@bbradar/mcp 0.1.16 → 0.1.20

package/dist/server.js

@@ -5,7 +5,7 @@ import { BBRadarApiError } from "./bbradarClient.js";
 import { stableStringify, stripUndefined } from "./json.js";
 import { FixedWindowRateLimiter } from "./rateLimit.js";
 import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
-const SERVER_VERSION = "0.1.0";
+const SERVER_VERSION = "0.1.19";
 const MAX_PROGRAMS_PER_SEARCH = 100;
 const MAX_TARGET_EXPORT = 500;
 const MAX_RECENT_CHANGES = 100;
@@ -20,7 +20,7 @@ const MAX_FIND_TARGET_SAMPLE_PROGRAMS = 10;
 const MAX_FIND_TARGET_SAMPLES = 20;
 const MAX_FIND_UPSTREAM_REQUEST_BUDGET = 50;
 const DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET = 20;
-const DEFAULT_RESOLVE_UPSTREAM_REQUEST_BUDGET = 4;
+const DEFAULT_RESOLVE_UPSTREAM_REQUEST_BUDGET = 12;
 const MAX_ACCEPTED_NUMERIC_LIMIT = 1_000;
 const PROGRAM_COLLECTION_CONCURRENCY = 4;
 const TARGET_SAMPLE_CONCURRENCY = 3;
@@ -31,12 +31,52 @@ const MAX_FILTER_TARGET_SAMPLE_PROGRAMS = 25;
 const MAX_LOCAL_EXPORT_RESOURCES = 25;
 const EXPORT_PREVIEW_LIMIT = 25;
 const STALE_PROGRAM_ID_RESOLVE_PAGES = 1;
-const STALE_PROGRAM_ID_RESOLVE_BUDGET = 8;
+const STALE_PROGRAM_ID_RESOLVE_BUDGET = 12;
 const PROGRAM_FALLBACK_CACHE_MAX_ENTRIES = 200;
 const MAX_RESOLVE_SEARCH_QUERIES = 4;
-const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 8;
+const FAST_RESOLVE_SEARCH_QUERIES = 2;
+const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 96;
 const SDK_VERSION = "1.29.0";
-const PROGRAM_ID_PLATFORM_GUESSES = ["HackerOne", "Bugcrowd", "Intigriti", "HackenProof", "YesWeHack", "Cantina", "Code4rena", "Immunefi"];
+const CORE_TOOL_NAMES = new Set([
+    "search_programs",
+    "get_program",
+    "resolve_program",
+    "run_program_name_action",
+    "get_program_eligible_targets_by_name",
+    "get_program_targets",
+    "get_recent_changes",
+    "get_latest_added_targets",
+    "get_opportunities",
+    "find_programs",
+    "find_programs_by_target",
+    "list_filters",
+    "get_bbradar_guide",
+    "get_mcp_status",
+    "export_targets"
+]);
+const PROGRAM_ID_PLATFORM_GUESSES = [
+    "HackerOne",
+    "BugCrowd",
+    "Intigriti",
+    "HackenProof",
+    "YesWeHack",
+    "Immunefi",
+    "Cantina",
+    "Code4rena",
+    "Huntr",
+    "GObugfree",
+    "Bug Bounty Switzerland",
+    "Inspectiv",
+    "Compass Security",
+    "BugRap",
+    "IssueHunt",
+    "PatchDay",
+    "Remedy",
+    "Standoff365",
+    "Sherlock",
+    "CodeHawks"
+];
+const PRIMARY_PROGRAM_ID_PLATFORM_GUESSES = PROGRAM_ID_PLATFORM_GUESSES.slice(0, 8);
 const WEB3_TAGS = ["web3", "crypto", "blockchain", "smart-contract", "smart contract", "defi", "nft", "ethereum", "solana", "solidity"];
 const WEB3_CONTEST_SIGNALS = ["contest", "audit", "competitive", "code4rena", "sherlock", "cantina", "codehawks", "hats", "spearbit", "warden"];
 const VDP_SIGNALS = ["vdp", "disclosure", "responsible disclosure", "vulnerability disclosure", "no bounty", "non-bounty", "no reward"];
@@ -150,7 +190,7 @@ function stringListSchema(description = "Optional filter values. Empty or omitte
         .describe(description);
 }
 function platformListSchema() {
-    return stringListSchema("Optional platform filters such as HackerOne, Bugcrowd, Intigriti, or HackenProof. Empty or omitted means all platforms.");
+    return stringListSchema("Optional platform filters such as HackerOne, BugCrowd, Intigriti, HackenProof, Immunefi, YesWeHack, Cantina, or GObugfree. Empty or omitted means all platforms.");
 }
 function tagListSchema() {
     return stringListSchema("Optional combined scope/language/target-type tags. Empty or omitted means all tags.");
@@ -206,7 +246,7 @@ const programIdSchema = z
     .trim()
     .min(3)
     .max(256)
-    .regex(/^[A-Za-z0-9_-]+:[^?#]+$/, "Use platform:handle, for example HackerOne:example-handle.")
+    .regex(/^[^:/?#\u0000-\u001F\u007F]+:[^?#\u0000-\u001F\u007F]+$/, "Use platform:handle, for example HackerOne:example-handle.")
     .refine((value) => !/[\u0000-\u001F\u007F]/.test(value), {
     message: "program_id cannot contain control characters."
 })
@@ -324,12 +364,26 @@ const programCandidatePresetInputSchema = {
     output_mode: programListModeSchema.default("compact"),
     upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
 };
+function createProfiledToolRegistrar(server, profile) {
+    return (name, toolConfig, callback) => {
+        const registeredTool = server.registerTool(name, toolConfig, callback);
+        if (profile === "core" && !CORE_TOOL_NAMES.has(name)) {
+            registeredTool.disable();
+        }
+        return registeredTool;
+    };
+}
 export function createBbradarServer(client, config) {
-    const server = new McpServer({
-        name: "bbradar.io",
-        version: SERVER_VERSION
-    }, {
-        instructions: [
+    const instructions = config.toolProfile === "core"
+        ? [
+            "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
+            "This server uses the compact core tool profile. Start with get_bbradar_guide when unsure.",
+            "Use resolve_program or run_program_name_action for a named program.",
+            "Use find_programs for general discovery and find_programs_by_target for reverse target lookup.",
+            "Default to bounty-eligible in-scope data unless the user explicitly requests broader results.",
+            "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
+        ]
+        : [
             "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
             "When unsure which BBRadar tool to use, call get_bbradar_guide first. It is local-only and cheap.",
             "Simple default path: find_program_candidates for discovery, run_program_name_action for one named program, get_program_eligible_targets_by_name for target lists by program name.",
@@ -338,14 +392,20 @@ export function createBbradarServer(client, config) {
             "Default to bounty-eligible in-scope data. Include out-of-scope, ineligible, VDP, disclosure-only, or no-bounty data only when the user explicitly asks.",
             "Recently updated programs across platforms: find_recently_updated_programs. Do not infer a platform such as Immunefi unless the user explicitly names it.",
             "Freshness: find_recently_updated_programs, get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
-            "Discovery: find_program_candidates, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
+            "Discovery: find_program_candidates, find_wildcard_programs, find_recently_added_wildcards, find_low_competition_high_reward, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
-        ].join("\n")
+        ];
+    const server = new McpServer({
+        name: "bbradar.io",
+        version: SERVER_VERSION
+    }, {
+        instructions: instructions.join("\n")
     });
+    const registerTool = createProfiledToolRegistrar(server, config.toolProfile);
     const rateLimiter = new FixedWindowRateLimiter();
     const exportStore = new Map();
-    server.registerTool("search_programs", {
+    registerTool("search_programs", {
         title: "Search BBRadar Programs",
         description: `List active programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
@@ -371,7 +431,7 @@ export function createBbradarServer(client, config) {
             meta: sanitizeJson(data?.meta)
         });
     }));
-    server.registerTool("get_program", {
+    registerTool("get_program", {
         title: "Get BBRadar Program",
         description: "Get one program by platform:handle program_id, handle, or human program name. Names are resolved automatically when unambiguous.",
         inputSchema: {
@@ -407,7 +467,7 @@ export function createBbradarServer(client, config) {
             }
         }));
     }));
-    server.registerTool("resolve_program", {
+    registerTool("resolve_program", {
         title: "Resolve Program",
         description: "Resolve partial name/handle text to likely program_ids. Use this when the user gives a program name fragment like Nado.",
         inputSchema: {
@@ -431,7 +491,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("resolve_program", config, rateLimiter, async () => resolveProgram(client, config, args)));
-    server.registerTool("run_program_name_action", {
+    registerTool("run_program_name_action", {
         title: "Run Program Name Action",
         description: "Start here for one named program. Resolves a partial program name, then runs targets, new_targets, scope_delta, brief, or target_breakdown.",
         inputSchema: {
@@ -465,7 +525,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("run_program_name_action", config, rateLimiter, async () => runProgramNameAction(client, config, args)));
-    server.registerTool("get_program_eligible_targets_by_name", {
+    registerTool("get_program_eligible_targets_by_name", {
         title: "Get Eligible Targets By Program Name",
         description: "Fast one-call path for user asks like 'find in-scope eligible targets for Aztec': resolve the program name, fetch targets, and return filtered in-scope bounty-eligible targets. Prefer this over separate resolve_program + get_program_targets calls when the user asks for a target list by name.",
         inputSchema: {
@@ -496,7 +556,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_eligible_targets_by_name", config, rateLimiter, async () => getProgramEligibleTargetsByName(client, config, args)));
-    server.registerTool("get_program_targets", {
+    registerTool("get_program_targets", {
         title: "Get Program Targets",
         description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${MAX_TARGETS_PER_PROGRAM}.`,
         inputSchema: {
@@ -518,7 +578,7 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
