From 2e3285681a1d15a0df709ec8e301809268c067d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=BB=84=E4=BA=91=E9=BE=99?=
 <76432572+nankingjing@users.noreply.github.com>
Date: Sat, 11 Jul 2026 15:27:47 +0800
Subject: [PATCH] fix(mcp): validate and clamp 'days' arg in
 list_reports/search

---
 mcp/src/index.ts | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/mcp/src/index.ts b/mcp/src/index.ts
index 7028999..1add1c6 100644
--- a/mcp/src/index.ts
+++ b/mcp/src/index.ts
@@ -63,8 +63,21 @@ async function fetchReport(date: string, type: string): Promise<string> {
 // Tool handlers
 // ---------------------------------------------------------------------------
 
+/**
+ * Parse and clamp a caller-supplied "days" argument into [1, max].
+ * Guards against non-numeric, zero, or negative values, which would otherwise
+ * make Array.slice misbehave: slice(0, NaN) returns nothing, and slice(0, -5)
+ * drops the oldest entries instead of limiting the count (a size-dependent,
+ * nonsensical result). Invalid input falls back to the default.
+ */
+function clampDays(raw: unknown, fallback: number, max: number): number {
+  const n = Math.floor(Number(raw));
+  if (!Number.isFinite(n) || n < 1) return Math.min(fallback, max);
+  return Math.min(n, max);
+}
+
 async function toolListReports(args: Record<string, unknown>): Promise<string> {
-  const days = Math.min(Number(args["days"] ?? 7), 30);
+  const days = clampDays(args["days"], 7, 30);
   const { dates } = await fetchManifest();
   const slice = dates.slice(0, days);
 
@@ -97,9 +110,11 @@ async function toolGetLatest(args: Record<string, unknown>): Promise<string> {
 }
 
 async function toolSearch(args: Record<string, unknown>): Promise<string> {
-  const query = String(args["query"] ?? "").trim().toLowerCase();
+  const query = String(args["query"] ?? "")
+    .trim()
+    .toLowerCase();
   if (!query) throw new Error("'query' is required");
-  const days = Math.min(Number(args["days"] ?? 7), 14);
+  const days = clampDays(args["days"], 7, 14);
 
   const { dates } = await fetchManifest();
   const slice = dates.slice(0, days);