splitwise-mcp 2.1.4 → 2.1.6

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
-    "version": "2.1.4"
+    "version": "2.1.6"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Splitwise",
       "source": "./",
       "description": "MCP server for Splitwise — manage expenses, groups, and friends via natural language",
-      "version": "2.1.4",
+      "version": "2.1.6",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "splitwise-mcp",
   "displayName": "Splitwise",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -3644,7 +3644,12 @@ var require_fast_uri = __commonJS({
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
+      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed) {
+        throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+      }
+      const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -3770,6 +3775,7 @@ var require_fast_uri = __commonJS({
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
     var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3804,6 +3810,20 @@ var require_fast_uri = __commonJS({
         parsed.error = "URI authority must not contain a literal backslash.";
         malformedAuthorityOrPort = true;
       }
+      const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+      if (introducerMatch !== null) {
+        const region = introducerMatch[1];
+        const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+        if (normalizedRegion.length >= 2) {
+          if (normalizedRegion.slice(0, 2) !== "//") {
+            parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+            malformedAuthorityOrPort = true;
+          } else if (region.length !== normalizedRegion.length) {
+            parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+            malformedAuthorityOrPort = true;
+          }
+        }
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -23048,17 +23068,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error51) {
   if (error51 && typeof error51 === "object") {
+    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
+      return error51.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error51 && typeof error51.message === "string") {
       return error51.message;
     }
-    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
-      const firstIssue = error51.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error51);
     } catch {
@@ -29673,16 +29709,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -30870,8 +30897,17 @@ var EMPTY_COMPLETION_RESULT = {
 import process3 from "node:process";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -30899,18 +30935,24 @@ function serializeMessage(message) {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = process3.stdin, _stdout = process3.stdout) {
+  constructor(_stdin = process3.stdin, _stdout = process3.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error51) {
+        this.onerror?.(error51);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error51) => {
       this.onerror?.(error51);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -31304,10 +31346,10 @@ var SplitwiseClient = class {
    * host's install-time smoke test) when SPLITWISE_API_KEY isn't set yet.
    * Tool calls re-raise the error at request time.
    *
-   * Optional constructor seam: a hosted per-user deployment (e.g. a Cloudflare
-   * Worker "remote connector") builds one client per request with that user's
-   * `apiKey` injected. The stdio path passes no options, so the key resolves
-   * from the environment exactly as before — byte-for-byte identical behaviour.
+   * Optional constructor seam: a hosted per-user deployment builds one client
+   * per request with that user's `apiKey` injected. The stdio path passes no
+   * options, so the key resolves from the environment exactly as before —
+   * byte-for-byte identical behaviour.
    */
   constructor(opts) {
     const key = opts?.apiKey ?? readEnvVar("SPLITWISE_API_KEY");
@@ -31738,7 +31780,7 @@ function registerUtilityTools(server, client2) {
 // src/index.ts
 await runMcp({
   name: "splitwise-mcp",
-  version: "2.1.4",
+  version: "2.1.6",
   // x-release-please-version
   deps: client,
   banner: "[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.",

package/dist/client.js

@@ -4,15 +4,15 @@ import { loadDotenvSafely, readEnvVar, createApiClient } from '@chrischall/mcp-u
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. mcpb
 // bundle). `loadDotenvSafely` swallows a missing dotenv module and never lets
 // .env override a host-provided value.
-// The try/catch guards the Cloudflare Worker runtime, where `import.meta.url`
-// is undefined and `fileURLToPath(undefined)` would throw at module init
-// (Worker startup validation) — there is no filesystem / .env to load there.
+// The try/catch guards a runtime where `import.meta.url` is undefined and
+// `fileURLToPath(undefined)` would throw at module init — a sandboxed one has
+// no filesystem or .env to load anyway.
 try {
     const dir = dirname(fileURLToPath(import.meta.url));
     await loadDotenvSafely({ path: join(dir, '..', '.env'), override: false });
 }
 catch {
-    /* non-Node runtime (Workers): no .env to load */
+    /* non-Node runtime: no .env to load */
 }
 const BASE_URL = 'https://secure.splitwise.com/api/v3.0';
 const SERVICE_NAME = 'Splitwise';
@@ -25,10 +25,10 @@ export class SplitwiseClient {
      * host's install-time smoke test) when SPLITWISE_API_KEY isn't set yet.
      * Tool calls re-raise the error at request time.
      *
-     * Optional constructor seam: a hosted per-user deployment (e.g. a Cloudflare
-     * Worker "remote connector") builds one client per request with that user's
-     * `apiKey` injected. The stdio path passes no options, so the key resolves
-     * from the environment exactly as before — byte-for-byte identical behaviour.
+     * Optional constructor seam: a hosted per-user deployment builds one client
+     * per request with that user's `apiKey` injected. The stdio path passes no
+     * options, so the key resolves from the environment exactly as before —
+     * byte-for-byte identical behaviour.
      */
     constructor(opts) {
         // Injected apiKey (hosted per-user path) takes precedence; otherwise fall