         return runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
     }));
-    server.registerTool("get_recent_changes", {
+    registerTool("get_recent_changes", {
         title: "Get Recent Target Changes",
         description: `List recent target changes. page_size max ${MAX_RECENT_CHANGES}.`,
         inputSchema: {
@@ -557,15 +617,22 @@ export function createBbradarServer(client, config) {
             facets: sanitizeJson(data?.facets)
         });
     }));
-    server.registerTool("get_latest_added_targets", {
+    registerTool("get_latest_added_targets", {
         title: "Get Latest Added Targets",
-        description: "Latest added targets by type, optionally with that program's target list.",
+        description: "Latest added targets by type with optional platform, reward, and report-count filters. For fast wildcard discovery use target_type=wildcard and include_full_target_list=false.",
         inputSchema: {
             target_type: filterValueSchema().default("domain"),
+            platforms: platformListSchema(),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false).describe("Include out-of-scope."),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
             recent_changes_page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            include_full_target_list: z.boolean().default(true),
+            max_results: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(10),
+            include_full_target_list: z.boolean().default(true).describe("Fetch the newest matching program's complete target list. Set false for the fastest cross-program discovery."),
             full_target_list_mode: targetListModeSchema.default("identifiers"),
             full_target_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
             full_list_include_out_of_scope: z.boolean().default(false),
@@ -577,13 +644,14 @@ export function createBbradarServer(client, config) {
             query: jsonRecordSchema().optional(),
             latest_added_at: z.string().optional(),
             program: programOutputSchema().optional(),
+            matches: z.array(jsonRecordSchema()).optional(),
             new_targets: z.array(z.unknown()).optional(),
             full_targets: z.array(z.unknown()).optional(),
             meta: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_latest_added_targets", config, rateLimiter, async () => getLatestAddedTargets(client, config, args)));
-    server.registerTool("get_program_scope_summary", {
+    registerTool("get_program_scope_summary", {
         title: "Get Program Scope Summary",
         description: "Grouped compact scope for one program.",
         inputSchema: {
@@ -602,7 +670,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeSummary(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeSummaryFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
-    server.registerTool("get_program_target_breakdown", {
+    registerTool("get_program_target_breakdown", {
         title: "Get Program Target Breakdown",
         description: "Target type, scope tag, language tag, and bucket counts for one program.",
         inputSchema: {
@@ -621,7 +689,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramTargetBreakdown(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramTargetBreakdownFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
-    server.registerTool("get_program_scope_delta", {
+    registerTool("get_program_scope_delta", {
         title: "Get Program Scope Delta",
         description: "Compact recent scope changes for one program.",
         inputSchema: {
@@ -647,7 +715,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_scope_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeDelta(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeDeltaFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
-    server.registerTool("get_recent_target_activity", {
+    registerTool("get_recent_target_activity", {
         title: "Get Recent Target Activity",
         description: "Recent target changes grouped by program.",
         inputSchema: {
@@ -673,7 +741,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_recent_target_activity", config, rateLimiter, async () => getRecentTargetActivity(client, config, args)));
-    server.registerTool("check_program_new_targets", {
+    registerTool("check_program_new_targets", {
         title: "Check Program New Targets",
         description: "Yes/no new in-scope targets for one program.",
         inputSchema: {
@@ -698,7 +766,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => checkProgramNewTargets(client, config, { ...args, program_id: programId }), (indexFallback) => checkProgramNewTargetsFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
-    server.registerTool("check_watchlist_new_targets", {
+    registerTool("check_watchlist_new_targets", {
         title: "Check Watchlist New Targets",
         description: "New in-scope targets across many known program_ids.",
         inputSchema: {
@@ -719,7 +787,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("check_watchlist_new_targets", config, rateLimiter, async () => checkWatchlistNewTargets(client, config, args)));
-    server.registerTool("get_opportunities", {
+    registerTool("get_opportunities", {
         title: "Get BBRadar Opportunities",
         description: `List programs in one opportunity tier. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
@@ -750,7 +818,7 @@ export function createBbradarServer(client, config) {
             meta: sanitizeJson(data?.meta)
         });
     }));
-    server.registerTool("find_programs", {
+    registerTool("find_programs", {
         title: "Find BBRadar Programs",
         description: "Ranked program discovery with filters and compact output.",
         inputSchema: {
@@ -798,24 +866,30 @@ export function createBbradarServer(client, config) {
         ...args,
         target_samples_only_wildcards: args.min_wildcards > 0
     })));
-    server.registerTool("find_wildcard_programs", {
+    registerTool("find_wildcard_programs", {
         title: "Find Wildcard Programs",
-        description: "Wildcard program shortlist.",
+        description: "Wildcard program shortlist with platform, minimum reward, freshness, and report-count filters.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional(),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             max_public_report_count: z.number().int().min(0).default(25),
             require_known_report_count: z.boolean().default(true),
             include_unknown_report_count: z.boolean().default(false),
             exclude_ctf: z.boolean().default(true),
             require_bounty: z.boolean().default(true),
             min_wildcards: z.number().int().min(1).max(100).default(1),
+            min_added_24h: z.number().int().min(0).optional(),
+            min_added_7d: z.number().int().min(0).optional(),
+            sort_by: programSortSchema.default("best_hunt_value"),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
             include_target_samples: z.boolean().default(false),
             target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -829,8 +903,8 @@ export function createBbradarServer(client, config) {
         web3: false,
         opportunity_levels: [],
         updated_since: args.updated_since,
-        min_bounty_min: undefined,
-        min_bounty_max: undefined,
+        min_bounty_min: args.min_reward !== undefined && args.reward_threshold_mode === "min_at_least" ? args.min_reward : undefined,
+        min_bounty_max: args.min_reward !== undefined && args.reward_threshold_mode === "max_at_least" ? args.min_reward : undefined,
         max_bounty_max: undefined,
         require_bounty: args.require_bounty,
         max_public_report_count: args.max_public_report_count,
@@ -845,20 +919,21 @@ export function createBbradarServer(client, config) {
         min_wildcards: args.min_wildcards,
         min_eligible_targets: undefined,
         min_total_targets: undefined,
-        min_added_24h: undefined,
-        min_added_7d: undefined,
+        min_added_24h: args.min_added_24h,
+        min_added_7d: args.min_added_7d,
         max_pages: args.max_pages,
         max_results: args.max_results,
-        sort_by: "best_hunt_value",
+        sort_by: args.sort_by,
         include_target_samples: args.include_target_samples,
         target_sample_programs: args.target_sample_programs,
         target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
         target_samples_only_wildcards: true,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_web3_programs", {
+    registerTool("find_web3_programs", {
         title: "Find Web3 Programs",
         description: "Web3/blockchain/smart-contract program shortlist.",
         inputSchema: {
@@ -919,7 +994,7 @@ export function createBbradarServer(client, config) {
         target_samples_only_wildcards: args.min_wildcards > 0,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_reward_programs", {
+    registerTool("find_reward_programs", {
         title: "Find Reward Programs",
         description: "Programs matching reward thresholds.",
         inputSchema: {
@@ -948,7 +1023,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_reward_programs", config, rateLimiter, async () => findRewardPrograms(client, config, args)));
-    server.registerTool("find_web3_contests", {
+    registerTool("find_web3_contests", {
         title: "Find Web3 Contests",
         description: "Web3 contest or competitive audit shortlist.",
         inputSchema: {
@@ -971,7 +1046,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_web3_contests", config, rateLimiter, async () => findWeb3Contests(client, config, args)));
-    server.registerTool("find_language_programs", {
