it-tools-mcp 3.0.0

package/build/security.js

@@ -0,0 +1,201 @@
+import { z } from "zod";
+/**
+ * Security utilities for IT Tools MCP Server
+ */
+// Input size limits to prevent DoS attacks
+export const INPUT_LIMITS = {
+    TEXT_MAX: 1000000, // 1MB for text input
+    JSON_MAX: 500000, // 500KB for JSON
+    HTML_MAX: 500000, // 500KB for HTML
+    XML_MAX: 500000, // 500KB for XML
+    YAML_MAX: 100000, // 100KB for YAML
+    CSV_MAX: 1000000, // 1MB for CSV
+    PASSWORD_MAX: 128, // Max password length
+    TOKEN_LENGTH_MAX: 1024, // Max token length
+    LIST_ITEMS_MAX: 10000, // Max list items
+    REGEX_MAX: 1000, // Max regex pattern length
+};
+// Base schema with common security validations
+export const secureTextSchema = (maxLength = INPUT_LIMITS.TEXT_MAX) => z.string()
+    .max(maxLength, `Input too large (max ${maxLength} characters)`)
+    .refine((text) => !text.includes('\0'), "Null bytes not allowed");
+// Secure schemas for different input types
+export const secureSchemas = {
+    text: secureTextSchema(),
+    shortText: secureTextSchema(1000),
+    password: secureTextSchema(INPUT_LIMITS.PASSWORD_MAX),
+    json: secureTextSchema(INPUT_LIMITS.JSON_MAX),
+    html: secureTextSchema(INPUT_LIMITS.HTML_MAX),
+    xml: secureTextSchema(INPUT_LIMITS.XML_MAX),
+    yaml: secureTextSchema(INPUT_LIMITS.YAML_MAX),
+    csv: secureTextSchema(INPUT_LIMITS.CSV_MAX),
+    regex: secureTextSchema(INPUT_LIMITS.REGEX_MAX),
+    // Numeric with bounds
+    positiveInt: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+    boundedInt: (min, max) => z.number().int().min(min).max(max),
+    // Safe URL validation
+    url: z.string().url().max(2048),
+    // Safe email validation
+    email: z.string().email().max(254),
+    // Base64 validation
+    base64: z.string().regex(/^[A-Za-z0-9+/]*={0,2}$/, "Invalid Base64 format"),
+    // Hex validation
+    hexColor: z.string().regex(/^#?[0-9A-Fa-f]{6}$/, "Invalid hex color format"),
+    // Safe filename
+    filename: z.string()
+        .max(255)
+        .regex(/^[a-zA-Z0-9._-]+$/, "Filename contains invalid characters"),
+};
+/**
+ * Rate limiting for tools (simple in-memory implementation)
+ */
+class SimpleRateLimiter {
+    requests = new Map();
+    windowMs;
+    maxRequests;
+    constructor(windowMs = 60000, maxRequests = 100) {
+        this.windowMs = windowMs;
+        this.maxRequests = maxRequests;
+    }
+    isAllowed(identifier) {
+        const now = Date.now();
+        const windowStart = now - this.windowMs;
+        if (!this.requests.has(identifier)) {
+            this.requests.set(identifier, []);
+        }
+        const requests = this.requests.get(identifier);
+        // Remove old requests outside the window
+        while (requests.length > 0 && requests[0] < windowStart) {
+            requests.shift();
+        }
+        if (requests.length >= this.maxRequests) {
+            return false;
+        }
+        requests.push(now);
+        return true;
+    }
+    reset(identifier) {
+        if (identifier) {
+            this.requests.delete(identifier);
+        }
+        else {
+            this.requests.clear();
+        }
+    }
+}
+// Global rate limiter instance
+export const rateLimiter = new SimpleRateLimiter();
+/**
+ * Security wrapper for tool handlers
+ */
+export function secureToolHandler(handler, identifier = 'default') {
+    return async (params) => {
+        // Rate limiting check
+        if (!rateLimiter.isAllowed(identifier)) {
+            throw new Error('Rate limit exceeded. Please try again later.');
+        }
+        try {
+            return await handler(params);
+        }
+        catch (error) {
+            // Log error without exposing sensitive information
+            console.error(`Tool error for ${identifier}:`, error instanceof Error ? error.message : 'Unknown error');
+            // Return safe error message
+            throw new Error('Tool execution failed. Please check your input and try again.');
+        }
+    };
+}
+/**
+ * Input sanitization utilities
+ */
+export const sanitize = {
+    /**
+     * Remove potentially dangerous characters from text
+     */
+    text: (input) => {
+        return input
+            .replace(/[\0\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control characters
+            .normalize('NFKC'); // Normalize Unicode
+    },
+    /**
+     * Escape HTML entities
+     */
+    html: (input) => {
+        return input
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#x27;');
+    },
+    /**
+     * Safe regex pattern validation
+     */
+    regex: (pattern) => {
+        // Basic validation to prevent ReDoS
+        if (pattern.length > INPUT_LIMITS.REGEX_MAX) {
+            throw new Error('Regex pattern too long');
+        }
+        // Check for potentially dangerous patterns
+        const dangerousPatterns = [
+            /(\*\+|\+\*|\?\+|\+\?|\*\?|\?\*)/, // Nested quantifiers
+            /(\([^)]*){10,}/, // Excessive grouping
+            /(\|.*){20,}/, // Excessive alternation
+        ];
+        for (const dangerous of dangerousPatterns) {
+            if (dangerous.test(pattern)) {
+                throw new Error('Potentially dangerous regex pattern detected');
+            }
+        }
+        return pattern;
+    }
+};
+/**
+ * Format bytes as human-readable string (e.g., 1.2 MB, 512 KB)
+ */
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    if (bytes < 1024 * 1024 * 1024)
+        return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+    return `${(bytes / 1024 / 1024 / 1024).toFixed(2)} GB`;
+}
+/**
+ * Memory and CPU usage monitoring (human-readable + raw values)
+ */
+export function getResourceUsage() {
+    const usage = process.memoryUsage();
+    const cpuUsage = process.cpuUsage();
+    const uptime = process.uptime();
+    return {
+        memory: {
+            heapUsed: formatBytes(usage.heapUsed),
+            heapUsedBytes: usage.heapUsed,
+            heapTotal: formatBytes(usage.heapTotal),
+            heapTotalBytes: usage.heapTotal,
+            external: formatBytes(usage.external),
+            externalBytes: usage.external,
+            rss: formatBytes(usage.rss),
+            rssBytes: usage.rss,
+        },
+        cpu: {
+            user: `${(cpuUsage.user / 1000).toFixed(1)} ms`, // microseconds to ms
+            userMicros: cpuUsage.user,
+            system: `${(cpuUsage.system / 1000).toFixed(1)} ms`,
+            systemMicros: cpuUsage.system,
+        },
+        uptime: `${uptime.toFixed(1)} s`,
+        uptimeSeconds: uptime,
+    };
+}
+/**
+ * Security headers for responses (if applicable)
+ */
+export const SECURITY_HEADERS = {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'X-XSS-Protection': '1; mode=block',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+};

