crawlforge-mcp-server 5.5.6 → 5.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crawlforge-mcp-server",
-  "version": "5.5.6",
+  "version": "5.5.8",
   "mcpName": "io.github.mysleekdesigns/crawlforge-mcp-server",
   "description": "CrawlForge MCP Server - Professional Model Context Protocol server with 29 web scraping, crawling, deep-research, and autonomous-extraction tools. Returns clean Markdown and structured JSON for Claude, Cursor, and any MCP client. Defaults to local Ollama for LLM extraction (no API key needed); OpenAI/Anthropic available as opt-in. Includes a unified multi-format scrape tool, an autonomous agent, pre-built site templates, and Camoufox stealth browsing.",
   "main": "server.js",

package/server.js

@@ -105,7 +105,7 @@ const taskStore = createTaskStore({ logger });
 // Create the server
 const server = new McpServer({
   name: "crawlforge",
-  version: "5.5.6",
+  version: "5.5.8",
   description: "Production-ready MCP server with 29 web scraping, crawling, and content processing tools. Features MCP Resources (crawlforge://), Prompts, Sampling fallback, Elicitation, stealth browsing, deep research, structured extraction, embedded JavaScript state extraction, real Google SERP rank tracking, Reddit search via community archives, change tracking, local-LLM extraction via Ollama, unified multi-format scrape, and autonomous agent tool.",
   homepage: "https://www.crawlforge.dev",
   icon: "https://www.crawlforge.dev/icon.png",

package/src/tools/extract/processDocument.js

@@ -14,6 +14,7 @@ import { htmlToMarkdown } from '../../utils/htmlToMarkdown.js'; // D3.1
 import { safeFetch } from '../../utils/ssrfGuard.js';
 import { preflightFetch } from '../../utils/robotsGate.js';
 import { noteRetryAfter } from '../../utils/hostRateLimiter.js';
+import { isRemoteTransport } from '../../utils/remoteMode.js';
 
 const ProcessDocumentSchema = z.object({
   source: z.string().min(1),
@@ -148,6 +149,18 @@ export class ProcessDocumentTool {
       const validated = ProcessDocumentSchema.parse(params);
       const { source, sourceType, options, respect_robots, user_agent } = validated;
 
+      // `file` and `pdf_file` read a path straight off this machine's disk,
+      // which is the point of the tool when you are running it yourself. Served
+      // to a network, it is arbitrary file read on the host, so refuse it there
+      // rather than trusting whoever holds the key. Local use is unaffected.
+      if ((sourceType === 'file' || sourceType === 'pdf_file') && isRemoteTransport()) {
+        throw new Error(
+          `sourceType '${sourceType}' reads a local file and is only available when this server ` +
+            `runs on your own machine (stdio, or HTTP bound to loopback). Pass a URL with ` +
+            `sourceType 'url' or 'pdf_url' instead.`
+        );
+      }
+
       const result = {
         source,
         sourceType,

package/src/tools/tracking/trackChanges/notifier.js

@@ -5,6 +5,22 @@
  */
 
 import { identityHeaders } from '../../../utils/fetchIdentity.js';
+// Webhook and Slack targets are caller-supplied URLs, so they go out through the
+// same guard as every other outbound request. WebhookDispatcher already did this;
+// these two senders were the only ones left calling bare fetch.
+import { safeFetch } from '../../../utils/ssrfGuard.js';
+
+/**
+ * How long to wait on a notification endpoint before giving up.
+ *
+ * fetch/undici has no `timeout` RequestInit option, so without an explicit
+ * signal a webhook target that accepts the connection and then never answers
+ * holds the request open forever. These sends are awaited together in
+ * `sendNotifications`, so one unresponsive endpoint stalls every notification
+ * for that change, not just its own. `WebhookDispatcher` hit exactly this and
+ * documents it; 30s matches the default it settled on.
+ */
+const NOTIFY_TIMEOUT_MS = Number(process.env.TRACK_CHANGES_NOTIFY_TIMEOUT_MS) || 30000;
 
 /**
  * Send all enabled notifications for a detected change.
@@ -41,14 +57,15 @@ export async function sendWebhookNotification(url, changeResult, webhookConfig,
       details: webhookConfig.includeContent ? changeResult.details : undefined
     };
 
-    const response = await fetch(webhookConfig.url, {
+    const response = await safeFetch(webhookConfig.url, {
       method: webhookConfig.method || 'POST',
       headers: {
         'Content-Type': 'application/json',
         ...identityHeaders({ role: 'webhook' }),
         ...webhookConfig.headers
       },
-      body: JSON.stringify(payload)
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(NOTIFY_TIMEOUT_MS)
     });
 
     if (!response.ok) {
@@ -90,10 +107,11 @@ export async function sendSlackNotification(url, changeResult, slackConfig, emit
       username: slackConfig.username || 'Change Tracker'
     };
 
-    const response = await fetch(slackConfig.webhookUrl, {
+    const response = await safeFetch(slackConfig.webhookUrl, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(payload)
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(NOTIFY_TIMEOUT_MS)
     });
 
     if (!response.ok) {

package/src/utils/remoteMode.js

@@ -0,0 +1,25 @@
+/**
+ * Is this process serving a network that is not just the machine it runs on?
+ *
+ * The distinction matters for tools that touch the local filesystem. Over
+ * stdio, and over HTTP bound to loopback, the caller *is* the local user:
+ * reading a file they name is the feature, and no privilege boundary is
+ * crossed. Bound to a public interface it is a different act entirely — the
+ * caller is remote and the filesystem is the server's, so the same request
+ * reads files that were never theirs to read.
+ *
+ * The two expressions below are deliberately identical to the places that
+ * actually decide the transport and the bind address:
+ *   - `server.js` (`useHttp`), and
+ *   - `src/server/transports/streamableHttp.js` (`host` / `hostIsLoopback`).
+ * Keep them in step. Erring toward "remote" is the safe direction: it refuses
+ * a local-file read that would have been allowed, which is a visible,
+ * reversible inconvenience rather than a silent disclosure.
+ */
+export function isRemoteTransport() {
+  const useHttp = process.argv.includes('--http') || process.env.MCP_HTTP === 'true';
+  if (!useHttp) return false; // stdio — the caller is the local user
+
+  const host = process.env.MCP_HTTP_HOST ?? (process.env.RENDER ? '0.0.0.0' : '127.0.0.1');
+  return !(host === '127.0.0.1' || host === '::1' || host === 'localhost');
+}