crawlforge-mcp-server 5.5.5 → 5.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crawlforge-mcp-server",
-  "version": "5.5.5",
+  "version": "5.5.7",
   "mcpName": "io.github.mysleekdesigns/crawlforge-mcp-server",
   "description": "CrawlForge MCP Server - Professional Model Context Protocol server with 29 web scraping, crawling, deep-research, and autonomous-extraction tools. Returns clean Markdown and structured JSON for Claude, Cursor, and any MCP client. Defaults to local Ollama for LLM extraction (no API key needed); OpenAI/Anthropic available as opt-in. Includes a unified multi-format scrape tool, an autonomous agent, pre-built site templates, and Camoufox stealth browsing.",
   "main": "server.js",
@@ -114,7 +114,7 @@
     "cheerio": "^1.1.2",
     "commander": "^14.0.3",
     "compromise": "^14.14.4",
-    "crawlforge-extractors": "^1.5.2",
+    "crawlforge-extractors": "^1.5.3",
     "diff": "^9.0.0",
     "dotenv": "^17.2.1",
     "franc": "^6.2.0",

package/server.js

@@ -105,7 +105,7 @@ const taskStore = createTaskStore({ logger });
 // Create the server
 const server = new McpServer({
   name: "crawlforge",
-  version: "5.5.5",
+  version: "5.5.7",
   description: "Production-ready MCP server with 29 web scraping, crawling, and content processing tools. Features MCP Resources (crawlforge://), Prompts, Sampling fallback, Elicitation, stealth browsing, deep research, structured extraction, embedded JavaScript state extraction, real Google SERP rank tracking, Reddit search via community archives, change tracking, local-LLM extraction via Ollama, unified multi-format scrape, and autonomous agent tool.",
   homepage: "https://www.crawlforge.dev",
   icon: "https://www.crawlforge.dev/icon.png",

package/setup.js

@@ -68,8 +68,11 @@ function addToMcpConfig(configPath, clientName, apiKey) {
       }
     };
 
-    // Write updated config
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+    // Write updated config. This file now embeds the API key, so keep it
+    // owner-only (0o600). The `mode` option only applies when writeFileSync
+    // creates the file, so chmod enforces it for a pre-existing config too.
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
 
     return {
       success: true,
@@ -107,7 +110,7 @@ function configureMcpClients(apiKey) {
     if (!fs.existsSync(cursorConfigPath)) {
       // Create mcp.json if it doesn't exist
       try {
-        fs.writeFileSync(cursorConfigPath, JSON.stringify({ mcpServers: {} }, null, 2));
+        fs.writeFileSync(cursorConfigPath, JSON.stringify({ mcpServers: {} }, null, 2), { mode: 0o600 });
       } catch (e) {
         // Ignore creation errors
       }

package/src/core/creatorMode.js

@@ -10,8 +10,21 @@
 import crypto from 'crypto';
 import dotenv from 'dotenv';
 
-// Load .env file early to check for creator secret
-dotenv.config({ path: '.env', quiet: true });
+// Load the cwd .env early to check for the creator secret, but into an isolated
+// object rather than straight into process.env. A .env sitting in whatever
+// directory the server is launched from is untrusted; seeding process.env from
+// it directly would let it silently flip the SSRF controls (this module is
+// imported before config.js runs its package-relative .env load). We copy the
+// benign keys through — preserving the historical "cwd .env is read" behavior,
+// including the creator secret — but never the SSRF/allowlist controls, which
+// must come from the real environment.
+const CWD_ENV_DENYLIST = new Set(['SSRF_PROTECTION_ENABLED', 'SSRF_STRICT', 'ALLOWED_DOMAINS']);
+const cwdEnv = {};
+dotenv.config({ path: '.env', quiet: true, processEnv: cwdEnv });
+for (const [key, value] of Object.entries(cwdEnv)) {
+  if (CWD_ENV_DENYLIST.has(key)) continue;
+  if (process.env[key] === undefined) process.env[key] = value; // don't override the real env
+}
 
 // SECURITY: Clear any externally-set creator mode env var to prevent bypass
 delete process.env.CRAWLFORGE_CREATOR_MODE;

package/src/server/transports/streamableHttp.js

@@ -151,7 +151,14 @@ function sendRpcError(res, status, code, message) {
  */
 export async function connectStreamableHttp(server, authManager, logger, options = {}) {
   const port = options.port ?? 3000;
-  const host = options.host ?? '0.0.0.0';
+  // Bind loopback by default so a local `--http` server is not exposed to the
+  // LAN. Managed hosts need 0.0.0.0 to be reachable by their router: Render sets
+  // $RENDER; $MCP_HTTP_HOST is an explicit override for any other platform.
+  const host = options.host ?? process.env.MCP_HTTP_HOST ?? (process.env.RENDER ? '0.0.0.0' : '127.0.0.1');
+  const hostIsLoopback = host === '127.0.0.1' || host === '::1' || host === 'localhost';
+  if (authManager.isCreatorMode() && !hostIsLoopback) {
+    console.error(`WARNING: creator mode is enabled but the server is bound to ${host} (non-loopback) — per-request auth will NOT be bypassed. Bind to 127.0.0.1 to use creator mode.`);
+  }
   const legacy = options.legacy === true;
   const oauthProvider = options.oauth ?? null;
   const metrics = options.metrics ?? null;
@@ -242,12 +249,14 @@ export async function connectStreamableHttp(server, authManager, logger, options
 