+    registerTool("find_language_programs", {
         title: "Find Language Programs",
         description: "Language-specific program shortlist.",
         inputSchema: {
@@ -998,7 +1073,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_language_programs", config, rateLimiter, async () => findLanguagePrograms(client, config, args)));
-    server.registerTool("find_target_type_programs", {
+    registerTool("find_target_type_programs", {
         title: "Find Target Type Programs",
         description: "Target-type program shortlist.",
         inputSchema: {
@@ -1024,7 +1099,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_target_type_programs", config, rateLimiter, async () => findTargetTypePrograms(client, config, args)));
-    server.registerTool("find_vdp_programs", {
+    registerTool("find_vdp_programs", {
         title: "Find VDP Programs",
         description: "VDP/disclosure-only/no-bounty program shortlist.",
         inputSchema: {
@@ -1044,7 +1119,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_vdp_programs", config, rateLimiter, async () => findVdpPrograms(client, config, args)));
-    server.registerTool("find_paid_programs", {
+    registerTool("find_paid_programs", {
         title: "Find Paid Programs",
         description: "Paid bounty program shortlist.",
         inputSchema: {
@@ -1067,7 +1142,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_paid_programs", config, rateLimiter, async () => findPaidPrograms(client, config, args)));
-    server.registerTool("find_stack_matches", {
+    registerTool("find_stack_matches", {
         title: "Find Stack Matches",
         description: "Combined stack/language/type/reward shortlist.",
         inputSchema: {
@@ -1097,7 +1172,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_stack_matches", config, rateLimiter, async () => findStackMatches(client, config, args)));
-    server.registerTool("find_low_noise_programs", {
+    registerTool("find_low_noise_programs", {
         title: "Find Low Noise Programs",
         description: "Low-public-report program shortlist.",
         inputSchema: {
@@ -1123,7 +1198,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_low_noise_programs", config, rateLimiter, async () => findLowNoisePrograms(client, config, args)));
-    server.registerTool("find_recent_by_type", {
+    registerTool("find_recent_by_type", {
         title: "Find Recent By Type",
         description: "Recent changes by target type grouped by program.",
         inputSchema: {
@@ -1149,7 +1224,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_recent_by_type", config, rateLimiter, async () => findRecentByType(client, config, args)));
-    server.registerTool("find_programs_by_target", {
+    registerTool("find_programs_by_target", {
         title: "Find Programs By Target",
         description: "Reverse lookup target/domain ownership. Accepts domains, URLs, wildcards, target names, and partial target text.",
         inputSchema: {
@@ -1172,21 +1247,21 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_programs_by_target", config, rateLimiter, async () => findProgramsByTarget(client, config, args)));
-    server.registerTool("find_program_candidates", {
+    registerTool("find_program_candidates", {
         title: "Find BBRadar Program Candidates",
         description: "Start here for broad program discovery. Default ranked hunt-candidate preset with safe filters and compact output.",
         inputSchema: programCandidatePresetInputSchema,
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_program_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
-    server.registerTool("find_hunt_candidates", {
+    registerTool("find_hunt_candidates", {
         title: "Find BBRadar Hunt Candidates",
         description: "Legacy alias for find_program_candidates. Prefer find_program_candidates for new calls.",
         inputSchema: programCandidatePresetInputSchema,
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_hunt_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
-    server.registerTool("find_fresh_hunt_candidates", {
+    registerTool("find_fresh_hunt_candidates", {
         title: "Find Fresh Hunt Candidates",
         description: "Freshness-first hunt shortlist.",
         inputSchema: {
@@ -1255,7 +1330,7 @@ export function createBbradarServer(client, config) {
         output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_recently_updated_programs", {
+    registerTool("find_recently_updated_programs", {
         title: "Find Recently Updated Programs",
         description: "Recently updated program shortlist across all platforms by default. Platform filters are applied only when explicitly provided.",
         inputSchema: {
@@ -1280,7 +1355,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_recently_updated_programs", config, rateLimiter, async () => findRecentlyUpdatedPrograms(client, config, args)));
-    server.registerTool("list_filters", {
+    registerTool("list_filters", {
         title: "List BBRadar Filters",
         description: "Discover observed filter values.",
         inputSchema: {
@@ -1299,7 +1374,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("list_filters", config, rateLimiter, async () => listFilters(client, args)));
-    server.registerTool("get_bbradar_guide", {
+    registerTool("get_bbradar_guide", {
         title: "Get BBRadar Tool Guide",
         description: "Local quick-start guide for choosing BBRadar tools. Call this when the user's request is ambiguous or when a smaller model may need a decision tree.",
         inputSchema: {
@@ -1312,9 +1387,9 @@ export function createBbradarServer(client, config) {
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_bbradar_guide", config, rateLimiter, async () => ({
         request_id: randomUUID(),
-        guide: bbradarGuide(args.topic)
+        guide: bbradarGuide(args.topic, config.toolProfile)
     })));
-    server.registerTool("get_mcp_status", {
+    registerTool("get_mcp_status", {
         title: "Get BBRadar MCP Status",
         description: "Local MCP status and timing metrics.",
         inputSchema: {},
@@ -1333,10 +1408,14 @@ export function createBbradarServer(client, config) {
             web_base_url: config.webBaseUrl,
             response_cache_enabled: config.cacheTtlMs > 0 && config.cacheMaxEntries > 0,
             cache_ttl_ms: config.cacheTtlMs,
+            negative_cache_ttl_ms: config.negativeCacheTtlMs,
             cache_max_entries: config.cacheMaxEntries,
             local_program_index_enabled: false,
             default_rate_limit_per_minute: config.defaultRateLimitPerMinute,
             export_rate_limit_per_minute: config.exportRateLimitPerMinute,
+            max_concurrent_upstream_requests: config.maxConcurrentRequests,
+            compact_tool_text: config.compactToolText,
+            tool_profile: config.toolProfile,
             request_timeout_ms: config.requestTimeoutMs,
             validate_on_startup: config.validateOnStartup,
             transport: "stdio",
@@ -1345,7 +1424,7 @@ export function createBbradarServer(client, config) {
             client: client.diagnostics()
         }
     })));
-    server.registerTool("compare_programs", {
+    registerTool("compare_programs", {
         title: "Compare BBRadar Programs",
         description: "Compare programs.",
         inputSchema: {
@@ -1359,7 +1438,7 @@ export function createBbradarServer(client, config) {
         outputSchema: decisionOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("compare_programs", config, rateLimiter, async () => comparePrograms(client, config, args)));
-    server.registerTool("compare_programs_compact", {
+    registerTool("compare_programs_compact", {
         title: "Compare Programs Compact",
         description: "Compact program comparison.",
         inputSchema: {
@@ -1372,7 +1451,7 @@ export function createBbradarServer(client, config) {
         outputSchema: decisionOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("compare_programs_compact", config, rateLimiter, async () => comparePrograms(client, config, { ...args, output_mode: "compact" })));
-    server.registerTool("summarize_program_activity", {
+    registerTool("summarize_program_activity", {
         title: "Summarize Program Activity",
         description: "Summarize one program's activity.",
         inputSchema: {
@@ -1387,7 +1466,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => summarizeProgramActivity(client, config, programId, args.recent_changes_limit))));
-    server.registerTool("get_program_brief", {
+    registerTool("get_program_brief", {
         title: "Get Program Brief",
         description: "Compact worth-hunting brief for one program.",
         inputSchema: {
@@ -1410,17 +1489,28 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_brief", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramBrief(client, config, { ...args, program_id: programId }))));
-    server.registerTool("find_recently_added_wildcards", {
+    registerTool("find_recently_added_wildcards", {
         title: "Find Recently Added Wildcards",
-        description: "Recently added wildcard programs.",
+        description: "Recently added wildcard programs with platform, minimum reward, and report-count filters. Returns bounded wildcard target samples.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
+            min_added_24h: z.number().int().min(0).optional(),
             min_added_7d: z.number().int().min(1).default(1),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(false),
             require_bounty: z.boolean().default(true),
+            min_wildcards: z.number().int().min(1).max(100).default(1),
