renovate-mcp 0.8.0 → 0.9.2

package/README.md

@@ -36,7 +36,7 @@ Eleven tools plus a preset reference:
 | `lint_config` | Semantic lint for Renovate-specific footguns schema validation misses — malformed `/…/` regex patterns plus unknown manager names in `matchManagers` / `excludeManagers`. Offline. |
 | `dry_run` | Run Renovate with `--dry-run` and return the structured JSON report. Defaults to `--platform=local` against `repoPath`; pass `platform` + `endpoint` + `token` + `repository` to run as a real GitHub/GitLab client (needed when the config extends `local>` presets on a private host). When `platform` is not passed, the tool reads `RENOVATE_PLATFORM` from the MCP server's env before defaulting to `local`. When `token` is not passed, falls back to `RENOVATE_TOKEN` from MCP env, then to `GITLAB_TOKEN` (when `platform=gitlab`) or `GITHUB_TOKEN` (when `platform=github`) — auto-translated to `RENOVATE_TOKEN` for the spawned Renovate CLI, since Renovate itself only reads that one var. `repository` accepts GitHub-style `owner/repo` and GitLab nested-group paths like `group/subgroup/project`. `endpoint`/`token` also flow through in local mode so `gitlab>…` / `github>…` preset shortcuts can be redirected at a self-hosted host without setting up a full remote run. No PRs, no pushes. Emits MCP progress notifications during the run when the caller supplies a `progressToken`. |
 | `dry_run_diff` | Semantic diff between two `dry_run` reports — `added` / `removed` / `changed` proposed updates plus a compact text rendering. Stateless; takes both reports as inputs. Useful when iterating on a config to see exactly what each tweak did. |
-| `write_config` | Validate, then atomically write a config to disk. Refuses to save invalid configs unless `force: true`. |
+| `write_config` | Validate, then atomically write a config to disk. Refuses to save invalid configs unless `force: true` is paired with `confirmForce: "YES_OVERRIDE_VALIDATION"` — the literal sentinel makes accidental overrides under prompt-injected tool calls harder. |
 | `renovate://presets` (resource) | Markdown index of all 1000+ built-in presets grouped by namespace. |
 | `renovate://presets/{namespace}` (resource template) | Markdown listing for a single namespace (e.g. `renovate://presets/config`) — cheaper than the full index. |
 | `renovate://preset/{name}` (resource template) | Expanded JSON body for one preset (e.g. `renovate://preset/config:recommended`). |
@@ -54,6 +54,7 @@ See [Design notes](#design-notes) for implementation details (timeouts, safety c
 
 **Required**
 
+- Linux or macOS. Windows is not supported — `package.json` declares `"os": ["darwin", "linux"]`, so `npm i` surfaces an `EBADPLATFORM` warning on Windows, and the server exits with a clear stderr message at startup. Run on WSL2 or a Linux/macOS host instead.
 - Node.js ≥ 24 (aligns with Renovate's own engine requirement).
 - Renovate on your `PATH` — either a global install (`npm i -g renovate`) or a project-local install that exposes `renovate` + `renovate-config-validator` via `npm exec`. Only needed for `validate_config`, `dry_run`, and `write_config`; the offline tools (`read_config`, `resolve_config`, `preview_custom_manager`, `lint_config`) work without it.
 
@@ -230,7 +231,9 @@ npm run generate:managers # regenerate src/data/managers.generated.ts from the r
 
 The preset catalogue at `src/data/presets.generated.ts` and the manager-name list at `src/data/managers.generated.ts` are committed snapshots of Renovate's built-in presets and manager registry. Runtime code never imports the `renovate` package — only the `scripts/generate-*.mjs` scripts do. Regenerate both after bumping the `renovate` devDependency.
 
-CI runs `typecheck`, `build`, and `test:coverage` on Node 24 for every PR and push to `main` (see `.github/workflows/ci.yml`). Coverage is uploaded as a per-run artifact; no threshold is enforced yet.
+CI runs `typecheck`, `build`, and `test:coverage` on Node 24 for every PR and push to `main` (see `.github/workflows/ci.yml`), across an OS matrix of `ubuntu-latest` and `macos-latest` with `fail-fast: false` so a platform-specific regression on either side surfaces. Coverage is uploaded as a per-run artifact from the Ubuntu job only (to avoid name collisions); no threshold is enforced yet. The Ubuntu job also re-runs `npm install --package-lock-only` and fails on a non-empty diff, catching drift between `package.json` root metadata (`os`, `engines`, `bin`, dep ranges) and `package-lock.json` that `npm ci` does not validate.
+
+`.github/workflows/dependency-review.yml` runs [`actions/dependency-review-action`](https://github.com/actions/dependency-review-action) on every PR and fails the check when a newly introduced dependency carries a CVE of `high` severity or above. Findings also render inline in the PR's "Files changed" / Conversation tabs.
 
 `.github/workflows/claude.yml` is maintainer tooling: it lets the repo owner trigger [`anthropics/claude-code-action`](https://github.com/anthropics/claude-code-action) by mentioning `@claude` in an issue, issue comment, PR review, or PR review comment. It's gated on `sender.login == repository_owner`, so mentions from anyone else are ignored. The workflow needs the `CLAUDE_CODE_OAUTH_TOKEN` secret on the repo; outside contributors and forks do not need any Anthropic credentials to work on this project.
 
@@ -241,7 +244,7 @@ Releases are automated via [release-please](https://github.com/googleapis/releas
 1. Merge Conventional Commits to `main` (`feat:`, `fix:`, etc.)
 2. release-please opens or updates a release PR that bumps the version and updates `CHANGELOG.md`
 3. Merging the release PR creates a GitHub release and tag
-4. The `publish` workflow (`.github/workflows/publish.yml`) fires on the release event, runs the test suite, and runs `npm publish` with provenance
+4. The `publish` workflow (`.github/workflows/publish.yml`) fires on the release event, runs the test suite, smoke-tests the packed tarball end-to-end (install globally, then run an MCP `initialize` handshake against the resulting `renovate-mcp` binary), and only then runs `npm publish` with provenance
 
 Publishing uses [npm Trusted Publishers](https://docs.npmjs.com/trusted-publishers) — no npm token is stored in the repo. Instead the workflow authenticates to npm via OIDC using the `id-token: write` permission. Trusted Publishers must be configured on the npm package settings page before OIDC publishes will succeed; this requires the package to already exist, so the **first release must be published manually once** (`npm login && npm publish` from a clean build), after which Trusted Publishers can be wired up and all subsequent releases go through this workflow.
 
