nuwax-mcp-stdio-proxy 1.4.0 → 1.4.2

package/dist/index.js

@@ -23761,7 +23761,7 @@ var StdioServerTransport = class {
 
 // src/constants.ts
 var PKG_NAME = "nuwax-mcp-stdio-proxy";
-var PKG_VERSION = "1.4.0";
+var PKG_VERSION = "1.4.2";
 
 // src/shared.ts
 async function discoverTools(client) {
@@ -23825,8 +23825,19 @@ function setupGracefulShutdown(cleanupFn) {
   process.on("SIGTERM", () => void shutdown("SIGTERM"));
 }
 
+// src/filter.ts
+function filterTools(tools, filter) {
+  if (filter.allowTools && filter.allowTools.size > 0) {
+    return tools.filter((t) => filter.allowTools.has(t.name));
+  }
+  if (filter.denyTools && filter.denyTools.size > 0) {
+    return tools.filter((t) => !filter.denyTools.has(t.name));
+  }
+  return tools;
+}
+
 // src/modes/stdio.ts
-async function runStdio(config2) {
+async function runStdio(config2, allowTools, denyTools) {
   const entries = Object.entries(config2.mcpServers);
   if (entries.length === 0) {
     logError("No MCP servers configured in mcpServers");
@@ -23854,11 +23865,21 @@ async function runStdio(config2) {
       const { client, cleanup } = connected;
       clients.set(id, client);
       cleanups.set(id, cleanup);
-      const allServerTools = await discoverTools(client);
+      let serverTools = await discoverTools(client);
+      if (entry.allowTools || entry.denyTools) {
+        const perFilter = {};
+        if (entry.allowTools) perFilter.allowTools = new Set(entry.allowTools);
+        if (entry.denyTools) perFilter.denyTools = new Set(entry.denyTools);
+        const before = serverTools.length;
+        serverTools = filterTools(serverTools, perFilter);
+        if (serverTools.length !== before) {
+          logInfo(`Server "${id}": filtered ${before} \u2192 ${serverTools.length} tool(s)`);
+        }
+      }
       logInfo(
-        `Server "${id}": ${allServerTools.length} tool(s)${allServerTools.length > 0 ? " \u2014 " + allServerTools.map((t) => t.name).join(", ") : ""}`
+        `Server "${id}": ${serverTools.length} tool(s)${serverTools.length > 0 ? " \u2014 " + serverTools.map((t) => t.name).join(", ") : ""}`
       );
-      for (const tool of allServerTools) {
+      for (const tool of serverTools) {
         if (toolToClient.has(tool.name)) {
           logWarn(
             `Tool "${tool.name}" from "${id}" shadows existing tool from "${toolToServer.get(tool.name)}"`
@@ -23878,9 +23899,17 @@ async function runStdio(config2) {
   }
   const aggregatedTools = Array.from(toolsByName.values());
   logInfo(`Aggregated ${aggregatedTools.length} unique tool(s) from ${clients.size} server(s)`);
+  const toolFilter = {};
+  if (allowTools) toolFilter.allowTools = new Set(allowTools);
+  if (denyTools) toolFilter.denyTools = new Set(denyTools);
+  const filteredTools = filterTools(aggregatedTools, toolFilter);
+  const filteredNames = new Set(filteredTools.map((t) => t.name));
+  if (filteredTools.length !== aggregatedTools.length) {
+    logInfo(`After filtering: ${filteredTools.length} tool(s) \u2014 ${filteredTools.map((t) => t.name).join(", ")}`);
+  }
   const { server } = await createToolProxyServer({
-    tools: aggregatedTools,
-    resolveClient: (name) => toolToClient.get(name),
+    tools: filteredTools,
+    resolveClient: (name) => filteredNames.has(name) ? toolToClient.get(name) : void 0,
     errorLabel: (name) => `"${name}" (server: "${toolToServer.get(name) || "unknown"}")`
   });
   logInfo("Proxy server running on stdio");
@@ -23907,17 +23936,6 @@ async function runStdio(config2) {
   });
 }
 
