http-inspector-mcp 1.0.0 → 1.0.1

package/README.md

@@ -18,3 +18,23 @@ node dist/index.js
 ```
 
 Response bodies are never returned, only headers and sizes, so no content is leaked.
+
+<!-- paywall -->
+## Premium tools
+
+These tools need a license key:
+
+* `dns_records`
+* `redirect_chain`
+* `security_txt`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-http-inspector-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.js

@@ -22,3 +22,108 @@ export async function inspectUrl(args) {
         lines.length ? `\nHeaders:\n${lines.join("\n")}` : "",
     ].filter(Boolean).join("\n");
 }
+// ---- muxB tools:
+const DOH = "https://cloudflare-dns.com/dns-query";
+const TYPES = ["A", "AAAA", "MX", "NS", "TXT", "CNAME", "CAA", "SOA"];
+function hostOf(raw) {
+    const url = (raw ?? "").trim();
+    if (!/^https?:\/\/.+/i.test(url))
+        throw new HttpError("Provide a full URL starting with http or https");
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new HttpError(`Cannot parse that URL: ${url}`);
+    }
+    if (!parsed.hostname)
+        throw new HttpError("That URL has no hostname");
+    return parsed.hostname;
+}
+export async function dnsRecords(args) {
+    const hostname = hostOf(`https://${(args.host ?? "").trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "")}`);
+    if (!hostname)
+        throw new HttpError("Provide a hostname to look up");
+    const asked = (args.types ?? "A,AAAA,MX,NS")
+        .split(",")
+        .map((t) => t.trim().toUpperCase())
+        .filter(Boolean);
+    const types = (asked.length ? asked : ["A"]).slice(0, 8);
+    for (const t of types) {
+        if (!TYPES.includes(t)) {
+            throw new HttpError(`Unsupported record type "${t}". Use any of ${TYPES.join(", ")}.`);
+        }
+    }
+    const blocks = [];
+    for (const type of types) {
+        const res = await fetch(`${DOH}?name=${encodeURIComponent(hostname)}&type=${encodeURIComponent(type)}`, {
+            headers: { accept: "application/dns-json", "User-Agent": UA },
+            signal: AbortSignal.timeout(15000),
+        });
+        if (!res.ok)
+            throw new HttpError(`DNS over HTTPS returned ${res.status} for ${type}`);
+        const d = (await res.json());
+        if (d.Status !== 0) {
+            blocks.push(`${type}: resolver status ${d.Status}${d.Comment ? ` (${d.Comment})` : ""}`);
+            continue;
+        }
+        const answers = d.Answer ?? [];
+        if (!answers.length) {
+            blocks.push(`${type}: no records`);
+            continue;
+        }
+        const rows = answers.slice(0, 12).map((a) => `- ${a.data ?? "no data reported"}${typeof a.TTL === "number" ? ` (TTL ${a.TTL}s)` : ""}`);
+        blocks.push(`${type}: ${answers.length} record(s)\n${rows.join("\n")}`);
+    }
+    return `DNS records for ${hostname} via Cloudflare DNS over HTTPS\n${blocks.join("\n")}`;
+}
+export async function redirectChain(args) {
+    const start = (args.url ?? "").trim();
+    if (!/^https?:\/\/.+/i.test(start))
+        throw new HttpError("Provide a full URL starting with http or https");
+    if (start.length > 2000)
+        throw new HttpError("URL is too long");
+    const maxHops = Math.max(1, Math.min(Math.trunc(Number(args.max_hops ?? 8) || 8), 20));
+    let current = start;
+    const hops = [];
+    for (let i = 0; i < maxHops; i += 1) {
+        const began = Date.now();
+        let res;
+        try {
+            res = await fetch(current, { method: "GET", redirect: "manual", headers: { "User-Agent": UA }, signal: AbortSignal.timeout(20000) });
+        }
+        catch (e) {
+            hops.push(`${i + 1}. ${current}\n   request failed: ${e instanceof Error ? e.message : String(e)}`);
+            break;
+        }
+        const ms = Date.now() - began;
+        const location = res.headers.get("location");
+        if (res.status >= 300 && res.status < 400 && location) {
+            const next = new URL(location, current).toString();
+            hops.push(`${i + 1}. ${res.status} ${res.statusText} in ${ms}ms\n   -> ${next}`);
+            current = next;
+            continue;
+        }
+        hops.push(`${i + 1}. ${res.status} ${res.statusText} in ${ms}ms - final destination\n   ${current}`);
+        break;
+    }
+    return `Redirect chain from ${start} (${hops.length} hop(s), max ${maxHops}):\n${hops.join("\n")}`;
+}
+export async function securityTxt(args) {
+    const hostname = hostOf(`https://${(args.host ?? "").trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "")}`);
+    const url = `https://${hostname}/.well-known/security.txt`;
+    const res = await fetch(url, { headers: { "User-Agent": UA, Accept: "text/plain" }, redirect: "follow", signal: AbortSignal.timeout(20000) });
+    if (res.status === 404)
+        return `${hostname} publishes no /.well-known/security.txt (HTTP 404).`;
+    if (!res.ok)
+        throw new HttpError(`${url} returned ${res.status}`);
+    const body = (await res.text()).replace(/\r/g, "").trim();
+    if (!body)
+        return `${hostname} serves an empty /.well-known/security.txt.`;
+    const fields = body
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l && !l.startsWith("#"))
+        .slice(0, 20);
+    return `security.txt at ${url}\n${fields.join("\n")}`;
+}

package/dist/license.js

@@ -0,0 +1,80 @@
+// Premium tools on this server need a license key bought from MCP Marketplace.
+// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
+// that is not listed in PREMIUM keeps working without a key.
+const SLUG = "http-inspector-mcp";
+// Tools that need a key. Everything else is free.
+const PREMIUM = new Set([
+    "dns_records",
+    "redirect_chain",
+    "security_txt",
+]);
+const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
+// The license check calls the marketplace's verify endpoint directly instead of
+// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
+// check it makes is rejected by Supabase before it reaches the function. The
+// publishable key below is public by design - it ships in mcp-marketplace.io's
+// own JavaScript and only ever reaches their licence check.
+const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
+const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
+const OK_CACHE_MS = 60 * 60 * 1000;
+const BAD_CACHE_MS = 60 * 1000;
+const seen = new Map();
+const REASONS = {
+    missing_key: "no key is set",
+    invalid_format: "that key is not a valid MCP Marketplace key",
+    not_found: "that key was not found",
+    revoked: "that key has been revoked",
+    rotated: "that key was rotated, use your new one",
+    expired: "that key has expired, renew it",
+    rate_limited: "there were too many checks just now, try again shortly",
+    network_error: "the license server could not be reached",
+};
+function blocked(tool, reason) {
+    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
+    return `"${tool}" needs a license key, but ${why}. ` +
+        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
+}
+async function verify(key) {
+    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
+        method: "POST",
+        headers: {
+            apikey: PUBLISHABLE_KEY,
+            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ key, slug: SLUG }),
+        // an unusable key answers 400 with a JSON body, so read the body either way
+        signal: AbortSignal.timeout(15000),
+    });
+    const data = (await res.json());
+    if (typeof data?.valid !== "boolean")
+        return { valid: false, reason: "unexpected_response" };
+    return data;
+}
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export async function premiumRequired(tool) {
+    if (!PREMIUM.has(tool))
+        return null;
+    const key = process.env.MCP_LICENSE_KEY;
+    if (!key)
+        return blocked(tool, "missing_key");
+    const hit = seen.get(key);
+    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
+        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
+    }
+    let result;
+    try {
+        result = await verify(key);
+    }
+    catch {
+        result = { valid: false, reason: "network_error" };
+    }
+    seen.set(key, { ...result, at: Date.now() });
+    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
+}

package/dist/server.js

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { inspectUrl } from "./api.js";
+import { inspectUrl, dnsRecords, redirectChain, securityTxt } from "./api.js";
+import { premiumRequired } from "./license.js";
 const text = (value) => ({ content: [{ type: "text", text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -20,5 +21,59 @@ export function createServer() {
             return textError(error(e));
         }
     });
+    server.registerTool("dns_records", {
+        title: "Dns records",
+        description: "Look up A, AAAA, MX, NS, TXT, CNAME, CAA or SOA records for a host using Cloudflare DNS over HTTPS.",
+        inputSchema: z.object({ host: z.string().describe("Hostname or URL, for example github.com."), types: z.string().describe("Comma separated record types. Defaults to A,AAAA,MX,NS.").optional() }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: dns_records ----
+        const paywallMessage = await premiumRequired("dns_records");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await dnsRecords(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("redirect_chain", {
+        title: "Redirect chain",
+        description: "Follow a URL one redirect at a time and report each hop: status code, elapsed milliseconds and the next location.",
+        inputSchema: z.object({ url: z.string().describe("The URL to trace."), max_hops: z.number().describe("Max hops, 1-20, default 8.").optional() }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: redirect_chain ----
+        const paywallMessage = await premiumRequired("redirect_chain");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await redirectChain(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("security_txt", {
+        title: "Security txt",
+        description: "Fetch a site's /.well-known/security.txt and report its contact, policy, expiry and other fields.",
+        inputSchema: z.object({ host: z.string().describe("Hostname or URL, for example anthropic.com.") }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: security_txt ----
+        const paywallMessage = await premiumRequired("security_txt");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await securityTxt(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
     return server;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "repository": {
     "type": "git",