@@ -259,12 +262,15 @@ Scope and non-goals are summarized in [What this is NOT](#what-this-is-not); thi
 - `preview_custom_manager` runs every user-supplied regex on a `worker_threads` worker with a wall-clock budget per operation (default 2 s, configurable via `matchTimeoutMs`). Catastrophic backtracking — e.g. `^(a+)+b$` against `aaaa…c`, or `(.*)*=` against a modestly sized file — would otherwise pin the MCP server's event loop indefinitely. On timeout the worker is terminated and a warning is appended identifying which `fileMatch[i]` or `matchStrings[i]` was aborted, so the user can simplify the pattern or raise the budget.
 - `preview_custom_manager` also stats each matched file before reading it and skips anything larger than `maxFileBytes` (default 5 MiB) with a warning, so a stray lockfile, generated artifact, or SQL dump caught by a loose `fileMatch` can't OOM the server. `maxHitsPerFile` already bounds output size; this guards input size.
 - `resolve_config` expands `extends` against a committed snapshot of Renovate's built-in presets (`src/data/presets.generated.ts`). External `github>` / `gitlab>` fetching is opt-in, uses each platform's contents API with a 10 s timeout, and caches results per call. The `endpoint` input swaps in a custom API base for GHE / self-hosted GitLab; `platform` additionally rewrites `local>` presets to be fetched against that endpoint.
+- External preset fetches refuse to follow HTTP redirects (`redirect: "manual"`) and never attach `Authorization: Bearer …` / `PRIVATE-TOKEN: …` headers to non-`https://` URLs. Following redirects with custom auth headers can leak `RENOVATE_TOKEN` / `GITHUB_TOKEN` / `GITLAB_TOKEN` cross-host (undici only strips the standard `Authorization` header on cross-*origin* redirects, not `PRIVATE-TOKEN`); rejecting them outright avoids the leak path and matches the fact that the GitHub/GitLab content APIs don't normally redirect for valid presets.
+- External preset fetches cap the response body at 1 MB. A `Content-Length` over the cap is rejected up front; chunked responses without a declared length are streamed into a bounded buffer that aborts the read once the running total passes the cap. Auth-failure bodies (401/403) are read with an 8 KB cap so a misconfigured endpoint returning a giant HTML error page can't OOM the long-lived MCP process. Preset bodies are tiny in practice, so the cap is well above any legitimate value.
+- The `endpoint` input on `resolve_config` / `explain_config` / `dry_run` is validated before any token-bearing request is built or forwarded to the Renovate child as `--endpoint=`. Anything that isn't an `https://` URL with a non-empty public host is refused: non-https schemes (`http:`, `file:`, `data:`, …), userinfo (`user:pass@host`), and any RFC 1918 / loopback / link-local literal (`localhost`, `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16` (incl. cloud-metadata), `0.0.0.0/8`, `::1`, `::`, `::ffff:*`, `fc00::/7`, `fe80::/10`). Self-hosted GitHub Enterprise / GitLab on public-DNS https URLs is unaffected. The check is string-level (no DNS) — the goal is to make a prompt-injected `endpoint` value unable to coerce a token-bearing request to an attacker-controlled or internal-only address.
 - `resolve_config` merges preset bodies with a close approximation of Renovate's own `mergeChildConfig` — arrays concat, objects recursively merge, scalars overwrite — not a bit-identical port. Rule-specific semantics for `hostRules`, `regexManagers` / `customManagers`, and certain boolean flags aren't modeled here. Every response carries `mergeQuality: "preview"` plus a human-readable `disclaimer` so callers can't miss the limitation; run `dry_run` for authoritative output.
 - When `resolve_config` encounters template tokens outside its supported subset, it records a structured entry in `warnings`: under-argument cases (`{{arg2}}` referenced when only one arg was passed) substitute an empty string, while non-positional tokens (`{{packageRules}}`, Handlebars helpers like `{{#if …}}`) pass through verbatim.
 - `explain_config` reuses the same expansion machinery as `resolve_config` (`parsePreset`, `loadPresetBody`, `applyArgs`, `recordTemplateWarnings`) so the two can't drift — if `resolve_config` resolves a preset, `explain_config` does too. The annotated layer threads each preset body's leaves through a parallel `mergeAnnotated` that preserves contributors instead of dropping them, then pins each contribution with the source name (literal `extends` entry, or `<own>` for the user's input config) and a `via` chain naming every parent preset traversed to reach it. Arrays accumulate every contribution in `setBy` and concat their `value`s; scalars list every contribution in merge order with the last as the winner. `merge_quality: "preview"` carries the same disclaimer as `resolve_config` — Renovate's rule-specific semantics for `hostRules`, `regexManagers`, and certain boolean flags aren't modelled.
-- `dry_run` uses `--report-type=file` so we get a structured JSON report instead of scraping stdout. When a `hostRules` input is passed it's written to a mode-0600 temp file in `os.tmpdir()`, handed to Renovate via the `RENOVATE_CONFIG_FILE` env var (the CLI has no `--config-file` flag), and deleted in a `finally` block. Token/password values — including the platform `token` input — are scrubbed from the detected `problems` list and the `logTail` fallback before returning.
+- `dry_run` uses `--report-type=file` so we get a structured JSON report instead of scraping stdout. The report path is pre-created with mode 0600 before Renovate is spawned (Renovate overwrites in place with `O_TRUNC`, preserving the mode), so the on-disk JSON is never world-readable while the run is in flight — Renovate's `problems` array can carry host-rule values that we don't want exposed under the default `umask`. The file is unlinked in a `finally` block. When a `hostRules` input is passed it's written to a mode-0600 temp file in `os.tmpdir()`, handed to Renovate via the `RENOVATE_CONFIG_FILE` env var (the CLI has no `--config-file` flag), and deleted in a `finally` block. Token/password values — including the platform `token` input — are scrubbed from the detected `problems` list and the `logTail` fallback before returning.
 - `dry_run` defaults to `--platform=local` so no host token is required, but that mode can't resolve `local>` presets (they have no platform context to expand against) and silently hides non-default-host GitHub/GitLab setups. When the caller doesn't pass a `platform` input, the tool first falls back to `RENOVATE_PLATFORM` from the MCP server's env (if it's one of `local`/`github`/`gitlab`) before defaulting to `local` — without that fallback, the wrapper would unconditionally pass `--platform=local` and silently override an env var the user had set in their `mcp.json`. Passing `platform` + `endpoint` + `token` + `repository` (or relying on the `RENOVATE_PLATFORM` / `RENOVATE_ENDPOINT` env vars) switches the run to a real platform client so the preset-fetch path works end-to-end; `--dry-run` is still set, so no PRs are opened. The repository is passed to Renovate as a positional argument because the CLI has no `--repository` flag. `endpoint` and `token` are also forwarded in the default `platform=local` mode so `gitlab>…` / `github>…` preset shortcuts (which are otherwise hardcoded to gitlab.com/github.com) can be redirected at a self-hosted host. As a guard against the silent-failure mode, `dry_run` preflight-checks the repo's config: if it extends any `local>…` preset while the effective platform is `local`, the tool fails fast with specific remediation rather than spawning a Renovate run that would opaquely report `config-validation`. The preflight is skipped for `dryRunMode=extract` so manifest-only extraction can still be attempted.
 - `dry_run` returns a top-level `ok` boolean that is `false` whenever the CLI exited non-zero OR the structured report contains a validation/error-level problem (`level >= 40`, `message === "config-validation"`, or a non-empty `validationError` field). Renovate frequently writes exit-code 0 alongside report-level failures — trusting the exit code alone hides runs that did nothing.
 - `dry_run` emits MCP progress notifications only when the caller's `tools/call` includes `_meta.progressToken` — no-op otherwise, so legacy clients see zero overhead. A 5-second heartbeat ticks while the child runs; each tick's message is best-effort enriched with the latest Renovate JSON-log `msg` seen on stdout. Notifications are also emitted at start and completion. We deliberately don't couple to Renovate's log schema beyond reading `msg`, since that schema isn't a stable API.
 - `dry_run_diff` is stateless on purpose: both reports are passed as inputs, no per-repo state is kept on the server. Updates are keyed by `(manager, packageFile, depName)` so a version bump on the same dep shows up once under `changed` rather than twice as `removed + added`. Compared per identity: `newValue`, `newVersion`, `updateType`, `branchName`, `groupName`, `schedule`. Either input can be the raw Renovate report or the full `dry_run` summary (with the `report` key) — the tool unwraps `report` automatically.
-- `write_config` writes to a temp file, validates, then atomically renames — so a failed validation never leaves a broken config on disk.
+- `write_config` writes to a temp file, validates, then atomically renames — so a failed validation never leaves a broken config on disk. The `force: true` escape hatch is gated behind a separate `confirmForce: "YES_OVERRIDE_VALIDATION"` literal: a single boolean is too easy for a prompt-injected agent to flip, but emitting an unusual sentinel string is a deliberate step that's harder to navigate accidentally.