-// src/filter.ts
-function filterTools(tools, filter) {
-  if (filter.allowTools && filter.allowTools.size > 0) {
-    return tools.filter((t) => filter.allowTools.has(t.name));
-  }
-  if (filter.denyTools && filter.denyTools.size > 0) {
-    return tools.filter((t) => !filter.denyTools.has(t.name));
-  }
-  return tools;
-}
-
 // src/detect.ts
 async function detectProtocol(url2, headers) {
   logInfo(`Auto-detecting protocol for ${url2}...`);
@@ -25753,14 +25771,33 @@ function parseCliArgs() {
   return parseStdioArgs(args);
 }
 function parseStdioArgs(args) {
-  const idx = args.indexOf("--config");
-  if (idx === -1 || idx + 1 >= args.length) {
+  let configJson;
+  let allowTools;
+  let denyTools;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--config" && i + 1 < args.length) {
+      i++;
+      configJson = args[i];
+    } else if (arg === "--allow-tools" && i + 1 < args.length) {
+      i++;
+      allowTools = args[i].split(",").map((s) => s.trim()).filter(Boolean);
+    } else if (arg === "--deny-tools" && i + 1 < args.length) {
+      i++;
+      denyTools = args[i].split(",").map((s) => s.trim()).filter(Boolean);
+    }
+  }
+  if (!configJson) {
     logError("Missing --config argument");
     logError(`Usage: nuwax-mcp-stdio-proxy --config '{"mcpServers":{...}}'`);
     process.exit(1);
   }
-  const config2 = parseConfigJson(args[idx + 1]);
-  return { mode: "stdio", config: config2 };
+  if (allowTools && denyTools) {
+    logError("Cannot use both --allow-tools and --deny-tools");
+    process.exit(1);
+  }
+  const config2 = parseConfigJson(configJson);
+  return { mode: "stdio", config: config2, allowTools, denyTools };
 }
 function parseConvertArgs(args) {
   let url2;
@@ -25858,9 +25895,13 @@ function parseConfigJson(json2) {
 }
 function printUsage() {
   logError("Usage:");
-  logError(`  nuwax-mcp-stdio-proxy --config '{"mcpServers":{...}}'          (stdio aggregation)`);
-  logError("  nuwax-mcp-stdio-proxy convert [URL] [OPTIONS]                  (remote \u2192 stdio)");
-  logError("  nuwax-mcp-stdio-proxy proxy --port <PORT> --config '...'       (HTTP server)");
+  logError(`  nuwax-mcp-stdio-proxy --config '{"mcpServers":{...}}' [OPTIONS]  (stdio aggregation)`);
+  logError("  nuwax-mcp-stdio-proxy convert [URL] [OPTIONS]                    (remote \u2192 stdio)");
+  logError("  nuwax-mcp-stdio-proxy proxy --port <PORT> --config '...'         (HTTP server)");
+  logError("");
+  logError("Options (stdio / convert):");
+  logError("  --allow-tools <TOOLS>          Tool whitelist (comma-separated)");
+  logError("  --deny-tools <TOOLS>           Tool blacklist (comma-separated)");
 }
 function printConvertUsage() {
   logError("Usage: nuwax-mcp-stdio-proxy convert [URL] [OPTIONS]");
@@ -25882,7 +25923,7 @@ async function main() {
   const args = parseCliArgs();
   switch (args.mode) {
     case "stdio":
-      await runStdio(args.config);
+      await runStdio(args.config, args.allowTools, args.denyTools);
       break;
     case "convert":
       await runConvert(args);

package/dist/modes/stdio.d.ts

@@ -5,4 +5,4 @@
  * into a single stdio MCP endpoint.
  */
 import type { McpServersConfig } from '../types.js';
-export declare function runStdio(config: McpServersConfig): Promise<void>;
+export declare function runStdio(config: McpServersConfig, allowTools?: string[], denyTools?: string[]): Promise<void>;