+            sort_by: programSortSchema.default("most_new_targets"),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -1434,37 +1524,38 @@ export function createBbradarServer(client, config) {
         web3: false,
         opportunity_levels: [],
         updated_since: undefined,
-        min_bounty_min: undefined,
-        min_bounty_max: undefined,
+        min_bounty_min: args.min_reward !== undefined && args.reward_threshold_mode === "min_at_least" ? args.min_reward : undefined,
+        min_bounty_max: args.min_reward !== undefined && args.reward_threshold_mode === "max_at_least" ? args.min_reward : undefined,
         max_bounty_max: undefined,
         require_bounty: args.require_bounty,
         max_public_report_count: args.max_public_report_count,
-        require_known_report_count: false,
-        include_unknown_report_count: false,
+        require_known_report_count: args.require_known_report_count,
+        include_unknown_report_count: args.include_unknown_report_count,
         exclude_ctf: true,
         exclude_mobile_only: false,
         exclude_non_web: false,
         has_api_scope: false,
         fresh_launch_days: undefined,
-        min_wildcards: 1,
+        min_wildcards: args.min_wildcards,
         min_eligible_targets: undefined,
         min_total_targets: undefined,
-        min_added_24h: undefined,
+        min_added_24h: args.min_added_24h,
         min_added_7d: args.min_added_7d,
         max_pages: args.max_pages,
         max_results: args.max_results,
-        sort_by: "best_hunt_value",
-        include_target_samples: true,
-        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
-        target_sample_size: 5,
+        sort_by: args.sort_by,
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
         target_samples_only_wildcards: true,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_low_competition_high_reward", {
+    registerTool("find_low_competition_high_reward", {
         title: "Find Low Competition High Reward",
-        description: "Legacy low-report high-reward shortlist.",
+        description: "Low-report, high-reward shortlist with optional wildcard and technology filters.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
@@ -1473,6 +1564,7 @@ export function createBbradarServer(client, config) {
             max_public_report_count: z.number().int().min(0).default(10),
             min_bounty_max: z.number().int().min(0).default(5_000),
             min_eligible_targets: z.number().int().min(0).default(1),
+            min_wildcards: z.number().int().min(0).max(100).default(0),
             exclude_ctf: z.boolean().default(true),
             exclude_mobile_only: z.boolean().default(false),
             exclude_non_web: z.boolean().default(false),
@@ -1480,6 +1572,10 @@ export function createBbradarServer(client, config) {
             fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -1505,7 +1601,7 @@ export function createBbradarServer(client, config) {
         exclude_non_web: args.exclude_non_web,
         has_api_scope: args.has_api_scope,
         fresh_launch_days: args.fresh_launch_days,
-        min_wildcards: 0,
+        min_wildcards: args.min_wildcards,
         min_eligible_targets: args.min_eligible_targets,
         min_total_targets: undefined,
         min_added_24h: undefined,
@@ -1513,15 +1609,16 @@ export function createBbradarServer(client, config) {
         max_pages: args.max_pages,
         max_results: args.max_results,
         sort_by: "best_hunt_value",
-        include_target_samples: true,
-        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
-        target_sample_size: 5,
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
-        target_samples_only_wildcards: false,
+        target_samples_only_wildcards: args.min_wildcards > 0,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("get_program_delta", {
+    registerTool("get_program_delta", {
         title: "Get Program Delta",
         description: "Recent target changes for one program.",
         inputSchema: {
@@ -1539,7 +1636,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramDelta(client, config, { ...args, program_id: programId }))));
-    server.registerTool("export_targets", {
+    registerTool("export_targets", {
         title: "Export BBRadar Targets",
         description: `Read-only target export. limit max ${MAX_TARGET_EXPORT}.`,
         inputSchema: {
@@ -1596,11 +1693,14 @@ export function createBbradarServer(client, config) {
             });
         }
     }));
-    registerPrompts(server);
+    registerPrompts(server, config.toolProfile);
     registerResources(server, client, config, exportStore);
     return server;
 }
-function bbradarGuide(topic) {
+function bbradarGuide(topic, profile) {
+    if (profile === "core") {
+        return coreBbradarGuide(topic);
+    }
     const primaryEntryPoints = [
         {
             tool: "find_program_candidates",
@@ -1652,6 +1752,27 @@ function bbradarGuide(topic) {
             first_tool: "find_recently_updated_programs",
             then: "Use get_latest_added_targets for global added targets, or check_program_new_targets when the user names one program."
         },
+        {
+            user_goal: "latest added wildcard targets with platform, reward, or report-count filters",
+            first_tool: "get_latest_added_targets",
+            arguments: {
+                target_type: "wildcard",
+                platforms: ["requested platform"],
+                min_reward: 5000,
+                max_public_report_count: 10,
+                include_full_target_list: false
+            }
+        },
+        {
+            user_goal: "wildcard programs with low report count and good rewards",
+            first_tool: "find_wildcard_programs",
+            arguments: {
+                platforms: ["requested platform"],
+                min_reward: 5000,
+                max_public_report_count: 10,
+                include_target_samples: true
+            }
+        },
         {
             user_goal: "compare a short list",
             first_tool: "compare_programs_compact",
@@ -1669,8 +1790,8 @@ function bbradarGuide(topic) {
         }
     ];
     const advancedTools = {
-        discovery: ["find_stack_matches", "find_language_programs", "find_target_type_programs", "find_reward_programs", "find_paid_programs", "find_web3_contests", "find_low_noise_programs"],
-        freshness: ["find_recently_updated_programs", "find_fresh_hunt_candidates", "get_latest_added_targets", "get_recent_target_activity", "get_program_scope_delta", "check_watchlist_new_targets"],
+        discovery: ["find_wildcard_programs", "find_low_competition_high_reward", "find_stack_matches", "find_language_programs", "find_target_type_programs", "find_reward_programs", "find_paid_programs", "find_web3_contests", "find_low_noise_programs"],
+        freshness: ["find_recently_added_wildcards", "find_recently_updated_programs", "find_fresh_hunt_candidates", "get_latest_added_targets", "get_recent_target_activity", "get_program_scope_delta", "check_watchlist_new_targets"],
         details: ["get_program_brief", "get_program_scope_summary", "get_program_target_breakdown", "find_programs_by_target"],
         exports: ["export_targets"]
     };
@@ -1702,6 +1823,20 @@ function bbradarGuide(topic) {
         {
             user_says: "who owns https://api.example.com/v1/users",
             call: { tool: "find_programs_by_target", arguments: { target_query: "https://api.example.com/v1/users" } }
+        },
+        {
+            user_says: "latest HackerOne wildcard targets with rewards over 5000",
+            call: {
+                tool: "get_latest_added_targets",
+                arguments: { target_type: "wildcard", platforms: ["HackerOne"], min_reward: 5000, include_full_target_list: false }
+            }
+        },
+        {
+            user_says: "wildcard programs with under 10 reports and good rewards",
+            call: {
+                tool: "find_wildcard_programs",
+                arguments: { max_public_report_count: 10, min_reward: 5000, include_target_samples: true }
+            }
         }
     ];
     return {
@@ -1722,6 +1857,67 @@ function bbradarGuide(topic) {
         examples
     };
 }
+function coreBbradarGuide(topic) {
+    const decisionTree = [
+        {
+            user_goal: "find programs to hunt",
+            first_tool: "find_programs",
+            arguments: { max_results: 10, output_mode: "compact" }
+        },
+        {
+            user_goal: "named program summary or action",
+            first_tool: "run_program_name_action",
+            arguments: { query: "program name", action: "brief" }
+        },
+        {
+            user_goal: "named program targets",
+            first_tool: "get_program_eligible_targets_by_name",
+            arguments: { query: "program name", target_list_mode: "identifiers" }
+        },
+        {
+            user_goal: "find which program owns a target",
+            first_tool: "find_programs_by_target",
+            arguments: { target_query: "domain, URL, wildcard, package/repo name, or short target phrase", match_mode: "smart" }
+        },
+        {
+            user_goal: "fresh or recently changed scope",
+            first_tool: "get_recent_changes",
+            then: "Use get_latest_added_targets when only newly added targets are needed."
+        },
+        {
+            user_goal: "export targets",
+            first_tool: "export_targets",
+            then: "Use the returned bbradar://exports resource_uri for the full local export payload."
+        },
+        {
+            user_goal: "unknown filter values",
+            first_tool: "list_filters",
+            then: "Reuse observed platforms, tags, target types, and language tags in find_programs."
