feat: add file upload support with multipart/form-data

[qwang07]

Closes #15

Summary

This PR implements file upload functionality for the MCP REST API Tester, allowing users to test API endpoints that require file uploads. The implementation uses multipart/form-data encoding and follows industry-standard practices.

Features

• ✅ File Upload via Local Paths: Upload files from local filesystem
• ✅ Multiple Files Support: Upload multiple files in a single request
• ✅ Form Fields Mixing: Combine file uploads with form fields and JSON body
• ✅ Configurable Size Limits: FILE_UPLOAD_SIZE_LIMIT environment variable (default: 10MB)
• ✅ Security: Path traversal attack protection (rejects paths containing ..)
• ✅ Modular Design: Extracted file utilities to src/file-utils.ts

Implementation Details

New Files

• src/file-utils.ts: Modular file upload utilities
  • validateFilePath(): Path traversal protection
  • checkFileExists(): File existence validation
  • checkFileSize(): Size limit enforcement
  • validateFiles(): Batch validation
  • createFormData(): multipart/form-data builder

Modified Files

• src/index.ts: Integrated file upload into MCP server
• package.json: Added dependencies (form-data) and test scripts
• README.md: Updated features and usage examples
• src/resources/config.md: Added FILE_UPLOAD_SIZE_LIMIT documentation
• src/resources/examples.md: Added comprehensive file upload examples
• .gitignore: Added test-generated files and pnpm-lock.yaml

Test Coverage

• 23 unit tests using Node.js native test runner
• TDD approach (test-driven development)
• Tests cover:
  • File path validation (path traversal protection)
  • File size checking
  • FormData creation
  • Error handling
• All tests passing ✅

Usage Example

// Single file upload
use_mcp_tool('rest-api', 'test_request', {
  "method": "POST",
  "endpoint": "/upload",
  "files": [
    {
      "fieldName": "avatar",
      "filePath": "/path/to/profile.jpg"
    }
  ],
  "formFields": {
    "username": "john"
  }
});

Testing

Tested on macOS with:

• Unit tests: npm test (23/23 passing)
• Integration tests: Express test server
• End-to-end tests: MCP Inspector and Claude Desktop
• Security tests: Path traversal attack prevention verified

Breaking Changes

None. This is a backward-compatible feature addition.

Additional Notes

• Following multipart/form-data industry standard (field-by-field approach)
• Respects existing authentication and custom header configurations
• Header priority maintained: FormData headers → Custom headers → Request headers → Auth headers

🤖 Generated with Claude Code

[dkmaker]

Great - i will check it in a few days - good work!!