revclamp-mcp 1.20.7 → 1.20.8

package/README.md

@@ -41,7 +41,7 @@ Add `revclamp-mcp` to your `claude_desktop_config.json` or `.cursor/mcp.json`. B
   "mcpServers": {
     "revclamp": {
       "command": "npx",
-      "args": ["-y", "github:revclamp/revclamp-mcp"]
+      "args": ["-y", "github:lhphong09t2/revclamp-mcp"]
     }
   }
 }
@@ -59,7 +59,7 @@ curl -sS -X POST https://api.revclamp.com/api/mcp \
 
 ```bash
 # Run a <60s local CLI smoke check (verifies all 9 tool schemas & executes a local_engine.mjs sample audit with zero API key)
-npx -y github:revclamp/revclamp-mcp#v1.20.7 --self-test
+npx -y github:lhphong09t2/revclamp-mcp#v1.20.8 --self-test
 
 # List all 9 MCP tools and JSON schemas (runs locally in-process)
 node index.mjs --list-tools

package/index.mjs

@@ -20,6 +20,7 @@ import { fileURLToPath } from "node:url";
 import {
   LOCAL_MCP_TOOLS,
   MCP_PROTOCOL_VERSION,
+  normalizeMcpToolArgs,
   executeLocalMcpTool,
   executeLocalMcpJsonRpc,
 } from "./local_engine.mjs";
@@ -27,11 +28,12 @@ import {
 export {
   LOCAL_MCP_TOOLS,
   MCP_PROTOCOL_VERSION,
+  normalizeMcpToolArgs,
   executeLocalMcpTool,
   executeLocalMcpJsonRpc,
 };
 
-export const PACKAGE_VERSION = "1.20.7";
+export const PACKAGE_VERSION = "1.20.8";
 export const DEFAULT_MCP_ENDPOINT = "https://api.revclamp.com/api/mcp";
 export const ALLOWED_MCP_ORIGINS = Object.freeze(
   new Set(["https://api.revclamp.com", "https://revclamp.com"])
@@ -41,7 +43,7 @@ export const MAX_STDIO_LINE_BYTES = MAX_PAYLOAD_BYTES;
 export const REQUEST_TIMEOUT_MS = 10_000;
 
 const LIVE_SECRET_GUARD_RE =
-  /(?:[sr]k_live_[A-Za-z0-9_-]{4,}|whsec_live_[A-Za-z0-9_-]{4,}|whsec_(?!test_|synth_|sandbox_)[A-Za-z0-9_-]{10,}|shpss_live_[A-Za-z0-9_-]{4,}|shpss_[0-9a-fA-F]{16,}|shp(?:at|ua|ca|pa)_[A-Za-z0-9_-]{8,}|lsq_[A-Za-z0-9_-]{4,}|r[gc]_live_[A-Za-z0-9_-]{4,}|AKIA[0-9A-Z]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)/i;
+  /(?:[sr]k_live_[A-Za-z0-9_-]{4,}|whsec_live_[A-Za-z0-9_-]{4,}|whsec_(?!test_|synth_|sandbox_|demo_|sample_|mock_|example_|fake_|dummy_)[A-Za-z0-9_-]{10,}|shpss_live_[A-Za-z0-9_-]{4,}|shpss_[0-9a-fA-F]{16,}|shp(?:at|ua|ca|pa)_[A-Za-z0-9_-]{8,}|lsq_[A-Za-z0-9_-]{4,}|r[gc]_live_[A-Za-z0-9_-]{4,}|AKIA[0-9A-Z]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)/i;
 
 export function toSafeRpcId(rawId) {
   if (typeof rawId === "number" && Number.isFinite(rawId)) {
@@ -314,6 +316,37 @@ export async function forwardMcpJsonRpc(
         },
       };
     }
+    if (methodStr === "tools/call" && rpcRequest.params.arguments !== undefined) {
+      const normRes = normalizeMcpToolArgs(
+        String(rpcRequest.params?.name || "").trim(),
+        rpcRequest.params.arguments
+      );
+      if (!normRes.ok) {
+        if (isNotification) {
+          return null;
+        }
+        return {
+          jsonrpc: "2.0",
+          id: safeId,
+          error: {
+            code: -32602,
+            message: normRes.message,
+            data: {
+              error: normRes.error,
+              reason: normRes.error,
+              ...(normRes.canonicalKey ? { canonicalKey: normRes.canonicalKey } : {}),
+            },
+          },
+        };
+      }
+      rpcRequest = {
+        ...rpcRequest,