package/dist/index.js

@@ -15,6 +15,16 @@ import { registerGetVersion } from "./tools/getVersion.js";
 import { registerPresetResources } from "./resources/presets.js";
 import { checkSetup, startupBanner } from "./lib/setupCheck.js";
 import { SERVER_VERSION } from "./lib/version.js";
+import { logError } from "./lib/log.js";
+// Register before any work: stdout carries JSON-RPC frames, so a stray Node-default
+// log of an unhandled rejection / uncaught exception would corrupt MCP framing.
+process.on("unhandledRejection", (reason) => {
+    logError("unhandled rejection", reason);
+});
+process.on("uncaughtException", (err) => {
+    logError("uncaught exception", err);
+    process.exit(1);
+});
 const BASE_INSTRUCTIONS = [
     "Design and debug Renovate configurations interactively.",
     "",
@@ -32,6 +42,10 @@ const BASE_INSTRUCTIONS = [
     "If any tool fails unexpectedly, call check_setup to diagnose CLI availability.",
     "Built-in preset reference: renovate://presets (namespace index), renovate://presets/{namespace} (one namespace), renovate://preset/{name} (one preset's expanded JSON).",
 ].join("\n");
+if (process.platform === "win32") {
+    process.stderr.write("renovate-mcp does not support Windows. Supported platforms are Linux and macOS — see the `os` field in package.json. Run on WSL2 or a Linux/macOS host instead.\n");
+    process.exit(1);
+}
 const setup = await checkSetup();
 // `RENOVATE_MCP_REQUIRE_CLI=false` is the opt-out for users who have
 // consciously chosen the offline subset and don't want the startup notice.

package/dist/lib/endpointValidator.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validate a user-provided `endpoint` URL before any network call attaches
+ * auth headers or before it is forwarded to the Renovate child as
+ * `--endpoint=`. The check is intentionally string-level (no DNS): it
+ * refuses non-https schemes, missing/userinfo hosts, and any RFC 1918 /
+ * loopback / link-local literal. The point is to make a prompt-injected
+ * `endpoint` value unable to coerce a token-bearing request to an
+ * attacker-controlled or internal-only address.
+ *
+ * Throws `EndpointValidationError` with a user-facing reason on rejection.
+ * Call sites map that to their own error shape (`{ ok: false, reason }`,
+ * `isError: true`, etc.).
+ */
+export declare class EndpointValidationError extends Error {
+    constructor(message: string);
+}
+export declare function validateEndpoint(endpoint: string): void;

package/dist/lib/endpointValidator.js

@@ -0,0 +1,102 @@
+/**
+ * Validate a user-provided `endpoint` URL before any network call attaches
+ * auth headers or before it is forwarded to the Renovate child as
+ * `--endpoint=`. The check is intentionally string-level (no DNS): it
+ * refuses non-https schemes, missing/userinfo hosts, and any RFC 1918 /
+ * loopback / link-local literal. The point is to make a prompt-injected
+ * `endpoint` value unable to coerce a token-bearing request to an
+ * attacker-controlled or internal-only address.
+ *
+ * Throws `EndpointValidationError` with a user-facing reason on rejection.
+ * Call sites map that to their own error shape (`{ ok: false, reason }`,
+ * `isError: true`, etc.).
+ */
+export class EndpointValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "EndpointValidationError";
+    }
+}
+export function validateEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new EndpointValidationError(`Invalid endpoint \`${endpoint}\`: not a parseable URL.`);
+    }
+    if (url.protocol !== "https:") {
+        throw new EndpointValidationError(`Invalid endpoint \`${endpoint}\`: protocol must be https: (refused ${url.protocol}). ` +
+            "Plain http would expose the auth token in cleartext; non-network schemes are not endpoints.");
+    }
+    if (!url.hostname) {
+        throw new EndpointValidationError(`Invalid endpoint \`${endpoint}\`: host is empty.`);
+    }
+    if (url.username || url.password) {
+        throw new EndpointValidationError(`Invalid endpoint \`${endpoint}\`: userinfo (\`user:password@host\`) is not allowed — it can mask the real authority and override credentials.`);
+    }
+    const host = stripIpv6Brackets(url.hostname).toLowerCase();
+    if (isPrivateOrLoopbackHost(host)) {
+        throw new EndpointValidationError(`Invalid endpoint \`${endpoint}\`: host \`${host}\` is in a private, loopback, or link-local range. ` +
+            "Refused to prevent SSRF and accidental exposure of the attached auth token to internal services. " +
+            "If you need a self-hosted GitHub/GitLab, use its public-DNS https URL.");
+    }
+}
+function stripIpv6Brackets(hostname) {
+    if (hostname.startsWith("[") && hostname.endsWith("]")) {
+        return hostname.slice(1, -1);
+    }
+    return hostname;
+}
+function isPrivateOrLoopbackHost(host) {
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    if (isIpv4DottedQuad(host))
+        return isPrivateIpv4(host);
+    if (host.includes(":"))
+        return isPrivateIpv6(host);
+    return false;
+}
+function isIpv4DottedQuad(host) {
+    return /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+}
+function isPrivateIpv4(host) {
+    const octets = host.split(".").map((p) => Number.parseInt(p, 10));
+    if (octets.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+        return true; // malformed → refuse
+    const [a, b] = octets;
+    if (a === 10)
+        return true; // 10.0.0.0/8
+    if (a === 127)
+        return true; // 127.0.0.0/8 loopback
+    if (a === 0)
+        return true; // 0.0.0.0/8 "this network"
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16
+    if (a === 169 && b === 254)
+        return true; // 169.254.0.0/16 link-local (incl. cloud metadata)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12
+    return false;
+}
+function isPrivateIpv6(addr) {
+    // Anything starting with `::` is in the reserved ::/8 block: loopback (::1),
+    // unspecified (::), IPv4-mapped (::ffff:*), and various deprecated ranges.
+    // None are legitimate public endpoints, and Node's URL parser may normalise
+    // ::ffff:127.0.0.1 to ::ffff:7f00:1, so a literal-by-literal check is brittle.
+    if (addr.startsWith("::"))
+        return true;
+    // First-hextet checks: fc00::/7 (unique-local) and fe80::/10 (link-local).
+    const firstColon = addr.indexOf(":");
+    if (firstColon <= 0)
+        return false;
+    const firstHextet = addr.slice(0, firstColon);
+    const value = Number.parseInt(firstHextet, 16);
+    if (!Number.isFinite(value))
+        return false;
+    if (value >= 0xfc00 && value <= 0xfdff)
+        return true; // fc00::/7
+    if (value >= 0xfe80 && value <= 0xfebf)
+        return true; // fe80::/10
+    return false;
+}