+        }
+    ];
+    return {
+        topic,
+        tool_profile: "core",
+        rule_zero: "BBRadar is passive intelligence only. Never scan or contact targets.",
+        defaults: {
+            output_mode: "compact",
+            target_list_mode: "identifiers",
+            target_match_mode: "smart",
+            include_out_of_scope: false,
+            include_ineligible: false,
+            require_bounty: true
+        },
+        primary_entry_points: [
+            "find_programs",
+            "run_program_name_action",
+            "get_program_eligible_targets_by_name",
+            "find_programs_by_target",
+            "get_bbradar_guide"
+        ],
+        decision_tree: decisionTree.filter((entry) => topic === "start" || guideEntryMatchesTopic(topic, entry)),
+        available_tools: [...CORE_TOOL_NAMES]
+    };
+}
 function guideEntryMatchesTopic(topic, entry) {
     const goal = typeof entry.user_goal === "string" ? entry.user_goal : "";
     const firstTool = typeof entry.first_tool === "string" ? entry.first_tool : "";
@@ -3156,13 +3352,27 @@ async function findProgramsByTarget(client, config, input) {
     };
     const sourceRequests = [];
     const matches = [];
+    const directHandleFirst = !queryLooksLikeTargetIdentifier(input.target_query) &&
+        !/\s/.test(input.target_query.trim()) &&
+        looksLikeDirectProgramHandleQuery(input.target_query);
+    if (input.use_api_search && !directHandleFirst) {
+        const directResult = await searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests);
+        if (directResult) {
+            return directResult;
+        }
+    }
     const directHandles = await collectDirectHandlePrograms(client, {
         query: input.target_query,
         platforms: input.platforms,
         budget,
         warnings,
         source: "target_query_program_id_guess",
-        maxProgramIds: 1,
+        maxProgramIds: input.use_api_search && directHandleFirst
+            ? 4
+            : queryLooksLikeTargetIdentifier(input.target_query) || looksLikeDirectProgramHandleQuery(input.target_query)
+                ? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS
+                : 4,
+        maxHandleVariants: 1,
         stopOnFirstMatch: true
     });
     sourceRequests.push(...directHandles.sourceRequests);
@@ -3181,8 +3391,8 @@ async function findProgramsByTarget(client, config, input) {
             }
         });
     }
-    if (input.use_api_search) {
-        const directResult = await searchProgramsByTargetApi(client, config, input, warnings);
+    if (input.use_api_search && directHandleFirst) {
+        const directResult = await searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests);
         if (directResult) {
             return directResult;
         }
@@ -3287,13 +3497,18 @@ function programsByTargetResult(input, warnings, sourceRequests, matches, budget
         meta: options.meta
     });
 }
-async function searchProgramsByTargetApi(client, config, input, warnings) {
+async function searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests) {
     const searchQueries = targetApiSearchQueries(input.target_query);
     const grouped = new Map();
-    const sourceRequests = [];
     let rawMatchesScanned = 0;
+    let searchQueriesChecked = 0;
     let lastMeta;
     for (const searchQuery of searchQueries) {
+        if (!tryConsumeBudget(budget)) {
+            addUniqueWarning(warnings, "Upstream request budget was exhausted before all target search variants could be checked.");
+            break;
+        }
+        searchQueriesChecked += 1;
         let api;
         try {
             api = await client.searchTargets({
@@ -3306,8 +3521,10 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
                 page: 1,
                 page_size: Math.max(input.max_results * input.max_targets_per_program, input.max_results)
             });
+            refundBudgetIfNoUpstreamRequest(budget, api);
         }
         catch (error) {
+            refundBudgetIfNoUpstreamError(budget, error);
             if (error instanceof BBRadarApiError && (error.status === 404 || error.status === 405)) {
                 warnings.push("Direct target search API is unavailable; fell back to sampled program target lists.");
                 return undefined;
@@ -3348,15 +3565,93 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
                 if (!targetMatchesQuery(target, input.target_query, input.match_mode)) {
                     continue;
                 }
-                const existing = grouped.get(programId) ?? { program: addProgramResourceLinks({ ...program, id: programId }), targets: [] };
-                existing.targets.push(target);
+                const existing = grouped.get(programId) ?? {
+                    program: addProgramResourceLinks({ ...program, id: programId }),
+                    targets: [],
+                    targetKeys: new Set()
+                };
+                const targetKey = stableStringify({
+                    identifier: targetIdentifier(target),
+                    target_type: stringField(target, "target_type")
+                });
+                if (!existing.targetKeys.has(targetKey)) {
+                    existing.targetKeys.add(targetKey);
+                    existing.targets.push(target);
+                }
                 grouped.set(programId, existing);
             }
         }
-        if (grouped.size >= input.max_results) {
+        if (grouped.size >= input.max_results ||
+            (grouped.size > 0 && input.match_mode === "smart")) {
             break;
         }
     }
+    if (grouped.size > 0 && input.match_mode === "smart") {
+        await mapWithConcurrency([...grouped.entries()].slice(0, input.max_results), TARGET_SAMPLE_CONCURRENCY, async ([programId, entry]) => {
+            if (!tryConsumeBudget(budget)) {
+                addUniqueWarning(warnings, "Upstream request budget was exhausted before matched program target lists could be hydrated.");
+                return;
+            }
+            try {
+                const targetsApi = await client.getProgramTargets(programId);
+                refundBudgetIfNoUpstreamRequest(budget, targetsApi);
+                sourceRequests.push({
+                    source: "program_targets",
+                    program_id: programId,
+                    request_id: targetsApi.requestId,
+                    upstream_request_id: targetsApi.upstreamRequestId,
+                    ...apiSourceMetadata(targetsApi)
+                });
+                const targetsData = readObject(targetsApi.data);
+                const hydratedTargets = readArray(targetsData?.targets).map(sanitizeTarget);
+                const hydratedTargetOrder = new Map(hydratedTargets.map((target, index) => [
+                    stableStringify({
+                        identifier: targetIdentifier(target),
+                        target_type: stringField(target, "target_type")
+                    }),
+                    index
+                ]));
+                for (const target of hydratedTargets) {
+                    if (!targetIdentifier(target) ||
+                        !targetHasAllowedScope(target, {
+                            include_out_of_scope: input.include_out_of_scope,
+                            include_ineligible: input.include_ineligible,
+                            strict_scope_filter: false
+                        }) ||
+                        !targetMatchesQuery(target, input.target_query, input.match_mode)) {
+                        continue;
+                    }
+                    const targetKey = stableStringify({
+                        identifier: targetIdentifier(target),
+                        target_type: stringField(target, "target_type")
+                    });
+                    if (!entry.targetKeys.has(targetKey)) {
+                        entry.targetKeys.add(targetKey);
+                        entry.targets.push(target);
+                    }
+                }
+                entry.targets.sort((left, right) => {
+                    const leftKey = stableStringify({
+                        identifier: targetIdentifier(left),
+                        target_type: stringField(left, "target_type")
+                    });
+                    const rightKey = stableStringify({
+                        identifier: targetIdentifier(right),
+                        target_type: stringField(right, "target_type")
+                    });
+                    return ((hydratedTargetOrder.get(leftKey) ?? Number.MAX_SAFE_INTEGER) -
+                        (hydratedTargetOrder.get(rightKey) ?? Number.MAX_SAFE_INTEGER));
+                });
+            }
+            catch (error) {
+                refundBudgetIfNoUpstreamError(budget, error);
+                if (!isProgramNotFoundError(error)) {
+                    throw error;
+                }
+                addUniqueWarning(warnings, `Could not hydrate target matches for ${programId}; returned direct target-search matches only.`);
+            }
+        });
+    }
     const matches = [...grouped.values()].slice(0, input.max_results).map((entry) => stripUndefined({
         program: formatProgram(entry.program, "compact"),
         match_count: entry.targets.length,
@@ -3384,6 +3679,14 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
         },
         matches,
         programs: matches.map((match) => readObject(match.program)).filter((program) => program !== undefined),
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        },
+        ranking_scope: {
+            mode: "target_search_api",
+            possibly_incomplete: grouped.size < input.max_results && searchQueriesChecked < searchQueries.length
+        },
         meta: stripUndefined({
             ...(lastMeta ?? {}),
             returned: matches.length,
@@ -3480,7 +3783,8 @@ async function listFilters(client, input) {
             }
         }
     }
-    catch {
+    catch (error) {
+        refundBudgetIfNoUpstreamError(budget, error);
         // Facets are best-effort; list_filters should still return observed program filters.
