data-compliance-mcp 1.0.19 → 1.0.20

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## [1.0.20] - 2026-06-17
+- fix: Stripe webhook now validates payment_link ID — ignores events not belonging to this server
+
 ## [1.0.19] - 2026-06-16
 - feat: ATO optimisation — purpose verb, usage context, required fields, ToolRank badge
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "data-compliance-mcp",
   "mcpName": "io.github.OjasKord/data-compliance-mcp",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "description": "Data safety classifier for AI agents. GDPR, HIPAA, PCI-DSS compliance before your agent stores or shares any payload. SAFE/ESCALATE verdict in one call.",
   "main": "src/server.js",
   "scripts": {

package/server.json

@@ -1,25 +1,42 @@
-{
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.OjasKord/data-compliance-mcp",
-  "title": "Data Compliance Classifier MCP",
-  "description": "Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.",
-  "version": "1.0.6",
-  "websiteUrl": "https://kordagencies.com",
-  "repository": {
-    "url": "https://github.com/OjasKord/data-compliance-mcp",
-    "source": "github"
-  },
-  "packages": [
-    {
-      "registryType": "npm",
-      "identifier": "data-compliance-mcp",
-      "version": "1.0.6",
-      "transport": { "type": "stdio" },
-      "environmentVariables": [
-        { "name": "ANTHROPIC_API_KEY", "description": "Anthropic API key for AI classification", "isRequired": true, "isSecret": true },
-        { "name": "ABUSEIPDB_API_KEY", "description": "AbuseIPDB API key for threat intelligence (optional)", "isRequired": false, "isSecret": true }
-      ]
-    }
-  ],
-  "remotes": [{ "type": "streamable-http", "url": "https://data-compliance-mcp-production.up.railway.app" }]
-}
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.OjasKord/data-compliance-mcp",
+  "title": "Data Compliance Classifier MCP",
+  "description": "Classify data safety before storing or sharing. GDPR, HIPAA, PCI-DSS, CCPA. AI-powered.",
+  "version": "1.0.19",
+  "websiteUrl": "https://kordagencies.com",
+  "repository": {
+    "url": "https://github.com/OjasKord/data-compliance-mcp",
+    "source": "github"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "data-compliance-mcp",
+      "version": "1.0.19",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "ANTHROPIC_API_KEY",
+          "description": "Anthropic API key for AI classification",
+          "isRequired": true,
+          "isSecret": true
+        },
+        {
+          "name": "ABUSEIPDB_API_KEY",
+          "description": "AbuseIPDB API key for threat intelligence (optional)",
+          "isRequired": false,
+          "isSecret": true
+        }
+      ]
+    }
+  ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://data-compliance-mcp-production.up.railway.app"
+    }
+  ]
+}

package/src/server.js

@@ -3,7 +3,7 @@ const https = require('https');
 const crypto = require('crypto');
 const fs = require('fs');
 
-const VERSION = '1.0.19';
+const VERSION = '1.0.20';
 const PERSIST_FILE = '/tmp/datacompliance_stats.json';
 const API_KEYS_FILE = '/tmp/datacompliance_apikeys.json';
 const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY || '';
@@ -41,6 +41,7 @@ function checkPerMinuteLimit(ip, toolName, limit) {
 const STRIPE_PRO_URL = 'https://buy.stripe.com/cNidR87s9dXD0pue7Sebu0r';
 const ENTERPRISE_UPGRADE_URL = 'https://buy.stripe.com/9B6bJ0aElbPv7RW9RCebu0s';
 const STRIPE_ENTERPRISE_URL = 'https://buy.stripe.com/cNi7sKeUB8Dj7RW7Juebu0d';
+const ALLOWED_PAYMENT_LINK_IDS = ['plink_1TQzEjD6WvRe6sn35lz6hsVZ', 'plink_1TQzGlD6WvRe6sn3o85eJaLV', 'plink_1TObMjD6WvRe6sn3jOhhQVLR'];
 
 const REDIS_PREFIX = 'dcc';
 const FREE_TIER_REDIS_KEY = 'dcc:free_tier_usage';
@@ -920,6 +921,11 @@ async function handleStripeWebhook(body, sig) {
     const event = JSON.parse(body);
     if (event.type === 'checkout.session.completed') {
       const session = event.data.object;
+      const paymentLinkId = session.payment_link;
+      if (paymentLinkId && !ALLOWED_PAYMENT_LINK_IDS.includes(paymentLinkId)) {
+        console.log('[data-compliance] Webhook received but payment link ' + paymentLinkId + ' not for this server — ignoring.');
+        return { received: true, ignored: true };
+      }
       const email = session.customer_email || session.customer_details?.email;
       const plan = getPlanFromProduct(session.metadata?.product_name || '');
       if (email) {