     // MCP endpoint
     if (req.url === '/mcp' || req.url === '/' || req.url?.startsWith('/mcp?')) {
-      // Per-request auth (bypassed in creator mode). `internal` marks a
-      // request from the website's REST proxy (INTERNAL_PROXY_SECRET): it is
-      // billing-exempt in withAuth because the website already charged the
-      // end user. Request-scoped only — never persisted on the session.
+      // Per-request auth. Creator mode bypasses it, but only on a loopback bind
+      // — never expose an unauthenticated MCP endpoint on a public interface.
+      // `internal` marks a request from the website's REST proxy
+      // (INTERNAL_PROXY_SECRET): it is billing-exempt in withAuth because the
+      // website already charged the end user. Request-scoped only — never
+      // persisted on the session.
       let internal = false;
-      if (!authManager.isCreatorMode()) {
+      if (!(authManager.isCreatorMode() && hostIsLoopback)) {
         const authResult = await authenticateRequest(req, authManager, oauthProvider);
         if (!authResult.ok) {
           logger.warn('Streamable HTTP request rejected', {

package/src/tools/extract/processDocument.js

@@ -14,6 +14,7 @@ import { htmlToMarkdown } from '../../utils/htmlToMarkdown.js'; // D3.1
 import { safeFetch } from '../../utils/ssrfGuard.js';
 import { preflightFetch } from '../../utils/robotsGate.js';
 import { noteRetryAfter } from '../../utils/hostRateLimiter.js';
+import { isRemoteTransport } from '../../utils/remoteMode.js';
 
 const ProcessDocumentSchema = z.object({
   source: z.string().min(1),
@@ -148,6 +149,18 @@ export class ProcessDocumentTool {
       const validated = ProcessDocumentSchema.parse(params);
       const { source, sourceType, options, respect_robots, user_agent } = validated;
 
+      // `file` and `pdf_file` read a path straight off this machine's disk,
+      // which is the point of the tool when you are running it yourself. Served
+      // to a network, it is arbitrary file read on the host, so refuse it there
+      // rather than trusting whoever holds the key. Local use is unaffected.
+      if ((sourceType === 'file' || sourceType === 'pdf_file') && isRemoteTransport()) {
+        throw new Error(
+          `sourceType '${sourceType}' reads a local file and is only available when this server ` +
+            `runs on your own machine (stdio, or HTTP bound to loopback). Pass a URL with ` +
+            `sourceType 'url' or 'pdf_url' instead.`
+        );
+      }
+
       const result = {
         source,
         sourceType,

package/src/tools/tracking/trackChanges/notifier.js

@@ -5,6 +5,10 @@
  */
 
 import { identityHeaders } from '../../../utils/fetchIdentity.js';
+// Webhook and Slack targets are caller-supplied URLs, so they go out through the
+// same guard as every other outbound request. WebhookDispatcher already did this;
+// these two senders were the only ones left calling bare fetch.
+import { safeFetch } from '../../../utils/ssrfGuard.js';
 
 /**
  * Send all enabled notifications for a detected change.
@@ -41,7 +45,7 @@ export async function sendWebhookNotification(url, changeResult, webhookConfig,
       details: webhookConfig.includeContent ? changeResult.details : undefined
     };
 
-    const response = await fetch(webhookConfig.url, {
+    const response = await safeFetch(webhookConfig.url, {
       method: webhookConfig.method || 'POST',
       headers: {
         'Content-Type': 'application/json',
@@ -90,7 +94,7 @@ export async function sendSlackNotification(url, changeResult, slackConfig, emit
       username: slackConfig.username || 'Change Tracker'
     };
 
-    const response = await fetch(slackConfig.webhookUrl, {
+    const response = await safeFetch(slackConfig.webhookUrl, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(payload)

package/src/utils/remoteMode.js

@@ -0,0 +1,25 @@
+/**
+ * Is this process serving a network that is not just the machine it runs on?
+ *
+ * The distinction matters for tools that touch the local filesystem. Over
+ * stdio, and over HTTP bound to loopback, the caller *is* the local user:
+ * reading a file they name is the feature, and no privilege boundary is
+ * crossed. Bound to a public interface it is a different act entirely — the
+ * caller is remote and the filesystem is the server's, so the same request
+ * reads files that were never theirs to read.
+ *
+ * The two expressions below are deliberately identical to the places that
+ * actually decide the transport and the bind address:
+ *   - `server.js` (`useHttp`), and
+ *   - `src/server/transports/streamableHttp.js` (`host` / `hostIsLoopback`).
+ * Keep them in step. Erring toward "remote" is the safe direction: it refuses
+ * a local-file read that would have been allowed, which is a visible,
+ * reversible inconvenience rather than a silent disclosure.
+ */
+export function isRemoteTransport() {
+  const useHttp = process.argv.includes('--http') || process.env.MCP_HTTP === 'true';
+  if (!useHttp) return false; // stdio — the caller is the local user
+
+  const host = process.env.MCP_HTTP_HOST ?? (process.env.RENDER ? '0.0.0.0' : '127.0.0.1');
+  return !(host === '127.0.0.1' || host === '::1' || host === 'localhost');
+}