package/dist/lib/externalPresetFetcher.js

@@ -1,8 +1,11 @@
 import { resolveCredential } from "./credentialResolver.js";
+import { EndpointValidationError, validateEndpoint } from "./endpointValidator.js";
 import { classifyExternalSource } from "./presetResolver.js";
 const DEFAULT_TIMEOUT_MS = 10_000;
 const DEFAULT_GITHUB_API_BASE = "https://api.github.com";
 const DEFAULT_GITLAB_API_BASE = "https://gitlab.com/api/v4";
+const MAX_PRESET_BYTES = 1_000_000;
+const MAX_AUTH_BODY_BYTES = 8_192;
 function trimTrailingSlash(url) {
     return url.replace(/\/+$/, "");
 }
@@ -26,7 +29,19 @@ function dispatch(parsed, options) {
     }
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-    const endpoint = options.endpoint ? trimTrailingSlash(options.endpoint) : undefined;
+    let endpoint;
+    if (options.endpoint) {
+        try {
+            validateEndpoint(options.endpoint);
+        }
+        catch (err) {
+            if (err instanceof EndpointValidationError) {
+                return Promise.resolve({ ok: false, reason: err.message });
+            }
+            throw err;
+        }
+        endpoint = trimTrailingSlash(options.endpoint);
+    }
     switch (parsed.source) {
         case "github":
             return fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint);
@@ -52,9 +67,10 @@ async function fetchGitHub(parsed, timeoutMs, fetchImpl, endpoint) {
         Accept: "application/vnd.github.raw",
         "User-Agent": "renovate-mcp",
     };
-    if (credential.token)
+    const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
+    if (sendAuth)
         headers.Authorization = `Bearer ${credential.token}`;
-    return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "github", credential);
+    return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "github", sendAuth ? credential : suppressCredential(credential));
 }
 async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
     if (!parsed.repoPath) {
@@ -66,9 +82,16 @@ async function fetchGitLab(parsed, timeoutMs, fetchImpl, endpoint) {
     const url = `${apiBase}/projects/${encodeURIComponent(parsed.repoPath)}/repository/files/${encodeURIComponent(file)}/raw?ref=${encodeURIComponent(ref)}`;
     const credential = resolveCredential(["RENOVATE_TOKEN", "GITLAB_TOKEN"]);
     const headers = { "User-Agent": "renovate-mcp" };
-    if (credential.token)
+    const sendAuth = Boolean(credential.token) && isHttpsUrl(url);
+    if (sendAuth)
         headers["PRIVATE-TOKEN"] = credential.token;
-    return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "gitlab", credential);
+    return fetchJson(url, headers, timeoutMs, parsed.original, fetchImpl, "gitlab", sendAuth ? credential : suppressCredential(credential));
+}
+function isHttpsUrl(url) {
+    return /^https:\/\//i.test(url);
+}
+function suppressCredential(credential) {
+    return { envVar: null, token: undefined, triedVars: credential.triedVars };
 }
 function presetFileName(parsed) {
     if (parsed.subpath)
@@ -113,13 +136,20 @@ async function fetchJson(url, headers, timeoutMs, presetName, fetchImpl, platfor
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const res = await fetchImpl(url, { headers, signal: controller.signal });
+        const res = await fetchImpl(url, {
+            headers,
+            signal: controller.signal,
+            redirect: "manual",
+        });
+        if (isRedirectResponse(res)) {
+            return { ok: false, reason: formatRedirectRefusal(presetName, url, res) };
+        }
         if (!res.ok) {
             const rateLimit = detectRateLimit(res, platform, presetName);
             if (rateLimit)
                 return { ok: false, reason: rateLimit };
             if (res.status === 401 || res.status === 403) {
-                const body = await safeReadText(res);
+                const body = await safeReadText(res, MAX_AUTH_BODY_BYTES);
                 return {
                     ok: false,
                     reason: formatAuthFailure(res.status, presetName, url, credential, body),
@@ -130,7 +160,17 @@ async function fetchJson(url, headers, timeoutMs, presetName, fetchImpl, platfor
                 reason: `HTTP ${res.status}${res.statusText ? ` ${res.statusText}` : ""} when fetching ${presetName}`,
             };
         }
-        const text = await res.text();
+        const oversize = checkDeclaredLength(res, presetName);
+        if (oversize)
+            return oversize;
+        const bounded = await readBoundedText(res, MAX_PRESET_BYTES);
+        if (!bounded.ok) {
+            return {
+                ok: false,
+                reason: `Preset body for ${presetName} exceeds ${MAX_PRESET_BYTES} bytes.`,
+            };
+        }
+        const text = bounded.text;
         try {
             const body = JSON.parse(text);
             if (!body || typeof body !== "object" || Array.isArray(body)) {
@@ -166,14 +206,85 @@ async function fetchJson(url, headers, timeoutMs, presetName, fetchImpl, platfor
     }
 }
 const AUTH_BODY_MAX = 500;
-async function safeReadText(res) {
+async function safeReadText(res, maxBytes) {
     try {
-        return await res.text();
+        return await readCappedText(res, maxBytes);
     }
     catch {
         return "";
     }
 }
+function checkDeclaredLength(res, presetName) {
+    const declared = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(declared) && declared > MAX_PRESET_BYTES) {
+        return {
+            ok: false,
+            reason: `Preset body for ${presetName} exceeds ${MAX_PRESET_BYTES} bytes (declared ${declared}).`,
+        };
+    }
+    return undefined;
+}
+async function readBoundedText(res, maxBytes) {
+    const collected = await collectBytes(res, maxBytes, "reject");
+    if (collected.overflow)
+        return { ok: false };
+    return { ok: true, text: new TextDecoder("utf-8").decode(collected.bytes) };
+}
+async function readCappedText(res, maxBytes) {
+    const collected = await collectBytes(res, maxBytes, "truncate");
+    return new TextDecoder("utf-8").decode(collected.bytes);
+}
+async function collectBytes(res, maxBytes, onOverflow) {
+    if (!res.body) {
+        const text = await res.text();
+        const encoded = new TextEncoder().encode(text);
+        if (encoded.byteLength > maxBytes) {
+            return onOverflow === "reject"
+                ? { bytes: new Uint8Array(0), overflow: true }
+                : { bytes: encoded.slice(0, maxBytes), overflow: true };
+        }
+        return { bytes: encoded, overflow: false };
+    }
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            const remaining = maxBytes - total;
+            if (value.byteLength > remaining) {
+                await reader.cancel().catch(() => undefined);
+                if (onOverflow === "reject") {
+                    return { bytes: new Uint8Array(0), overflow: true };
+                }
+                if (remaining > 0) {
+                    chunks.push(value.slice(0, remaining));
+                    total += remaining;
+                }
+                return { bytes: concat(chunks, total), overflow: true };
+            }
+            chunks.push(value);
+            total += value.byteLength;
+        }
+    }
+    finally {
+        reader.releaseLock?.();
+    }
+    return { bytes: concat(chunks, total), overflow: false };
+}
+function concat(chunks, total) {
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+}
 function formatAuthFailure(status, presetName, url, credential, body) {
     const lines = [`HTTP ${status} when fetching ${presetName}`];
     lines.push(`  URL:         ${url}`);
@@ -192,3 +303,17 @@ function formatCredential(credential) {
         return `${credential.envVar} (present)`;
     return `none (tried ${credential.triedVars.join(", ")})`;
 }
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+function isRedirectResponse(res) {
+    return res.type === "opaqueredirect" || REDIRECT_STATUSES.has(res.status);
+}
+function formatRedirectRefusal(presetName, url, res) {
+    const status = res.status > 0 ? String(res.status) : "redirect";
+    const lines = [
+        `Redirect refused while fetching ${presetName}`,
+        `  URL:      ${url}`,
+        `  Status:   ${status}`,
+        `  Reason:   Following redirects is disabled to prevent leaking auth tokens to a different host. If your endpoint legitimately redirects, fetch the final URL directly.`,
+    ];
+    return lines.join("\n");
+}