package/dist/modes/stdio.js

@@ -8,7 +8,8 @@ import { isSseEntry, isStreamableEntry } from '../types.js';
 import { logInfo, logWarn, logError } from '../logger.js';
 import { buildBaseEnv, connectStdio, connectStreamable, connectSse } from '../transport.js';
 import { discoverTools, createToolProxyServer, setupGracefulShutdown } from '../shared.js';
-export async function runStdio(config) {
+import { filterTools } from '../filter.js';
+export async function runStdio(config, allowTools, denyTools) {
     const entries = Object.entries(config.mcpServers);
     if (entries.length === 0) {
         logError('No MCP servers configured in mcpServers');
@@ -37,9 +38,22 @@ export async function runStdio(config) {
             const { client, cleanup } = connected;
             clients.set(id, client);
             cleanups.set(id, cleanup);
-            const allServerTools = await discoverTools(client);
-            logInfo(`Server "${id}": ${allServerTools.length} tool(s)${allServerTools.length > 0 ? ' — ' + allServerTools.map((t) => t.name).join(', ') : ''}`);
-            for (const tool of allServerTools) {
+            let serverTools = await discoverTools(client);
+            // Per-server tool filtering (allowTools/denyTools in config entry)
+            if (entry.allowTools || entry.denyTools) {
+                const perFilter = {};
+                if (entry.allowTools)
+                    perFilter.allowTools = new Set(entry.allowTools);
+                if (entry.denyTools)
+                    perFilter.denyTools = new Set(entry.denyTools);
+                const before = serverTools.length;
+                serverTools = filterTools(serverTools, perFilter);
+                if (serverTools.length !== before) {
+                    logInfo(`Server "${id}": filtered ${before} → ${serverTools.length} tool(s)`);
+                }
+            }
+            logInfo(`Server "${id}": ${serverTools.length} tool(s)${serverTools.length > 0 ? ' — ' + serverTools.map((t) => t.name).join(', ') : ''}`);
+            for (const tool of serverTools) {
                 if (toolToClient.has(tool.name)) {
                     logWarn(`Tool "${tool.name}" from "${id}" shadows existing tool from "${toolToServer.get(tool.name)}"`);
                 }
@@ -59,10 +73,21 @@ export async function runStdio(config) {
     }
     const aggregatedTools = Array.from(toolsByName.values());
     logInfo(`Aggregated ${aggregatedTools.length} unique tool(s) from ${clients.size} server(s)`);
+    // ---- Phase 1.5: Apply tool filtering (allow/deny) ----
+    const toolFilter = {};
+    if (allowTools)
+        toolFilter.allowTools = new Set(allowTools);
+    if (denyTools)
+        toolFilter.denyTools = new Set(denyTools);
+    const filteredTools = filterTools(aggregatedTools, toolFilter);
+    const filteredNames = new Set(filteredTools.map((t) => t.name));
+    if (filteredTools.length !== aggregatedTools.length) {
+        logInfo(`After filtering: ${filteredTools.length} tool(s) — ${filteredTools.map((t) => t.name).join(', ')}`);
+    }
     // ---- Phase 2: Create the aggregating MCP server ----
     const { server } = await createToolProxyServer({
-        tools: aggregatedTools,
-        resolveClient: (name) => toolToClient.get(name),
+        tools: filteredTools,
+        resolveClient: (name) => filteredNames.has(name) ? toolToClient.get(name) : undefined,
         errorLabel: (name) => `"${name}" (server: "${toolToServer.get(name) || 'unknown'}")`,
     });
     logInfo('Proxy server running on stdio');

package/dist/types.d.ts

@@ -6,6 +6,10 @@ export interface StdioServerEntry {
     command: string;
     args?: string[];
     env?: Record<string, string>;
+    /** 工具白名单（只暴露指定工具） */
+    allowTools?: string[];
+    /** 工具黑名单（排除指定工具） */
+    denyTools?: string[];
 }
 /**
  * Streamable HTTP 类型: 连接远程 MCP server (Streamable HTTP)
@@ -18,6 +22,10 @@ export interface StreamableServerEntry {
     transport?: 'streamable-http';
     headers?: Record<string, string>;
     authToken?: string;
+    /** 工具白名单（只暴露指定工具） */
+    allowTools?: string[];
+    /** 工具黑名单（排除指定工具） */
+    denyTools?: string[];
 }
 /**
  * SSE 类型: 连接远程 MCP server (Server-Sent Events)
@@ -29,6 +37,10 @@ export interface SseServerEntry {
     transport: 'sse';
     headers?: Record<string, string>;
     authToken?: string;
+    /** 工具白名单（只暴露指定工具） */
+    allowTools?: string[];
+    /** 工具黑名单（排除指定工具） */
+    denyTools?: string[];
 }
 export type McpServerEntry = StdioServerEntry | StreamableServerEntry | SseServerEntry;
 export declare function isSseEntry(entry: McpServerEntry): entry is SseServerEntry;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuwax-mcp-stdio-proxy",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "TypeScript MCP proxy — aggregates multiple MCP servers (stdio + streamable-http + SSE) with convert & proxy modes",
   "type": "module",
   "bin": {