mcp-for-i 0.1.7 → 0.1.9

package/README.md

@@ -148,9 +148,12 @@ npm run release:patch -- --no-push
 - Passwords are stored in keychain when available.
 - Control plane is local-first (`127.0.0.1` by default).
 - Guarded policy profile is the default for operational safety.
+- Tool schemas are strict (`additionalProperties: false`) with runtime argument validation, including nested connection/action/filter/profile payloads.
+- QSYS object names and source settings are validated before command execution to reduce interpolation and injection risk.
 
 ## Links
 
 - Main repo: [ashishthomas2202/mcp-for-i](https://github.com/ashishthomas2202/mcp-for-i)
 - Skills repo: [ashishthomas2202/mcp-for-i-skills](https://github.com/ashishthomas2202/mcp-for-i-skills)
 - Docs: `docs/`
+- Full capability guide: `docs/capabilities.md`

package/dist/ibmi/CompileTools.js

@@ -76,16 +76,34 @@ export var CompileTools;
     }
     CompileTools.runCommand = runCommand;
     function buildLibraryList(config) {
-        return config.libraryList.slice(0).reverse();
+        return config.libraryList
+            .slice(0)
+            .map(lib => String(lib || "").trim().toUpperCase())
+            .filter(Boolean)
+            .reverse();
     }
     function buildLiblistCommands(connection, config) {
-        const defaultLibs = Tools.sanitizeObjNamesForPase((connection.defaultUserLibraries || []).filter(l => l && l !== "QSYS"));
-        const currentLib = Tools.sanitizeObjNamesForPase([config.currentLibrary || "QGPL"])[0];
-        const userLibs = Tools.sanitizeObjNamesForPase(buildLibraryList(config));
-        return [
+        const defaultLibNames = (connection.defaultUserLibraries || [])
+            .filter(l => l && l !== "QSYS")
+            .map(l => assertLibraryName(connection, l, "default library"));
+        const userLibNames = buildLibraryList(config).map(l => assertLibraryName(connection, l, "library list"));
+        const currentLib = assertLibraryName(connection, config.currentLibrary || "QGPL", "current library");
+        const defaultLibs = Tools.sanitizeObjNamesForPase(defaultLibNames);
+        const userLibs = Tools.sanitizeObjNamesForPase(userLibNames);
+        const commands = [
             `liblist -d ${IBMiClient.escapeForShell(defaultLibs.join(` `))}`,
-            `liblist -c ${IBMiClient.escapeForShell(currentLib)}`,
-            `liblist -a ${IBMiClient.escapeForShell(userLibs.join(` `))}`
+            `liblist -c ${IBMiClient.escapeForShell(Tools.sanitizeObjNamesForPase([currentLib])[0])}`
         ];
+        if (userLibs.length > 0) {
+            commands.push(`liblist -a ${IBMiClient.escapeForShell(userLibs.join(` `))}`);
+        }
+        return commands;
     }
 })(CompileTools || (CompileTools = {}));
+function assertLibraryName(connection, value, context) {
+    const normalized = String(value || "").trim().toUpperCase();
+    if (!normalized || !connection.validQsysName(normalized)) {
+        throw new Error(`Invalid ${context}: ${value}`);
+    }
+    return normalized;
+}

