data-filter-mcp 0.2.4__tar.gz → 0.2.6__tar.gz

{data_filter_mcp-0.2.4 → data_filter_mcp-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: data-filter-mcp
-Version: 0.2.4
+Version: 0.2.6
 Summary: Local MCP server for running restricted Python text filters over files
 Author: Aleksei Arakelian
 License-Expression: MIT

{data_filter_mcp-0.2.4 → data_filter_mcp-0.2.6}/data_filter_mcp/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.2.4'
-__version_tuple__ = version_tuple = (0, 2, 4)
+__version__ = version = '0.2.6'
+__version_tuple__ = version_tuple = (0, 2, 6)
 
-__commit_id__ = commit_id = 'gd2ae7c43f'
+__commit_id__ = commit_id = 'ga0ff2aab6'

{data_filter_mcp-0.2.4 → data_filter_mcp-0.2.6}/data_filter_mcp/server.py

@@ -239,7 +239,7 @@ def create_mcp_server(service: FilterService | None = None) -> FastMCP:
         The function must return a text result (str). The returned text may contain any
         format you want, such as plain text, YAML, CSV-like text, or a custom report.
 
-        Preloaded standard-library modules:
+        Preloaded standard-library modules (don't try to import them in your functions):
         - json, yaml, re
         - math, statistics, datetime, decimal
         - collections, itertools, functools, operator

{data_filter_mcp-0.2.4 → data_filter_mcp-0.2.6}/data_filter_mcp/validator.py

@@ -56,6 +56,10 @@ SAFE_ATTRIBUTE_READS = {
     ("itertools", "chain"),
 }
 
+SAFE_DUNDER_ATTRIBUTES = {
+    "__name__",
+}
+
 SAFE_BUILTINS: dict[str, Any] = {
     "all": all,
     "any": any,
@@ -71,10 +75,14 @@ SAFE_BUILTINS: dict[str, Any] = {
     "range": range,
     "reversed": reversed,
     "sorted": sorted,
+    "set": set,
     "str": str,
     "sum": sum,
     "tuple": tuple,
+    "type": type,
     "zip": zip,
+    "isinstance": isinstance,
+    "Exception": Exception,
 }
 
 SAFE_METHODS = {
@@ -280,6 +288,7 @@ SAFE_METHODS = {
     "sha384",
     "sha512",
     "shorten",
+    "sort",
     "span",
     "split",
     "splitlines",
@@ -355,6 +364,8 @@ ALLOWED_NODE_TYPES = {
     ast.Constant,
     ast.List,
     ast.Tuple,
+    ast.Try,
+    ast.ExceptHandler,
     ast.Set,
     ast.Dict,
     ast.Subscript,
@@ -472,14 +483,21 @@ class FilterValidator(ast.NodeVisitor):
         self.generic_visit(node)
 
     def visit_Attribute(self, node: ast.Attribute) -> None:
-        if node.attr.startswith("_"):
+        is_safe_dunder = node.attr in SAFE_DUNDER_ATTRIBUTES
+        if node.attr.startswith("_") and not is_safe_dunder:
             raise FilterValidationError(f"Attribute access is not allowed: {node.attr}")
 
         parent = self._parents.get(id(node))
         if self._is_safe_attribute_read(node):
             return
 
-        if not isinstance(parent, ast.Call) or parent.func is not node:
+        is_call_target = isinstance(parent, ast.Call) and parent.func is node
+
+        if is_safe_dunder and not is_call_target:
+            self.visit(node.value)
+            return
+
+        if not is_call_target:
             raise FilterValidationError(
                 "Attribute access is restricted to approved method calls"
             )

{data_filter_mcp-0.2.4 → data_filter_mcp-0.2.6}/data_filter_mcp.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: data-filter-mcp
-Version: 0.2.4
+Version: 0.2.6
 Summary: Local MCP server for running restricted Python text filters over files
 Author: Aleksei Arakelian
 License-Expression: MIT

{data_filter_mcp-0.2.4 → data_filter_mcp-0.2.6}/tests/test_validator.py

@@ -144,6 +144,46 @@ def test_compile_filter_rejects_attribute_reads() -> None:
         compile_filter(code)
 
 
+def test_compile_filter_allows_dunder_name_attribute() -> None:
+    code = textwrap.dedent(
+        """
+        def filter_item(data):
+            return type(data).__name__
+        """
+    )
+
+    filter_fn = compile_filter(code)
+
+    assert filter_fn([1, 2, 3]) == "list"
+    assert filter_fn({"k": 1}) == "dict"
+    assert filter_fn("hello") == "str"
+
+
+def test_compile_filter_allows_dunder_name_in_lambda() -> None:
+    code = textwrap.dedent(
+        """
+        def filter_item(data):
+            return ",".join(sorted([type(item).__name__ for item in data]))
+        """
+    )
+
+    filter_fn = compile_filter(code)
+
+    assert filter_fn([1, "x", 2.0]) == "float,int,str"
+
+
+def test_compile_filter_rejects_calling_dunder_name() -> None:
+    code = textwrap.dedent(
+        """
+        def filter_item(data):
+            return data.__name__()
+        """
+    )
+
+    with pytest.raises(FilterValidationError, match="Method is not allowed: __name__"):
+        compile_filter(code)
+
+
 def test_compile_filter_rejects_string_format_methods() -> None:
     code = textwrap.dedent(
         """