     }
     if (input.include_target_facets && input.target_sample_programs > 0) {
@@ -3616,11 +3920,15 @@ async function comparePrograms(client, config, input) {
     });
 }
 async function summarizeProgramActivity(client, config, programId, recentChangesLimit) {
-    const programApi = await client.getProgram(programId);
+    const [programApi, changes] = await Promise.all([
+        client.getProgram(programId),
+        recentChangesLimit > 0
+            ? fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true)
+            : Promise.resolve(undefined)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
     const scopeSummary = readObject(program.scope_summary);
     const targetActivity = readObject(scopeSummary?.target_activity);
-    const changes = recentChangesLimit > 0 ? await fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true) : undefined;
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -3647,12 +3955,14 @@ async function getLatestAddedTargets(client, config, input) {
         include_removed: false,
         include_ineligible: input.include_ineligible,
         include_out_of_scope: input.include_out_of_scope,
+        platforms: input.platforms,
         tags: [input.target_type],
         page: 1,
         page_size: input.recent_changes_page_size
     });
     const recentData = readObject(recentApi.data);
     const changes = readArray(recentData?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const platformFilters = new Set(input.platforms.map(normalizeTag));
     const matchingChanges = changes
         .filter((change) => {
         const target = readObject(change.target);
@@ -3661,6 +3971,7 @@ async function getLatestAddedTargets(client, config, input) {
             programId !== undefined &&
             target !== undefined &&
             targetMatchesRequestedType(target, input.target_type) &&
+            latestAddedProgramMatches(change, input, platformFilters) &&
             targetHasAllowedScope(target, {
                 include_out_of_scope: input.include_out_of_scope,
                 include_ineligible: input.include_ineligible,
@@ -3668,6 +3979,11 @@ async function getLatestAddedTargets(client, config, input) {
             }));
     })
         .sort((left, right) => timestampField(right, "changed_at") - timestampField(left, "changed_at"));
+    const limitedMatches = matchingChanges.slice(0, input.max_results);
+    const matches = limitedMatches.map((change, index) => ({
+        rank: index + 1,
+        ...formatChange(change, "compact")
+    }));
     const latest = matchingChanges[0];
     const sourceRequests = [
         {
@@ -3682,9 +3998,12 @@ async function getLatestAddedTargets(client, config, input) {
             request_id: randomUUID(),
             source_requests: sourceRequests,
             query: latestAddedTargetsQuery(input),
+            matches: [],
             new_targets: [],
             meta: {
                 recent_changes_scanned: changes.length,
+                matching_changes_scanned: 0,
+                matches_returned: 0,
                 no_match: true
             }
         };
@@ -3727,11 +4046,14 @@ async function getLatestAddedTargets(client, config, input) {
         query: latestAddedTargetsQuery(input),
         latest_added_at: latestAddedAt,
         program,
+        matches,
         new_targets: formatTargetList(latestNewTargets, input.full_target_list_mode),
         full_targets: input.include_full_target_list ? formatTargetList(limitedFullTargets, input.full_target_list_mode) : undefined,
         meta: stripUndefined({
             recent_changes_scanned: changes.length,
             matching_changes_scanned: matchingChanges.length,
+            matches_returned: matches.length,
+            matches_has_more: matches.length < matchingChanges.length,
             new_targets_returned: formatTargetList(latestNewTargets, input.full_target_list_mode).length,
             full_targets_total_active: totalActiveTargets,
             full_targets_total_after_filters: totalAfterFilters,
@@ -3740,6 +4062,39 @@ async function getLatestAddedTargets(client, config, input) {
         })
     });
 }
+function latestAddedProgramMatches(change, input, platformFilters) {
+    const rawProgram = readObject(change.program);
+    if (!rawProgram) {
+        return false;
+    }
+    const program = addProgramResourceLinks(rawProgram);
+    const rewardRange = readObject(program.reward_range);
+    const platform = normalizeTag(stringField(program, "platform") ?? "");
+    const bountyMin = numberField(rewardRange, "min");
+    const bountyMax = numberField(rewardRange, "max");
+    const publicReportCount = numberField(program, "public_report_count");
+    if (platformFilters.size > 0 && !platformFilters.has(platform)) {
+        return false;
+    }
+    if (input.min_reward !== undefined) {
+        const reward = input.reward_threshold_mode === "min_at_least" ? bountyMin : bountyMax;
+        if ((reward ?? 0) < input.min_reward) {
+            return false;
+        }
+    }
+    if (input.require_known_report_count && publicReportCount === undefined) {
+        return false;
+    }
+    if (input.max_public_report_count !== undefined) {
+        if (publicReportCount === undefined) {
+            return input.include_unknown_report_count;
+        }
+        if (publicReportCount > input.max_public_report_count) {
+            return false;
+        }
+    }
+    return true;
+}
 async function getProgramTargetsPayload(client, input, programId) {
     const api = await client.getProgramTargets(programId);
     const data = readObject(api.data);
@@ -4296,9 +4651,11 @@ async function getProgramTargetBreakdownFromIndexFallback(client, indexFallback,
     });
 }
 async function getProgramScopeDelta(client, config, input) {
-    const programApi = await client.getProgram(input.program_id);
+    const [programApi, changesPayload] = await Promise.all([
+        client.getProgram(input.program_id),
+        fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed || input.change_type === "removed", input.include_ineligible, input.include_out_of_scope, input.max_targets)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
-    const changesPayload = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed || input.change_type === "removed", input.include_ineligible, input.include_out_of_scope, input.max_targets);
     const filteredChanges = filterProgramScopeDeltaChanges(changesPayload.changes, input);
     const limitedChanges = filteredChanges.slice(0, input.max_targets);
     return stripUndefined({
@@ -4753,9 +5110,11 @@ async function getProgramBrief(client, config, input) {
     });
 }
 async function getProgramDelta(client, config, input) {
-    const programApi = await client.getProgram(input.program_id);
+    const [programApi, changes] = await Promise.all([
+        client.getProgram(input.program_id),
+        fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed, input.include_ineligible, input.include_out_of_scope)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
-    const changes = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed, input.include_ineligible, input.include_out_of_scope);
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -5346,7 +5705,11 @@ function programResolutionMatch(candidate, query) {
     };
 }
 function hasHighConfidenceProgramResolutionMatch(programs, webBaseUrl, query) {
-    return programs.some((program) => programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score >= 85);
+    const threshold = looksLikeDirectProgramHandleQuery(query) ? 95 : 85;
+    return programs.some((program) => programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score >= threshold);
+}
+function hasViableProgramResolutionMatch(programs, scorePrograms) {
+    return scorePrograms ? scorePrograms(programs) >= 80 : programs.length > 0;
 }
 function bestProgramResolutionScore(programs, webBaseUrl, query) {
     return programs.reduce((best, program) => Math.max(best, programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score), 0);
@@ -5357,6 +5720,7 @@ function programResolutionSearchQueries(query) {
 function programResolutionQueryVariants(query) {
     const normalized = normalizeTag(query);
     const meaningfulTokens = [...meaningfulProgramQueryTokens(query)];
+    const searchTokens = meaningfulTokens.filter((token) => token.length >= 3);
     const meaningfulPhrase = meaningfulTokens.join(" ");
     const singleTokenNameVariants = meaningfulTokens.length === 1
         ? [
@@ -5370,7 +5734,7 @@ function programResolutionQueryVariants(query) {
         normalized,
         meaningfulPhrase,
         meaningfulTokens.join("-"),
-        ...meaningfulTokens,
+        ...searchTokens,
         ...singleTokenNameVariants
     ];
     return uniqueStrings(values.filter((value) => value.length >= 2));
@@ -5486,7 +5850,13 @@ async function findPrograms(client, config, input) {
         initial: input.upstream_request_budget,
         remaining: input.upstream_request_budget
     };
-    const upstreamTags = uniqueStrings([...input.tags, ...input.scope_tags, ...input.target_types, ...input.language_tags]);
+    const upstreamTags = uniqueStrings([
+        ...input.tags,
+        ...input.scope_tags,
+        ...input.target_types,
+        ...input.language_tags,
+        ...(input.min_wildcards > 0 ? ["wildcard"] : [])
+    ]);
     const collected = await collectPrograms(client, {
         platforms: input.platforms,
         tags: upstreamTags,
@@ -5598,15 +5968,43 @@ async function collectProgramsForResolution(client, options) {
     const collections = [];
     const queryCollections = [];
     const queries = options.searchQueries.length > 0 ? options.searchQueries : [undefined];
-    const primaryDirectProgramIds = new Set(directProgramIdCandidates(options.query, options.platforms).slice(0, 1));
+    const fastQueries = queries.slice(0, FAST_RESOLVE_SEARCH_QUERIES);
+    const remainingQueries = queries.slice(FAST_RESOLVE_SEARCH_QUERIES);
+    const primaryDirectPlatforms = options.platforms.length > 0 ? options.platforms : PRIMARY_PROGRAM_ID_PLATFORM_GUESSES;
+    const primaryDirectProgramIds = new Set(directProgramIdCandidates(options.query, primaryDirectPlatforms, { maxHandleVariants: 1 }));
