mcp-marmiton 2.0.1 → 2.1.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.1.0
+
+- **The largest page this reads is a setting, and pages past it are refused.**
+  A deadline abandons a body that arrives slowly; one that arrives quickly and
+  large is never abandoned by it, and it lands in memory in one piece before
+  anything looks at it. The body is read in pieces and stopped at
+  `MARMITON_MAX_BODY_BYTES`, eight megabytes by default.
+
 ## 2.0.1
 
 - **Every tool is documented, with its arguments and what its answer carries.**

package/PRIVACY.md

@@ -55,11 +55,12 @@ becomes of them. `MARMITON_LOG_LEVEL` governs how much is written and defaults t
 
 ## The settings that change any of this
 
-| Variable                | What it changes                                                                                                  |
-| ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| `MARMITON_USER_AGENT`   | Adds your own identifier in front of this project's, which stays appended so the site can always reach a person. |
-| `MARMITON_CACHE_TTL_MS` | How long an answer is held in memory. `0` turns the cache off.                                                   |
-| `MARMITON_LOG_LEVEL`    | How much is written to stderr.                                                                                   |
+| Variable                  | What it changes                                                                                                  |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| `MARMITON_USER_AGENT`     | Adds your own identifier in front of this project's, which stays appended so the site can always reach a person. |
+| `MARMITON_CACHE_TTL_MS`   | How long an answer is held in memory. `0` turns the cache off.                                                   |
+| `MARMITON_MAX_BODY_BYTES` | The largest page this reads. A page past it is refused rather than held.                                         |
+| `MARMITON_LOG_LEVEL`      | How much is written to stderr.                                                                                   |
 
 ## Children
 
@@ -131,11 +132,12 @@ qu'ils deviennent. `MARMITON_LOG_LEVEL` règle leur quantité et vaut `error` pa
 
 ## Les réglages qui changent tout cela
 
-| Variable                | Ce qu'elle change                                                                                                        |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| `MARMITON_USER_AGENT`   | Ajoute votre identifiant devant celui du projet, qui reste accolé pour que le site puisse toujours joindre une personne. |
-| `MARMITON_CACHE_TTL_MS` | Combien de temps une réponse est gardée en mémoire. `0` éteint le cache.                                                 |
-| `MARMITON_LOG_LEVEL`    | La quantité écrite sur stderr.                                                                                           |
+| Variable                  | Ce qu'elle change                                                                                                        |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| `MARMITON_USER_AGENT`     | Ajoute votre identifiant devant celui du projet, qui reste accolé pour que le site puisse toujours joindre une personne. |
+| `MARMITON_CACHE_TTL_MS`   | Combien de temps une réponse est gardée en mémoire. `0` éteint le cache.                                                 |
+| `MARMITON_MAX_BODY_BYTES` | La plus grande page lue. Au-delà, la page est refusée plutôt que gardée.                                                 |
+| `MARMITON_LOG_LEVEL`      | La quantité écrite sur stderr.                                                                                           |
 
 ## Les enfants
 

package/README.md

@@ -6,6 +6,7 @@
 [![MCP Registry](https://img.shields.io/badge/MCP_Registry-listed-6E56CF)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.smeet666/mcp-marmiton)
 [![Glama](https://glama.ai/mcp/servers/smeet666/mcp-marmiton/badges/score.svg)](https://glama.ai/mcp/servers/smeet666/mcp-marmiton)
 [![M8ven](https://m8ven.ai/badge/mcp/smeet666-mcp-marmiton-1f9qvs?variant=verified)](https://m8ven.ai/mcp/smeet666-mcp-marmiton-1f9qvs)
+[![LobeHub](https://lobehub.com/badge/mcp/smeet666-mcp-marmiton)](https://lobehub.com/mcp/smeet666-mcp-marmiton)
 [![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=marmiton&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIm1jcC1tYXJtaXRvbiJdfQ%3D%3D)
 [![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat&logo=visualstudiocode&logoColor=white)](https://insiders.vscode.dev/redirect/mcp/install?name=marmiton&config=%7B%22name%22%3A%22marmiton%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22mcp-marmiton%22%5D%7D)
 
@@ -62,7 +63,7 @@ Node 24 or later is required, and no environment variable has to be set.
   "mcpServers": {
     "marmiton": {
       "command": "docker",
-      "args": ["run", "-i", "--rm", "ghcr.io/smeet666/mcp-marmiton:2.0.1"]
+      "args": ["run", "-i", "--rm", "ghcr.io/smeet666/mcp-marmiton:2.1.0"]
     }
   }
 }
@@ -74,7 +75,7 @@ because a TTY rewrites the stream. The container needs outbound HTTPS to
 