package/build/tools/color.js

@@ -0,0 +1,67 @@
+import Color from "color";
+import { z } from "zod";
+export function registerColorTools(server) {
+    // Color conversion tools
+    server.tool("color-hex-to-rgb", "Convert HEX color to RGB", {
+        hex: z.string().describe("HEX color code (e.g., #FF5733 or FF5733)"),
+    }, async ({ hex }) => {
+        try {
+            const rgb = Color(hex).rgb().array();
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `${hex} = RGB(${rgb[0]}, ${rgb[1]}, ${rgb[2]})`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error converting HEX to RGB: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                    },
+                ],
+            };
+        }
+    });
+    server.tool("color-rgb-to-hex", "Convert RGB color to HEX", {
+        r: z.number().describe("Red value (0-255)"),
+        g: z.number().describe("Green value (0-255)"),
+        b: z.number().describe("Blue value (0-255)"),
+    }, async ({ r, g, b }) => {
+        try {
+            if (r < 0 || r > 255 || g < 0 || g > 255 || b < 0 || b > 255) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "RGB values must be between 0 and 255.",
+                        },
+                    ],
+                };
+            }
+            const hex = Color({ r, g, b }).hex().toUpperCase();
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `RGB(${r}, ${g}, ${b}) = ${hex}`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error converting RGB to HEX: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                    },
+                ],
+            };
+        }
+    });
+}