+    for (const search of fastQueries) {
+        if (options.budget.remaining <= 0) {
+            addUniqueWarning(options.warnings, "Program name search stopped at the request budget; pass a higher upstream_request_budget for a deeper resolution attempt.");
+            break;
+        }
+        const collection = await collectPrograms(client, {
+            search,
+            platforms: options.platforms,
+            tags: options.tags,
+            updated_since: undefined,
+            opportunity_levels: options.opportunity_levels,
+            max_pages: 1,
+            budget: options.budget,
+            warnings: options.warnings
+        });
+        collections.push(collection);
+        queryCollections.push({ search, collection });
+        const merged = mergeProgramCollections(collections);
+        if (options.isHighConfidenceMatch?.(merged.programs) ||
+            hasViableProgramResolutionMatch(merged.programs, options.scorePrograms)) {
+            return merged;
+        }
+    }
     if (primaryDirectProgramIds.size > 0 && options.budget.remaining > 0) {
         const primaryDirectHandles = await collectDirectHandlePrograms(client, {
             query: options.query,
-            platforms: options.platforms,
+            platforms: primaryDirectPlatforms,
             budget: options.budget,
             warnings: options.warnings,
             source: "program_id_handle_guess",
-            maxProgramIds: 1,
+            maxProgramIds: MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS,
+            maxHandleVariants: 1,
+            acceptEmptyTargetsAsPrograms: true,
             stopOnFirstMatch: true
         });
         if (primaryDirectHandles.programs.length > 0 || primaryDirectHandles.requestsScanned > 0) {
@@ -5616,7 +6014,7 @@ async function collectProgramsForResolution(client, options) {
             return mergeProgramCollections(collections);
         }
     }
-    for (const search of queries) {
+    for (const search of remainingQueries) {
         if (options.budget.remaining <= 0) {
             addUniqueWarning(options.warnings, "Program name search stopped at the request budget; pass a higher upstream_request_budget for a deeper resolution attempt.");
             break;
@@ -5637,7 +6035,9 @@ async function collectProgramsForResolution(client, options) {
             return mergeProgramCollections(collections);
         }
     }
-    if (options.budget.remaining > 0) {
+    const searchedCollection = collections.length > 0 ? mergeProgramCollections(collections) : undefined;
+    if (options.budget.remaining > 0 &&
+        (!searchedCollection || !hasViableProgramResolutionMatch(searchedCollection.programs, options.scorePrograms))) {
         const directHandles = await collectDirectHandlePrograms(client, {
             query: options.query,
             platforms: options.platforms,
@@ -5645,6 +6045,8 @@ async function collectProgramsForResolution(client, options) {
             warnings: options.warnings,
             source: "program_id_handle_guess",
             skipProgramIds: primaryDirectProgramIds,
+            maxHandleVariants: 4,
+            acceptEmptyTargetsAsPrograms: true,
             stopOnFirstMatch: true
         });
         if (directHandles.programs.length > 0 || directHandles.requestsScanned > 0) {
@@ -5715,7 +6117,7 @@ function mergeProgramCollections(collections) {
     };
 }
 async function collectDirectHandlePrograms(client, options) {
-    const programIds = directProgramIdCandidates(options.query, options.platforms)
+    const programIds = directProgramIdCandidates(options.query, options.platforms, { maxHandleVariants: options.maxHandleVariants })
         .filter((programId) => !options.skipProgramIds?.has(programId))
         .slice(0, options.maxProgramIds ?? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS);
     const programs = [];
@@ -5723,70 +6125,45 @@ async function collectDirectHandlePrograms(client, options) {
     let requestsScanned = 0;
     for (const programId of programIds) {
         if (!tryConsumeBudget(options.budget)) {
+            addUniqueWarning(options.warnings, "Upstream request budget was exhausted before all direct program handle guesses could be checked.");
             break;
         }
         requestsScanned += 1;
         try {
-            const api = await client.getProgram(programId);
-            programs.push(api.data);
+            const targetsApi = await client.getProgramTargets(programId);
+            refundBudgetIfNoUpstreamRequest(options.budget, targetsApi);
+            const targetsData = readObject(targetsApi.data);
+            const hasTargetsArray = Array.isArray(targetsData?.targets);
+            const targets = readArray(targetsData?.targets).map(sanitizeTarget);
+            const programEndpointExists = targets.length > 0 || (options.acceptEmptyTargetsAsPrograms === true && hasTargetsArray);
+            if (programEndpointExists) {
+                programs.push(syntheticProgramFromProgramId(programId, targets));
+            }
             sourceRequests.push({
                 source: options.source,
+                endpoint: "program_targets",
                 program_id: programId,
-                request_id: api.requestId,
-                upstream_request_id: api.upstreamRequestId,
-                ...apiSourceMetadata(api)
+                request_id: targetsApi.requestId,
+                upstream_request_id: targetsApi.upstreamRequestId,
+                ...apiSourceMetadata(targetsApi)
             });
-            if (options.stopOnFirstMatch) {
+            if (programEndpointExists && options.stopOnFirstMatch) {
                 break;
             }
         }
         catch (error) {
+            refundBudgetIfNoUpstreamError(options.budget, error);
             if (error instanceof BBRadarApiError && error.status === 404) {
                 sourceRequests.push({
                     source: options.source,
-                    endpoint: "program_detail",
+                    endpoint: "program_targets",
                     program_id: programId,
                     request_id: error.requestId,
                     upstream_request_id: error.upstreamRequestId,
-                    status: error.status
+                    status: error.status,
+                    cache_hit: error.cached,
+                    cache_expires_at: error.cacheExpiresAt
                 });
-                if (!tryConsumeBudget(options.budget)) {
-                    break;
-                }
-                requestsScanned += 1;
-                try {
-                    const targetsApi = await client.getProgramTargets(programId);
-                    const targetsData = readObject(targetsApi.data);
-                    const targets = readArray(targetsData?.targets).map(sanitizeTarget);
-                    if (targets.length > 0) {
-                        programs.push(syntheticProgramFromProgramId(programId, targets));
-                    }
-                    sourceRequests.push({
-                        source: options.source,
-                        endpoint: "program_targets",
-                        program_id: programId,
-                        request_id: targetsApi.requestId,
-                        upstream_request_id: targetsApi.upstreamRequestId,
-                        ...apiSourceMetadata(targetsApi)
-                    });
-                    if (targets.length > 0 && options.stopOnFirstMatch) {
-                        break;
-                    }
-                }
-                catch (targetError) {
-                    if (targetError instanceof BBRadarApiError && targetError.status === 404) {
-                        sourceRequests.push({
-                            source: options.source,
-                            endpoint: "program_targets",
-                            program_id: programId,
-                            request_id: targetError.requestId,
-                            upstream_request_id: targetError.upstreamRequestId,
-                            status: targetError.status
-                        });
-                        continue;
-                    }
-                    throw targetError;
-                }
                 continue;
             }
             throw error;
@@ -5804,11 +6181,12 @@ function syntheticProgramFromProgramId(programId, targets) {
     const separatorIndex = programId.indexOf(":");
     const platform = separatorIndex >= 0 ? programId.slice(0, separatorIndex) : undefined;
     const handle = separatorIndex >= 0 ? programId.slice(separatorIndex + 1) : programId;
+    const displayHandle = handle.split("/").filter(Boolean).at(-1) ?? handle;
     const scopeTags = uniqueStrings(targets.flatMap((target) => readStringArrayField(target, "scope_tags")));
     return stripUndefined({
         id: programId,
         handle,
-        name: titleizeProgramHandle(handle),
+        name: titleizeProgramHandle(displayHandle),
         platform,
         scope_tags: scopeTags,
         target_counts: {
@@ -5827,38 +6205,75 @@ function titleizeProgramHandle(handle) {
         .map((part) => part.slice(0, 1).toUpperCase() + part.slice(1))
         .join(" ");
 }
-function directProgramIdCandidates(query, platforms) {
+function directProgramIdCandidates(query, platforms, options = {}) {
     const platformGuesses = (platforms.length > 0 ? platforms : PROGRAM_ID_PLATFORM_GUESSES).map(canonicalProgramIdPlatform);
-    const handles = directProgramHandleVariants(query);
-    return uniqueStrings(platformGuesses.flatMap((platform) => handles.map((handle) => `${platform}:${handle}`))).slice(0, MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS);
+    const handles = directProgramHandleVariants(query).slice(0, options.maxHandleVariants ?? Number.POSITIVE_INFINITY);
+    return uniqueStrings(handles.flatMap((handle) => platformGuesses.flatMap((platform) => normalizeTag(platform) === "bugcrowd"
+        ? [`${platform}:engagements/${handle}`, `${platform}:${handle}`]
+        : [`${platform}:${handle}`]))).slice(0, MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS);
 }
 function canonicalProgramIdPlatform(platform) {