package/dist/ibmi/IBMiContent.js

@@ -86,11 +86,11 @@ export class IBMiContent {
             if (withDates !== undefined)
                 return withDates;
         }
-        const lib = this.ibmi.upperCaseName(library);
-        const file = this.ibmi.upperCaseName(sourceFile);
-        const mbr = this.ibmi.upperCaseName(member);
+        const lib = this.requireQsysName(library, "library");
+        const file = this.requireQsysName(sourceFile, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
         const tempRemote = this.ibmi.getTempRemote("mbr");
-        const ccsid = this.config.sourceFileCCSID || "*FILE";
+        const ccsid = this.normalizeSourceFileCcsid(this.config.sourceFileCCSID);
         const cmd = `QSYS/CPYTOSTMF FROMMBR('${Tools.qualifyPath(lib, file, mbr, undefined, true)}') ` +
             `TOSTMF('${tempRemote}') STMFOPT(*REPLACE) STMFCCSID(1208) DBFCCSID(${ccsid})`;
         const result = await this.ibmi.sendQsh({ command: `system \"${IBMiClient.escapeForShell(cmd)}\"` });
@@ -114,12 +114,12 @@ export class IBMiContent {
     }
     async uploadMemberContentRaw(library, sourceFile, member, content) {
         this.assertWritable();
-        const lib = this.ibmi.upperCaseName(library);
-        const file = this.ibmi.upperCaseName(sourceFile);
-        const mbr = this.ibmi.upperCaseName(member);
+        const lib = this.requireQsysName(library, "library");
+        const file = this.requireQsysName(sourceFile, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
         const tempRemote = this.ibmi.getTempRemote("mbr");
         await this.writeStreamfileRaw(tempRemote, content);
-        const ccsid = this.config.sourceFileCCSID || "*FILE";
+        const ccsid = this.normalizeSourceFileCcsid(this.config.sourceFileCCSID);
         const cmd = `QSYS/CPYFRMSTMF FROMSTMF('${tempRemote}') ` +
             `TOMBR('${Tools.qualifyPath(lib, file, mbr, undefined, true)}') MBROPT(*REPLACE) ` +
             `STMFCCSID(1208) DBFCCSID(${ccsid})`;
@@ -181,7 +181,7 @@ export class IBMiContent {
         return badLibs;
     }
     async getObjectList(library, types = ["*ALL"]) {
-        const lib = this.ibmi.upperCaseName(library);
+        const lib = this.requireQsysName(library, "library");
         const safeTypes = types.map(t => this.ibmi.upperCaseName(t));
         const hasInvalidType = safeTypes.some(t => !/^[*A-Z0-9]+$/.test(t));
         if (hasInvalidType)
@@ -197,8 +197,8 @@ export class IBMiContent {
         }));
     }
     async getMemberList(options) {
-        const lib = this.ibmi.upperCaseName(options.library);
-        const file = this.ibmi.upperCaseName(options.sourceFile);
+        const lib = this.requireQsysName(options.library, "library");
+        const file = this.requireQsysName(options.sourceFile, "sourceFile");
         const rows = await this.ibmi.runSQL(`select SYSTEM_TABLE_MEMBER, SOURCE_TYPE, PARTITION_TEXT from QSYS2.SYSPARTITIONSTAT where SYSTEM_TABLE_SCHEMA=${Tools.sqlString(lib)} and SYSTEM_TABLE_NAME=${Tools.sqlString(file)}`);
         return rows.map(r => ({
             library: lib,
@@ -209,9 +209,9 @@ export class IBMiContent {
         }));
     }
     async getMemberInfo(library, sourceFile, member) {
-        const lib = this.ibmi.upperCaseName(library);
-        const file = this.ibmi.upperCaseName(sourceFile);
-        const mbr = this.ibmi.upperCaseName(member);
+        const lib = this.requireQsysName(library, "library");
+        const file = this.requireQsysName(sourceFile, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
         const rows = await this.ibmi.runSQL(`select SYSTEM_TABLE_MEMBER, SOURCE_TYPE, PARTITION_TEXT from QSYS2.SYSPARTITIONSTAT where SYSTEM_TABLE_SCHEMA=${Tools.sqlString(lib)} and SYSTEM_TABLE_NAME=${Tools.sqlString(file)} and SYSTEM_TABLE_MEMBER=${Tools.sqlString(mbr)}`);
         const row = rows[0];
         if (!row)
@@ -225,9 +225,9 @@ export class IBMiContent {
         };
     }
     async downloadMemberContentWithDates(library, sourceFile, member) {
-        const lib = this.ibmi.upperCaseName(library);
-        const file = this.ibmi.upperCaseName(sourceFile);
-        const mbr = this.ibmi.upperCaseName(member);
+        const lib = this.requireQsysName(library, "library");
+        const file = this.requireQsysName(sourceFile, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
         const tempLib = await this.getTempLibrary();
         if (!tempLib)
             return undefined;
