@bbradar/mcp 0.1.19 → 0.1.20

package/dist/server.js

@@ -5,7 +5,7 @@ import { BBRadarApiError } from "./bbradarClient.js";
 import { stableStringify, stripUndefined } from "./json.js";
 import { FixedWindowRateLimiter } from "./rateLimit.js";
 import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
-const SERVER_VERSION = "0.1.0";
+const SERVER_VERSION = "0.1.19";
 const MAX_PROGRAMS_PER_SEARCH = 100;
 const MAX_TARGET_EXPORT = 500;
 const MAX_RECENT_CHANGES = 100;
@@ -20,7 +20,7 @@ const MAX_FIND_TARGET_SAMPLE_PROGRAMS = 10;
 const MAX_FIND_TARGET_SAMPLES = 20;
 const MAX_FIND_UPSTREAM_REQUEST_BUDGET = 50;
 const DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET = 20;
-const DEFAULT_RESOLVE_UPSTREAM_REQUEST_BUDGET = 4;
+const DEFAULT_RESOLVE_UPSTREAM_REQUEST_BUDGET = 12;
 const MAX_ACCEPTED_NUMERIC_LIMIT = 1_000;
 const PROGRAM_COLLECTION_CONCURRENCY = 4;
 const TARGET_SAMPLE_CONCURRENCY = 3;
@@ -31,11 +31,29 @@ const MAX_FILTER_TARGET_SAMPLE_PROGRAMS = 25;
 const MAX_LOCAL_EXPORT_RESOURCES = 25;
 const EXPORT_PREVIEW_LIMIT = 25;
 const STALE_PROGRAM_ID_RESOLVE_PAGES = 1;
-const STALE_PROGRAM_ID_RESOLVE_BUDGET = 8;
+const STALE_PROGRAM_ID_RESOLVE_BUDGET = 12;
 const PROGRAM_FALLBACK_CACHE_MAX_ENTRIES = 200;
 const MAX_RESOLVE_SEARCH_QUERIES = 4;
+const FAST_RESOLVE_SEARCH_QUERIES = 2;
 const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 96;
 const SDK_VERSION = "1.29.0";
+const CORE_TOOL_NAMES = new Set([
+    "search_programs",
+    "get_program",
+    "resolve_program",
+    "run_program_name_action",
+    "get_program_eligible_targets_by_name",
+    "get_program_targets",
+    "get_recent_changes",
+    "get_latest_added_targets",
+    "get_opportunities",
+    "find_programs",
+    "find_programs_by_target",
+    "list_filters",
+    "get_bbradar_guide",
+    "get_mcp_status",
+    "export_targets"
+]);
 const PROGRAM_ID_PLATFORM_GUESSES = [
     "HackerOne",
     "BugCrowd",
@@ -346,12 +364,26 @@ const programCandidatePresetInputSchema = {
     output_mode: programListModeSchema.default("compact"),
     upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
 };
+function createProfiledToolRegistrar(server, profile) {
+    return (name, toolConfig, callback) => {
+        const registeredTool = server.registerTool(name, toolConfig, callback);
+        if (profile === "core" && !CORE_TOOL_NAMES.has(name)) {
+            registeredTool.disable();
+        }
+        return registeredTool;
+    };
+}
 export function createBbradarServer(client, config) {
-    const server = new McpServer({
-        name: "bbradar.io",
-        version: SERVER_VERSION
-    }, {
-        instructions: [
+    const instructions = config.toolProfile === "core"
+        ? [
+            "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
+            "This server uses the compact core tool profile. Start with get_bbradar_guide when unsure.",
+            "Use resolve_program or run_program_name_action for a named program.",
+            "Use find_programs for general discovery and find_programs_by_target for reverse target lookup.",
+            "Default to bounty-eligible in-scope data unless the user explicitly requests broader results.",
+            "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
+        ]
+        : [
             "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
             "When unsure which BBRadar tool to use, call get_bbradar_guide first. It is local-only and cheap.",
             "Simple default path: find_program_candidates for discovery, run_program_name_action for one named program, get_program_eligible_targets_by_name for target lists by program name.",
@@ -360,14 +392,20 @@ export function createBbradarServer(client, config) {
             "Default to bounty-eligible in-scope data. Include out-of-scope, ineligible, VDP, disclosure-only, or no-bounty data only when the user explicitly asks.",
             "Recently updated programs across platforms: find_recently_updated_programs. Do not infer a platform such as Immunefi unless the user explicitly names it.",
             "Freshness: find_recently_updated_programs, get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
-            "Discovery: find_program_candidates, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
+            "Discovery: find_program_candidates, find_wildcard_programs, find_recently_added_wildcards, find_low_competition_high_reward, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
-        ].join("\n")
+        ];
+    const server = new McpServer({
+        name: "bbradar.io",
+        version: SERVER_VERSION
+    }, {
+        instructions: instructions.join("\n")
     });
+    const registerTool = createProfiledToolRegistrar(server, config.toolProfile);
     const rateLimiter = new FixedWindowRateLimiter();
     const exportStore = new Map();
-    server.registerTool("search_programs", {
+    registerTool("search_programs", {
         title: "Search BBRadar Programs",
         description: `List active programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
@@ -393,7 +431,7 @@ export function createBbradarServer(client, config) {
             meta: sanitizeJson(data?.meta)
         });
     }));
-    server.registerTool("get_program", {
+    registerTool("get_program", {
         title: "Get BBRadar Program",