+        params: {
+          ...rpcRequest.params,
+          arguments: normRes.args,
+        },
+      };
+    }
   }
 
   try {

package/local_engine.mjs

@@ -26,7 +26,79 @@ export const SUPPORTED_MCP_PROTOCOL_VERSIONS = Object.freeze([
 ]);
 
 const LOCAL_LIVE_SECRET_GUARD_RE =
-  /(?:[sr]k_live_[A-Za-z0-9_-]{4,}|whsec_live_[A-Za-z0-9_-]{4,}|whsec_(?!test_|synth_|sandbox_)[A-Za-z0-9_-]{10,}|shpss_live_[A-Za-z0-9_-]{4,}|shpss_[0-9a-fA-F]{16,}|shp(?:at|ua|ca|pa)_[A-Za-z0-9_-]{8,}|lsq_[A-Za-z0-9_-]{4,}|r[gc]_live_[A-Za-z0-9_-]{4,}|AKIA[0-9A-Z]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)/i;
+  /(?:[sr]k_live_[A-Za-z0-9_-]{4,}|whsec_live_[A-Za-z0-9_-]{4,}|whsec_(?!test_|synth_|sandbox_|demo_|sample_|mock_|example_|fake_|dummy_)[A-Za-z0-9_-]{10,}|shpss_live_[A-Za-z0-9_-]{4,}|shpss_[0-9a-fA-F]{16,}|shp(?:at|ua|ca|pa)_[A-Za-z0-9_-]{8,}|lsq_[A-Za-z0-9_-]{4,}|r[gc]_live_[A-Za-z0-9_-]{4,}|AKIA[0-9A-Z]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)/i;
+
+const LOCAL_MCP_TOOL_ARG_ALIAS_GROUPS = Object.freeze({
+  revclamp_verify_webhook_signature: Object.freeze([
+    Object.freeze({ canonical: "rawPayload", aliases: Object.freeze(["payload", "body"]) }),
+    Object.freeze({
+      canonical: "signatureHeader",
+      aliases: Object.freeze(["signature", "header", "stripeSignature", "shopifyHmac"]),
+    }),
+    Object.freeze({
+      canonical: "secret",
+      aliases: Object.freeze(["webhookSecret", "signingSecret"]),
+    }),
+    Object.freeze({ canonical: "timestampSec", aliases: Object.freeze(["timestamp"]) }),
+    Object.freeze({
+      canonical: "toleranceSec",
+      aliases: Object.freeze(["toleranceSeconds", "tolerance"]),
+    }),
+  ]),
+  revclamp_simulate_webhook_replay: Object.freeze([
+    Object.freeze({ canonical: "scenarioPreset", aliases: Object.freeze(["preset"]) }),
+    Object.freeze({
+      canonical: "idempotencyWindowSec",
+      aliases: Object.freeze(["windowSec", "dedupWindowSec"]),
+    }),
+  ]),
+});
+
+export function normalizeMcpToolArgs(toolName, rawArgs) {
+  if (rawArgs === null || typeof rawArgs !== "object" || Array.isArray(rawArgs)) {
+    return {
+      ok: false,
+      error: "INVALID_ARGUMENTS_OBJECT",
+      message: "Invalid params: arguments must be a JSON object",
+    };
+  }
+  const normalized = { ...rawArgs };
+  const groups = Object.hasOwn(LOCAL_MCP_TOOL_ARG_ALIAS_GROUPS, toolName)
+    ? LOCAL_MCP_TOOL_ARG_ALIAS_GROUPS[toolName]
+    : null;
+  if (!groups) {
+    return { ok: true, args: normalized };
+  }
+  for (const group of groups) {
+    const allKeys = [group.canonical, ...group.aliases];
+    const presentKeys = allKeys.filter(
+      (k) => Object.hasOwn(rawArgs, k) && rawArgs[k] !== undefined
+    );
+    if (presentKeys.length > 1) {
+      const firstKey = presentKeys[0];
+      const firstVal = rawArgs[firstKey];
+      for (let i = 1; i < presentKeys.length; i += 1) {
+        const otherKey = presentKeys[i];
+        if (!Object.is(firstVal, rawArgs[otherKey])) {
+          return {
+            ok: false,
+            error: "CONFLICTING_PARAMETER_ALIASES",
+            canonicalKey: group.canonical,
+            conflictKey: otherKey,
