davinci-resolve-mcp 2.212.0 → 2.212.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +39 -0
- package/README.md +1 -1
- package/README.zh-CN.md +2 -2
- package/SECURITY.md +5 -1
- package/install.py +1 -1
- package/package.json +1 -1
- package/src/granular/common.py +1 -1
- package/src/server.py +1 -1
- package/src/utils/mcp_transport.py +30 -4
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,45 @@
|
|
|
2
2
|
|
|
3
3
|
Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
|
|
4
4
|
|
|
5
|
+
## What's New in v2.212.1 — the networked transport's generated bearer token no longer lands in server.log
|
|
6
|
+
|
|
7
|
+
### Fixed
|
|
8
|
+
|
|
9
|
+
- **A generated transport token was written to `logs/server.log` in cleartext (CWE-532).**
|
|
10
|
+
Starting `--transport sse` or `--transport streamable-http` without pinning
|
|
11
|
+
`$DAVINCI_MCP_TOKEN` logged the fresh token verbatim. The transport logger
|
|
12
|
+
has no handler of its own, so the record propagated to the root logger,
|
|
13
|
+
which `src/server.py` points at `logs/server.log` — opened with the default
|
|
14
|
+
file mode (0644 under the usual umask), appended to forever, and never
|
|
15
|
+
cleared. That copy was strictly less protected and strictly more durable
|
|
16
|
+
than the one the code deliberately locks down: the 0600 state file under
|
|
17
|
+
the per-user private directory, deleted in `run_networked`'s `finally`. The
|
|
18
|
+
token is the transport's only access control, and the control panel's
|
|
19
|
+
sibling token was already kept out of argv and logs against exactly this
|
|
20
|
+
local-user threat. The log line now names the state file's path instead of
|
|
21
|
+
the value, and a generated token is echoed only to an interactive stderr
|
|
22
|
+
(a redirected stderr is another file). The state file remains the
|
|
23
|
+
hand-back channel the control panel already reads. Reported privately by an
|
|
24
|
+
external security researcher, with a reproduction against the real
|
|
25
|
+
`run_networked` and the server's real root-logger configuration.
|
|
26
|
+
|
|
27
|
+
### Documentation
|
|
28
|
+
|
|
29
|
+
- `SECURITY.md` now states the rule outright: the pidfile and the transport
|
|
30
|
+
state file are the only on-disk copies of either token, and neither is
|
|
31
|
+
written to `logs/server.log`. The `mcp_transport` module docstring no longer
|
|
32
|
+
says the token is "logged at startup".
|
|
33
|
+
|
|
34
|
+
### Validation
|
|
35
|
+
|
|
36
|
+
- A regression test runs the real `run_networked` (uvicorn stubbed) with a
|
|
37
|
+
root `FileHandler` configured the way `src/server.py` configures it, and
|
|
38
|
+
asserts the token is absent from the file, the state-file path is present,
|
|
39
|
+
a redirected stderr never carries it, an interactive stderr carries it
|
|
40
|
+
exactly once, and a pinned token is echoed nowhere. Against the previous
|
|
41
|
+
code the test fails with the token found in the log — the reporter's
|
|
42
|
+
finding, reproduced.
|
|
43
|
+
|
|
5
44
|
## What's New in v2.212.0 — graph risk follows the graph the call targets
|
|
6
45
|
|
|
7
46
|
### Changed
|
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
English | [简体中文](README.zh-CN.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
|
|
6
6
|
[](https://www.npmjs.com/package/davinci-resolve-mcp)
|
|
7
7
|
[](docs/reference/api-coverage.md)
|
|
8
8
|
[-blue.svg)](#server-modes)
|
package/README.zh-CN.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | 简体中文
|
|
4
4
|
|
|
5
|
-
[](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
|
|
6
6
|
[](https://www.npmjs.com/package/davinci-resolve-mcp)
|
|
7
7
|
[](docs/reference/api-coverage.md)
|
|
8
8
|
[-blue.svg)](#服务器模式)
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
[](https://www.python.org/downloads/)
|
|
13
13
|
[](https://opensource.org/licenses/MIT)
|
|
14
14
|
|
|
15
|
-
> 本翻译对应 v2.212.
|
|
15
|
+
> 本翻译对应 v2.212.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
|
|
16
16
|
|
|
17
17
|
一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
|
|
18
18
|
|
package/SECURITY.md
CHANGED
|
@@ -39,7 +39,11 @@ Their posture:
|
|
|
39
39
|
- **Secrets on disk are private.** The panel's pidfile (token + pid + URL) and
|
|
40
40
|
the transport's state file (token + URL) live under
|
|
41
41
|
`~/.davinci-resolve-mcp/` (0700) and are written 0600 — never in a shared
|
|
42
|
-
temp directory or `~/Documents`.
|
|
42
|
+
temp directory or `~/Documents`. Those are the only on-disk copies: neither
|
|
43
|
+
token is ever written to `logs/server.log`, which the server appends to with
|
|
44
|
+
the default file mode and never clears. The transport logs the state file's
|
|
45
|
+
path, not the token, and echoes a generated token only to an interactive
|
|
46
|
+
stderr.