package/dist/lib/hostRulesConfig.js

@@ -51,9 +51,16 @@ function escapeRegex(s) {
 export function scrubSecrets(text, secrets) {
     // Sort by length descending so that when one secret is a substring of
     // another, the longer one wins the greedy regex alternation instead of
-    // being partially chewed up by the shorter one.
-    const alternatives = secrets
-        .filter((s) => s.length > 0)
+    // being partially chewed up by the shorter one. Each secret is also matched
+    // in its `encodeURIComponent` form so a token that ends up embedded in a URL
+    // (e.g. as a query parameter in a redirect Renovate logs) still gets
+    // redacted; when a secret has no encodable characters, the two forms
+    // collapse and the dedup below drops the duplicate.
+    const alternatives = [
+        ...new Set(secrets
+            .filter((s) => s.length > 0)
+            .flatMap((s) => [s, encodeURIComponent(s)])),
+    ]
         .sort((a, b) => b.length - a.length)
         .map(escapeRegex);
     if (!alternatives.length)

package/dist/lib/inputLimits.d.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+export declare const PATH_MAX_BYTES = 4096;
+export declare const TOKEN_MAX_BYTES = 1024;
+export declare const ENDPOINT_MAX_BYTES = 2048;
+export declare const REPOSITORY_MAX_BYTES = 256;
+export declare const FILENAME_MAX_BYTES = 512;
+export declare const CONFIG_JSON_MAX_BYTES = 1000000;
+export declare const REPORT_JSON_MAX_BYTES = 10000000;
+export declare const HOST_RULES_MAX_ITEMS = 256;
+export declare const HOST_RULE_JSON_MAX_BYTES = 64000;
+export declare const pathString: (description: string) => z.ZodString;
+export declare const tokenString: (description: string) => z.ZodString;
+export declare const endpointString: (description: string) => z.ZodString;
+export declare const repositoryString: (description: string) => z.ZodString;
+export declare const filenameString: (description: string) => z.ZodString;
+export declare const configRecord: (description: string) => z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export declare const reportRecord: (description: string) => z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export declare const hostRuleRecord: (description: string) => z.ZodRecord<z.ZodString, z.ZodUnknown>;

package/dist/lib/inputLimits.js

@@ -0,0 +1,46 @@
+import { z } from "zod";
+// Centralized input-size caps for every tool schema. These exist to refuse
+// pathologically large inputs (DoS via 100 MB blobs) before any business
+// logic runs. Caps are intentionally generous — real-world inputs are orders
+// of magnitude smaller — so the only way to trip them is intent or a buggy
+// caller.
+export const PATH_MAX_BYTES = 4096;
+export const TOKEN_MAX_BYTES = 1024;
+export const ENDPOINT_MAX_BYTES = 2048;
+export const REPOSITORY_MAX_BYTES = 256;
+export const FILENAME_MAX_BYTES = 512;
+export const CONFIG_JSON_MAX_BYTES = 1_000_000;
+export const REPORT_JSON_MAX_BYTES = 10_000_000;
+export const HOST_RULES_MAX_ITEMS = 256;
+export const HOST_RULE_JSON_MAX_BYTES = 64_000;
+export const pathString = (description) => z.string().max(PATH_MAX_BYTES).describe(description);
+export const tokenString = (description) => z.string().max(TOKEN_MAX_BYTES).describe(description);
+export const endpointString = (description) => z.string().max(ENDPOINT_MAX_BYTES).describe(description);
+export const repositoryString = (description) => z.string().max(REPOSITORY_MAX_BYTES).describe(description);
+export const filenameString = (description) => z.string().max(FILENAME_MAX_BYTES).describe(description);
+const refineJsonSize = (limit) => (value) => {
+    try {
+        return JSON.stringify(value).length <= limit;
+    }
+    catch {
+        return false;
+    }
+};
+export const configRecord = (description) => z
+    .record(z.string(), z.unknown())
+    .refine(refineJsonSize(CONFIG_JSON_MAX_BYTES), {
+    message: `Config object exceeds ${CONFIG_JSON_MAX_BYTES} bytes when serialized`,
+})
+    .describe(description);
+export const reportRecord = (description) => z
+    .record(z.string(), z.unknown())
+    .refine(refineJsonSize(REPORT_JSON_MAX_BYTES), {
+    message: `Report object exceeds ${REPORT_JSON_MAX_BYTES} bytes when serialized`,
+})
+    .describe(description);
+export const hostRuleRecord = (description) => z
+    .record(z.string(), z.unknown())
+    .refine(refineJsonSize(HOST_RULE_JSON_MAX_BYTES), {
+    message: `hostRule entry exceeds ${HOST_RULE_JSON_MAX_BYTES} bytes when serialized`,
+})
+    .describe(description);

package/dist/lib/log.d.ts

@@ -0,0 +1 @@
+export declare function logError(message: string, reason?: unknown): void;

package/dist/lib/log.js

@@ -0,0 +1,21 @@
+// stderr-only logging for the MCP stdio server.
+// stdout carries JSON-RPC frames — anything written there corrupts the next
+// message the client receives, so error output must never go through console.log.
+const PREFIX = "[renovate-mcp]";
+function formatReason(reason) {
+    if (reason instanceof Error) {
+        return reason.stack ?? `${reason.name}: ${reason.message}`;
+    }
+    if (typeof reason === "string")
+        return reason;
+    try {
+        return JSON.stringify(reason);
+    }
+    catch {
+        return String(reason);
+    }
+}
+export function logError(message, reason) {
+    const suffix = reason === undefined ? "" : `: ${formatReason(reason)}`;
+    process.stderr.write(`${PREFIX} ${message}${suffix}\n`);
+}

package/dist/lib/version.d.ts

@@ -1,4 +1,4 @@
-export declare const SERVER_VERSION = "0.8.0";
+export declare const SERVER_VERSION = "0.9.2";
 export type BuildMode = "local" | "released";
 export interface VersionInfo {
     version: string;

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "0.8.0"; // x-release-please-version
+export const SERVER_VERSION = "0.9.2"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/dist/tools/dryRun.js

