolvedPath);
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cf-memory-mcp",
-	"version": "3.9.7",
+	"version": "3.9.8",
 	"description": "Cloudflare-hosted MCP server for code indexing, retrieval, and assistant memory with a direct remote MCP endpoint and local stdio bridge.",
 	"main": "bin/cf-memory-mcp.js",
 	"bin": {