mirror of
https://github.com/0xrsydn/idx-cli.git
synced 2026-11-07 09:45:36 +00:00
60634d3aef
Findings from a Codex (gpt-6.1-sol, xhigh) review of v0.2.4..HEAD, each verified in the code before fixing: - high: ticker symbols reached cache file paths unchecked, so a symbol like `../../REPORT` read (and deleted, if unparseable) .json files outside the cache, reachable through MCP get_quotes. resolve_symbol now accepts only ticker characters, and cache keys are encoded as single safe path components. - high: sync decided before downloading and replaced the database without rechecking; an import that landed meanwhile was erased. It now rechecks the local state before installing, and idx-mcp runs ownership_sync exclusively with ownership reads. - replaces_sqlite_sha256 never downgrades history: the client requires the rebuild to keep at least the local release count, and the publisher lists a replaced build only then. - cache writes are atomic (temp file + rename), so concurrent readers never see, and delete, a partial entry. - idx-mcp caps symbols (20, deduplicated) and limits, and runs at most 4 tool calls at once. - each Yahoo client gets its own cookie jar, paired with its crumb. - ZIP entries (XLSX, KSEI archives) are read with a 256 MiB bound; non-ASCII archive dates and huge percentages are parse errors instead of panics or overflow. - agent-smoke --keep deletes every copied agent config, not only auth files. CLI goldens unchanged; the MCP tool golden changes only to state the new caps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
977 B
TOML
31 lines
977 B
TOML
[package]
|
|
name = "idx-mcp"
|
|
description = "MCP server for Indonesian stock market (IDX) market, financial, and ownership data"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
# rmcp requires 1.88.
|
|
rust-version = "1.88"
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
homepage.workspace = true
|
|
readme = "../../README.md"
|
|
keywords = ["idx", "stocks", "indonesia", "mcp", "finance"]
|
|
categories = ["finance"]
|
|
include = ["/Cargo.toml", "/LICENSE", "/src/**"]
|
|
|
|
[[bin]]
|
|
name = "idx-mcp"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
idx-core.workspace = true
|
|
clap.workspace = true
|
|
rmcp = { version = "3.5", default-features = false, features = ["server", "macros", "transport-io"] }
|
|
schemars = "1"
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio = { version = "1", features = ["macros", "rt-multi-thread", "io-std", "sync"] }
|
|
|
|
[dev-dependencies]
|
|
# Tests drive the binary with the mock provider; release builds exclude it.
|
|
idx-core = { workspace = true, features = ["testing"] }
|