mcp-medic 1.2.7 → 1.2.8

package/dist/fleet.js

@@ -3,7 +3,7 @@ import { resolve, join } from 'node:path';
 import { loadConfig } from './config-loader.js';
 import { runChecks } from './orchestrator.js';
 import { allChecks } from './checks/index.js';
-import { redactRecord } from './redact.js';
+import { isSecretKey, redactDeep, redactRecord } from './redact.js';
 async function mapWithConcurrency(items, concurrency, worker) {
     const results = new Array(items.length);
     let nextIndex = 0;
@@ -18,6 +18,74 @@ async function mapWithConcurrency(items, concurrency, worker) {
     }));
     return results;
 }
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [key, canonicalize(value[key])]));
+    }
+    return value;
+}
+function stableStringify(value) {
+    return JSON.stringify(canonicalize(value)) ?? 'undefined';
+}
+function redactInlineSecrets(value) {
+    return value
+        .replace(/(\bBearer\s+)[^\s,;"']+/gi, '$1[REDACTED]')
+        .replace(/([a-z0-9_.-]*(?:authorization|token|secret|password|passwd|pwd|api[-_]?key|apikey|cookie|credential|bearer)[a-z0-9_.-]*\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1[REDACTED]');
+}
+function redactArgs(args) {
+    if (!args)
+        return args;
+    const result = [...args];
+    for (let i = 0; i < result.length; i += 1) {
+        const arg = result[i];
+        const equalsIndex = arg.indexOf('=');
+        if (equalsIndex >= 0 && isSecretKey(arg.slice(0, equalsIndex).replace(/^-+/, ''))) {
+            result[i] = `${arg.slice(0, equalsIndex + 1)}[REDACTED]`;
+        }
+        else if (isSecretKey(arg.replace(/^-+/, '')) && i + 1 < result.length) {
+            result[i + 1] = '[REDACTED]';
+            i += 1;
+        }
+    }
+    return result.map(redactInlineSecrets);
+}
+/** Removes URL credentials and secret-looking query/fragment values before a diff is displayed. */
+function redactUrl(value) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const url = new URL(value);
+        if (url.username)
+            url.username = '[REDACTED]';
+        if (url.password)
+            url.password = '[REDACTED]';
+        for (const key of [...url.searchParams.keys()]) {
+            if (isSecretKey(key))
+                url.searchParams.set(key, '[REDACTED]');
+        }
+        if (url.hash)
+            url.hash = '[REDACTED]';
+        return url.toString();
+    }
+    catch {
+        // Invalid URL-like values still get a conservative pass over common credential forms.
+        return value
+            .replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@?#]+@/i, '$1[REDACTED]@')
+            .replace(/([?&])([^=&#]+)=([^&#]*)/g, (match, separator, rawKey) => {
+            let key = rawKey;
+            try {
+                key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+            }
+            catch { /* retain raw key */ }
+            return isSecretKey(key) ? `${separator}${rawKey}=[REDACTED]` : match;
+        })
+            .replace(/#.*$/, '#[REDACTED]');
+    }
+}
 function findFilesMatching(dir, rootDir, pattern, results = []) {
     if (!existsSync(dir))
         return results;
@@ -145,20 +213,41 @@ export function diffConfigs(configA, configB) {
                 changes.push({ field: 'transport', from: serverA.transport, to: serverB.transport });
             }
             if (serverA.command !== serverB.command) {
-                changes.push({ field: 'command', from: serverA.command, to: serverB.command });
+                changes.push({
+                    field: 'command',
+                    from: serverA.command === undefined ? undefined : redactInlineSecrets(serverA.command),
+                    to: serverB.command === undefined ? undefined : redactInlineSecrets(serverB.command),
+                });
             }
-            if (JSON.stringify(serverA.args) !== JSON.stringify(serverB.args)) {
-                changes.push({ field: 'args', from: serverA.args, to: serverB.args });
+            if (stableStringify(serverA.args) !== stableStringify(serverB.args)) {
+                changes.push({ field: 'args', from: redactArgs(serverA.args), to: redactArgs(serverB.args) });
             }
-            if (serverA.url !== serverB.url) {
-                changes.push({ field: 'url', from: serverA.url, to: serverB.url });
+            if (stableStringify(serverA.url) !== stableStringify(serverB.url)) {
+                changes.push({ field: 'url', from: redactUrl(serverA.url), to: redactUrl(serverB.url) });
             }
-            if (JSON.stringify(serverA.env) !== JSON.stringify(serverB.env)) {
+            if (stableStringify(serverA.env) !== stableStringify(serverB.env)) {
                 // Report that env changed and which keys, but never raw values —
                 // env vars routinely carry API keys/tokens and diff output gets
                 // pasted into PRs and CI logs.
                 changes.push({ field: 'env', from: redactRecord(serverA.env), to: redactRecord(serverB.env) });
             }
+            if (stableStringify(serverA.headers) !== stableStringify(serverB.headers)) {
+                changes.push({ field: 'headers', from: redactRecord(serverA.headers), to: redactRecord(serverB.headers) });
+            }
+            if (stableStringify(serverA.tokenRefreshUrl) !== stableStringify(serverB.tokenRefreshUrl)) {
+                changes.push({
+                    field: 'tokenRefreshUrl',
+                    from: redactUrl(serverA.tokenRefreshUrl),
+                    to: redactUrl(serverB.tokenRefreshUrl),
+                });
+            }
+            if (stableStringify(serverA.tokenRefreshBody) !== stableStringify(serverB.tokenRefreshBody)) {
+                changes.push({
+                    field: 'tokenRefreshBody',
+                    from: redactDeep(serverA.tokenRefreshBody),
+                    to: redactDeep(serverB.tokenRefreshBody),
+                });
+            }
             if (changes.length > 0) {
                 entries.push({ serverName: name, kind: 'modified', changes });
             }

package/dist/redact.js

@@ -12,7 +12,7 @@ const REDACTED = '[REDACTED]';
 /** Matches key names that conventionally carry secret values. Intentionally
  * broad — false positives (redacting a harmless key) are safe; false
  * negatives (leaking a secret) are not. */
-const SECRET_KEY_PATTERN = /(authorization|auth|token|secret|password|passwd|pwd|api[-_]?key|apikey|cookie|credential|bearer|session|private[-_]?key|client[-_]?secret)/i;
+const SECRET_KEY_PATTERN = /(authorization|auth|token|secret|password|passwd|pwd|api[-_]?key|apikey|access[-_]?key|access[-_]?token|(?:^|[-_])key(?:$|[-_])|cookie|credential|bearer|session|private[-_]?key|client[-_]?secret)/i;
 export function isSecretKey(key) {
     return SECRET_KEY_PATTERN.test(key);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-medic",
-  "version": "1.2.7",
+  "version": "1.2.8",
   "description": "Diagnose broken MCP (Model Context Protocol) server configs before they break your agent silently.",
   "type": "module",
   "main": "dist/index.js",