hanzo-mcp 0.8.13__tar.gz → 0.8.14__tar.gz

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hanzo-mcp
-Version: 0.8.13
+Version: 0.8.14
 Summary: The Zen of Hanzo MCP: One server to rule them all. The ultimate MCP that orchestrates all others.
 Author-email: Hanzo Industries Inc <dev@hanzo.ai>
 License: MIT

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/hanzo_mcp/__init__.py

@@ -26,4 +26,4 @@ if os.environ.get("HANZO_MCP_TRANSPORT") == "stdio":
     except ImportError:
         pass
 
-__version__ = "0.8.4"
+__version__ = "0.8.13"

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/hanzo_mcp/server.py

@@ -3,6 +3,7 @@
 import os
 import atexit
 import signal
+import secrets
 import logging
 import warnings
 import threading
@@ -53,6 +54,7 @@ class HanzoMCPServer:
         port: int = 8888,
         enabled_tools: dict[str, bool] | None = None,
         disabled_tools: list[str] | None = None,
+        auth_token: str | None = None,
     ):
         """Initialize the Hanzo AI server.
 
@@ -80,6 +82,15 @@ class HanzoMCPServer:
         # Use enhanced server for automatic context normalization
         self.mcp = mcp_instance if mcp_instance is not None else EnhancedFastMCP(name)
 
+        # Initialize authentication token
+        self.auth_token = auth_token or os.environ.get('HANZO_MCP_TOKEN')
+        if not self.auth_token:
+            # Generate a secure random token if none provided
+            self.auth_token = secrets.token_urlsafe(32)
+            logger = logging.getLogger(__name__)
+            logger.warning(f"No auth token provided. Generated token: {self.auth_token}")
+            logger.warning("Set HANZO_MCP_TOKEN environment variable for persistent auth")
+
         # Initialize permissions and command executor
         self.permission_manager = PermissionManager()
 

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/hanzo_mcp/tools/common/permissions.py

@@ -112,7 +112,7 @@ class PermissionManager:
         self.excluded_patterns.append(pattern)
 
     def is_path_allowed(self, path: str) -> bool:
-        """Check if a path is allowed.
+        """Check if a path is allowed with security validation.
 
         Args:
             path: The path to check
@@ -120,7 +120,24 @@ class PermissionManager:
         Returns:
             True if the path is allowed, False otherwise
         """
-        resolved_path: Path = Path(path).resolve()
+        # Security check: Reject paths with traversal attempts
+        if ".." in str(path) or "~" in str(path):
+            return False
+        
+        try:
+            # Resolve the path (follows symlinks and makes absolute)
+            resolved_path: Path = Path(path).resolve(strict=False)
+            
+            # Security check: Ensure resolved path doesn't escape allowed directories
+            # by checking if it's actually under an allowed path after resolution
+            original_path = Path(path)
+            if original_path.is_absolute() and str(resolved_path) != str(original_path.resolve(strict=False)):
+                # Path resolution changed the path significantly, might be symlink attack
+                # Additional check: is the resolved path still under allowed paths?
+                pass  # Continue to normal checks
+        except (OSError, RuntimeError) as e:
+            # Path resolution failed, deny access
+            return False
 
         # Check exclusions first
         if self._is_path_excluded(resolved_path):
@@ -129,12 +146,28 @@ class PermissionManager:
         # Check if the path is within any allowed path
         for allowed_path in self.allowed_paths:
             try:
+                # This will raise ValueError if resolved_path is not under allowed_path
                 resolved_path.relative_to(allowed_path)
+                # Additional check: ensure no symlinks are escaping the allowed directory
+                if resolved_path.exists() and resolved_path.is_symlink():
+                    link_target = Path(os.readlink(resolved_path))
+                    if link_target.is_absolute():
+                        # Absolute symlink - check if it points within allowed paths
+                        if not any(self._is_subpath(link_target, ap) for ap in self.allowed_paths):
+                            return False
                 return True
             except ValueError:
                 continue
 
         return False
+    
+    def _is_subpath(self, child: Path, parent: Path) -> bool:
+        """Check if child is a subpath of parent."""
+        try:
+            child.resolve().relative_to(parent.resolve())
+            return True
+        except ValueError:
+            return False
 
     def _is_path_excluded(self, path: Path) -> bool:
         """Check if a path is excluded.

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/hanzo_mcp/tools/editor/neovim_edit.py

@@ -252,7 +252,7 @@ Or visit: https://neovim.io/"""
                             end if
                         end tell"""
 
-                        subprocess.run(["osascript", "-e", applescript])
+                        subprocess.run(["osascript", "-e", applescript], timeout=10)
                         return f"Opened {file_path} in Neovim (new terminal window)"
 
                 elif shutil.which("gnome-terminal"):
@@ -272,7 +272,7 @@ Or visit: https://neovim.io/"""
 
             else:
                 # Run and wait for completion
-                result = subprocess.run(cmd)
+                result = subprocess.run(cmd, timeout=120)
 
                 if result.returncode == 0:
                     return f"Successfully edited {file_path} in Neovim"

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/hanzo_mcp/tools/shell/command_executor.py

@@ -109,13 +109,12 @@ class CommandExecutor:
         if shell_basename in ["wsl", "wsl.exe"]:
             # For WSL, handle commands with shell operators differently
             if any(char in command for char in ";&|<>(){}[]$\"'`"):
-                # For commands with special characters, use a more reliable approach
-                # with bash -c and double quotes around the entire command
-                escaped_command = command.replace('"', '\\"')
+                # Use shlex.quote for proper escaping to prevent command injection
+                escaped_command = shlex.quote(command)
                 if use_login_shell:
-                    formatted_command = f'{user_shell} bash -l -c "{escaped_command}"'
+                    formatted_command = f'{user_shell} bash -l -c {escaped_command}'
                 else:
-                    formatted_command = f'{user_shell} bash -c "{escaped_command}"'
+                    formatted_command = f'{user_shell} bash -c {escaped_command}'
             else:
                 # # For simple commands without special characters
                 # # Still respect login shell preference
@@ -125,8 +124,9 @@ class CommandExecutor:
                 formatted_command = f"{user_shell} {command}"
 
         elif shell_basename in ["powershell", "powershell.exe", "pwsh", "pwsh.exe"]:
-            # For PowerShell, escape double quotes with backslash most robust
-            escaped_command = command.replace('"', '\\"')
+            # Use proper escaping for PowerShell to prevent injection
+            # PowerShell requires different escaping than POSIX shells
+            escaped_command = command.replace('"', '`"').replace("'", "``'").replace('$', '`$')
             formatted_command = f'"{user_shell}" -Command "{escaped_command}"'
 
         else:

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/hanzo_mcp.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hanzo-mcp
-Version: 0.8.13
+Version: 0.8.14
 Summary: The Zen of Hanzo MCP: One server to rule them all. The ultimate MCP that orchestrates all others.
 Author-email: Hanzo Industries Inc <dev@hanzo.ai>
 License: MIT

{hanzo_mcp-0.8.13 → hanzo_mcp-0.8.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hanzo-mcp"
-version = "0.8.13"
+version = "0.8.14"
 description = "The Zen of Hanzo MCP: One server to rule them all. The ultimate MCP that orchestrates all others."
 readme = "README.md"
 requires-python = ">=3.12"