vpsnet-mcp 2.1.0 → 2.1.1

package/README.md

@@ -897,6 +897,12 @@ This server needs a **management** API key. Every failure below is reported by
 the tools with an `auth_problem` object containing the cause and the fix, so
 read that rather than guessing from the HTTP status.
 
+Tool failures carry `isError: true` while preserving the API error details and
+recovery guidance. Unknown mutation outcomes must be checked before another
+attempt. Service order numbers must be copied from `list_services`; ASCII
+letters, digits, and hyphens are supported, including multi-order suffixes.
+Malformed or oversized URL identifiers are rejected before an API request.
+
 | What you see | What it means | Fix |
 |---|---|---|
 | `aiScopedApiKeyCannotManageAccount` (403) | The key is an **AI-scoped key**. Those are issued only for VPSnet AI assistant inference and are deliberately refused on the entire account API. Granting scopes cannot change this — the restriction is on the key type. | Create a separate key with scope `full` (or `read` for GET-only use) and use that here. Keep the AI-scoped key for inference. |

package/build/api-path.js

@@ -0,0 +1,26 @@
+/** Reject URL normalization and delimiter tricks before credentials or transport. */
+export function validateApiPath(path) {
+    if (typeof path !== "string" ||
+        path.length > 8192 ||
+        !path.startsWith("/") ||
+        path.startsWith("//") ||
+        /[\\#\s\x00-\x1f\x7f]/u.test(path)) {
+        throw new Error("Invalid VPSnet API route.");
+    }
+    const pathname = path.split("?", 1)[0];
+    for (const segment of pathname.slice(1).split("/")) {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            throw new Error("Invalid VPSnet API route encoding.");
+        }
+        if (!decoded ||
+            decoded === "." ||
+            decoded === ".." ||
+            /[/%\\?#\s\x00-\x1f\x7f]/u.test(decoded)) {
+            throw new Error("Invalid VPSnet API route segment.");
+        }
+    }
+}

package/build/api.js

@@ -1,5 +1,6 @@
 import { annotateAuthFailure } from "./auth-failure.js";
 import { createApiConfiguration } from "./api-configuration.js";
+import { validateApiPath } from "./api-path.js";
 const DEFAULT_API_TIMEOUT_MS = 45_000;
 const configuration = createApiConfiguration(process.env, process.cwd());
 const { keyFile: SIDECAR_KEY_FILE, mcpJson: PROJECT_MCP_JSON } = configuration.paths;
@@ -77,6 +78,10 @@ function resolveApiTimeoutMs() {
 export async function apiRequest(method, path, body, extraHeaders, 
 // Explicitly annotate reviewed POST reads; other non-read methods fail closed.
 semantics) {
+    if (!["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+        throw new Error("Invalid VPSnet API request method.");
+    }
+    validateApiPath(path);
     const url = `${resolveApiBase()}${path}`;
     const headers = {
         "X-API-KEY": resolveApiKey(),

package/build/certificate-contract.js

@@ -7,16 +7,19 @@ export const certificateProductIdSchema = z
     .number()
     .int()
     .positive()
+    .max(Number.MAX_SAFE_INTEGER)
     .describe("Published product ID returned by list_certificate_catalog");
 export const certificateOfferIdSchema = z
     .number()
     .int()
     .positive()
+    .max(Number.MAX_SAFE_INTEGER)
     .describe("Published EUR offer ID returned by the selected catalog product");
 export const certificateOfferGenerationSchema = z
     .number()
     .int()
     .positive()
+    .max(Number.MAX_SAFE_INTEGER)
     .describe("Exact offer generation returned by the catalog; stale generations are rejected");
 export const certificateSubscriptionIdSchema = z
     .string()
@@ -172,6 +175,7 @@ const freeCertificateTargetOrderIdSchema = z
     .number()
     .int()
     .positive()
+    .max(Number.MAX_SAFE_INTEGER)
     .nullable()
     .optional()
     .describe("Optional owned VPS or Cloud VPS order ID returned by service tools");
@@ -263,16 +267,19 @@ export const certificateOrderInputShape = {
         .number()
         .int()
         .positive()
+        .max(Number.MAX_SAFE_INTEGER)
         .describe("Owned administrator contact ID selected in the VPSnet certificate order form"),
     technical_contact_id: z
         .number()
         .int()
         .positive()
+        .max(Number.MAX_SAFE_INTEGER)
         .describe("Owned technical contact ID selected in the VPSnet certificate order form"),
     organization_contact_id: z
         .number()
         .int()
         .positive()
+        .max(Number.MAX_SAFE_INTEGER)
         .nullable()
         .optional()
         .describe("Owned organization contact ID when required for OV or EV validation"),

package/build/file-restore-contract.js

@@ -18,6 +18,7 @@ export const fileBrowsePointIdSchema = z
     .number()
     .int()
     .positive()
+    .max(Number.MAX_SAFE_INTEGER)
     .describe("Backup point ID returned by list_restore_file_points");
 export const fileBrowseIdSchema = z
     .string()