mcp-wordpress 1.5.2 → 2.0.0

package/src/docs/DocumentationGenerator.ts

@@ -138,7 +138,7 @@ export class DocumentationGenerator {
    * Generate complete documentation for all tools and types
    */
   async generateFullDocumentation(): Promise<DocumentationOutput> {
-    console.log("🚀 Starting API documentation generation...");
+    console.error("🚀 Starting API documentation generation...");
 
     const tools = await this.extractAllToolDocumentation();
     const categories = this.generateCategoryDocumentation(tools);
@@ -162,9 +162,7 @@ export class DocumentationGenerator {
     // Write documentation to files
     await this.writeDocumentationFiles(output);
 
-    console.log(
-      `✅ Documentation generation complete! ${tools.length} tools documented.`,
-    );
+    console.error(`✅ Documentation generation complete! ${tools.length} tools documented.`);
     return output;
   }
 
@@ -190,18 +188,11 @@ export class DocumentationGenerator {
         const category = this.extractCategoryFromClassName(className);
 
         for (const toolDef of toolDefinitions) {
-          const doc = await this.extractToolDocumentation(
-            toolDef,
-            category,
-            className,
-          );
+          const doc = await this.extractToolDocumentation(toolDef, category, className);
           toolDocs.push(doc);
         }
       } catch (error) {
-        console.warn(
-          `⚠️ Failed to extract documentation for ${className}:`,
-          error,
-        );
+        console.warn(`⚠️ Failed to extract documentation for ${className}:`, error);
       }
     }
 
@@ -216,9 +207,7 @@ export class DocumentationGenerator {
     category: string,
     className: string,
   ): Promise<ToolDocumentation> {
-    const parameters = this.extractParameterDocumentation(
-      toolDef.parameters || [],
-    );
+    const parameters = this.extractParameterDocumentation(toolDef.parameters || []);
     const examples = this.generateToolExamples(toolDef, category);
     const wordpressEndpoint = this.wordpressEndpoints.get(toolDef.name);
     const returnType = this.inferReturnType(toolDef.name, category);
@@ -242,9 +231,7 @@ export class DocumentationGenerator {
   /**
    * Extract parameter documentation
    */
-  private extractParameterDocumentation(
-    parameters: any[],
-  ): ParameterDocumentation[] {
+  private extractParameterDocumentation(parameters: any[]): ParameterDocumentation[] {
     return parameters.map((param) => ({
       name: param.name,
       type: param.type || "string",
@@ -259,10 +246,7 @@ export class DocumentationGenerator {
   /**
    * Generate usage examples for tools
    */
-  private generateToolExamples(
-    toolDef: ToolDefinition,
-    category: string,
-  ): ExampleUsage[] {
+  private generateToolExamples(toolDef: ToolDefinition, category: string): ExampleUsage[] {
     const examples: ExampleUsage[] = [];
 
     // Basic usage example
@@ -291,10 +275,7 @@ export class DocumentationGenerator {
   /**
    * Generate basic usage example
    */
-  private generateBasicExample(
-    toolDef: ToolDefinition,
-    category: string,
-  ): ExampleUsage | null {
+  private generateBasicExample(toolDef: ToolDefinition, category: string): ExampleUsage | null {
     const toolName = toolDef.name;
     const basicParams: Record<string, any> = {};
 
@@ -310,11 +291,7 @@ export class DocumentationGenerator {
       description: `Simple example of using ${toolName}`,
       command: toolName,
       parameters: basicParams,
-      expectedResponse: this.generateExpectedResponse(
-        toolName,
-        category,
-        "basic",
-      ),
+      expectedResponse: this.generateExpectedResponse(toolName, category, "basic"),
       errorExample: {
         scenario: "Authentication failure",
         error: {
@@ -328,10 +305,7 @@ export class DocumentationGenerator {
   /**
    * Generate multi-site example
    */
-  private generateMultiSiteExample(
-    toolDef: ToolDefinition,
-    category: string,
-  ): ExampleUsage | null {
+  private generateMultiSiteExample(toolDef: ToolDefinition, category: string): ExampleUsage | null {
     const params = { site: "site1", ...this.getExampleParameters(toolDef, 1) };
 
