Warn about ws:// key revocation, correct the Node floor - #2
Merged
Conversation
client.ts rewrites http:// and https:// to wss://, but an explicit ws:// passes through untouched — and TrueNAS auto-revokes any API key it sees used over an insecure transport. The failure presents as a bad key, and the key really is dead, so it is worth naming. README claimed Node 20+ while package.json declared >=18 and CI now proves the built server imports on 18. Corrected to match the verified floor rather than the middle guess. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two documentation corrections, both found by checking claims against the code rather than trusting them.
ws://silently kills your API keysrc/client.ts:28-30rewriteshttp://andhttps://towss://, but an explicitws://passes through untouched. TrueNAS auto-revokes any API key it sees used over an insecure transport, so the result is an authentication failure that looks like a typo in the key — except the key really is dead and needs regenerating.Nothing in the README said so. Added as a callout in Configuration.
The Node floor was stated three ways
package.jsonengines>=18.0.0runtimejob18 is the verified answer —
@modelcontextprotocol/sdkdeclares>=18, the build targets ES2022, and CI now imports the built server on 18 every run. README corrected to match, rather than leaving the one number nothing was checking.