 ### Bundle, without npm
 
-Download `mcp-marmiton-2.0.1.mcpb` from
+Download `mcp-marmiton-2.1.0.mcpb` from
 [the latest release](https://github.com/smeet666/mcp-marmiton/releases/latest)
 and open it. A client that supports MCP bundles installs it on its own, with no
 npm and no configuration file to edit. The bundle carries its dependencies, so
@@ -193,6 +194,7 @@ Every variable is optional. Set them in the `env` block of your client config.
 | `MARMITON_MAX_RETRIES`       | `3`                  | Attempts after a transient failure, from 0 to 10.                                                   |
 | `MARMITON_CACHE_TTL_MS`      | `900000`             | How long a page stays in memory, from 0 to 86400000.                                                |
 | `MARMITON_CACHE_MAX_ENTRIES` | `200`                | Pages held in memory at once, from 0 to 10000.                                                      |
+| `MARMITON_MAX_BODY_BYTES`    | `8000000`            | Largest page this reads, in bytes, from 100000 to 64000000.                                         |
 | `MARMITON_LOG_LEVEL`         | `error`              | `silent`, `error`, `info` or `debug`, written to stderr.                                            |
 
 A value outside its range falls back to the default, and the reason is written to
@@ -331,7 +333,7 @@ renseigner.
   "mcpServers": {
     "marmiton": {
       "command": "docker",
-      "args": ["run", "-i", "--rm", "ghcr.io/smeet666/mcp-marmiton:2.0.1"]
+      "args": ["run", "-i", "--rm", "ghcr.io/smeet666/mcp-marmiton:2.1.0"]
     }
   }
 }
@@ -344,7 +346,7 @@ aucun identifiant.
 
 ### Bundle, sans npm
 
-Téléchargez `mcp-marmiton-2.0.1.mcpb` depuis
+Téléchargez `mcp-marmiton-2.1.0.mcpb` depuis
 [la dernière publication](https://github.com/smeet666/mcp-marmiton/releases/latest)
 et ouvrez-le. Un client qui gère les bundles MCP l'installe seul, sans npm et
 sans fichier de configuration à modifier. Le bundle emporte ses dépendances, donc
@@ -466,6 +468,7 @@ configuration du client.
 | `MARMITON_MAX_RETRIES`       | `3`                  | Tentatives après un échec passager, de 0 à 10.                                                            |
 | `MARMITON_CACHE_TTL_MS`      | `900000`             | Durée pendant laquelle une page reste en mémoire, de 0 à 86400000.                                        |
 | `MARMITON_CACHE_MAX_ENTRIES` | `200`                | Pages gardées en mémoire à la fois, de 0 à 10000.                                                         |
+| `MARMITON_MAX_BODY_BYTES`    | `8000000`            | Plus grande page lue, en octets, de 100000 à 64000000.                                                    |
 | `MARMITON_LOG_LEVEL`         | `error`              | `silent`, `error`, `info` ou `debug`, écrit sur la sortie d'erreur.                                       |
 
 Une valeur hors de sa plage retombe sur le défaut, et la raison est écrite sur la

package/dist/index.js

@@ -8,7 +8,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import process from "process";
 
 // src/version.ts
-var PKG_VERSION = "2.0.1";
+var PKG_VERSION = "2.1.0";
 var REPO_URL = "https://github.com/smeet666/mcp-marmiton";
 
 // src/config.ts
@@ -19,6 +19,10 @@ var DEFAULTS = {
   maxRetries: 3,
   cacheTtlMs: 15 * 60 * 1e3,
   cacheMaxEntries: 200,
+  // Recipe pages run to tens of kilobytes. A body an order of magnitude past
+  // that is a page this reader has no reading for, and finding that out by
+  // holding it costs the caller the memory and the site the transfer.
+  maxBodyBytes: 8e6,
   logLevel: "error"
 };
 var MIN_ALLOWED_INTERVAL_MS = 500;
@@ -99,6 +103,11 @@ function loadConfig(env = process.env) {
       max: 1e4,
       fallback: DEFAULTS.cacheMaxEntries
     }),
+    maxBodyBytes: readNumber("MARMITON_MAX_BODY_BYTES", env, {
+      min: 1e5,
+      max: 64e6,
+      fallback: DEFAULTS.maxBodyBytes
+    }),
     logLevel
   };
 }
@@ -324,6 +333,36 @@ function readAnswer(url, status, body, retryAfterMs, ownGuessMs) {
   }
   return { kind: "usable" };
 }
+async function readBounded(response, maxBytes, url) {
+  const stream = response.body;
+  if (!stream) {
+    return await response.text();
+  }
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  const parts = [];
+  let held = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      held += value.byteLength;
+      if (held > maxBytes) {
+        throw parseFailure(
+          url,
+          `the page carries more than the ${maxBytes} bytes this reads for one page`
+        );
+      }
+      parts.push(decoder.decode(value, { stream: true }));
+    }
+  } finally {
+    await reader.cancel().catch(() => void 0);
+  }
+  parts.push(decoder.decode());
+  return parts.join("");
+}
 async function fetchHtml(url, deps) {
   const { config, limiter, logger } = deps;
   const doFetch = deps.fetchImpl ?? fetch;
@@ -353,7 +392,7 @@ async function fetchHtml(url, deps) {
         });
         status = response.status;
         retryAfterMs = parseRetryAfter(response.headers.get("retry-after"));
-        body = await response.text();
+        body = await readBounded(response, config.maxBodyBytes, url);
       } catch (error) {
         lastError = asTransportError(error, url);
         logger.debug(`${lastError.code} for ${url}: ${lastError.message}`);