     return {
@@ -339,21 +313,14 @@ export class DocumentationGenerator {
       description: `Using ${toolDef.name} with specific site targeting`,
       command: toolDef.name,
       parameters: params,
-      expectedResponse: this.generateExpectedResponse(
-        toolDef.name,
-        category,
-        "multisite",
-      ),
+      expectedResponse: this.generateExpectedResponse(toolDef.name, category, "multisite"),
     };
   }
 
   /**
    * Generate advanced example with all parameters
    */
-  private generateAdvancedExample(
-    toolDef: ToolDefinition,
-    category: string,
-  ): ExampleUsage | null {
+  private generateAdvancedExample(toolDef: ToolDefinition, category: string): ExampleUsage | null {
     const allParams = this.getExampleParameters(toolDef, "all");
 
     if (Object.keys(allParams).length <= 2) {
@@ -365,20 +332,14 @@ export class DocumentationGenerator {
       description: "Comprehensive example using all available parameters",
       command: toolDef.name,
       parameters: allParams,
-      expectedResponse: this.generateExpectedResponse(
-        toolDef.name,
-        category,
-        "advanced",
-      ),
+      expectedResponse: this.generateExpectedResponse(toolDef.name, category, "advanced"),
     };
   }
 
   /**
    * Generate category documentation
    */
-  private generateCategoryDocumentation(
-    tools: ToolDocumentation[],
-  ): CategoryDocumentation[] {
+  private generateCategoryDocumentation(tools: ToolDocumentation[]): CategoryDocumentation[] {
     const categories = new Map<string, ToolDocumentation[]>();
 
     // Group tools by category
@@ -389,15 +350,13 @@ export class DocumentationGenerator {
       categories.get(tool.category)!.push(tool);
     }
 
-    return Array.from(categories.entries()).map(
-      ([categoryName, categoryTools]) => ({
-        name: categoryName,
-        description: this.getCategoryDescription(categoryName),
-        toolCount: categoryTools.length,
-        tools: categoryTools.map((t) => t.name).sort(),
-        usagePatterns: this.generateUsagePatterns(categoryName, categoryTools),
-      }),
-    );
+    return Array.from(categories.entries()).map(([categoryName, categoryTools]) => ({
+      name: categoryName,
+      description: this.getCategoryDescription(categoryName),
+      toolCount: categoryTools.length,
+      tools: categoryTools.map((t) => t.name).sort(),
+      usagePatterns: this.generateUsagePatterns(categoryName, categoryTools),
+    }));
   }
 
   /**
@@ -446,10 +405,7 @@ export class DocumentationGenerator {
   /**
    * Generate OpenAPI specification
    */
-  private generateOpenAPISpecification(
-    tools: ToolDocumentation[],
-    types: TypeDocumentation[],
-  ): OpenAPISpecification {
+  private generateOpenAPISpecification(tools: ToolDocumentation[], types: TypeDocumentation[]): OpenAPISpecification {
     const paths: Record<string, any> = {};
     const components: Record<string, any> = {
       schemas: {},
@@ -524,9 +480,7 @@ export class DocumentationGenerator {
   /**
    * Write all documentation files
    */
-  private async writeDocumentationFiles(
-    output: DocumentationOutput,
-  ): Promise<void> {
+  private async writeDocumentationFiles(output: DocumentationOutput): Promise<void> {
     const outputDir = this.config.outputDir;
 
     // Ensure output directory exists
@@ -560,19 +514,13 @@ export class DocumentationGenerator {
 
     // Write OpenAPI specification
     if (output.openApiSpec) {
-      await fs.promises.writeFile(
-        path.join(outputDir, "openapi.json"),
-        JSON.stringify(output.openApiSpec, null, 2),
-      );
+      await fs.promises.writeFile(path.join(outputDir, "openapi.json"), JSON.stringify(output.openApiSpec, null, 2));
     }
 
