d6302a673d
Guards the browser OAuth popup flow used by claude.ai and ChatGPT: - GET /login: return_to URL validation, XSS escaping, error display - POST /login: first-party cookie properties (httpOnly/secure/lax/domain), open redirect blocking, credential rejection paths - GET /oauth/authorize: must redirect to /login (never app.squaremcp.com), return_to encoding, valid session bypasses redirect Also exports `app` from index.ts and guards main() with NODE_ENV !== 'test' so the Express app can be imported by supertest without triggering DB init. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
1.5 KiB
JSON
52 lines
1.5 KiB
JSON
{
|
|
"name": "hermes-mcp",
|
|
"version": "1.0.0",
|
|
"description": "Multi-account email MCP server for Claude AI",
|
|
"type": "module",
|
|
"main": "dist/index.js",
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"start": "node dist/index.js",
|
|
"dev": "tsx watch src/index.ts",
|
|
"product:site": "node product/site/server.mjs",
|
|
"test:product-site": "node product/site/smoke-test.cjs",
|
|
"test:product-site:e2e": "node product/site/e2e-test.mjs",
|
|
"test:product-site:verify": "node product/site/verify.mjs",
|
|
"test:product-site:cleanup": "node product/site/cleanup-test-submissions.mjs",
|
|
"deploy:product-site:verify": "bash product/site/deploy-and-verify.sh",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.0.0",
|
|
"@types/cors": "^2.8.19",
|
|
"bcryptjs": "^3.0.3",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.6",
|
|
"dotenv": "^16.0.0",
|
|
"express": "^4.18.0",
|
|
"imapflow": "^1.0.0",
|
|
"jsonwebtoken": "^9.0.3",
|
|
"mysql2": "^3.14.0",
|
|
"nodemailer": "^6.9.0",
|
|
"redis": "^5.12.1"
|
|
},
|
|
"devDependencies": {
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/cookie-parser": "^1.4.10",
|
|
"@types/express": "^4.17.0",
|
|
"@types/jsonwebtoken": "^9.0.10",
|
|
"@types/node": "^20.0.0",
|
|
"@types/nodemailer": "^6.4.0",
|
|
"@types/supertest": "^7.2.0",
|
|
"@vitest/coverage-v8": "^4.1.6",
|
|
"pixelmatch": "^7.1.0",
|
|
"playwright": "^1.59.1",
|
|
"pngjs": "^7.0.0",
|
|
"supertest": "^7.2.2",
|
|
"tsx": "^4.0.0",
|
|
"typescript": "^5.0.0",
|
|
"vitest": "^4.1.6"
|
|
}
|
|
}
|