pretext-pdf-mcp 1.0.6 → 1.0.7

package/CHANGELOG.md

@@ -0,0 +1,62 @@
+# Changelog
+
+All notable changes to pretext-pdf-mcp are documented here.
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+
+---
+
+## [1.0.7] — 2026-04-13
+
+### Fixed
+
+- **Critical: Version mismatch** — Hardcoded server version (1.0.0) didn't match package.json (1.0.6). Now correctly reports 1.0.7.
+- **Critical: Unsafe type casting in API endpoint** — Added `validatePdfDocumentInput()` to reject null/undefined/non-object inputs before calling `render()`. Previously would pass invalid types and throw cryptic errors.
+- **High: Inconsistent error categorization** — Added `isClientError()` to distinguish client validation errors (HTTP 400) from server errors (HTTP 500). Error responses now include `code` field for debugging.
+- **Medium: MAX_BODY limit too small** — Increased from 100 KB to 500 KB on `/api/generate` to support PDFs with images, rich formatting, and v0.5.1+ features. Now consistent with `/mcp` endpoint.
+- **High: Missing input validation** — `/api/generate` now validates `body.data` is an object before calling `render()`, preventing silent type coercion failures.
+- **Low: Missing limit documentation** — Added detailed comments explaining the 500 KB limit rationale on both endpoints.
+
+### Test Coverage
+
+- pretext-pdf: 442/442 tests passing
+- pretext-pdf-mcp: 14/14 tests passing
+
+---
+
+## [1.0.6] — 2026-04-13
+
+### Security
+- Per-chunk size enforcement on both HTTP endpoints (`/api/generate` 100KB, `/mcp` 500KB).
+  Previously the full request body was buffered before the size check, allowing memory exhaustion via large payloads.
+
+### Changed
+- Bumped `pretext-pdf` dependency to `^0.5.0` to pick up security hardening, CJK/Thai i18n,
+  validation improvements, `defaultParagraphStyle`, per-section headers/footers, and tabular numbers.
+
+---
+
+## [1.0.5] — 2026-04-09
+
+### Added
+- Live demo at https://himaan1998y.github.io/pretext-pdf-mcp/
+- StackBlitz playground link in README
+- Smithery registry integration (`https://pretext-pdf.run.tools`)
+- `generate_invoice` tool: GST-aware invoices with INR/USD/EUR/GBP support
+- `generate_report` tool: multi-section reports with optional TOC, tables, and callouts
+- `list_element_types` tool: returns a markdown reference of all 16 element types
+- Docker support via `Dockerfile`
+- Claude Desktop configuration documented in README
+
+### Changed
+- HTTP server mode: `PORT` env var enables REST API alongside stdio MCP transport
+- Tool descriptions expanded for better LLM comprehension
+
+---
+
+## [1.0.0] — 2026-04-08
+
+### Added
+- Initial release
+- `generate_pdf` tool: full `PdfDocument` JSON → Base64 PDF
+- Stdio MCP transport (compatible with Claude Desktop, Cursor, Windsurf)
+- HTTP transport for stateless `/mcp` endpoint

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Himanshu Jain
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.js