     // Write summary
-    await fs.promises.writeFile(
-      path.join(outputDir, "summary.json"),
-      JSON.stringify(output.summary, null, 2),
-    );
+    await fs.promises.writeFile(path.join(outputDir, "summary.json"), JSON.stringify(output.summary, null, 2));
 
-    console.log(`📁 Documentation written to ${outputDir}/`);
+    console.error(`📁 Documentation written to ${outputDir}/`);
   }
 
   // Helper methods for specific documentation tasks...
@@ -624,8 +572,7 @@ export class DocumentationGenerator {
       version: "1.2.0",
       coverage: {
         toolsWithExamples: tools.filter((t) => t.examples.length > 0).length,
-        toolsWithWordPressMapping: tools.filter((t) => t.wordpressEndpoint)
-          .length,
+        toolsWithWordPressMapping: tools.filter((t) => t.wordpressEndpoint).length,
         typesDocumented: types.length,
       },
     };
@@ -709,11 +656,7 @@ export class DocumentationGenerator {
     return exampleValues[param.name] || "example_value";
   }
 
-  private generateExpectedResponse(
-    toolName: string,
-    category: string,
-    type: string,
-  ): any {
+  private generateExpectedResponse(toolName: string, category: string, type: string): any {
     if (toolName.includes("list")) {
       return {
         success: true,
@@ -781,10 +724,7 @@ export class DocumentationGenerator {
     };
   }
 
-  private getExampleParameters(
-    toolDef: ToolDefinition,
-    type: string | number,
-  ): Record<string, any> {
+  private getExampleParameters(toolDef: ToolDefinition, type: string | number): Record<string, any> {
     const params: Record<string, any> = {};
     const parameters = toolDef.parameters || [];
 
@@ -816,16 +756,10 @@ export class DocumentationGenerator {
       cache: "Performance caching and optimization tools",
       performance: "Performance monitoring and analytics tools",
     };
-    return (
-      descriptions[categoryName.toLowerCase()] ||
-      `${categoryName} management tools`
-    );
+    return descriptions[categoryName.toLowerCase()] || `${categoryName} management tools`;
   }
 
-  private generateUsagePatterns(
-    categoryName: string,
-    tools: ToolDocumentation[],
-  ): string[] {
+  private generateUsagePatterns(categoryName: string, tools: ToolDocumentation[]): string[] {
     const patterns: Record<string, string[]> = {
       posts: [
         "Create and publish blog posts",
@@ -865,8 +799,7 @@ export class DocumentationGenerator {
     return {
       id: 123,
       title: "Welcome to WordPress",
-      content:
-        "<p>This is your first post. Edit or delete it to get started!</p>",
+      content: "<p>This is your first post. Edit or delete it to get started!</p>",
       status: "publish",
       date: "2024-01-01T00:00:00Z",
       author: 1,
@@ -953,8 +886,7 @@ export class DocumentationGenerator {
         code: "AUTHENTICATION_FAILED",
         message: "Authentication failed",
         description: "Invalid credentials or insufficient permissions",
-        resolution:
-          "Check your authentication credentials and user permissions",
+        resolution: "Check your authentication credentials and user permissions",
       },
       {
         code: "VALIDATION_ERROR",
@@ -972,8 +904,7 @@ export class DocumentationGenerator {
         code: "PERMISSION_DENIED",
         message: "Insufficient permissions",
         description: "The user does not have permission to perform this action",
-        resolution:
-          "Contact an administrator to grant the necessary permissions",
+        resolution: "Contact an administrator to grant the necessary permissions",
       },
     ];
   }
@@ -1012,10 +943,7 @@ export class DocumentationGenerator {
     const formatter = new MarkdownFormatter();
     const content = formatter.generateApiOverview(output);
 