@@ -251,9 +251,9 @@ export class IBMiContent {
     }
     async uploadMemberContentWithDates(library, sourceFile, member, body) {
         this.assertWritable();
-        const lib = this.ibmi.upperCaseName(library);
-        const file = this.ibmi.upperCaseName(sourceFile);
-        const mbr = this.ibmi.upperCaseName(member);
+        const lib = this.requireQsysName(library, "library");
+        const file = this.requireQsysName(sourceFile, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
         const tempLib = await this.getTempLibrary();
         if (!tempLib) {
             throw new Error(`Temp library is not available for source-date updates.`);
@@ -322,42 +322,64 @@ export class IBMiContent {
     }
     async createLibrary(library) {
         this.assertWritable();
-        const lib = this.ibmi.upperCaseName(library);
+        const lib = this.requireQsysName(library, "library");
         return this.ibmi.sendQsh({ command: `system \"CRTLIB LIB(${lib})\"` });
     }
     async createSourceFile(library, file, rcdlen = 112) {
         this.assertWritable();
-        const lib = this.ibmi.upperCaseName(library);
-        const src = this.ibmi.upperCaseName(file);
+        const lib = this.requireQsysName(library, "library");
+        const src = this.requireQsysName(file, "sourceFile");
         return this.ibmi.sendQsh({ command: `system \"CRTSRCPF FILE(${lib}/${src}) RCDLEN(${rcdlen})\"` });
     }
     async createMember(library, file, member, srctype) {
         this.assertWritable();
-        const lib = this.ibmi.upperCaseName(library);
-        const src = this.ibmi.upperCaseName(file);
-        const mbr = this.ibmi.upperCaseName(member);
-        const type = srctype ? this.ibmi.upperCaseName(srctype) : "*NONE";
+        const lib = this.requireQsysName(library, "library");
+        const src = this.requireQsysName(file, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
+        const type = this.normalizeSourceType(srctype);
         return this.ibmi.sendQsh({ command: `system \"ADDPFM FILE(${lib}/${src}) MBR(${mbr}) SRCTYPE(${type})\"` });
     }
     async renameMember(library, file, member, newMember) {
         this.assertWritable();
-        const lib = this.ibmi.upperCaseName(library);
-        const src = this.ibmi.upperCaseName(file);
-        const mbr = this.ibmi.upperCaseName(member);
-        const newMbr = this.ibmi.upperCaseName(newMember);
+        const lib = this.requireQsysName(library, "library");
+        const src = this.requireQsysName(file, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
+        const newMbr = this.requireQsysName(newMember, "newMember");
         return this.ibmi.sendQsh({ command: `system \"RNMM FILE(${lib}/${src}) MBR(${mbr}) NEWMBR(${newMbr})\"` });
     }
     async deleteMember(library, file, member) {
         this.assertWritable();
-        const lib = this.ibmi.upperCaseName(library);
-        const src = this.ibmi.upperCaseName(file);
-        const mbr = this.ibmi.upperCaseName(member);
+        const lib = this.requireQsysName(library, "library");
+        const src = this.requireQsysName(file, "sourceFile");
+        const mbr = this.requireQsysName(member, "member");
         return this.ibmi.sendQsh({ command: `system \"RMVM FILE(${lib}/${src}) MBR(${mbr})\"` });
     }
     async createTempFile() {
         const dir = await fs.mkdtemp(path.join(os.tmpdir(), "mcpfori-"));
         return path.join(dir, "tmp");
     }
+    requireQsysName(value, label) {
+        const normalized = this.ibmi.upperCaseName(String(value || "").trim());
+        if (!normalized || !this.ibmi.validQsysName(normalized)) {
+            throw new Error(`Invalid ${label}: ${value}`);
+        }
+        return normalized;
+    }
+    normalizeSourceType(value) {
+        const normalized = this.ibmi.upperCaseName(String(value || "*NONE").trim());
+        if (!/^\*?[A-Z0-9#@$._]{1,10}$/.test(normalized)) {
+            throw new Error(`Invalid source type: ${value}`);
+        }
+        return normalized;
+    }
+    normalizeSourceFileCcsid(value) {
+        const normalized = String(value || "*FILE").trim().toUpperCase();
+        if (/^\d{1,5}$/.test(normalized))
+            return normalized;
+        if (/^\*[A-Z0-9]{2,10}$/.test(normalized))
+            return normalized;
+        throw new Error(`Invalid sourceFileCCSID setting: ${value}`);
+    }
     assertWritable() {
         if (this.config.readOnlyMode) {
             throw new Error("Connection is in read-only mode");