@@ -5,13 +5,13 @@ import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { run, resolveRenovateTool, formatMissingBinaryError } from "../lib/renovateCli.js";
 import { resolveCredential } from "../lib/credentialResolver.js";
+import { EndpointValidationError, validateEndpoint } from "../lib/endpointValidator.js";
 import { locateConfig } from "../lib/configLocations.js";
 import { detectLookupProblems } from "../lib/lookupProblems.js";
 import { collectSecrets, scrubSecrets, writeHostRulesConfig, } from "../lib/hostRulesConfig.js";
 import { extractRenovateLogMsg, buildDryRunHeartbeatMessage, } from "../lib/dryRunProgress.js";
-const hostRuleSchema = z
-    .record(z.string(), z.unknown())
-    .describe("A single Renovate hostRule (matchHost, hostType, username, password, token, …). Structure is not validated here — Renovate's own config loader checks it when the temp file is read.");
+import { HOST_RULES_MAX_ITEMS, endpointString, hostRuleRecord, pathString, repositoryString, tokenString, } from "../lib/inputLimits.js";
+const hostRuleSchema = hostRuleRecord("A single Renovate hostRule (matchHost, hostType, username, password, token, …). Structure is not validated here — Renovate's own config loader checks it when the temp file is read.");
 /**
  * Walk Renovate's JSON report looking for `problems` arrays and collect the
  * ones that represent failed runs — not informational notices. Criteria:
@@ -90,9 +90,7 @@ export function registerDryRun(server) {
         title: "Dry-run Renovate",
         description: "Run Renovate in dry-run mode to preview what it would do — no PRs opened, no git pushes. Returns a structured JSON report plus a top-level `ok` boolean (false when the CLI failed OR the report records a validation/error-level problem, even if the exit code was 0).\n\nDefault mode runs `--platform=local` against the filesystem at `repoPath`. If your config extends `local>…` presets, pass `platform` (`github` or `gitlab`), `endpoint` (API base URL), `token`, and `repository` to run as a real platform client that can actually fetch those presets — Renovate still runs with `--dry-run`, so no PRs are opened. If you only need `gitlab>…` / `github>…` presets resolved against a self-hosted host (not a full remote run), pass just `endpoint` (and `token` if needed) while leaving `platform` unset — both flow through to Renovate in local mode too, which is enough to redirect those preset shortcuts away from the public defaults. The tool preflight-checks for `local>` presets under `--platform=local` (in `lookup` and `full` modes) and fails fast with remediation guidance rather than spawning a Renovate run that would fail opaquely with `config-validation`. The preflight is skipped for `dryRunMode=extract` so manifest-only extraction can be attempted regardless.\n\nWhen the `token` input is omitted, the tool falls back to `RENOVATE_TOKEN` from the MCP server's env, then to `GITLAB_TOKEN` (when `platform=gitlab`) or `GITHUB_TOKEN` (when `platform=github`) — whichever is auto-translated to `RENOVATE_TOKEN` for the spawned Renovate CLI. This matches the precedence `resolve_config` already uses, so a single `GITLAB_TOKEN` in `.mcp.json` works for both tools. For a remote-platform run, an actionable preflight error is returned before spawning Renovate when no token can be resolved at all.\n\nCredentials for private registries (e.g. `COMPOSER_AUTH` for Packagist/Satis proxies, `NPM_TOKEN` / `.npmrc` for npm, Docker registry creds, `RENOVATE_HOST_RULES` for anything else) must be set on the MCP server process itself — via the `env` key in `claude_desktop_config.json` / `.mcp.json`, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env. Alternatively, encode credentials as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on this tool (written to a mode-0600 temp file that is cleaned up after the run; token/password values — including the platform `token` input — are scrubbed from `logTail` and `problems`). Per-call `hostRules` are appended to any the repo's own config already declares. If a lookup can't auth to a registry, Renovate often reports 0 updates without a loud error; when that happens this tool surfaces detected auth failures under `problems` in the output so callers can distinguish a genuine \"no updates\" from a silent registry-auth failure.",
         inputSchema: {
-            repoPath: z
-                .string()
-                .describe("Absolute path to the repository root. Required for the default `platform=local` mode. When `platform` is overridden (e.g. `gitlab` / `github`), Renovate runs against the remote `repository` instead — `repoPath` is still used as the child's working directory but its manifest files are ignored."),
+            repoPath: pathString("Absolute path to the repository root. Required for the default `platform=local` mode. When `platform` is overridden (e.g. `gitlab` / `github`), Renovate runs against the remote `repository` instead — `repoPath` is still used as the child's working directory but its manifest files are ignored."),
             dryRunMode: z
                 .enum(["extract", "lookup", "full"])
                 .default("full")
@@ -109,24 +107,30 @@ export function registerDryRun(server) {
                 .enum(["local", "github", "gitlab"])
                 .optional()
                 .describe("Renovate platform to run as. When unset, falls back to `RENOVATE_PLATFORM` from the MCP server's env (if it's one of `local`/`github`/`gitlab`), then to `local`. Default `local` runs against the filesystem at `repoPath`. Set `github` or `gitlab` (with `endpoint` + `token` + `repository`) to run a full remote dry-run — this is what you need when your config extends `local>` presets that live on a private GitHub Enterprise / self-hosted GitLab. Still no PRs opened because `--dry-run` is always set."),
-            endpoint: z
-                .string()
-                .optional()
-                .describe("Custom API base URL (e.g. `https://gitlab.example.com/api/v4/` or `https://ghe.example.com/api/v3/`). Forwarded as `--endpoint` regardless of `platform`: required for non-default GitHub/GitLab hosts when `platform=github`/`gitlab`, and also useful in the default `platform=local` mode to point `gitlab>…` / `github>…` preset shortcuts at a self-hosted host instead of the public defaults."),
-            token: z
-                .string()
-                .optional()
-                .describe("Auth token, exported as `RENOVATE_TOKEN` to the child. Scrubbed from any log output this tool returns. Used both for the platform connection (when `platform` is `github`/`gitlab`) and for preset resolution against private repos (e.g. when fetching a `gitlab>…` preset from a private project while in local mode). When omitted, falls back to `RENOVATE_TOKEN` from MCP env, then to `GITLAB_TOKEN` (when `platform=gitlab`) or `GITHUB_TOKEN` (when `platform=github`) — same precedence as `resolve_config`. Platform-specific fallbacks only kick in when the matching remote platform is selected; in `platform=local` they're ignored."),
-            repository: z
-                .string()
-                .optional()
-                .describe("Identifier of the repository Renovate should operate on, passed as a positional argument (Renovate has no `--repository` flag). For GitHub: `owner/repo`. For GitLab: `group/project` or a nested-group path like `group/subgroup/project` — both are accepted. Required when `platform` is `github`/`gitlab`. Ignored when `platform=local`."),
+            endpoint: endpointString("Custom API base URL (e.g. `https://gitlab.example.com/api/v4/` or `https://ghe.example.com/api/v3/`). Forwarded as `--endpoint` regardless of `platform`: required for non-default GitHub/GitLab hosts when `platform=github`/`gitlab`, and also useful in the default `platform=local` mode to point `gitlab>…` / `github>…` preset shortcuts at a self-hosted host instead of the public defaults.").optional(),
+            token: tokenString("Auth token, exported as `RENOVATE_TOKEN` to the child. Scrubbed from any log output this tool returns. Used both for the platform connection (when `platform` is `github`/`gitlab`) and for preset resolution against private repos (e.g. when fetching a `gitlab>…` preset from a private project while in local mode). When omitted, falls back to `RENOVATE_TOKEN` from MCP env, then to `GITLAB_TOKEN` (when `platform=gitlab`) or `GITHUB_TOKEN` (when `platform=github`) — same precedence as `resolve_config`. Platform-specific fallbacks only kick in when the matching remote platform is selected; in `platform=local` they're ignored.").optional(),
+            repository: repositoryString("Identifier of the repository Renovate should operate on, passed as a positional argument (Renovate has no `--repository` flag). For GitHub: `owner/repo`. For GitLab: `group/project` or a nested-group path like `group/subgroup/project` — both are accepted. Required when `platform` is `github`/`gitlab`. Ignored when `platform=local`.").optional(),
             hostRules: z
                 .array(hostRuleSchema)
+                .max(HOST_RULES_MAX_ITEMS)
                 .optional()
                 .describe("Optional per-invocation Renovate hostRules for private registry auth. Written to a mode-0600 temp file that is passed via the RENOVATE_CONFIG_FILE env var and deleted after the run. Token/password values are scrubbed from any log output this tool returns. Appended to (not replacing) any hostRules declared in the repo's own config."),
         },
     }, async ({ repoPath, dryRunMode, logLevel, timeoutMs, platform, endpoint, token, repository, hostRules }, extra) => {
+        if (endpoint !== undefined) {
+            try {
+                validateEndpoint(endpoint);
+            }
+            catch (err) {
+                if (err instanceof EndpointValidationError) {
+                    return {
+                        isError: true,
+                        content: [{ type: "text", text: err.message }],
+                    };
+                }
+                throw err;
+            }
+        }
         const reportPath = path.join(tmpdir(), `renovate-mcp-report-${randomUUID()}.json`);
         const bin = resolveRenovateTool("renovate");
         const ruleList = hostRules ?? [];
@@ -246,6 +250,14 @@ export function registerDryRun(server) {
             }).catch(() => undefined);
         };
         try {
+            // Pre-create the report file with mode 0600 so the on-disk JSON is
+            // not world-readable while Renovate is running. Renovate's report
+            // writer calls fs.writeFile with O_WRONLY|O_CREAT|O_TRUNC, which
+            // preserves the existing file's mode — so the 0600 we set here
+            // sticks across Renovate's overwrite. The `wx` flag fails fast if
+            // the path already exists (e.g. UUID collision), which is the safer
+            // default than silently inheriting whatever mode it had.
+            await fs.writeFile(reportPath, "", { flag: "wx", mode: 0o600 });
             const args = [
                 `--platform=${effectivePlatform}`,
                 `--dry-run=${dryRunMode}`,