-    await fs.promises.writeFile(
-      path.join(this.config.outputDir, "README.md"),
-      content,
-    );
+    await fs.promises.writeFile(path.join(this.config.outputDir, "README.md"), content);
   }
 
   private async writeToolDocumentation(tool: ToolDocumentation): Promise<void> {
@@ -1023,25 +951,16 @@ export class DocumentationGenerator {
     const formatter = new MarkdownFormatter();
     const content = formatter.generateToolDocumentation(tool);
 
-    await fs.promises.writeFile(
-      path.join(this.config.outputDir, "tools", `${tool.name}.md`),
-      content,
-    );
+    await fs.promises.writeFile(path.join(this.config.outputDir, "tools", `${tool.name}.md`), content);
   }
 
-  private async writeCategoryDocumentation(
-    category: CategoryDocumentation,
-  ): Promise<void> {
+  private async writeCategoryDocumentation(category: CategoryDocumentation): Promise<void> {
     const { MarkdownFormatter } = await import("./MarkdownFormatter.js");
     const formatter = new MarkdownFormatter();
     const content = formatter.generateCategoryDocumentation(category);
 
     await fs.promises.writeFile(
-      path.join(
-        this.config.outputDir,
-        "categories",
-        `${category.name.toLowerCase()}.md`,
-      ),
+      path.join(this.config.outputDir, "categories", `${category.name.toLowerCase()}.md`),
       content,
     );
   }
@@ -1051,9 +970,6 @@ export class DocumentationGenerator {
     const formatter = new MarkdownFormatter();
     const content = formatter.generateTypeDocumentation(type);
 
-    await fs.promises.writeFile(
-      path.join(this.config.outputDir, "types", `${type.name}.md`),
-      content,
-    );
+    await fs.promises.writeFile(path.join(this.config.outputDir, "types", `${type.name}.md`), content);
   }
 }

package/src/dxt-entry.cjs

@@ -16,6 +16,9 @@ console.error(`DEBUG: Current working directory: ${process.cwd()}`);
 console.error(`DEBUG: __dirname: ${__dirname}`);
 console.error(`DEBUG: Node version: ${process.version}`);
 
+// Set DXT mode environment variable
+process.env.NODE_ENV = "dxt";
+
 console.error("DEBUG: Environment variables passed from DXT:");
 console.error(`  WORDPRESS_SITE_URL: ${process.env.WORDPRESS_SITE_URL ? 'SET' : 'NOT SET'}`);
 console.error(`  WORDPRESS_USERNAME: ${process.env.WORDPRESS_USERNAME ? 'SET' : 'NOT SET'}`);
@@ -30,7 +33,7 @@ async function startDXTServer() {
         console.error("DEBUG: Creating MCPWordPressServer instance from DXT entry point...");
         const server = new MCPWordPressServer();
         
-        console.error("DEBUG: Starting server...");
+        console.error("DEBUG: Starting server (DXT mode - fast startup)...");
         await server.run();
         
         // Handle graceful shutdown

package/src/index.ts

@@ -1,19 +1,12 @@
-console.error("DEBUG: MCP WordPress Server module loading started...");
-
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { fileURLToPath } from "url";
 import { WordPressClient } from "./client/api.js";
-import {
-  ServerConfiguration,
-  SiteConfig,
-} from "./config/ServerConfiguration.js";
+import { ServerConfiguration, SiteConfig } from "./config/ServerConfiguration.js";
 import { ToolRegistry } from "./server/ToolRegistry.js";
 import { ConnectionTester } from "./server/ConnectionTester.js";
 import { getErrorMessage } from "./utils/error.js";
 
-console.error("DEBUG: All imports completed successfully");
-
 // --- Constants ---
 const SERVER_VERSION = "1.1.8"; // Technical debt resolution and modular architecture
 
