davinci-resolve-mcp 2.211.0 → 2.212.1

package/CHANGELOG.md

@@ -2,6 +2,79 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.212.1 — the networked transport's generated bearer token no longer lands in server.log
+
+### Fixed
+
+- **A generated transport token was written to `logs/server.log` in cleartext (CWE-532).**
+  Starting `--transport sse` or `--transport streamable-http` without pinning
+  `$DAVINCI_MCP_TOKEN` logged the fresh token verbatim. The transport logger
+  has no handler of its own, so the record propagated to the root logger,
+  which `src/server.py` points at `logs/server.log` — opened with the default
+  file mode (0644 under the usual umask), appended to forever, and never
+  cleared. That copy was strictly less protected and strictly more durable
+  than the one the code deliberately locks down: the 0600 state file under
+  the per-user private directory, deleted in `run_networked`'s `finally`. The
+  token is the transport's only access control, and the control panel's
+  sibling token was already kept out of argv and logs against exactly this
+  local-user threat. The log line now names the state file's path instead of
+  the value, and a generated token is echoed only to an interactive stderr
+  (a redirected stderr is another file). The state file remains the
+  hand-back channel the control panel already reads. Reported privately by an
+  external security researcher, with a reproduction against the real
+  `run_networked` and the server's real root-logger configuration.
+
+### Documentation
+
+- `SECURITY.md` now states the rule outright: the pidfile and the transport
+  state file are the only on-disk copies of either token, and neither is
+  written to `logs/server.log`. The `mcp_transport` module docstring no longer
+  says the token is "logged at startup".
+
+### Validation
+
+- A regression test runs the real `run_networked` (uvicorn stubbed) with a
+  root `FileHandler` configured the way `src/server.py` configures it, and
+  asserts the token is absent from the file, the state-file path is present,
+  a redirected stderr never carries it, an interactive stderr carries it
+  exactly once, and a pinned token is echoed nowhere. Against the previous
+  code the test fails with the token found in the log — the reporter's
+  finding, reproduced.
+
+## What's New in v2.212.0 — graph risk follows the graph the call targets
+
+### Changed
+
+- **Every `graph` mutation now reports the blast radius of its `source`.**
+  The graph tool resolves `source` as `"timeline"` (the DEFAULT, the
+  timeline-level node graph), `"item"` (one clip), or
+  `"color_group_pre"`/`"color_group_post"` (a group's shared graph), and every
+  mutation lands on whichever graph that names. The classifier reported all
+  five graph actions as item-scoped regardless, so `reset_all_grades` on a
+  color-group graph — which wipes the grade of every clip in the group — read
+  as one item. The radius is now derived from the call: timeline, item, or
+  project for a color group, and the reasons name the target graph.
+
+- **`graph.set_lut` and `graph.apply_arri_cdl_lut` are HIGH on the timeline or a color-group graph, MEDIUM on one item.**
+  A plain `set_lut` call with no `source` restyles every clip on the timeline;
+  rating that MEDIUM under-stated it, while rating the item-scoped call HIGH
+  would over-block a one-clip LUT. Safe mode now blocks the broad cases
+  unless `allow_risky_operation=true`; the item case passes as before.
+  `reset_all_grades` and `apply_grade_from_drx` stay HIGH, `set_node_enabled`
+  stays LOW — only their reported scope changed.
+
+### Added
+
+- Tests: safe mode blocks broad LUT writes before the handler and allows
+  item-scoped ones; the classifier's LUT split; the radius of every graph
+  action across all five source values; and a medium-band matrix pinning
+  every remaining MEDIUM destructive action as recognised, destructive, not
+  confirmation-gated, and carrying its reviewed radius.
+
+- Adapted from PR #192 by @Rohitkanithi, which introduced the scope split
+  and its tests for the two LUT actions; landed with the radius generalised
+  to every graph action, since the same `source` governs them all.
+
 ## What's New in v2.211.0 — dry_run on an action that cannot honour it now refuses instead of executing
 
