spaps-mcp 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.1 - 2026-06-20
+
+- Maintenance: align the MCP package version after release automation.
+
 ## 0.1.0 - 2026-06-15
 
 - Initial SPAPS MCP stdio server with docs, auth discovery, capability, wizard,

package/README.md

@@ -6,7 +6,7 @@ capability checks, and integration wizard steps to MCP-capable agents.
 ## Metadata
 
 - `package_name`: `spaps-mcp`
-- `latest_version`: `0.1.0`
+- `latest_version`: `0.1.1`
 - `minimum_runtime`: `Node.js >=18.0.0`
 - `api_base_url`: `https://api.sweetpotato.dev`
 

package/dist/{chunk-GPBTYWDD.js → chunk-WWRSSH7A.js}

@@ -1,4 +1,5 @@
 // src/http.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
 var SpapsHttpError = class extends Error {
   data;
   constructor(data) {
@@ -7,6 +8,16 @@ var SpapsHttpError = class extends Error {
     this.data = data;
   }
 };
+function parsePositiveIntEnv(value) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return void 0;
+  }
+  return Math.floor(parsed);
+}
 function resolveConfig(env = process.env) {
   const apiUrl = (env.SPAPS_API_URL || "http://localhost:3301").replace(/\/+$/, "");
   const enableSecretTools = ["1", "true", "yes", "on"].includes(
@@ -18,7 +29,8 @@ function resolveConfig(env = process.env) {
     bearerToken: env.SPAPS_AUTH_TOKEN || void 0,
     origin: env.SPAPS_ORIGIN || void 0,
     enableSecretTools,
-    wizardDir: env.SPAPS_WIZARD_STEPS_DIR || void 0
+    wizardDir: env.SPAPS_WIZARD_STEPS_DIR || void 0,
+    requestTimeoutMs: parsePositiveIntEnv(env.SPAPS_MCP_REQUEST_TIMEOUT_MS) ?? DEFAULT_REQUEST_TIMEOUT_MS
   };
 }
 function appendQuery(url, query) {
@@ -53,12 +65,22 @@ function unwrapEnvelope(payload, status, requestId) {
   }
   return payload;
 }
+function isTimeoutAbort(err) {
+  if (typeof err !== "object" || err === null || !("name" in err)) {
+    return false;
+  }
+  const name = err.name;
+  return name === "TimeoutError" || name === "AbortError";
+}
 var SpapsHttpClient = class {
   config;
   fetchFn;
+  requestTimeoutMs;
   constructor(config, fetchFn = fetch) {
     this.config = config;
     this.fetchFn = fetchFn;
+    const configured = config.requestTimeoutMs;
+    this.requestTimeoutMs = typeof configured === "number" && configured > 0 ? configured : DEFAULT_REQUEST_TIMEOUT_MS;
   }
   async get(path, options = {}) {
     return this.request("GET", path, options);
@@ -84,14 +106,34 @@ var SpapsHttpClient = class {
     if (this.config.origin) {
       headers.origin = this.config.origin;
     }
-    const response = await this.fetchFn(url, {
-      method,
-      headers,
-      body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
-    });
+    let response;
+    try {
+      response = await this.fetchFn(url, {
+        method,
+        headers,
+        body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+        signal: AbortSignal.timeout(this.requestTimeoutMs)
+      });
+    } catch (err) {
+      if (isTimeoutAbort(err)) {
+        throw new SpapsHttpError({
+          status: 504,
+          code: "SPAPS_REQUEST_TIMEOUT",
+          message: `SPAPS request timed out after ${this.requestTimeoutMs}ms`
+        });
+      }
+      throw err;
+    }
     const requestId = response.headers.get("x-request-id") || void 0;
     const text = await response.text();
-    const payload = text ? JSON.parse(text) : null;
+    let payload = null;
+    if (text) {
+      try {
+        payload = JSON.parse(text);
+      } catch {
+        payload = null;
+      }
+    }
     if (!response.ok) {
       const record = payload && typeof payload === "object" ? payload : {};
       const error = typeof record.error === "object" && record.error ? record.error : {};
@@ -414,29 +456,43 @@ function buildToolDefinitions({ config, fetchFn, client = new SpapsHttpClient(co
         include_auth_methods: z.boolean().optional()
       },
       handler: guarded(async (input) => {
-        const targetConfig = input.target_base_url ? { ...config, apiUrl: String(input.target_base_url).replace(/\/+$/, "") } : config;
+        const targetConfig = input.target_base_url ? {
+          ...config,
+          apiUrl: String(input.target_base_url).replace(/\/+$/, ""),
+          // Health checks are unauthenticated. Never forward the operator's
+          // configured credentials to an agent-supplied (and therefore
+          // potentially external/attacker-controlled) host — doing so would
+          // exfiltrate the secret API key + bearer JWT via SSRF.
+          apiKey: void 0,
+          bearerToken: void 0,
+          origin: void 0
+        } : config;
         const targetClient = input.target_base_url ? new SpapsHttpClient(targetConfig, fetchFn) : client;
-        const results = [
-          { test: "health", success: false, details: null },
-          { test: "ready", success: false, details: null },
-          { test: "local_mode_contract", success: false, details: null }
+        const checks = [
+          { test: "health", path: "/health" },
+          { test: "ready", path: "/health/ready" },
+          { test: "local_mode_contract", path: "/health/local-mode" }
         ];
-        results[0].details = await targetClient.get("/health");
-        results[0].success = true;
-        results[1].details = await targetClient.get("/health/ready");
-        results[1].success = true;
-        results[2].details = await targetClient.get("/health/local-mode");
-        results[2].success = true;
         if (input.include_auth_methods) {
-          results.push({
-            test: "auth_methods",
-            success: true,
-            details: await targetClient.get("/api/auth/methods")
-          });
+          checks.push({ test: "auth_methods", path: "/api/auth/methods" });
+        }
+        const results = [];
+        for (const check of checks) {
+          try {
+            const details = await targetClient.get(check.path);
+            results.push({ test: check.test, success: true, details });
+          } catch (error) {
+            results.push({
+              test: check.test,
+              success: false,
+              details: error instanceof SpapsHttpError ? error.data : { error: error instanceof Error ? error.message : String(error) }
+            });
+          }
         }
+        const passed = results.filter((result) => result.success).length;
         return jsonResult({
-          success: true,
-          summary: `${results.filter((result) => result.success).length}/${results.length} tests passed`,
+          success: passed === results.length,
+          summary: `${passed}/${results.length} tests passed`,
           target_base_url: targetConfig.apiUrl,
           results,
           next_steps: [`See docs at ${targetConfig.apiUrl}/docs`]