         description: "Get one program by platform:handle program_id, handle, or human program name. Names are resolved automatically when unambiguous.",
         inputSchema: {
@@ -429,7 +467,7 @@ export function createBbradarServer(client, config) {
             }
         }));
     }));
-    server.registerTool("resolve_program", {
+    registerTool("resolve_program", {
         title: "Resolve Program",
         description: "Resolve partial name/handle text to likely program_ids. Use this when the user gives a program name fragment like Nado.",
         inputSchema: {
@@ -453,7 +491,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("resolve_program", config, rateLimiter, async () => resolveProgram(client, config, args)));
-    server.registerTool("run_program_name_action", {
+    registerTool("run_program_name_action", {
         title: "Run Program Name Action",
         description: "Start here for one named program. Resolves a partial program name, then runs targets, new_targets, scope_delta, brief, or target_breakdown.",
         inputSchema: {
@@ -487,7 +525,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("run_program_name_action", config, rateLimiter, async () => runProgramNameAction(client, config, args)));
-    server.registerTool("get_program_eligible_targets_by_name", {
+    registerTool("get_program_eligible_targets_by_name", {
         title: "Get Eligible Targets By Program Name",
         description: "Fast one-call path for user asks like 'find in-scope eligible targets for Aztec': resolve the program name, fetch targets, and return filtered in-scope bounty-eligible targets. Prefer this over separate resolve_program + get_program_targets calls when the user asks for a target list by name.",
         inputSchema: {
@@ -518,7 +556,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_eligible_targets_by_name", config, rateLimiter, async () => getProgramEligibleTargetsByName(client, config, args)));
-    server.registerTool("get_program_targets", {
+    registerTool("get_program_targets", {
         title: "Get Program Targets",
         description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${MAX_TARGETS_PER_PROGRAM}.`,
         inputSchema: {
@@ -540,7 +578,7 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
         return runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
     }));
-    server.registerTool("get_recent_changes", {
+    registerTool("get_recent_changes", {
         title: "Get Recent Target Changes",
         description: `List recent target changes. page_size max ${MAX_RECENT_CHANGES}.`,
         inputSchema: {
@@ -579,15 +617,22 @@ export function createBbradarServer(client, config) {
             facets: sanitizeJson(data?.facets)
         });
     }));
-    server.registerTool("get_latest_added_targets", {
+    registerTool("get_latest_added_targets", {
         title: "Get Latest Added Targets",
-        description: "Latest added targets by type, optionally with that program's target list.",
+        description: "Latest added targets by type with optional platform, reward, and report-count filters. For fast wildcard discovery use target_type=wildcard and include_full_target_list=false.",
         inputSchema: {
             target_type: filterValueSchema().default("domain"),
+            platforms: platformListSchema(),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false).describe("Include out-of-scope."),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
             recent_changes_page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            include_full_target_list: z.boolean().default(true),
+            max_results: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(10),
+            include_full_target_list: z.boolean().default(true).describe("Fetch the newest matching program's complete target list. Set false for the fastest cross-program discovery."),
             full_target_list_mode: targetListModeSchema.default("identifiers"),
             full_target_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
             full_list_include_out_of_scope: z.boolean().default(false),
@@ -599,13 +644,14 @@ export function createBbradarServer(client, config) {
             query: jsonRecordSchema().optional(),
             latest_added_at: z.string().optional(),
             program: programOutputSchema().optional(),
+            matches: z.array(jsonRecordSchema()).optional(),
             new_targets: z.array(z.unknown()).optional(),
             full_targets: z.array(z.unknown()).optional(),
             meta: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_latest_added_targets", config, rateLimiter, async () => getLatestAddedTargets(client, config, args)));
-    server.registerTool("get_program_scope_summary", {
+    registerTool("get_program_scope_summary", {
         title: "Get Program Scope Summary",
         description: "Grouped compact scope for one program.",
         inputSchema: {
@@ -624,7 +670,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeSummary(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeSummaryFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
-    server.registerTool("get_program_target_breakdown", {
+    registerTool("get_program_target_breakdown", {
         title: "Get Program Target Breakdown",
         description: "Target type, scope tag, language tag, and bucket counts for one program.",
