crawlforge-mcp-server 3.0.2 → 3.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crawlforge-mcp-server",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "CrawlForge MCP Server - Professional Model Context Protocol server with 19 comprehensive web scraping, crawling, and content processing tools.",
   "main": "server.js",
   "bin": {

package/server.js

@@ -1,5 +1,30 @@
 #!/usr/bin/env node
 
+// Secure Creator Mode Authentication - MUST run before any imports
+// Only the creator can enable unlimited access with their secret
+import crypto from 'crypto';
+import dotenv from 'dotenv';
+
+// Load .env file early to check for creator secret
+dotenv.config({ path: '.env', quiet: true });
+
+const CREATOR_SECRET_HASH = 'cfef62e5068d48e7dd6a39c9e16f0be2615510c6b68274fc8abe3156feb5050b';
+
+if (process.env.CRAWLFORGE_CREATOR_SECRET) {
+  const providedHash = crypto
+    .createHash('sha256')
+    .update(process.env.CRAWLFORGE_CREATOR_SECRET)
+    .digest('hex');
+
+  if (providedHash === CREATOR_SECRET_HASH) {
+    process.env.CRAWLFORGE_CREATOR_MODE = 'true';
+    console.log('🔓 Creator Mode Enabled - Unlimited Access');
+  } else {
+    console.warn('⚠️  Invalid creator secret provided');
+  }
+}
+
+// Now import everything else
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
@@ -28,11 +53,6 @@ import { config, validateConfig, isSearchConfigured, getToolConfig, getActiveSea
 // Authentication Manager
 import AuthManager from "./src/core/AuthManager.js";
 
-// Enable creator mode if BYPASS_API_KEY is set
-if (process.env.BYPASS_API_KEY === 'true') {
-  process.env.CRAWLFORGE_CREATOR_MODE = 'true';
-}
-
 // Initialize Authentication Manager
 await AuthManager.initialize();
 

package/src/core/AuthManager.js

@@ -16,14 +16,15 @@ class AuthManager {
     this.lastCreditCheck = null;
     this.CREDIT_CHECK_INTERVAL = 60000; // Check credits every minute max
     this.initialized = false;
-    this.creatorMode = process.env.CRAWLFORGE_CREATOR_MODE === 'true';
+    // NOTE: Don't read creator mode in constructor - it's set dynamically in server.js
   }
 
   /**
    * Check if running in creator mode (unlimited access, no API required)
+   * Reads from environment variable dynamically to ensure proper initialization order
    */
   isCreatorMode() {
-    return this.creatorMode;
+    return process.env.CRAWLFORGE_CREATOR_MODE === 'true';
   }
 
   /**