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createSpapsMcpServer
-} from "./chunk-GPBTYWDD.js";
+} from "./chunk-WWRSSH7A.js";
 
 // src/cli.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/index.d.ts

@@ -8,6 +8,13 @@ interface SpapsMcpConfig {
     origin?: string;
     enableSecretTools: boolean;
     wizardDir?: string;
+    /**
+     * Per-request timeout in milliseconds. A hung upstream would otherwise wedge
+     * an MCP tool forever; the outbound fetch is aborted after this many ms and
+     * surfaced as a {@link SpapsHttpError} timeout. Configurable via
+     * `SPAPS_MCP_REQUEST_TIMEOUT_MS`; defaults to {@link DEFAULT_REQUEST_TIMEOUT_MS}.
+     */
+    requestTimeoutMs?: number;
 }
 interface RequestOptions {
     body?: unknown;
@@ -31,6 +38,7 @@ declare function resolveConfig(env?: NodeJS.ProcessEnv): SpapsMcpConfig;
 declare class SpapsHttpClient {
     private readonly config;
     private readonly fetchFn;
+    private readonly requestTimeoutMs;
     constructor(config: SpapsMcpConfig, fetchFn?: FetchLike);
     get(path: string, options?: RequestOptions): Promise<unknown>;
     post(path: string, body?: unknown, options?: RequestOptions): Promise<unknown>;

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   listWizardSteps,
   resolveConfig,
   resolveWizardDir
-} from "./chunk-GPBTYWDD.js";
+} from "./chunk-WWRSSH7A.js";
 export {
   SpapsHttpClient,
   SpapsHttpError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps-mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Model Context Protocol server for SPAPS docs, contracts, capability checks, and integration wizard steps",
   "type": "module",
   "main": "dist/index.js",