crawlforge-mcp-server 5.5.5 → 5.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crawlforge-mcp-server",
-  "version": "5.5.5",
+  "version": "5.5.6",
   "mcpName": "io.github.mysleekdesigns/crawlforge-mcp-server",
   "description": "CrawlForge MCP Server - Professional Model Context Protocol server with 29 web scraping, crawling, deep-research, and autonomous-extraction tools. Returns clean Markdown and structured JSON for Claude, Cursor, and any MCP client. Defaults to local Ollama for LLM extraction (no API key needed); OpenAI/Anthropic available as opt-in. Includes a unified multi-format scrape tool, an autonomous agent, pre-built site templates, and Camoufox stealth browsing.",
   "main": "server.js",
@@ -114,7 +114,7 @@
     "cheerio": "^1.1.2",
     "commander": "^14.0.3",
     "compromise": "^14.14.4",
-    "crawlforge-extractors": "^1.5.2",
+    "crawlforge-extractors": "^1.5.3",
     "diff": "^9.0.0",
     "dotenv": "^17.2.1",
     "franc": "^6.2.0",

package/server.js

@@ -105,7 +105,7 @@ const taskStore = createTaskStore({ logger });
 // Create the server
 const server = new McpServer({
   name: "crawlforge",
-  version: "5.5.5",
+  version: "5.5.6",
   description: "Production-ready MCP server with 29 web scraping, crawling, and content processing tools. Features MCP Resources (crawlforge://), Prompts, Sampling fallback, Elicitation, stealth browsing, deep research, structured extraction, embedded JavaScript state extraction, real Google SERP rank tracking, Reddit search via community archives, change tracking, local-LLM extraction via Ollama, unified multi-format scrape, and autonomous agent tool.",
   homepage: "https://www.crawlforge.dev",
   icon: "https://www.crawlforge.dev/icon.png",

package/setup.js

@@ -68,8 +68,11 @@ function addToMcpConfig(configPath, clientName, apiKey) {
       }
     };
 
-    // Write updated config
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+    // Write updated config. This file now embeds the API key, so keep it
+    // owner-only (0o600). The `mode` option only applies when writeFileSync
+    // creates the file, so chmod enforces it for a pre-existing config too.
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
 
     return {
       success: true,
@@ -107,7 +110,7 @@ function configureMcpClients(apiKey) {
     if (!fs.existsSync(cursorConfigPath)) {
       // Create mcp.json if it doesn't exist
       try {
-        fs.writeFileSync(cursorConfigPath, JSON.stringify({ mcpServers: {} }, null, 2));
+        fs.writeFileSync(cursorConfigPath, JSON.stringify({ mcpServers: {} }, null, 2), { mode: 0o600 });
       } catch (e) {
         // Ignore creation errors
       }

package/src/core/creatorMode.js

@@ -10,8 +10,21 @@
 import crypto from 'crypto';
 import dotenv from 'dotenv';
 
-// Load .env file early to check for creator secret
-dotenv.config({ path: '.env', quiet: true });
+// Load the cwd .env early to check for the creator secret, but into an isolated
+// object rather than straight into process.env. A .env sitting in whatever
+// directory the server is launched from is untrusted; seeding process.env from
+// it directly would let it silently flip the SSRF controls (this module is
+// imported before config.js runs its package-relative .env load). We copy the
+// benign keys through — preserving the historical "cwd .env is read" behavior,
+// including the creator secret — but never the SSRF/allowlist controls, which
+// must come from the real environment.
+const CWD_ENV_DENYLIST = new Set(['SSRF_PROTECTION_ENABLED', 'SSRF_STRICT', 'ALLOWED_DOMAINS']);
+const cwdEnv = {};
+dotenv.config({ path: '.env', quiet: true, processEnv: cwdEnv });
+for (const [key, value] of Object.entries(cwdEnv)) {
+  if (CWD_ENV_DENYLIST.has(key)) continue;
+  if (process.env[key] === undefined) process.env[key] = value; // don't override the real env
+}
 
 // SECURITY: Clear any externally-set creator mode env var to prevent bypass
 delete process.env.CRAWLFORGE_CREATOR_MODE;

package/src/server/transports/streamableHttp.js

@@ -151,7 +151,14 @@ function sendRpcError(res, status, code, message) {
  */
 export async function connectStreamableHttp(server, authManager, logger, options = {}) {
   const port = options.port ?? 3000;
-  const host = options.host ?? '0.0.0.0';
+  // Bind loopback by default so a local `--http` server is not exposed to the
+  // LAN. Managed hosts need 0.0.0.0 to be reachable by their router: Render sets
+  // $RENDER; $MCP_HTTP_HOST is an explicit override for any other platform.
+  const host = options.host ?? process.env.MCP_HTTP_HOST ?? (process.env.RENDER ? '0.0.0.0' : '127.0.0.1');
+  const hostIsLoopback = host === '127.0.0.1' || host === '::1' || host === 'localhost';
+  if (authManager.isCreatorMode() && !hostIsLoopback) {
+    console.error(`WARNING: creator mode is enabled but the server is bound to ${host} (non-loopback) — per-request auth will NOT be bypassed. Bind to 127.0.0.1 to use creator mode.`);
+  }
   const legacy = options.legacy === true;
   const oauthProvider = options.oauth ?? null;
   const metrics = options.metrics ?? null;
@@ -242,12 +249,14 @@ export async function connectStreamableHttp(server, authManager, logger, options
 
     // MCP endpoint
     if (req.url === '/mcp' || req.url === '/' || req.url?.startsWith('/mcp?')) {
-      // Per-request auth (bypassed in creator mode). `internal` marks a
-      // request from the website's REST proxy (INTERNAL_PROXY_SECRET): it is
-      // billing-exempt in withAuth because the website already charged the
-      // end user. Request-scoped only — never persisted on the session.
+      // Per-request auth. Creator mode bypasses it, but only on a loopback bind
+      // — never expose an unauthenticated MCP endpoint on a public interface.
+      // `internal` marks a request from the website's REST proxy
+      // (INTERNAL_PROXY_SECRET): it is billing-exempt in withAuth because the
+      // website already charged the end user. Request-scoped only — never
+      // persisted on the session.
       let internal = false;
-      if (!authManager.isCreatorMode()) {
+      if (!(authManager.isCreatorMode() && hostIsLoopback)) {
         const authResult = await authenticateRequest(req, authManager, oauthProvider);
         if (!authResult.ok) {
           logger.warn('Streamable HTTP request rejected', {