+            message: `Invalid params: conflicting parameter aliases for '${group.canonical}' ('${firstKey}' vs '${otherKey}')`,
+          };
+        }
+      }
+    }
+    if (presentKeys.length >= 1) {
+      normalized[group.canonical] = rawArgs[presentKeys[0]];
+      for (const aliasKey of group.aliases) {
+        delete normalized[aliasKey];
+      }
+    }
+  }
+  return { ok: true, args: normalized };
+}
 
 export function scanLocalMcpPayloadForSecrets(node, depth = 0) {
   if (depth > 8) {
@@ -381,7 +453,28 @@ export const LOCAL_MCP_TOOLS = Object.freeze([
           maximum: 2592000,
           default: 259200,
         },
-        events: { type: "array" },
+        events: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              eventId: { type: "string" },
+              eventType: { type: "string" },
+              createdSec: { type: "integer" },
+              subscriptionStatus: { type: "string" },
+              tier: { type: "string" },
+              currentPeriodEndSec: { type: "integer" },
+              id: { type: "string" },
+              type: { type: "string" },
+              created: { type: "integer" },
+              status: { type: "string" },
+              target_status: { type: "string" },
+              arrivedAtSec: { type: "integer" },
+              arrived_at_sec: { type: "integer" },
+            },
+            additionalProperties: false,
+          },
+        },
         demo: { type: "boolean" },
       },
     },
@@ -1148,14 +1241,33 @@ function evaluateLocalVisaCe3Qualification(disputeReason, disputedTransaction, p
 }
 
 export function executeLocalMcpTool(toolName, rawArgs = {}) {
-  const args = rawArgs && typeof rawArgs === "object" && !Array.isArray(rawArgs) ? rawArgs : {};
-  const secretScan = scanLocalMcpPayloadForSecrets(args);
+  const inputArgs =
+    rawArgs === undefined
+      ? {}
+      : rawArgs && typeof rawArgs === "object" && !Array.isArray(rawArgs)
+        ? rawArgs
+        : null;
+  if (!inputArgs) {
+    const err = new Error("Invalid params: arguments must be a JSON object");
+    err.code = -32602;
+    err.reason = "INVALID_ARGUMENTS_OBJECT";
+    throw err;
+  }
+  const secretScan = scanLocalMcpPayloadForSecrets(inputArgs);
   if (!secretScan.ok) {
     const err = new Error(`Invalid params: ${secretScan.reason}`);
     err.code = -32602;
     err.reason = secretScan.reason;
     throw err;
   }
+  const normalizedRes = normalizeMcpToolArgs(toolName, inputArgs);
+  if (!normalizedRes.ok) {
+    const err = new Error(normalizedRes.message);
+    err.code = -32602;
+    err.reason = normalizedRes.error;
+    throw err;
+  }
+  const args = normalizedRes.args;
 
   if (toolName === "revclamp_calculate_roi_and_plan_fit") {
     const monthlyWonDisputeUsd = Number(args.monthlyWonDisputeUsd ?? 10_000);
@@ -2611,7 +2723,7 @@ function toSafeLocalRpcId(rawId) {
   return null;
 }
 
-export function executeLocalMcpJsonRpc(rpcRequest, packageVersion = "1.20.7") {
+export function executeLocalMcpJsonRpc(rpcRequest, packageVersion = "1.20.8") {
   if (!rpcRequest || typeof rpcRequest !== "object" || Array.isArray(rpcRequest)) {
     return {
       jsonrpc: "2.0",
@@ -2794,7 +2906,18 @@ export function executeLocalMcpJsonRpc(rpcRequest, packageVersion = "1.20.7") {
 