package/dist/tools/dryRunDiff.js

@@ -1,8 +1,6 @@
-import { z } from "zod";
 import { diffDryRunReports } from "../lib/dryRunDiff.js";
-const reportShape = z
-    .record(z.string(), z.unknown())
-    .describe("A Renovate dry-run report. Pass either the raw report (an object with a `repositories` key) or the full `dry_run` tool summary (an object with a `report` key); the tool unwraps `report` automatically.");
+import { reportRecord } from "../lib/inputLimits.js";
+const reportShape = reportRecord("A Renovate dry-run report. Pass either the raw report (an object with a `repositories` key) or the full `dry_run` tool summary (an object with a `report` key); the tool unwraps `report` automatically.");
 export function registerDryRunDiff(server) {
     server.registerTool("dry_run_diff", {
         title: "Diff two Renovate dry-run reports",

package/dist/tools/explainConfig.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { locateConfig } from "../lib/configLocations.js";
 import { explainConfig } from "../lib/configExplainer.js";
+import { configRecord, endpointString, pathString } from "../lib/inputLimits.js";
 const MERGE_QUALITY = "preview";
 const MERGE_DISCLAIMER = "Same simplified merge as resolve_config (arrays concat, objects merge, scalars overwrite). Renovate's rule-specific semantics for hostRules, regexManagers, and some boolean flags are not modelled — explanations of those keys are only as accurate as the merge.";
 export function registerExplainConfig(server) {
@@ -8,22 +9,13 @@ export function registerExplainConfig(server) {
         title: "Explain which preset set each field",
         description: "Inverse of resolve_config: walk the same preset tree, but annotate every leaf field with the chain of presets that touched it. Each leaf in `explanation` carries `{ value, setBy }` where `setBy` lists every contribution in merge order — last entry wins for scalars; for arrays each entry adds its own slice. The `<own>` source means the value came from the user's input config (siblings of `extends`); other sources are preset references as written in `extends`. Use this to trace surprises like \"why is `prCreation` set to 'not-pending'?\". Pure analysis: same offline-by-default behaviour as resolve_config, plus the same `externalPresets` / `endpoint` / `platform` opt-ins. Pass `repoPath` (reads the repo's config) or `configContent` (an inline config). For full-fidelity output, run dry_run instead.",
         inputSchema: {
-            repoPath: z
-                .string()
-                .optional()
-                .describe("Absolute path to the repository root. The tool will locate the repo's renovate config automatically."),
-            configContent: z
-                .record(z.string(), z.unknown())
-                .optional()
-                .describe("Inline config object to explain — use instead of repoPath."),
+            repoPath: pathString("Absolute path to the repository root. The tool will locate the repo's renovate config automatically.").optional(),
+            configContent: configRecord("Inline config object to explain — use instead of repoPath.").optional(),
             externalPresets: z
                 .boolean()
                 .optional()
                 .describe("When true, fetch external presets (github>, gitlab>) over HTTPS — same credentials and behaviour as resolve_config. Default false."),
-            endpoint: z
-                .string()
-                .optional()
-                .describe("API base URL for github>/gitlab> fetches. Use for GitHub Enterprise or self-hosted GitLab — same semantics as resolve_config."),
+            endpoint: endpointString("API base URL for github>/gitlab> fetches. Use for GitHub Enterprise or self-hosted GitLab — same semantics as resolve_config.").optional(),
             platform: z
                 .enum(["github", "gitlab"])
                 .optional()

package/dist/tools/lintConfig.js

@@ -1,21 +1,15 @@
-import { z } from "zod";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import JSON5 from "json5";
 import { lintConfig } from "../lib/configLinter.js";
+import { configRecord, pathString } from "../lib/inputLimits.js";
 export function registerLintConfig(server) {
     server.registerTool("lint_config", {
         title: "Lint Renovate config for semantic footguns",
         description: "Run a semantic lint pass over a Renovate config. Complements validate_config: schema validation catches structural bugs, this catches Renovate-specific footguns schema validation misses — malformed '/…/' regex patterns in fields like matchPackageNames, matchDepNames, matchSourceUrls, matchCurrentVersion, plus unknown manager names in matchManagers / excludeManagers (typos that Renovate silently ignores). Offline; does not shell out. Pass either configPath (file on disk, JSON or JSON5) or configContent (inline object).",
         inputSchema: {
-            configPath: z
-                .string()
-                .optional()
-                .describe("Absolute path to a config file to lint (JSON or JSON5)"),
-            configContent: z
-                .record(z.string(), z.unknown())
-                .optional()
-                .describe("Inline config object to lint"),
+            configPath: pathString("Absolute path to a config file to lint (JSON or JSON5)").optional(),
+            configContent: configRecord("Inline config object to lint").optional(),
         },
     }, async ({ configPath, configContent }) => {
         if (!configPath && !configContent) {

package/dist/tools/previewCustomManager.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { previewCustomManager, } from "../lib/customManagerPreview.js";
+import { pathString } from "../lib/inputLimits.js";
 const managerSchema = z
     .object({
     customType: z.string(),
@@ -33,7 +34,7 @@ export function registerPreviewCustomManager(server) {
             "Run the `dry_run` tool afterwards for full-fidelity confirmation.",
         ].join("\n"),
         inputSchema: {
-            repoPath: z.string().describe("Absolute path to the repository root"),
+            repoPath: pathString("Absolute path to the repository root"),
             manager: managerSchema.describe("A single Renovate customManagers entry. NOTE: `fileMatch` is an array of REGEX strings matched against POSIX-style relative paths (not globs)."),
             maxFilesWalked: z
                 .number()

package/dist/tools/readConfig.js

@@ -1,11 +1,11 @@
-import { z } from "zod";
 import { locateConfig } from "../lib/configLocations.js";
+import { pathString } from "../lib/inputLimits.js";
 export function registerReadConfig(server) {
     server.registerTool("read_config", {
         title: "Read Renovate config",
         description: "Locate and parse the Renovate configuration in a repository. Searches for renovate.json, renovate.json5, .renovaterc(.json|.json5), .github/renovate.json, .gitlab/renovate.json, and the 'renovate' field of package.json — in that priority order.",
         inputSchema: {
-            repoPath: z.string().describe("Absolute path to the repository root"),
+            repoPath: pathString("Absolute path to the repository root"),
         },
     }, async ({ repoPath }) => {
         const located = await locateConfig(repoPath);