package/dist/ibmi/Search.js

@@ -14,6 +14,14 @@ export var Search;
         };
     }
     async function searchMembers(connection, library, sourceFile, searchTerm, members, readOnly) {
+        const lib = String(library || "").trim().toUpperCase();
+        const src = String(sourceFile || "").trim().toUpperCase();
+        if (!connection.validQsysName(lib)) {
+            throw new Error(`Invalid library: ${library}`);
+        }
+        if (!connection.validQsysName(src)) {
+            throw new Error(`Invalid source file: ${sourceFile}`);
+        }
         let detailedMembers;
         let memberFilter;
         const pfgrep = connection.remoteFeatures.pfgrep;
@@ -42,7 +50,7 @@ export var Search;
             : `/usr/bin/grep -inHR -F "${sanitizeSearchTerm(searchTerm)}" ${memberFilter}`;
         const result = await connection.sendCommand({
             command,
-            directory: `/QSYS.LIB/${library}.LIB/${sourceFile}.FILE`
+            directory: `/QSYS.LIB/${lib}.LIB/${src}.FILE`
         });
         if (!result.stderr) {
             let hits = parseGrepOutput(result.stdout || '', readOnly);

package/dist/ibmi/client.js

@@ -39,7 +39,7 @@ export class IBMiClient {
         if (name.length > 10)
             return false;
         const upper = this.upperCaseName(name);
-        return /^[A-Z][A-Z0-9_.]{0,9}$/.test(upper);
+        return /^[A-Z#@$][A-Z0-9#@$._]{0,9}$/.test(upper);
     }
     async connect(connection) {
         this.currentHost = connection.host;

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import crypto from "crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
@@ -6,7 +7,8 @@ import { getTools, handleTool } from "./mcp/tools.js";
 import { McpContext } from "./mcp/context.js";
 import { log } from "./mcp/logger.js";
 import { validateToolInput } from "./mcp/validation.js";
-const server = new Server({ name: "mcp-for-i", version: "0.1.4" }, { capabilities: { tools: {} } });
+import { appendAuditRecord } from "./mcp/audit.js";
+const server = new Server({ name: "mcp-for-i", version: "0.1.8" }, { capabilities: { tools: {} } });
 const ctx = new McpContext();
 const tools = getTools();
 const toolMap = new Map(tools.map(tool => [tool.name, tool]));
@@ -15,6 +17,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
+    const correlationId = crypto.randomUUID();
+    const startedAt = Date.now();
     try {
         const toolDef = toolMap.get(name);
         if (!toolDef)
@@ -23,16 +27,40 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         if (errors.length > 0) {
             throw new Error(`Invalid arguments: ${errors.join("; ")}`);
         }
-        log("info", "tool.call", { name, args: redactSensitive(args || {}) });
+        const redactedArgs = redactSensitive(args || {});
+        log("info", "tool.call", { name, correlationId, args: redactedArgs });
         const result = await handleTool(ctx, name, args || {});
-        log("debug", "tool.result", { name });
+        const durationMs = Date.now() - startedAt;
+        log("debug", "tool.result", { name, correlationId, durationMs });
+        await safeAppendAudit({
+            tool: name,
+            status: "ok",
+            args: redactedArgs,
+            connectionName: resolveConnectionName(name, args || {}, ctx.activeName),
+            approve: Boolean(args && typeof args === "object" && args.approve),
+            durationMs,
+            correlationId,
+            resultSummary: summarizeResult(result)
+        });
         return result;
     }
     catch (err) {
-        log("error", "tool.error", { name, error: err?.message || String(err) });
+        const durationMs = Date.now() - startedAt;
+        const errorMessage = err?.message || String(err);
+        log("error", "tool.error", { name, correlationId, durationMs, error: errorMessage });
+        await safeAppendAudit({
+            tool: name,
+            status: "error",
+            args: redactSensitive(args || {}),
+            connectionName: resolveConnectionName(name, args || {}, ctx.activeName),
+            approve: Boolean(args && typeof args === "object" && args.approve),
+            durationMs,
+            correlationId,
+            error: errorMessage
+        });
         return {
             isError: true,
-            content: [{ type: "text", text: err?.message || String(err) }]
+            content: [{ type: "text", text: errorMessage }]
         };
     }
 });
@@ -57,3 +85,28 @@ function redactSensitive(input) {
     }
     return input;
 }
+function summarizeResult(result) {
+    const contentCount = Array.isArray(result?.content) ? result.content.length : 0;
+    return {
+        isError: Boolean(result?.isError),
+        contentCount,
+        hasStructuredContent: typeof result?.structuredContent !== "undefined"
+    };
+}
+function resolveConnectionName(tool, args, activeName) {
+    if (args?.connectionName)
+        return String(args.connectionName);
+    if (tool === "ibmi.connect" && args?.name)
+        return String(args.name);
+    return activeName;
+}
+async function safeAppendAudit(input) {
+    if (process.env.MCP_FOR_I_AUDIT_ENABLED === "0")
+        return;
+    try {
+        await appendAuditRecord(input);
+    }
+    catch (err) {
+        log("warn", "audit.append.failed", { error: err?.message || String(err) });
+    }
+}