4543ac3c1a
Motiviert durch die Mega-Debrid-Cooldown-Diagnose: der account-weite Cooldown musste aus Log-Arithmetik rekonstruiert werden (alle Fehlerzeilen zeigten ms-genau auf dieselbe Deadline). Genau diese Sicht-Luecke wird geschlossen. Neu: - GET /providers (debrid.ts getProviderRuntimeSnapshot): Live-Laufzeitzustand pro Mega-Account / Debrid-Link-Key — AKTIVER Cooldown (untilMs/remainingMs/Grund/ Kategorie/untilRestart), in-flight-Tiefe, Mega-Rotationscursor + Sticky-Count, Empty-Response-Streaks, Debrid-Link Key-/Host-Cooldowns + Runtime-Status. Account- Keys sind nicht-umkehrbare Hashes (mda_<fnv1a64>), keine Logins/Tokens. - GET /logs/conversion: der pro-Item Link-Aufloesungs-Lebenszyklus (Token, API getLink, Web, Account-Rotation, Abbrueche mit Zeiten) aus conversion.log. - Beide auch im /diagnostics-Aggregat (providers + logs.conversion) -> rd_diagnostics zeigt die Cooldowns jetzt direkt. - MCP-Bridge: neues Tool rd_providers + "conversion" in der rd_logs-Enum + README. Test: getProviderRuntimeSnapshot spiegelt einen geprimten Account-Cooldown (until/remaining/Grund) und ist vorher null. Suite 935 gruen, tsc 6.
63 lines
3.0 KiB
Markdown
63 lines
3.0 KiB
Markdown
# rd-diagnostics-mcp
|
||
|
||
Standalone **stdio MCP bridge** to the Real-Debrid-Downloader debug-server. It runs on the machine where the
|
||
MCP client runs, takes a **connection code** for a downloader server, and exposes that server's
|
||
read-only HTTP diagnostics API (`/diagnostics`, `/status`, `/errors`, `/logs/*`, `/accounts`, …) as MCP tools.
|
||
One bridge serves all 5–6 servers; you pass a `code` (or a configured `server` name) per call.
|
||
|
||
This bridge is **not** bundled into the Electron app and adds **no** dependencies to it.
|
||
|
||
## Setup
|
||
|
||
```bash
|
||
cd tools/rd-diagnostics-mcp
|
||
npm install
|
||
```
|
||
|
||
Register it with your MCP client as a stdio server that launches the bridge:
|
||
|
||
```bash
|
||
node "<repo>/tools/rd-diagnostics-mcp/src/bridge.mjs"
|
||
```
|
||
|
||
Provide servers via environment variables (codes contain a token — treat like passwords):
|
||
|
||
- `RDDIAG_CODE` — a single default connection code (`rddiag:v1:...`)
|
||
- `RDDIAG_SERVERS` — JSON map of name → code, e.g. `{"berlin":"rddiag:v1:...","fra":"rddiag:v1:..."}`
|
||
|
||
Without env config, every tool simply takes a `code` argument.
|
||
|
||
## Tools
|
||
|
||
`rd_servers`, `rd_ping`, `rd_diagnostics`, `rd_status`, `rd_items`, `rd_packages`, `rd_errors`, `rd_logs`
|
||
(`main|audit|rename|trace|session|conversion|package|item`), `rd_history`, `rd_accounts`, `rd_providers`
|
||
(live per-account/key cooldown + in-flight + rotation state), `rd_host`, `rd_self_check`,
|
||
`rd_get` (raw escape-hatch, any read-only path).
|
||
|
||
Each tool accepts `code` or `server` to pick the target.
|
||
|
||
## Connection code
|
||
|
||
Format: `rddiag:v1:<base64url(JSON)>` with `{ v:1, h:host, p:port, t:token, n?:name, fp?:certFingerprint, s?:scheme }`.
|
||
Generated by the app (Hilfe → Remote-Support → Ferndiagnose (MCP)) or via `node src/gen-code.mjs --host H --port P --token T`.
|
||
|
||
## Security model (read before exposing a server)
|
||
|
||
- The debug surface is **read-only** for state/logs; the one control endpoint is `/trace/config` (toggles the
|
||
optional, time-bounded support trace). No persistent secrets are written into the logs it serves: passwords are
|
||
redacted, debrid API keys/tokens and resolved download URLs are never logged; `/settings` and `/accounts` are redacted.
|
||
- Auth is a bearer token (24 random bytes). Over plain HTTP on a public network the token is sniffable, so:
|
||
- **Preferred:** keep the server bound to `127.0.0.1` ("Nur lokal") and reach it through a private tunnel
|
||
(Tailscale / SSH / Cloudflare Tunnel). The tunnel encrypts and authenticates; no public exposure.
|
||
- **Direct network bind (`0.0.0.0`)** requires a non-empty **IP allowlist** (enforced fail-closed: with an empty
|
||
allowlist only loopback is accepted). Use only inside a trusted LAN/VPN.
|
||
- Revoke instantly from the app ("Token neu" or "Deaktivieren") — the old code stops working immediately.
|
||
- `fp` pins a self-signed cert fingerprint and is verified on `secureConnect` (before the token is sent). HTTPS is
|
||
not the v1 default; plain HTTP behind a tunnel is the recommended transport.
|
||
|
||
## Test
|
||
|
||
```bash
|
||
npm test # spins a fake debug-server, runs the bridge as a stdio child, asserts the full protocol path
|
||
```
|