Function fetchRadarApi

apps/radar/src/tools/radar.tools.ts:139–185

* Helper function to make authenticated requests to the Radar API * Used for endpoints not yet available in the Cloudflare SDK

(
	accessToken: string,
	endpoint: string,
	params: Record<string, unknown> = {}
)

 * Used for endpoints not yet available in the Cloudflare SDK
 */
async function fetchRadarApi(
	accessToken: string,
	endpoint: string,
	params: Record<string, unknown> = {}
): Promise<unknown> {
	const url = new URL(`${RADAR_API_BASE}${endpoint}`)

	// Defense-in-depth: Ensure the resolved path stays within Radar API scope
	// The URL constructor normalizes the path (resolves '..' and decodes percent-encoding),
	// so we check the final pathname to prevent path traversal attacks
	if (!url.pathname.startsWith('/client/v4/radar/')) {
		throw new Error('Invalid endpoint path: must be within the Radar API scope')
	}

	for (const [key, value] of Object.entries(params)) {
		if (value === undefined || value === null) continue

		if (Array.isArray(value)) {
			for (const item of value) {
				url.searchParams.append(key, String(item))
			}
		} else {
			url.searchParams.set(key, String(value))
		}
	}

	const response = await fetch(url.toString(), {
		method: 'GET',
		headers: {
			Authorization: `Bearer ${accessToken}`,
			'Content-Type': 'application/json',
		},
	})

	if (!response.ok) {
		const errorBody = await response.text()
		throw new Error(`API request failed (${response.status}): ${errorBody}`)
	}

	const data = (await response.json()) as { success: boolean; result: unknown; errors?: unknown[] }

	if (!data.success) {
		throw new Error(`API returned error: ${JSON.stringify(data.errors)}`)
	}

	return data.result
}

export function registerRadarTools(agent: RadarMCP) {
	agent.server.registerTool(