 ### Changed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.211.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.211.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.211.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.212.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/SECURITY.md

@@ -39,7 +39,11 @@ Their posture:
 - **Secrets on disk are private.** The panel's pidfile (token + pid + URL) and
   the transport's state file (token + URL) live under
   `~/.davinci-resolve-mcp/` (0700) and are written 0600 — never in a shared
-  temp directory or `~/Documents`.
+  temp directory or `~/Documents`. Those are the only on-disk copies: neither
+  token is ever written to `logs/server.log`, which the server appends to with
+  the default file mode and never clears. The transport logs the state file's
+  path, not the token, and echoes a generated token only to an interactive
+  stderr.
 
 If you find a route that can be reached without the token, or a way to satisfy
 the Host/Origin checks from a non-loopback page, that is a security bug — please

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.211.0"
+VERSION = "2.212.1"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.211.0",
+  "version": "2.212.1",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.211.0"
+VERSION = "2.212.1"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 353-tool granular server instead
 """
 
-VERSION = "2.211.0"
+VERSION = "2.212.1"
 
 import base64
 import os

package/src/utils/execution_lifecycle.py

@@ -287,13 +287,42 @@ class RiskClassificationHook(LifecycleHook):
         ("timeline_item_color", "smart_reframe"),
         ("timeline_item_color", "create_magic_mask"),
         ("timeline_item_color", "regenerate_magic_mask"),
-        ("graph", "set_lut"),
-        ("graph", "apply_arri_cdl_lut"),
         # Importing or switching the active comp changes what renders.
         ("timeline_item_fusion", "import_comp"),
         ("timeline_item_fusion", "load_comp"),
     }
 
+    #: Raw graph LUT writes. Their level follows the graph they target (see
+    #: `_graph_scope`): MEDIUM on one item, HIGH on the timeline graph (the
+    #: tool's DEFAULT) or a color-group graph, where one call restyles every
+    #: clip on the timeline or in the group. Adapted from PR #192.
+    _GRAPH_LUT_ACTIONS: Set[Tuple[str, str]] = {
+        ("graph", "set_lut"),
+        ("graph", "apply_arri_cdl_lut"),
+    }
+
+    @staticmethod
+    def _graph_scope(params: Dict[str, Any]) -> Tuple["BlastRadius", str]:
+        """Blast radius of a `graph` tool call, from its `source` param.
+
+        The graph tool resolves `source` as "timeline" (default) ->
+        Timeline.GetNodeGraph(), "item" -> TimelineItem.GetNodeGraph(), and
+        "color_group_pre"/"color_group_post" -> the group's pre/post clip
+        graph. Every graph mutation — LUT, DRX apply, reset, node toggle —
+        lands on whichever graph that names, so the scope is a property of
+        the call, not of the action, and a rating that says "item" for a
+        reset of a color-group graph is wrong by the size of the group.
+        """
+        source = str(params.get("source") or "timeline")
+        if source == "item":
+            return BlastRadius.ITEM, "one timeline item's graph"
+        if source in {"color_group_pre", "color_group_post"}:
+            return (
+                BlastRadius.PROJECT,
+                f"a color group's {source} graph (every clip in the group)",
+            )
+        return BlastRadius.TIMELINE, "the timeline node graph (every clip on the timeline)"
+
     _READ_ONLY_PREFIXES = ("get_", "list_", "query_", "probe_", "inspect_", "export_", "check_")
 
