postmark-mcp 1.0.12 → 1.0.14

package/index.js

@@ -118,6 +118,39 @@ process.on('unhandledRejection', (reason) => {
 
 // Move tool registration to a separate function for better organization
 function registerTools(server, postmarkClient) {
+  // Helpers (scoped to this registrar)
+  const MAX_EMAIL_SIZE_B64 = 10 * 1024 * 1024; // Postmark limit (after base64)
+  const FORBIDDEN_EXTS = new Set([
+    'vbs', 'exe', 'bin', 'bat', 'chm', 'com', 'cpl', 'crt', 'hlp', 'hta', 'inf', 'ins', 'isp', 'jse', 'lnk',
+    'mdb', 'pcd', 'pif', 'reg', 'scr', 'sct', 'shs', 'vbe', 'vba', 'wsf', 'wsh', 'wsl', 'msc', 'msi', 'msp', 'mst'
+  ]);
+
+  function pickFilename(url, contentDisposition) {
+    // RFC 5987: filename*=UTF-8''encoded%20name.pdf
+    if (contentDisposition) {
+      const star = contentDisposition.match(/filename\*=([^;]+)/i);
+      if (star && star[1]) {
+        const v = star[1].trim().replace(/^UTF-8''/i, '');
+        try { return decodeURIComponent(v); } catch { }
+      }
+      const quoted = contentDisposition.match(/filename="?([^"]+)"?/i);
+      if (quoted && quoted[1]) return quoted[1];
+    }
+    try {
+      const u = new URL(url);
+      const last = u.pathname.split('/').pop();
+      if (last) return last;
+    } catch { }
+    return 'attachment';
+  }
+
+  function isForbiddenExt(name) {
+    const ext = (name.split('.').pop() || '').toLowerCase();
+    return FORBIDDEN_EXTS.has(ext);
+  }
+
+  const fmtMsgId = (id) => /^<.*>$/.test(id) ? id : `<${id}>`;
+
   // Define and register the sendEmail tool
   server.tool(
     "sendEmail",
@@ -128,25 +161,73 @@ function registerTools(server, postmarkClient) {
       htmlBody: z.string().optional().describe("HTML body of the email (optional)"),
       from: z.string().optional().describe("Sender email address (optional, uses default if not provided)"),
       tag: z.string().optional().describe("Optional tag for categorization"),
-      inReplyTo: z.string().optional().describe("Message ID this email is in reply to (optional)")
+      inReplyTo: z.string().optional().describe("SMTP Message-ID this email replies to (e.g. <id@host>)"),
+      attachmentUrls: z.array(z.string()).optional().describe("Array of attachment URLs (optional)")
     },
-    async ({ to, subject, textBody, htmlBody, from, tag, inReplyTo }) => {
+    async ({ to, subject, textBody, htmlBody, from, tag, inReplyTo, attachmentUrls }) => {
       const emailData = {
         From: from || defaultSender,
         To: to,
         Subject: subject,
         TextBody: textBody,
-        Headers: inReplyTo
-          ? [
-            { Name: "In-Reply-To", Value: inReplyTo },
-            { Name: "References", Value: inReplyTo }
-          ]
-          : undefined,
         MessageStream: defaultMessageStream,
         TrackOpens: true,
         TrackLinks: "HtmlAndText"
       };
 
+      if (inReplyTo) {
+        emailData.Headers = [
+          { Name: "In-Reply-To", Value: fmtMsgId(inReplyTo) },
+          { Name: "References", Value: fmtMsgId(inReplyTo) }
+        ];
+      }
+
+      // Fetch attachments and convert to base64 (with limits and safer filename parsing)
+      if (attachmentUrls && attachmentUrls.length > 0) {
+        let attachmentsSize = 0;
+        const attachments = [];
+
+        for (const url of attachmentUrls) {
+          const response = await fetch(url);
+          if (!response.ok) {
+            throw new Error(`Failed to fetch attachment from ${url}: ${response.status} ${response.statusText}`);
+          }
+
+          const arrayBuf = await response.arrayBuffer();
+          const buf = Buffer.from(arrayBuf);
+          const base64 = buf.toString('base64');
+
+          const contentType = response.headers.get("content-type") || "application/octet-stream";
+          const contentDisposition = response.headers.get("content-disposition") || "";
+          const filename = pickFilename(url, contentDisposition);
+
+          if (isForbiddenExt(filename)) {
+            throw new Error(`Attachment "${filename}" has a forbidden file extension.`);
+          }
+
+          attachments.push({
+            Name: filename,
+            Content: base64,
+            ContentType: contentType
+            // ContentID: 'cid:your-inline-id' // <- enable if you need inline images later
+          });
+
+          // Postmark counts after base64; track the growing size
+          attachmentsSize += Buffer.byteLength(base64, 'utf8');
+        }
+
+        // Conservative guard that also counts bodies
+        const bodySize =
+          (textBody ? Buffer.byteLength(textBody, 'utf8') : 0) +
+          (htmlBody ? Buffer.byteLength(htmlBody, 'utf8') : 0);
+
+        if (attachmentsSize + bodySize > MAX_EMAIL_SIZE_B64) {
+          throw new Error('Attachments + body exceed Postmark’s 10 MB limit.');
+        }
+
+        emailData.Attachments = attachments;
+      }
+
       if (htmlBody) emailData.HtmlBody = htmlBody;
       if (tag) emailData.Tag = tag;
 
@@ -196,7 +277,7 @@ function registerTools(server, postmarkClient) {
 
       if (tag) emailData.Tag = tag;
 
-      console.error('Sending template email...', { to, templateId: templateId || templateAlias });
+      console.error('Sending template email...', { to, template: templateId || templateAlias });
       const result = await postmarkClient.sendEmailWithTemplate(emailData);
       console.error('Template email sent successfully:', result.MessageID);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postmark-mcp",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Universal Postmark MCP server using official SDK",
   "main": "index.js",
   "bin": {