@@ -2,12 +2,46 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { PretextPdfError } from 'pretext-pdf';
 import { generatePdfTool } from './tools/generate-pdf.js';
 import { generateInvoiceTool } from './tools/generate-invoice.js';
 import { generateReportTool } from './tools/generate-report.js';
 import { listElementsTool } from './tools/list-elements.js';
+// ─── Input Validation ─────────────────────────────────────────────────────────
+/**
+ * Validate that body.data is a plain object (minimal type guard).
+ * Prevents obvious type errors before calling render().
+ */
+function validatePdfDocumentInput(data) {
+    if (data === null || data === undefined) {
+        throw new PretextPdfError('VALIDATION_ERROR', 'Request body.data is required and cannot be null or undefined');
+    }
+    if (typeof data !== 'object' || Array.isArray(data)) {
+        throw new PretextPdfError('VALIDATION_ERROR', `Request body.data must be an object, received ${typeof data}`);
+    }
+}
+/**
+ * Categorize pretext-pdf errors for HTTP status code determination.
+ * Returns true if error is a client error (400), false if server error (500).
+ */
+function isClientError(err) {
+    if (!(err instanceof PretextPdfError))
+        return true; // Unknown errors → client error by default
+    const clientErrors = [
+        'VALIDATION_ERROR',
+        'IMAGE_LOAD_FAILED',
+        'IMAGE_FORMAT_MISMATCH',
+        'SVG_LOAD_FAILED',
+        'PAGE_TOO_SMALL',
+        'FONT_NOT_LOADED',
+        'FONT_LOAD_FAILED',
+        'MONOSPACE_FONT_REQUIRED',
+        'ENCRYPTION_NOT_AVAILABLE',
+    ];
+    return clientErrors.includes(err.code);
+}
 function createServer() {
-    const server = new Server({ name: 'pretext-pdf', version: '1.0.0' }, { capabilities: { tools: {} } });
+    const server = new Server({ name: 'pretext-pdf', version: '1.0.7' }, { capabilities: { tools: {} } });
     const tools = [generatePdfTool, generateInvoiceTool, generateReportTool, listElementsTool];
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: tools.map(t => t.schema),
@@ -49,15 +83,21 @@ if (port) {
             res.end(JSON.stringify({ ok: true, service: 'pretext-pdf-mcp' }));
             return;
         }
-        // REST demo API — POST /api/generate → returns PDF bytes
+        // REST API — POST /api/generate → returns PDF bytes
+        // Limit: 500 KB — accommodates PDFs with images, rich formatting, and new features (v0.5.1+)
+        // Validation: body.data must be a PdfDocument object before calling render()
         if (url.pathname === '/api/generate' && req.method === 'POST') {
+            const MAX_BODY = 500_000; // 500 KB — same as MCP endpoint, supports full feature set
             const chunks = [];
-            for await (const chunk of req)
+            let totalSize = 0;
+            for await (const chunk of req) {
+                totalSize += chunk.length;
+                if (totalSize > MAX_BODY) {
+                    res.writeHead(413, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Request too large (max 500 KB)' }));
+                    return;
+                }
                 chunks.push(chunk);
-            if (Buffer.concat(chunks).length > 100_000) {
-                res.writeHead(413, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Request too large' }));
-                return;
             }
             let body;
             try {
@@ -65,10 +105,12 @@ if (port) {
             }
             catch {
                 res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                res.end(JSON.stringify({ error: 'Invalid JSON body' }));
                 return;
             }
             try {
+                // Validate input before calling render()
+                validatePdfDocumentInput(body.data);
                 const pdf = await render(body.data);
                 res.writeHead(200, {
                     'Content-Type': 'application/pdf',
@@ -79,16 +121,30 @@ if (port) {
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
-                res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: msg }));
+                const isClient = isClientError(err);
+                const statusCode = isClient ? 400 : 500;
+                const errorCode = err instanceof PretextPdfError ? err.code : 'UNKNOWN_ERROR';
+                res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: msg, code: errorCode }));
             }
             return;
         }
-        // MCP endpoint — POST /mcp (stateless)
+        // MCP endpoint — POST /mcp (stateless, structured protocol)
+        // Limit: 500 KB — same as REST API, accommodates full feature set (images, rich formatting, etc.)
+        // Note: MCP protocol adds overhead (jsonrpc wrapper), so same limit across endpoints
         if (url.pathname === '/mcp' && req.method === 'POST') {
+            const MAX_MCP_BODY = 500_000; // 500 KB — consistent with /api/generate
             const chunks = [];
-            for await (const chunk of req)
+            let mcpSize = 0;
+            for await (const chunk of req) {
+                mcpSize += chunk.length;
+                if (mcpSize > MAX_MCP_BODY) {
+                    res.writeHead(413, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Request too large (max 500 KB)' }));
+                    return;
+                }
                 chunks.push(chunk);
+            }
             const body = JSON.parse(Buffer.concat(chunks).toString());
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pretext-pdf-mcp",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "MCP server for pretext-pdf — generate professional PDFs from JSON in Claude, Cursor, or any AI agent",
   "keywords": [
     "mcp",
@@ -24,7 +24,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "pretext-pdf": "^0.4.3"
+    "pretext-pdf": "^0.5.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -35,7 +35,8 @@
     "dist/**/*",
     "smithery.yaml",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=18.0.0"
@@ -46,5 +47,8 @@
     "type": "git",
     "url": "https://github.com/Himaan1998Y/pretext-pdf-mcp"
   },
-  "homepage": "https://github.com/Himaan1998Y/pretext-pdf-mcp#readme"
+  "bugs": {
+    "url": "https://github.com/Himaan1998Y/pretext-pdf-mcp/issues"
+  },
+  "homepage": "https://himaan1998y.github.io/pretext-pdf-mcp/"
 }