@@ -26,20 +19,6 @@ class MCPWordPressServer {
   private toolRegistry: ToolRegistry;
 
   constructor(mcpConfig?: any) {
-    // Add debugging output for DXT troubleshooting
-    console.error("DEBUG: Starting MCP WordPress Server initialization...");
-    console.error("DEBUG: Environment variables:");
-    console.error(
-      `  WORDPRESS_SITE_URL: ${process.env.WORDPRESS_SITE_URL ? "SET" : "NOT SET"}`,
-    );
-    console.error(
-      `  WORDPRESS_USERNAME: ${process.env.WORDPRESS_USERNAME ? "SET" : "NOT SET"}`,
-    );
-    console.error(
-      `  WORDPRESS_APP_PASSWORD: ${process.env.WORDPRESS_APP_PASSWORD ? "SET" : "NOT SET"}`,
-    );
-    console.error(`  Working directory: ${process.cwd()}`);
-
     this.loadConfiguration(mcpConfig);
 
     if (this.wordpressClients.size === 0) {
@@ -64,8 +43,7 @@ class MCPWordPressServer {
 
   private loadConfiguration(mcpConfig?: any) {
     const serverConfig = ServerConfiguration.getInstance();
-    const { clients, configs } =
-      serverConfig.loadClientConfigurations(mcpConfig);
+    const { clients, configs } = serverConfig.loadClientConfigurations(mcpConfig);
 
     this.wordpressClients = clients;
     this.siteConfigs = configs;
@@ -81,21 +59,45 @@ class MCPWordPressServer {
   }
 
   async run() {
-    if (!this.initialized) {
-      await this.testClientConnections();
+    // Skip connection testing in DXT environment to prevent timeouts
+    const isDXTMode = process.env.NODE_ENV === "dxt" || process.argv[0]?.includes("dxt-entry");
+
+    if (!this.initialized && !isDXTMode) {
+      console.error("INFO: Testing connections to configured WordPress sites...");
+      try {
+        await this.testClientConnections();
+      } catch (error) {
+        console.error(`WARNING: Connection test failed: ${getErrorMessage(error)}`);
+        console.error("INFO: Continuing with server startup. Tools will be available but connections may fail.");
+      }
+    } else if (isDXTMode) {
+      console.error("INFO: DXT mode detected - skipping connection tests for faster startup");
+      this.initialized = true;
     }
+
     console.error("INFO: Starting MCP WordPress Server...");
 
-    // Connect to stdio transport
+    // Connect to stdio transport with timeout
     const transport = new StdioServerTransport();
-    await this.server.connect(transport);
 
-    console.error(
-      `INFO: Server started and connected. Tools available for ${this.wordpressClients.size} site(s).`,
-    );
+    // Add timeout protection for server connection
+    const connectionTimeout = setTimeout(() => {
+      console.error("ERROR: Server connection timed out after 30 seconds");
+      process.exit(1);
+    }, 30000);
+
+    try {
+      await this.server.connect(transport);
+      clearTimeout(connectionTimeout);
+
+      console.error(`INFO: Server started and connected. Tools available for ${this.wordpressClients.size} site(s).`);
 
-    // Keep the process alive
-    process.stdin.resume();
+      // Keep the process alive
+      process.stdin.resume();
+    } catch (error) {
+      clearTimeout(connectionTimeout);
+      throw error;
+    }
   }
 
   async shutdown() {
@@ -107,16 +109,8 @@ class MCPWordPressServer {
 
 // --- Main Execution ---
 async function main() {
-  console.error("DEBUG: main() function started");
-  console.error(`DEBUG: process.argv: ${JSON.stringify(process.argv)}`);
-  console.error(
-    `DEBUG: fileURLToPath(import.meta.url): ${fileURLToPath(import.meta.url)}`,
-  );
-
   try {
-    console.error("DEBUG: Creating MCPWordPressServer instance...");
     const mcpServer = new MCPWordPressServer();
-    console.error("DEBUG: MCPWordPressServer created, calling run()...");
     await mcpServer.run();
 
     const shutdown = async () => {
@@ -128,18 +122,10 @@ async function main() {
     process.on("SIGTERM", shutdown);
   } catch (error) {
     console.error(`FATAL: Failed to start server: ${getErrorMessage(error)}`);
-    console.error(`FATAL: Error stack: ${(error as Error).stack}`);
     process.exit(1);
   }
 }
 