         inputSchema: {
@@ -643,7 +689,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramTargetBreakdown(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramTargetBreakdownFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
-    server.registerTool("get_program_scope_delta", {
+    registerTool("get_program_scope_delta", {
         title: "Get Program Scope Delta",
         description: "Compact recent scope changes for one program.",
         inputSchema: {
@@ -669,7 +715,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_scope_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeDelta(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeDeltaFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
-    server.registerTool("get_recent_target_activity", {
+    registerTool("get_recent_target_activity", {
         title: "Get Recent Target Activity",
         description: "Recent target changes grouped by program.",
         inputSchema: {
@@ -695,7 +741,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_recent_target_activity", config, rateLimiter, async () => getRecentTargetActivity(client, config, args)));
-    server.registerTool("check_program_new_targets", {
+    registerTool("check_program_new_targets", {
         title: "Check Program New Targets",
         description: "Yes/no new in-scope targets for one program.",
         inputSchema: {
@@ -720,7 +766,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => checkProgramNewTargets(client, config, { ...args, program_id: programId }), (indexFallback) => checkProgramNewTargetsFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
-    server.registerTool("check_watchlist_new_targets", {
+    registerTool("check_watchlist_new_targets", {
         title: "Check Watchlist New Targets",
         description: "New in-scope targets across many known program_ids.",
         inputSchema: {
@@ -741,7 +787,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("check_watchlist_new_targets", config, rateLimiter, async () => checkWatchlistNewTargets(client, config, args)));
-    server.registerTool("get_opportunities", {
+    registerTool("get_opportunities", {
         title: "Get BBRadar Opportunities",
         description: `List programs in one opportunity tier. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
@@ -772,7 +818,7 @@ export function createBbradarServer(client, config) {
             meta: sanitizeJson(data?.meta)
         });
     }));
-    server.registerTool("find_programs", {
+    registerTool("find_programs", {
         title: "Find BBRadar Programs",
         description: "Ranked program discovery with filters and compact output.",
         inputSchema: {
@@ -820,24 +866,30 @@ export function createBbradarServer(client, config) {
         ...args,
         target_samples_only_wildcards: args.min_wildcards > 0
     })));
-    server.registerTool("find_wildcard_programs", {
+    registerTool("find_wildcard_programs", {
         title: "Find Wildcard Programs",
-        description: "Wildcard program shortlist.",
+        description: "Wildcard program shortlist with platform, minimum reward, freshness, and report-count filters.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional(),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             max_public_report_count: z.number().int().min(0).default(25),
             require_known_report_count: z.boolean().default(true),
             include_unknown_report_count: z.boolean().default(false),
             exclude_ctf: z.boolean().default(true),
             require_bounty: z.boolean().default(true),
             min_wildcards: z.number().int().min(1).max(100).default(1),
+            min_added_24h: z.number().int().min(0).optional(),
+            min_added_7d: z.number().int().min(0).optional(),
+            sort_by: programSortSchema.default("best_hunt_value"),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
             include_target_samples: z.boolean().default(false),
             target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -851,8 +903,8 @@ export function createBbradarServer(client, config) {
         web3: false,
         opportunity_levels: [],
         updated_since: args.updated_since,
-        min_bounty_min: undefined,
-        min_bounty_max: undefined,
+        min_bounty_min: args.min_reward !== undefined && args.reward_threshold_mode === "min_at_least" ? args.min_reward : undefined,
+        min_bounty_max: args.min_reward !== undefined && args.reward_threshold_mode === "max_at_least" ? args.min_reward : undefined,
         max_bounty_max: undefined,
         require_bounty: args.require_bounty,
         max_public_report_count: args.max_public_report_count,
@@ -867,20 +919,21 @@ export function createBbradarServer(client, config) {
         min_wildcards: args.min_wildcards,
         min_eligible_targets: undefined,
         min_total_targets: undefined,
-        min_added_24h: undefined,
-        min_added_7d: undefined,
+        min_added_24h: args.min_added_24h,
+        min_added_7d: args.min_added_7d,
         max_pages: args.max_pages,
         max_results: args.max_results,
-        sort_by: "best_hunt_value",
+        sort_by: args.sort_by,
         include_target_samples: args.include_target_samples,
         target_sample_programs: args.target_sample_programs,