package/dist/index.js

@@ -13,11 +13,11 @@ import { registerUtilityTools } from './tools/utilities.js';
 // first request. That preserves the deferred-config-error pattern: the server
 // boots and answers the host's install-time tools/list smoke test even when
 // SPLITWISE_API_KEY is absent — the configuration error only surfaces on the
-// first tool call. A hosted per-user connector (a later task) injects its own
-// per-request client into the same registrars instead of this singleton.
+// first tool call. A hosted per-user deployment injects its own per-request
+// client into the same registrars instead of this singleton.
 await runMcp({
     name: 'splitwise-mcp',
-    version: '2.1.4', // x-release-please-version
+    version: '2.1.6', // x-release-please-version
     deps: client,
     banner: '[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.',
     tools: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "splitwise-mcp",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "mcpName": "io.github.chrischall/splitwise-mcp",
   "description": "Splitwise MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -40,28 +40,19 @@
     "dev": "node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "worker:dev": "wrangler dev",
-    "worker:deploy": "wrangler deploy",
-    "worker:test": "vitest run --config vitest.workers.config.ts"
+    "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.13.0",
+    "@chrischall/mcp-utils": "^0.14.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.0",
     "zod": "^4.4.2"
   },
   "devDependencies": {
-    "@chrischall/mcp-connector": "^1.1.1",
-    "@cloudflare/vitest-pool-workers": "^0.18.4",
-    "@cloudflare/workers-oauth-provider": "^0.8.1",
-    "@cloudflare/workers-types": "^5.20260708.1",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.2",
-    "agents": "^0.19.0",
     "esbuild": "^0.28.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.2",
-    "wrangler": "^4.110.0"
+    "vitest": "^4.1.2"
   }
 }

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/splitwise-mcp",
     "source": "github"
   },
-  "version": "2.1.4",
+  "version": "2.1.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "splitwise-mcp",
-      "version": "2.1.4",
+      "version": "2.1.6",
       "transport": {
         "type": "stdio"
       },

package/dist/splitwise-auth.js

@@ -1,23 +0,0 @@
-import { SplitwiseClient } from './client.js';
-/**
- * `ConnectorAuth` for the Splitwise remote connector: the login page collects
- * the user's own Splitwise API key (from https://secure.splitwise.com/apps/register),
- * verifies it by constructing a `SplitwiseClient` with the key and calling the
- * current-user endpoint (a bad key throws, which the connector surfaces back on
- * the login page), and stores `{ apiKey }` as the OAuth props that `worker.ts`'s
- * `buildClient` turns into a per-user client.
- */
-export const splitwiseAuth = {
-    service: 'Splitwise',
-    accent: '#1CC29F',
-    privacyNote: 'Your Splitwise API key is stored encrypted and used only to call Splitwise on your behalf.',
-    fields: [{ name: 'apiKey', label: 'Splitwise API key', type: 'password' }],
-    async login(fields) {
-        // Verify the key up front — an invalid key makes /get_current_user throw
-        // here, which the connector surfaces back on the login page. We discard the
-        // response: the per-user client is built fresh from the stored key.
-        const client = new SplitwiseClient({ apiKey: fields.apiKey });
-        await client.request('GET', '/get_current_user');
-        return { apiKey: fields.apiKey };
-    },
-};