package/dist/tools/resolveConfig.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { locateConfig } from "../lib/configLocations.js";
 import { resolveConfig } from "../lib/presetResolver.js";
+import { configRecord, endpointString, pathString } from "../lib/inputLimits.js";
 const MERGE_QUALITY = "preview";
 const MERGE_DISCLAIMER = "Preset expansion uses a simplified merge (arrays concat, objects merge, scalars overwrite). Run dry_run for authoritative output — hostRules, regexManagers, and some boolean flags merge with rule-specific semantics that are not modeled here.";
 export function registerResolveConfig(server) {
@@ -8,22 +9,13 @@ export function registerResolveConfig(server) {
         title: "Resolve Renovate config (expand presets)",
         description: "Expand every preset referenced by `extends` and return the fully resolved config. Built-in presets resolve offline against the committed catalogue. Pass `externalPresets: true` to fetch `github>` and `gitlab>` presets over HTTPS (with optional `RENOVATE_TOKEN` — or `GITHUB_TOKEN` / `GITLAB_TOKEN` as platform-specific fallbacks — for private repos). For GitHub Enterprise or self-hosted GitLab, pass `endpoint` (API base URL, e.g. `https://ghe.example.com/api/v3` or `https://gitlab.example.com/api/v4`); pass `platform` in addition to route `local>` presets through the same endpoint. `bitbucket>`, `gitea>`, and npm presets are structurally unsupported and remain in `presetsUnresolved` regardless. Endpoint and platform are **tool inputs only** — env vars like `RENOVATE_ENDPOINT` are not read, since the MCP server runs under Claude rather than in your shell. Pass either `repoPath` (reads the repo's config) or `configContent` (an inline config object). The response includes `mergeQuality: \"preview\"` plus a `disclaimer` and a `warnings` array — preset merging here is a close approximation of Renovate's rules rather than bit-identical, and Handlebars expressions other than `{{argN}}` are left verbatim; run `dry_run` for authoritative output.",
         inputSchema: {
-            repoPath: z
-                .string()
-                .optional()
-                .describe("Absolute path to the repository root. The tool will locate the repo's renovate config automatically."),
-            configContent: z
-                .record(z.string(), z.unknown())
-                .optional()
-                .describe("Inline config object to resolve — use instead of repoPath."),
+            repoPath: pathString("Absolute path to the repository root. The tool will locate the repo's renovate config automatically.").optional(),
+            configContent: configRecord("Inline config object to resolve — use instead of repoPath.").optional(),
             externalPresets: z
                 .boolean()
                 .optional()
                 .describe("When true, fetch external presets (github>, gitlab>) over HTTPS. Credentials come from RENOVATE_TOKEN (preferred, matches Renovate's own convention) or GITHUB_TOKEN / GITLAB_TOKEN as platform-specific fallbacks, set on the MCP server process — via the `env` key in claude_desktop_config.json / .mcp.json, not your shell, since the MCP server runs as a child of Claude and does not inherit shell env. Default false."),
-            endpoint: z
-                .string()
-                .optional()
-                .describe("API base URL for github>/gitlab> fetches. Use for GitHub Enterprise (e.g. https://ghe.example.com/api/v3) or self-hosted GitLab (e.g. https://gitlab.example.com/api/v4). Defaults to https://api.github.com and https://gitlab.com/api/v4."),
+            endpoint: endpointString("API base URL for github>/gitlab> fetches. Use for GitHub Enterprise (e.g. https://ghe.example.com/api/v3) or self-hosted GitLab (e.g. https://gitlab.example.com/api/v4). Defaults to https://api.github.com and https://gitlab.com/api/v4.").optional(),
             platform: z
                 .enum(["github", "gitlab"])
                 .optional()

package/dist/tools/validateConfig.js

@@ -4,19 +4,14 @@ import { promises as fs } from "node:fs";
 import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { run, resolveRenovateTool, formatMissingBinaryError } from "../lib/renovateCli.js";
+import { configRecord, pathString } from "../lib/inputLimits.js";
 export function registerValidateConfig(server) {
     server.registerTool("validate_config", {
         title: "Validate Renovate config",
         description: "Validate a Renovate configuration against the official schema using renovate-config-validator. Pass either configPath (file on disk) or configContent (inline JSON object). Returns validation output and a boolean `valid`.",
         inputSchema: {
-            configPath: z
-                .string()
-                .optional()
-                .describe("Absolute path to a config file to validate"),
-            configContent: z
-                .record(z.string(), z.unknown())
-                .optional()
-                .describe("Inline config object to validate (written to a temp file)"),
+            configPath: pathString("Absolute path to a config file to validate").optional(),
+            configContent: configRecord("Inline config object to validate (written to a temp file)").optional(),
             strict: z
                 .boolean()
                 .optional()

package/dist/tools/writeConfig.js

@@ -1,7 +1,9 @@
 import { z } from "zod";
 import path from "node:path";
 import { promises as fs } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { run, resolveRenovateTool, formatMissingBinaryError } from "../lib/renovateCli.js";
+import { configRecord, filenameString, pathString } from "../lib/inputLimits.js";
 // Resolve symlinks in `p`, walking up to the nearest existing ancestor when
 // tail components don't exist yet (e.g. a new subdir we're about to mkdir).
 // This matters for the escape check: `fs.rename` follows symlinks along the
@@ -25,23 +27,40 @@ async function resolveWithExistingAncestor(p) {
         }
     }
 }
+const FORCE_CONFIRMATION_TOKEN = "YES_OVERRIDE_VALIDATION";
 export function registerWriteConfig(server) {
     server.registerTool("write_config", {
         title: "Write Renovate config",
-        description: "Write a Renovate config to disk. Runs renovate-config-validator first — refuses to write if validation fails unless force=true.",
+        description: "Write a Renovate config to disk. Runs renovate-config-validator first — refuses to write if validation fails unless force=true (which additionally requires confirmForce).",
         inputSchema: {
-            repoPath: z.string().describe("Absolute path to the repository root"),
-            config: z.record(z.string(), z.unknown()).describe("The Renovate config object"),
-            filename: z
-                .string()
-                .default("renovate.json")
-                .describe("Target filename relative to repoPath (default renovate.json)"),
+            repoPath: pathString("Absolute path to the repository root"),
+            config: configRecord("The Renovate config object"),
+            filename: filenameString("Target filename relative to repoPath (default renovate.json)").default("renovate.json"),
             force: z
                 .boolean()
                 .default(false)
-                .describe("Write even if validation fails"),
+                .describe("Write even if validation fails. Requires confirmForce."),
+            confirmForce: z
+                .literal(FORCE_CONFIRMATION_TOKEN)
+                .optional()
+                .describe(`Must be set to the literal '${FORCE_CONFIRMATION_TOKEN}' when force is true. The unusual literal exists to make accidental overrides harder under prompt-injected tool calls.`),
         },
-    }, async ({ repoPath, config, filename, force }) => {
+    }, async ({ repoPath, config, filename, force, confirmForce }) => {
+        if (force && confirmForce !== FORCE_CONFIRMATION_TOKEN) {
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            wrote: false,
+                            reason: "force-confirmation-missing",
+                            hint: `force=true requires confirmForce='${FORCE_CONFIRMATION_TOKEN}'. This guard exists to make accidental overrides harder under prompt-injected tool calls.`,
+                        }, null, 2),
+                    },
+                ],
+            };
+        }
         const repoAbs = path.resolve(repoPath);
         const target = path.resolve(repoAbs, filename);
         const rel = path.relative(repoAbs, target);
@@ -55,9 +74,12 @@ export function registerWriteConfig(server) {
             };
         }
         const payload = JSON.stringify(config, null, 2) + "\n";
-        const tmp = `${target}.renovate-mcp-tmp`;
+        // Randomize the suffix so two concurrent writes don't collide, and use
+        // `flag: "wx"` (O_CREAT|O_EXCL) so a pre-existing symlink at the temp
+        // path is refused with EEXIST instead of silently followed (issue #129).
+        const tmp = `${target}.renovate-mcp-tmp-${randomUUID()}`;
         await fs.mkdir(path.dirname(target), { recursive: true });
-        await fs.writeFile(tmp, payload);
+        await fs.writeFile(tmp, payload, { flag: "wx", mode: 0o600 });
         try {
             let valid = false;
             let validationOutput = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "0.8.0",
+  "version": "0.9.2",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -51,6 +51,10 @@
   "engines": {
     "node": ">=24"
   },
+  "os": [
+    "darwin",
+    "linux"
+  ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "ignore": "^7.0.5",