-console.error(
-  `DEBUG: Checking if should run main - process.argv[1]: ${process.argv[1]}`,
-);
-console.error(
-  `DEBUG: fileURLToPath(import.meta.url): ${fileURLToPath(import.meta.url)}`,
-);
-
 // Check if running as main module - handle both direct execution and DXT entry point
 const isMainModule =
   process.argv[1] === fileURLToPath(import.meta.url) ||
@@ -148,12 +134,7 @@ const isMainModule =
   !process.argv[1]; // When run through DXT, process.argv[1] might be undefined
 
 if (isMainModule) {
-  console.error("DEBUG: Running main function...");
   main();
-} else {
-  console.error(
-    "DEBUG: Not running main function - module imported, not executed directly",
-  );
 }
 
 export default MCPWordPressServer;

package/src/security/InputValidator.ts

@@ -10,8 +10,7 @@ const URL_PATTERN = /^https?:\/\/[^\s<>'"{}|\\^`\[\]]+$/;
 const EMAIL_PATTERN = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
 const SLUG_PATTERN = /^[a-z0-9-]+$/;
 const SCRIPT_PATTERN = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
-const SQL_INJECTION_PATTERN =
-  /('|(\\')|(;)|(\\x00)|(\\n)|(\\r)|(\\x1a)|(\\x22)|(\\x27)|(\\x5c)|(\\x60))/i;
+const SQL_INJECTION_PATTERN = /('|(\\')|(;)|(\\x00)|(\\n)|(\\r)|(\\x1a)|(\\x22)|(\\x27)|(\\x5c)|(\\x60))/i;
 
 /**
  * Security validation schemas
@@ -22,10 +21,7 @@ export const SecuritySchemas = {
     .string()
     .max(10000, "String too long")
     .refine((val) => !SCRIPT_PATTERN.test(val), "Script tags not allowed")
-    .refine(
-      (val) => !val.includes("javascript:"),
-      "JavaScript URLs not allowed",
-    )
+    .refine((val) => !val.includes("javascript:"), "JavaScript URLs not allowed")
     .refine((val) => !val.includes("data:"), "Data URLs not allowed")
     .refine((val) => !val.includes("onerror="), "Event handlers not allowed")
     .refine((val) => !val.includes("onload="), "Event handlers not allowed")
@@ -36,10 +32,7 @@ export const SecuritySchemas = {
     .string()
     .max(100000, "Content too long")
     .refine((val) => !SCRIPT_PATTERN.test(val), "Script tags not allowed")
-    .refine(
-      (val) => !val.includes("javascript:"),
-      "JavaScript URLs not allowed",
-    )
+    .refine((val) => !val.includes("javascript:"), "JavaScript URLs not allowed")
     .refine((val) => !val.includes("on[a-z]+="), "Event handlers not allowed"),
 
   // URL validation
@@ -47,10 +40,7 @@ export const SecuritySchemas = {
     .string()
     .url("Invalid URL format")
     .regex(URL_PATTERN, "URL contains invalid characters")
-    .refine(
-      (val) => !val.includes("javascript:"),
-      "JavaScript URLs not allowed",
-    )
+    .refine((val) => !val.includes("javascript:"), "JavaScript URLs not allowed")
     .refine((val) => !val.includes("data:"), "Data URLs not allowed"),
 
   // Email validation
@@ -65,49 +55,30 @@ export const SecuritySchemas = {
     .string()
     .min(1, "Slug cannot be empty")
     .max(100, "Slug too long")
-    .regex(
-      SLUG_PATTERN,
-      "Slug can only contain lowercase letters, numbers, and hyphens",
-    ),
+    .regex(SLUG_PATTERN, "Slug can only contain lowercase letters, numbers, and hyphens"),
 