   if (method === "tools/call") {
     const toolName = String(rpcRequest?.params?.name || "").trim();
-    const toolArgs = rpcRequest?.params?.arguments ?? {};
+    const rawToolArgs =
+      rpcRequest?.params?.arguments === undefined ? {} : rpcRequest.params.arguments;
+    if (!rawToolArgs || typeof rawToolArgs !== "object" || Array.isArray(rawToolArgs)) {
+      return {
+        jsonrpc: "2.0",
+        id: safeId,
+        error: {
+          code: -32602,
+          message: "Invalid params: arguments must be a JSON object",
+        },
+      };
+    }
     const toolSpec = LOCAL_MCP_TOOLS.find((t) => t.name === toolName);
     if (!toolSpec) {
       return {
@@ -2807,6 +2930,24 @@ export function executeLocalMcpJsonRpc(rpcRequest, packageVersion = "1.20.7") {
       };
     }
 
+    const normalizedRes = normalizeMcpToolArgs(toolName, rawToolArgs);
+    if (!normalizedRes.ok) {
+      return {
+        jsonrpc: "2.0",
+        id: safeId,
+        error: {
+          code: -32602,
+          message: normalizedRes.message,
+          data: {
+            error: normalizedRes.error,
+            reason: normalizedRes.error,
+            ...(normalizedRes.canonicalKey ? { canonicalKey: normalizedRes.canonicalKey } : {}),
+          },
+        },
+      };
+    }
+    const toolArgs = normalizedRes.args;
+
     const exampleCallMap = {
       revclamp_verify_webhook_signature: {
         provider: "stripe",

package/mcp-config.json

@@ -26,6 +26,6 @@
   },
   "manifest": {
     "name": "revclamp-mcp",
-    "version": "1.20.7"
+    "version": "1.20.8"
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "revclamp-mcp",
   "mcpName": "io.github.revclamp/revclamp-mcp",
-  "version": "1.20.7",
+  "version": "1.20.8",
   "description": "Model Context Protocol (MCP) server and CLI for Stripe 2025-03-31.basil entitlement checks, Visa CE 3.0 dispute staging (submit: false), EU/XI VIES VAT validation, Shopify Plus B2B Net-15/30/60 reconciliation, webhook HMAC-SHA256 verification, 0% take-rate ROI calculation, 72-hour webhook replay & out-of-order state-machine simulation, and Stripe dispute evidence 18,000 UTF-16 code unit & CE 3.0 completeness linting.",
   "type": "module",
   "main": "./index.mjs",
@@ -36,7 +36,10 @@
   "homepage": "https://revclamp.com",
   "repository": {
     "type": "git",
-    "url": "https://github.com/revclamp/revclamp-mcp.git"
+    "url": "https://github.com/lhphong09t2/revclamp-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/lhphong09t2/revclamp-mcp/issues"
   },
   "license": "MIT",
   "engines": {

package/server.json

@@ -4,16 +4,16 @@
   "description": "Zero-take-rate Stripe 2025-03-31.basil, Visa CE 3.0 & EU/UK VIES VAT guardrails MCP server.",
   "status": "active",
   "repository": {
-    "url": "https://github.com/revclamp/revclamp-mcp",
+    "url": "https://github.com/lhphong09t2/revclamp-mcp",
     "source": "github"
   },
-  "version": "1.20.7",
+  "version": "1.20.8",
   "packages": [
     {
       "registry_type": "npm",
       "registry_base_url": "https://registry.npmjs.org",
       "identifier": "revclamp-mcp",
-      "version": "1.20.7",
+      "version": "1.20.8",
       "transport": {
         "type": "stdio"
       },