|
|
43
47
|
|
|
44
48
|
If you find a route that can be reached without the token, or a way to satisfy
|
|
45
49
|
the Host/Origin checks from a non-loopback page, that is a security bug — please
|
package/install.py
CHANGED
|
@@ -37,7 +37,7 @@ from src.utils.update_check import (
|
|
|
37
37
|
|
|
38
38
|
# ─── Version ──────────────────────────────────────────────────────────────────
|
|
39
39
|
|
|
40
|
-
VERSION = "2.212.
|
|
40
|
+
VERSION = "2.212.1"
|
|
41
41
|
# Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
|
|
42
42
|
# Resolve's scripting bridge loads into newer interpreters on recent builds
|
|
43
43
|
# (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds
|
package/package.json
CHANGED
package/src/granular/common.py
CHANGED
|
@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
|
|
|
87
87
|
handlers=[logging.StreamHandler()],
|
|
88
88
|
)
|
|
89
89
|
|
|
90
|
-
VERSION = "2.212.
|
|
90
|
+
VERSION = "2.212.1"
|
|
91
91
|
logger = logging.getLogger("davinci-resolve-mcp")
|
|
92
92
|
logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
|
|
93
93
|
logger.info(f"Detected platform: {get_platform()}")
|
package/src/server.py
CHANGED
|
@@ -3,9 +3,13 @@
|
|
|
3
3
|
stdio remains the default. The `sse` and `streamable-http` modes bind to
|
|
4
4
|
loopback (127.0.0.1) by default and REQUIRE a bearer token on every request, so
|
|
5
5
|
turning networking on never silently exposes Resolve. The token comes from
|
|
6
|
-
``$DAVINCI_MCP_TOKEN`` or is generated
|
|
7
|
-
|
|
8
|
-
|
|
6
|
+
``$DAVINCI_MCP_TOKEN`` or is generated at startup. A small state file (0600,
|
|
7
|
+
under the per-user private state dir — never a shared tempdir) lets the control
|
|
8
|
+
panel show the live connection URL + token; that file is the only place a
|
|
9
|
+
generated token is written. It is never logged: the server's root logger
|
|
10
|
+
appends to ``logs/server.log`` with the default file mode and never truncates
|
|
11
|
+
it, so a logged token would outlive the session in a file the state file's
|
|
12
|
+
0600 was chosen to avoid. An interactive operator sees it once on stderr.
|
|
9
13
|
|
|
10
14
|
Security posture:
|
|
11
15
|
- Default host is loopback; a non-loopback bind logs a loud warning.
|
|
@@ -17,6 +21,7 @@ import json
|
|
|
17
21
|
import logging
|
|
18
22
|
import os
|
|
19
23
|
import secrets
|
|
24
|
+
import sys
|
|
20
25
|
import time
|
|
21
26
|
|
|
22
27
|
from src.utils.private_state import private_state_dir, write_private_json
|
|
@@ -102,6 +107,14 @@ def read_transport_state():
|
|
|
102
107
|
return state
|
|
103
108
|
|
|
104
109
|
|
|
110
|
+
def _stderr_is_interactive() -> bool:
|
|
111
|
+
"""True only when stderr is a terminal a person is looking at."""
|
|
112
|
+
try:
|
|
113
|
+
return bool(sys.stderr and sys.stderr.isatty())
|
|
114
|
+
except (AttributeError, ValueError):
|
|
115
|
+
return False
|
|
116
|
+
|
|
117
|
+
|
|
105
118
|
def run_networked(mcp, transport):
|
|
106
119
|
"""Serve `mcp` over an authenticated HTTP transport ('sse'|'streamable-http')."""
|
|
107
120
|
import uvicorn
|
|
@@ -124,7 +137,20 @@ def run_networked(mcp, transport):
|
|
|
124
137
|
logger.info("MCP %s transport: http://%s:%s (bearer token required)",
|
|
125
138
|
transport, host, port)
|
|
126
139
|
if generated:
|
|
127
|
-
|
|
140
|
+
# The token is the transport's only access control. Log WHERE it is,
|
|
141
|
+
# never WHAT it is: this record propagates to the root logger, which
|
|
142
|
+
# src/server.py points at logs/server.log — default file mode, appended
|
|
143
|
+
# forever, no cleanup in our finally: — whereas the state file is 0600
|
|
144
|
+
# and cleared at shutdown. The console gets the value only when a person
|
|
145
|
+
# is watching it (a TTY); a redirected stderr is just another file.
|
|
146
|
+
logger.info(
|
|
147
|
+
"Generated a bearer token; it is recorded in %s (0600). "
|
|
148
|
+
"Set $DAVINCI_MCP_TOKEN to pin your own.",
|
|
149
|
+
TRANSPORT_STATE_PATH,
|
|
150
|
+
)
|
|
151
|
+
if _stderr_is_interactive():
|
|
152
|
+
print(f"davinci-resolve-mcp: bearer token for this session: {token}",
|
|
153
|
+
file=sys.stderr, flush=True)
|
|
128
154
|
|
|
129
155
|
write_transport_state(transport, host, port, token)
|
|
130
156
|
try:
|