   // WordPress post/page content
   wpContent: z
     .string()
     .max(1000000, "Content too long")
-    .refine(
-      (val) => !SCRIPT_PATTERN.test(val),
-      "Script tags not allowed in content",
-    )
-    .refine(
-      (val) => !val.includes("javascript:"),
-      "JavaScript URLs not allowed",
-    ),
+    .refine((val) => !SCRIPT_PATTERN.test(val), "Script tags not allowed in content")
+    .refine((val) => !val.includes("javascript:"), "JavaScript URLs not allowed"),
 
   // Site ID validation
   siteId: z
     .string()
     .min(1, "Site ID cannot be empty")
     .max(50, "Site ID too long")
-    .regex(
-      /^[a-zA-Z0-9\-_]+$/,
-      "Site ID can only contain letters, numbers, hyphens, and underscores",
-    ),
+    .regex(/^[a-zA-Z0-9\-_]+$/, "Site ID can only contain letters, numbers, hyphens, and underscores"),
 
   // WordPress ID (numeric)
-  wpId: z
-    .number()
-    .int("ID must be an integer")
-    .positive("ID must be positive")
-    .max(999999999, "ID too large"),
+  wpId: z.number().int("ID must be an integer").positive("ID must be positive").max(999999999, "ID too large"),
 
   // Search query with SQL injection protection
   searchQuery: z
     .string()
     .max(500, "Search query too long")
-    .refine(
-      (val) => !SQL_INJECTION_PATTERN.test(val),
-      "Invalid characters in search query",
-    )
+    .refine((val) => !SQL_INJECTION_PATTERN.test(val), "Invalid characters in search query")
     .refine((val) => !val.includes("--"), "SQL comments not allowed")
     .refine((val) => !val.includes("/*"), "SQL comments not allowed"),
 
@@ -188,11 +159,7 @@ export class InputSanitizer {
  * Security validation decorator for tool methods
  */
 export function validateSecurity(schema: z.ZodSchema) {
-  return function (
-    target: any,
-    propertyName: string,
-    descriptor: PropertyDescriptor,
-  ) {
+  return function (target: any, propertyName: string, descriptor: PropertyDescriptor) {
     const method = descriptor.value;
 
     descriptor.value = async function (...args: any[]) {
@@ -202,7 +169,7 @@ export function validateSecurity(schema: z.ZodSchema) {
         const validatedParams = schema.parse(params);
 
         // Log security validation (without sensitive data)
-        console.log(`Security validation passed for ${propertyName}`, {
+        console.error(`Security validation passed for ${propertyName}`, {
           timestamp: new Date().toISOString(),
           method: propertyName,
           paramCount: Object.keys(validatedParams).length,
@@ -215,12 +182,7 @@ export function validateSecurity(schema: z.ZodSchema) {
         console.error(`Security validation failed for ${propertyName}`, {
           timestamp: new Date().toISOString(),
           method: propertyName,
-          error:
-            error instanceof z.ZodError
-              ? error.errors
-              : error instanceof Error
-                ? error.message
-                : String(error),
+          error: error instanceof z.ZodError ? error.errors : error instanceof Error ? error.message : String(error),
         });
 
         throw new SecurityValidationError(
@@ -229,8 +191,7 @@ export function validateSecurity(schema: z.ZodSchema) {
             ? error.errors
             : [
                 {
-                  message:
-                    error instanceof Error ? error.message : String(error),
+                  message: error instanceof Error ? error.message : String(error),
                 },
               ],
         );
@@ -328,10 +289,7 @@ export const ToolSchemas = {
  * Rate limiting and DoS protection
  */
 export class SecurityLimiter {
-  private static requestCounts = new Map<
-    string,
-    { count: number; resetTime: number }
-  >();
+  private static requestCounts = new Map<string, { count: number; resetTime: number }>();
   private static readonly RATE_LIMIT = 1000; // requests per window
   private static readonly WINDOW_MS = 60 * 1000; // 1 minute