     @classmethod
@@ -319,14 +348,31 @@ class RiskClassificationHook(LifecycleHook):
             if params.get("ripple", False):
                 radius = BlastRadius.TIMELINE
                 reasons.append("Ripple mode alters downstream timeline synchronization")
+            elif tool_name == "graph":
+                radius, scope = cls._graph_scope(params)
+                reasons.append(f"Graph target: {scope}")
             else:
                 radius = BlastRadius.ITEM
             conf_required = True
             reasons.append(f"Destructive timeline edit: {action}")
+        elif pair in cls._GRAPH_LUT_ACTIONS:
+            destructive = True
+            radius, scope = cls._graph_scope(params)
+            if radius is BlastRadius.ITEM:
+                level = RiskLevel.MEDIUM
+                reasons.append(f"Raw graph LUT write '{action}' is scoped to {scope}")
+            else:
+                level = RiskLevel.HIGH
+                conf_required = True
+                reasons.append(f"Raw graph LUT write '{action}' targets {scope}")
         elif pair in cls._LOW_RISK_ACTIONS:
             level = RiskLevel.LOW
             destructive = True
-            radius = BlastRadius.ITEM
+            if tool_name == "graph":
+                radius, scope = cls._graph_scope(params)
+                reasons.append(f"Graph target: {scope}")
+            else:
+                radius = BlastRadius.ITEM
             reasons.append(f"Bounded reversible edit: {action}")
         elif pair in cls._MEDIUM_RISK_ACTIONS:
             level = RiskLevel.MEDIUM

package/src/utils/mcp_transport.py

@@ -3,9 +3,13 @@
 stdio remains the default. The `sse` and `streamable-http` modes bind to
 loopback (127.0.0.1) by default and REQUIRE a bearer token on every request, so
 turning networking on never silently exposes Resolve. The token comes from
-``$DAVINCI_MCP_TOKEN`` or is generated and logged at startup. A small state file
-(0600, under the per-user private state dir — never a shared tempdir) lets the
-control panel show the live connection URL + token.
+``$DAVINCI_MCP_TOKEN`` or is generated at startup. A small state file (0600,
+under the per-user private state dir — never a shared tempdir) lets the control
+panel show the live connection URL + token; that file is the only place a
+generated token is written. It is never logged: the server's root logger
+appends to ``logs/server.log`` with the default file mode and never truncates
+it, so a logged token would outlive the session in a file the state file's
+0600 was chosen to avoid. An interactive operator sees it once on stderr.
 
 Security posture:
 - Default host is loopback; a non-loopback bind logs a loud warning.
@@ -17,6 +21,7 @@ import json
 import logging
 import os
 import secrets
+import sys
 import time
 
 from src.utils.private_state import private_state_dir, write_private_json
@@ -102,6 +107,14 @@ def read_transport_state():
     return state
 
 
+def _stderr_is_interactive() -> bool:
+    """True only when stderr is a terminal a person is looking at."""
+    try:
+        return bool(sys.stderr and sys.stderr.isatty())
+    except (AttributeError, ValueError):
+        return False
+
+
 def run_networked(mcp, transport):
     """Serve `mcp` over an authenticated HTTP transport ('sse'|'streamable-http')."""
     import uvicorn
@@ -124,7 +137,20 @@ def run_networked(mcp, transport):
     logger.info("MCP %s transport: http://%s:%s (bearer token required)",
                 transport, host, port)
     if generated:
-        logger.info("Generated bearer token (set $DAVINCI_MCP_TOKEN to pin it): %s", token)
+        # The token is the transport's only access control. Log WHERE it is,
+        # never WHAT it is: this record propagates to the root logger, which
+        # src/server.py points at logs/server.log — default file mode, appended
+        # forever, no cleanup in our finally: — whereas the state file is 0600
+        # and cleared at shutdown. The console gets the value only when a person
+        # is watching it (a TTY); a redirected stderr is just another file.
+        logger.info(
+            "Generated a bearer token; it is recorded in %s (0600). "
+            "Set $DAVINCI_MCP_TOKEN to pin your own.",
+            TRANSPORT_STATE_PATH,
+        )
+        if _stderr_is_interactive():
+            print(f"davinci-resolve-mcp: bearer token for this session: {token}",
+                  file=sys.stderr, flush=True)
 
     write_transport_state(transport, host, port, token)
     try: