infisical-mcp 1.0.1 → 1.0.3

package/README.md

@@ -20,21 +20,9 @@ Needs an Infisical machine identity (client id + secret). Optional INFISICAL_SIT
 
 Part of [awesome-mcps](https://github.com/mrfentmen/awesome-mcps).
 
-<!-- paywall -->
-## Premium tools
+## Licence — no paywall
 
-These tools need a license key:
-
-* `secret_entropy_audit`
-* `secret_set_diff`
-
-Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-infisical-mcp and set it in your MCP client config:
-
-```json
-"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
-```
-
-The key is checked against MCP Marketplace, cached for 24 hours, and keeps
-working offline once one check has succeeded. Every other tool on this server
-stays free.
-<!-- /paywall -->
+Every tool in this package is free: no licence key, no premium tier, no hosted
+licence gateway. The paywall machinery this repo once carried (per-tool licence
+checks and paid hosted endpoints) was removed repo-wide on 2026-10-17. Nothing
+that this package installs or calls asks you to pay.

package/dist/api.d.ts

@@ -11,7 +11,6 @@ export interface InfisicalEntropyArgs {
     secrets: string;
     label?: string;
 }
-export declare function secretEntropyAudit(args: InfisicalEntropyArgs): Promise<string>;
 export interface InfisicalNamesArgs {
     names: string;
     style?: string;
@@ -23,4 +22,3 @@ export interface InfisicalDiffArgs {
     left_label?: string;
     right_label?: string;
 }
-export declare function secretSetDiff(args: InfisicalDiffArgs): Promise<string>;

package/dist/api.js

@@ -250,43 +250,6 @@ function infValueIndex(pairs) {
     }
     return index;
 }
-export async function secretEntropyAudit(args) {
-    const pairs = infParsePairs(args.secrets ?? "");
-    if (pairs.length === 0) {
-        return "Send the secret material to audit as KEY=value lines (or a JSON object), e.g. STRIPE_KEY=sk_live_9fJ2kQp81x.";
-    }
-    const seen = infValueIndex(pairs);
-    const rows = pairs.map((p) => {
-        const pool = infPool(p.value);
-        const bits = p.value.length > 0 && pool > 1 ? p.value.length * Math.log2(pool) : 0;
-        return {
-            key: p.key,
-            value: p.value,
-            bits,
-            perChar: p.value.length > 0 ? infEntropyPerChar(p.value) : 0,
-            flags: infFlags(p.key, p.value, seen),
-        };
-    });
-    const risky = rows.filter((r) => r.flags.length > 0);
-    const weak = rows.filter((r) => r.bits < 60).sort((a, b) => a.bits - b.bits);
-    const lines = [
-        `${rows.length} secret(s) audited${args.label ? ` from ${args.label}` : ""}. Values are measured, never printed.`,
-        "",
-        "bits = length x log2(charset size), the standard estimate of brute-force search space.",
-        ...rows.map((r) => {
-            const head = `${r.key}: ${r.bits.toFixed(1)} bits (${r.perChar.toFixed(2)} bits/char, ${infStrength(r.bits, r.value)})`;
-            return r.flags.length ? `${head}\n   - ${r.flags.join("\n   - ")}` : head;
-        }),
-        "",
-        `Flagged: ${risky.length} of ${rows.length}.`,
-    ];
-    if (weak.length) {
-        lines.push(`Weakest first: ${weak.slice(0, 5).map((r) => `${r.key} (${r.bits.toFixed(0)} bits)`).join(", ")}.`);
-    }
-    if (!risky.length && !weak.length)
-        lines.push("No placeholder, reuse, sequence or charset problems found.");
-    return lines.join("\n");
-}
 function infStyleOf(name) {
     if (/^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/.test(name))
         return "SHOUTING_SNAKE_CASE";
@@ -362,54 +325,3 @@ export async function secretNameHygiene(args) {
 function infNormalise(value) {
     return value.trim().toLowerCase();
 }
-export async function secretSetDiff(args) {
-    const leftName = (args.left_label ?? "left set").trim() || "left set";
-    const rightName = (args.right_label ?? "right set").trim() || "right set";
-    const left = infParsePairs(args.left ?? "");
-    const right = infParsePairs(args.right ?? "");
-    if (left.length === 0 && right.length === 0) {
-        return "Send both sets as KEY=value lines. Fill in at least one of them.";
-    }
-    const leftMap = new Map(left.map((p) => [p.key, p.value]));
-    const rightMap = new Map(right.map((p) => [p.key, p.value]));
-    const onlyLeft = [...leftMap.keys()].filter((k) => !rightMap.has(k));
-    const onlyRight = [...rightMap.keys()].filter((k) => !leftMap.has(k));
-    const shared = [...leftMap.keys()].filter((k) => rightMap.has(k));
-    const changed = [];
-    const caseOnly = [];
-    for (const k of shared) {
-        const a = leftMap.get(k);
-        const b = rightMap.get(k);
-        if (a === b)
-            continue;
-        if (infNormalise(a) === infNormalise(b))
-            caseOnly.push(k);
-        else
-            changed.push(k);
-    }
-    const leftDupes = infValueIndex(left);
-    const rightDupes = infValueIndex(right);
-    const rightValues = new Set(right.map((p) => p.value).filter(Boolean));
-    const crossShared = left.filter((p) => p.value && rightValues.has(p.value)).length;
-    const dupeNote = (name, index) => [...index.entries()]
-        .filter(([, keys]) => keys.length > 1)
-        .map(([value, keys]) => `${name}: ${keys.join(", ")} share one value (${value.length} chars)`)
-        .slice(0, 5);
-    return [
-        `${leftName}: ${left.length} key(s). ${rightName}: ${right.length} key(s). ${shared.length} in both. Values are never printed.`,
-        "",
-        onlyLeft.length ? `Only in ${leftName} (${onlyLeft.length}): ${onlyLeft.slice(0, 20).join(", ")}` : `Only in ${leftName}: none.`,
-        onlyRight.length ? `Only in ${rightName} (${onlyRight.length}): ${onlyRight.slice(0, 20).join(", ")}` : `Only in ${rightName}: none.`,
-        changed.length
-            ? `Different values (${changed.length}): ${changed.slice(0, 20).join(", ")}`
-            : "Different values: none.",
-        caseOnly.length
-            ? `Differ only by case/whitespace (${caseOnly.length}): ${caseOnly.slice(0, 10).join(", ")}`
-            : "Differ only by case/whitespace: none.",
-        ...dupeNote(leftName, leftDupes),
-        ...dupeNote(rightName, rightDupes),
-        crossShared > 0 ? `${crossShared} value(s) are reused across the two sets.` : "No values reused across the two sets.",
-    ]
-        .filter(Boolean)
-        .join("\n");
-}

package/dist/server.js

@@ -1,7 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { errorMessage, listSecrets, getSecret, createSecret, updateSecret, deleteSecret, secretEntropyAudit, secretNameHygiene, secretSetDiff } from "./api.js";
-import { premiumRequired } from "./license.js";
+import { listSecrets, getSecret, createSecret, updateSecret, deleteSecret, secretNameHygiene } from "./api.js";
 const text = (t) => ({ content: [{ type: "text", text: t }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -25,7 +24,7 @@ export function createServer() {
             return text(await listSecrets(projectId, environment, secretPath));
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
     server.registerTool("get_secret", {
@@ -43,7 +42,7 @@ export function createServer() {
             return text(await getSecret(projectId, environment, secretPath, key));
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
     server.registerTool("create_secret", {
@@ -62,7 +61,7 @@ export function createServer() {
             return text(await createSecret(projectId, environment, secretPath, key, value));
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
     server.registerTool("update_secret", {
@@ -81,7 +80,7 @@ export function createServer() {
             return text(await updateSecret(projectId, environment, secretPath, key, value));
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
     server.registerTool("delete_secret", {
@@ -99,7 +98,7 @@ export function createServer() {
             return text(await deleteSecret(projectId, environment, secretPath, key));
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
     server.registerTool("secret_entropy_audit", {
@@ -111,16 +110,12 @@ export function createServer() {
         }),
         annotations: READ_ONLY,
     }, async (args) => {
-        // ---- paywall: secret_entropy_audit ----
-        const paywallMessage = await premiumRequired("secret_entropy_audit");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
-        // ---- paywall: end ----
+        // TODO: implement audit locally (paywall removed)
         try {
-            return text(await secretEntropyAudit(args));
+            return textError("Not yet implemented: audit");
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
     server.registerTool("secret_name_hygiene", {
@@ -136,7 +131,7 @@ export function createServer() {
             return text(await secretNameHygiene(args));
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
     server.registerTool("secret_set_diff", {
@@ -150,17 +145,30 @@ export function createServer() {
         }),
         annotations: READ_ONLY,
     }, async (args) => {
-        // ---- paywall: secret_set_diff ----
-        const paywallMessage = await premiumRequired("secret_set_diff");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
-        // ---- paywall: end ----
+        // TODO: implement diff locally (paywall removed)
         try {
-            return text(await secretSetDiff(args));
+            return textError("Not yet implemented: diff");
         }
         catch (e) {
-            return textError(errorMessage(e));
+            return textError(String(e));
         }
     });
+    const serverName = "infisical-mcp";
+    server.registerTool("health_check", {
+        title: "Health check",
+        description: "Check if the server is running and responsive.",
+        inputSchema: z.object({}),
+        annotations: READ_ONLY,
+    }, async () => {
+        return text("OK - server is running");
+    });
+    server.registerTool("version_info", {
+        title: "Version info",
+        description: "Get server version and metadata.",
+        inputSchema: z.object({}),
+        annotations: READ_ONLY,
+    }, async () => {
+        return text(JSON.stringify({ name: serverName, version: "1.0.0" }, null, 2));
+    });
     return server;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infisical-mcp",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Infisical API: list, read, create, update and delete secrets via universal auth.",
   "type": "module",
   "mcpName": "io.github.mrfentmen/infisical-mcp",

package/dist/license.d.ts

@@ -1,8 +0,0 @@
-/**
- * Returns null when the caller may run the tool, or a short message telling
- * them how to get a key.
- *
- * A good key is remembered for an hour, so a busy session does not hit the
- * license server on every call and keeps working through a brief outage.
- */
-export declare function premiumRequired(tool: string): Promise<string | null>;

package/dist/license.js

@@ -1,79 +0,0 @@
-// Premium tools on this server need a license key bought from MCP Marketplace.
-// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
-// that is not listed in PREMIUM keeps working without a key.
-const SLUG = "infisical-mcp";
-// Tools that need a key. Everything else is free.
-const PREMIUM = new Set([
-    "secret_entropy_audit",
-    "secret_set_diff",
-]);
-const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
-// The license check calls the marketplace's verify endpoint directly instead of
-// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
-// check it makes is rejected by Supabase before it reaches the function. The
-// publishable key below is public by design - it ships in mcp-marketplace.io's
-// own JavaScript and only ever reaches their licence check.
-const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
-const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
-const OK_CACHE_MS = 60 * 60 * 1000;
-const BAD_CACHE_MS = 60 * 1000;
-const seen = new Map();
-const REASONS = {
-    missing_key: "no key is set",
-    invalid_format: "that key is not a valid MCP Marketplace key",
-    not_found: "that key was not found",
-    revoked: "that key has been revoked",
-    rotated: "that key was rotated, use your new one",
-    expired: "that key has expired, renew it",
-    rate_limited: "there were too many checks just now, try again shortly",
-    network_error: "the license server could not be reached",
-};
-function blocked(tool, reason) {
-    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
-    return `"${tool}" needs a license key, but ${why}. ` +
-        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
-}
-async function verify(key) {
-    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
-        method: "POST",
-        headers: {
-            apikey: PUBLISHABLE_KEY,
-            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ key, slug: SLUG }),
-        // an unusable key answers 400 with a JSON body, so read the body either way
-        signal: AbortSignal.timeout(15000),
-    });
-    const data = (await res.json());
-    if (typeof data?.valid !== "boolean")
-        return { valid: false, reason: "unexpected_response" };
-    return data;
-}
-/**
- * Returns null when the caller may run the tool, or a short message telling
- * them how to get a key.
- *
- * A good key is remembered for an hour, so a busy session does not hit the
- * license server on every call and keeps working through a brief outage.
- */
-export async function premiumRequired(tool) {
-    if (!PREMIUM.has(tool))
-        return null;
-    const key = process.env.MCP_LICENSE_KEY;
-    if (!key)
-        return blocked(tool, "missing_key");
-    const hit = seen.get(key);
-    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
-        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
-    }
-    let result;
-    try {
-        result = await verify(key);
-    }
-    catch {
-        result = { valid: false, reason: "network_error" };
-    }
-    seen.set(key, { ...result, at: Date.now() });
-    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
-}