     const normalized = normalizeTag(platform).replace(/[^a-z0-9]/g, "");
     const knownPlatforms = {
         hackerone: "HackerOne",
-        bugcrowd: "Bugcrowd",
+        bugcrowd: "BugCrowd",
         intigriti: "Intigriti",
         hackenproof: "HackenProof",
         yeswehack: "YesWeHack",
+        immunefi: "Immunefi",
         cantina: "Cantina",
         code4rena: "Code4rena",
-        immunefi: "Immunefi"
+        huntr: "Huntr",
+        gobugfree: "GObugfree",
+        bugbountyswitzerland: "Bug Bounty Switzerland",
+        inspectiv: "Inspectiv",
+        compasssecurity: "Compass Security",
+        bugrap: "BugRap",
+        issuehunt: "IssueHunt",
+        patchday: "PatchDay",
+        remedy: "Remedy",
+        standoff365: "Standoff365",
+        sherlock: "Sherlock",
+        codehawks: "CodeHawks"
     };
     return knownPlatforms[normalized] ?? platform.trim();
 }
 function directProgramHandleVariants(query) {
     const handleText = query.includes(":") ? query.slice(query.indexOf(":") + 1) : query;
     const normalized = normalizeTargetIdentifierForMatch(handleText);
+    const literal = directProgramLiteralHandleVariant(handleText);
     const dashed = normalized.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     const compact = dashed.replace(/-/g, "");
     const tokens = [...meaningfulProgramQueryTokens(handleText)];
-    return uniqueStrings([
-        ...targetBrandTokens(handleText),
-        dashed,
-        compact,
-        tokens.join("-"),
-        tokens.join("")
-    ]).filter((handle) => /^[a-z0-9][a-z0-9_.-]{3,100}$/i.test(handle));
+    const brandTokens = targetBrandTokens(handleText);
+    const literalVariants = [literal, dashed, compact, tokens.join("-"), tokens.join("")];
+    const values = queryLooksLikeTargetIdentifier(handleText) ? [...brandTokens, ...literalVariants] : [...literalVariants, ...brandTokens];
+    return uniqueStrings(values).filter(isDirectProgramHandleVariant);
+}
+function looksLikeDirectProgramHandleQuery(query) {
+    const handleText = query.includes(":") ? query.slice(query.indexOf(":") + 1) : query;
+    return isDirectProgramHandleVariant(directProgramLiteralHandleVariant(handleText));
+}
+function directProgramLiteralHandleVariant(value) {
+    const normalized = value
+        .trim()
+        .replace(/\\/g, "/")
+        .replace(/^['"`<]+|['"`>]+$/g, "")
+        .replace(/^[a-z][a-z0-9+.-]*:\/\//i, "")
+        .replace(/^www\./i, "");
+    const queryStart = normalized.search(/[?#]/);
+    return (queryStart >= 0 ? normalized.slice(0, queryStart) : normalized).replace(/\/+$/, "");
+}
+function isDirectProgramHandleVariant(value) {
+    if (!value) {
+        return false;
+    }
+    if (value.length < 2 || value.length > 150 || /[\u0000-\u001F\u007F?#:]/.test(value)) {
+        return false;
+    }
+    return value
+        .split("/")
+        .every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && !/^[\s.]+$/.test(segment));
 }
 async function collectProgramSources(client, sources, options) {
     const pages = [];
@@ -6160,7 +6575,8 @@ async function collectTargetSamples(client, candidates, input, budget) {
                 .slice(0, input.target_sample_size);
             samples[programId] = targets;
         }
-        catch {
+        catch (error) {
+            refundBudgetIfNoUpstreamError(budget, error);
             samples[programId] = [];
         }
     });
@@ -6223,6 +6639,11 @@ function refundBudgetIfNoUpstreamRequest(budget, api, cost = 1) {
         budget.remaining = Math.min(budget.initial, budget.remaining + cost);
     }
 }
+function refundBudgetIfNoUpstreamError(budget, error, cost = 1) {
+    if (error instanceof BBRadarApiError && (error.cached || error.coalesced)) {
+        budget.remaining = Math.min(budget.initial, budget.remaining + cost);
+    }
+}
 function addUniqueWarning(warnings, warning) {
     if (warnings && !warnings.includes(warning)) {
         warnings.push(warning);
@@ -6325,7 +6746,12 @@ function readStringArrayField(value, field) {
     const fieldValue = value[field];
     return Array.isArray(fieldValue) ? fieldValue.filter((entry) => typeof entry === "string") : [];
 }
-function registerPrompts(server) {
+function registerPrompts(server, profile) {
+    const discoveryToolInstructions = profile === "core"
+        ? `- Start with find_programs and pass opportunity_levels from the requested value below unless the user asked for a broader search.
+- Express language, target type, reward, Web3, wildcard, VDP, and platform needs through find_programs filters.`
+        : `- Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from the requested value below.
+- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.`;
     server.registerPrompt("find_best_programs_to_hunt", {
         title: "Find Best Programs To Hunt",
         description: "Rank fresh BBRadar program data only. Do not invoke external bug bounty skills unless the user explicitly asks for methodology.",
@@ -6338,8 +6764,8 @@ function registerPrompts(server) {
     }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Treat results as fresh API reads; do not describe them as cached.
 
 Find the best BBRadar program candidates.
-- Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from this JSON array unless the user asked for a broader search: ${promptJson([args.opportunity_level ?? "elite"])}.
-- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
+${discoveryToolInstructions}
+- Use this opportunity level JSON array: ${promptJson([args.opportunity_level ?? "elite"])}.
 - Apply platform filters from this JSON string if provided: ${promptJson(args.platforms ?? "")}.
 - Apply tag filters from this JSON string if provided: ${promptJson(args.tags ?? "")}.
 - Keep the shortlist to this JSON value: ${promptJson(args.max_programs ?? "10")}.
@@ -6399,7 +6825,7 @@ async function runTool(toolName, config, rateLimiter, callback) {
             },
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
-        }, true);
+        }, true, config.compactToolText);
     }
     try {
         const payload = await callback();
@@ -6409,21 +6835,21 @@ async function runTool(toolName, config, rateLimiter, callback) {
             ...payload,
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
-        });
+        }, false, config.compactToolText);
     }
     catch (error) {
         const durationMs = Date.now() - startedAt;
         recordToolMetric(toolName, durationMs, "error");
-        return toolResult(errorPayload(error, decision, toolName, durationMs), true);
+        return toolResult(errorPayload(error, decision, toolName, durationMs), true, config.compactToolText);
     }
 }
-function toolResult(payload, isError = false) {
+function toolResult(payload, isError = false, compactText = false) {
     const resourceLinks = collectResourceLinks(payload);
     return {
         content: [
             {
                 type: "text",
-                text: JSON.stringify(payload)
+                text: compactText ? compactToolText(payload, isError) : JSON.stringify(payload)
             },
             ...resourceLinks
         ],
@@ -6431,6 +6857,28 @@ function toolResult(payload, isError = false) {
         ...(isError ? { isError: true } : {})
     };
 }
+function compactToolText(payload, isError) {
+    if (isError) {
+        return JSON.stringify(stripUndefined({
+            request_id: payload.request_id,
+            error: payload.error,
+            mcp_timing: payload.mcp_timing
+        }));
+    }
+    const meta = readObject(payload.meta);
+    const returned = numberField(meta, "returned") ??
+        [
+            readArray(payload.programs).length,
+            readArray(payload.targets).length,
+            readArray(payload.changes).length
+        ].find((count) => count > 0);
+    return JSON.stringify(stripUndefined({
+        request_id: payload.request_id,
+        summary: "Full tool result is available in structuredContent.",
+        returned,
+        mcp_timing: payload.mcp_timing
+    }));
+}
 function promptResult(text) {
     return {
         messages: [
@@ -6570,18 +7018,25 @@ function compactRecord(values) {
     }));
 }
 function latestAddedTargetsQuery(input) {
-    return {
+    return stripUndefined({
         change_type: "added",
         target_type: input.target_type,
+        platforms: input.platforms.length > 0 ? input.platforms : undefined,
+        min_reward: input.min_reward,
+        reward_threshold_mode: input.reward_threshold_mode,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: input.require_known_report_count,
+        include_unknown_report_count: input.include_unknown_report_count,
         include_out_of_scope: input.include_out_of_scope,
         include_ineligible: input.include_ineligible,
         recent_changes_page_size: input.recent_changes_page_size,
+        max_results: input.max_results,
         include_full_target_list: input.include_full_target_list,
         full_target_list_mode: input.full_target_list_mode,
         full_target_limit: input.full_target_limit,
         full_list_include_out_of_scope: input.full_list_include_out_of_scope,
         full_list_include_ineligible: input.full_list_include_ineligible
-    };
+    });
 }
 function formatTargetList(targets, mode) {
     if (mode === "identifiers") {
@@ -6633,7 +7088,7 @@ function targetMatchesQuery(target, query, mode) {
     }
     return (containsMatch ||
         profile.values.some((value) => queryValues.some((queryValue) => targetSuffixMatch(value, queryValue) || targetWildcardMatch(value, queryValue))) ||
-        targetTokensMatch(profile.tokens, query));
+        (!queryLooksLikeTargetIdentifier(query) && targetTokensMatch(profile.tokens, query)));
 }
 function upstreamTargetMatchMode(mode) {
     return mode === "smart" ? "contains" : mode;
@@ -6671,7 +7126,11 @@ function targetSearchProfile(target) {
     };
 }
 function targetQueryVariants(query) {
-    return targetStringVariants(query);
+    const variants = targetStringVariants(query);
+    if (!queryLooksLikeTargetIdentifier(query)) {
+        return variants;
+    }
+    return variants.filter(targetValueCanContainQuery);
 }
 function targetApiSearchQueries(query) {
     const normalized = normalizeTargetIdentifierForMatch(query);