         target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
         target_samples_only_wildcards: true,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_web3_programs", {
+    registerTool("find_web3_programs", {
         title: "Find Web3 Programs",
         description: "Web3/blockchain/smart-contract program shortlist.",
         inputSchema: {
@@ -941,7 +994,7 @@ export function createBbradarServer(client, config) {
         target_samples_only_wildcards: args.min_wildcards > 0,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_reward_programs", {
+    registerTool("find_reward_programs", {
         title: "Find Reward Programs",
         description: "Programs matching reward thresholds.",
         inputSchema: {
@@ -970,7 +1023,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_reward_programs", config, rateLimiter, async () => findRewardPrograms(client, config, args)));
-    server.registerTool("find_web3_contests", {
+    registerTool("find_web3_contests", {
         title: "Find Web3 Contests",
         description: "Web3 contest or competitive audit shortlist.",
         inputSchema: {
@@ -993,7 +1046,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_web3_contests", config, rateLimiter, async () => findWeb3Contests(client, config, args)));
-    server.registerTool("find_language_programs", {
+    registerTool("find_language_programs", {
         title: "Find Language Programs",
         description: "Language-specific program shortlist.",
         inputSchema: {
@@ -1020,7 +1073,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_language_programs", config, rateLimiter, async () => findLanguagePrograms(client, config, args)));
-    server.registerTool("find_target_type_programs", {
+    registerTool("find_target_type_programs", {
         title: "Find Target Type Programs",
         description: "Target-type program shortlist.",
         inputSchema: {
@@ -1046,7 +1099,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_target_type_programs", config, rateLimiter, async () => findTargetTypePrograms(client, config, args)));
-    server.registerTool("find_vdp_programs", {
+    registerTool("find_vdp_programs", {
         title: "Find VDP Programs",
         description: "VDP/disclosure-only/no-bounty program shortlist.",
         inputSchema: {
@@ -1066,7 +1119,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_vdp_programs", config, rateLimiter, async () => findVdpPrograms(client, config, args)));
-    server.registerTool("find_paid_programs", {
+    registerTool("find_paid_programs", {
         title: "Find Paid Programs",
         description: "Paid bounty program shortlist.",
         inputSchema: {
@@ -1089,7 +1142,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_paid_programs", config, rateLimiter, async () => findPaidPrograms(client, config, args)));
-    server.registerTool("find_stack_matches", {
+    registerTool("find_stack_matches", {
         title: "Find Stack Matches",
         description: "Combined stack/language/type/reward shortlist.",
         inputSchema: {
@@ -1119,7 +1172,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_stack_matches", config, rateLimiter, async () => findStackMatches(client, config, args)));
-    server.registerTool("find_low_noise_programs", {
+    registerTool("find_low_noise_programs", {
         title: "Find Low Noise Programs",
         description: "Low-public-report program shortlist.",
         inputSchema: {
@@ -1145,7 +1198,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_low_noise_programs", config, rateLimiter, async () => findLowNoisePrograms(client, config, args)));
-    server.registerTool("find_recent_by_type", {
+    registerTool("find_recent_by_type", {
         title: "Find Recent By Type",
         description: "Recent changes by target type grouped by program.",
         inputSchema: {
@@ -1171,7 +1224,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_recent_by_type", config, rateLimiter, async () => findRecentByType(client, config, args)));
-    server.registerTool("find_programs_by_target", {
+    registerTool("find_programs_by_target", {
         title: "Find Programs By Target",
         description: "Reverse lookup target/domain ownership. Accepts domains, URLs, wildcards, target names, and partial target text.",
         inputSchema: {
@@ -1194,21 +1247,21 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_programs_by_target", config, rateLimiter, async () => findProgramsByTarget(client, config, args)));
-    server.registerTool("find_program_candidates", {
+    registerTool("find_program_candidates", {
         title: "Find BBRadar Program Candidates",
         description: "Start here for broad program discovery. Default ranked hunt-candidate preset with safe filters and compact output.",
         inputSchema: programCandidatePresetInputSchema,
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_program_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
-    server.registerTool("find_hunt_candidates", {
+    registerTool("find_hunt_candidates", {
         title: "Find BBRadar Hunt Candidates",
         description: "Legacy alias for find_program_candidates. Prefer find_program_candidates for new calls.",
         inputSchema: programCandidatePresetInputSchema,
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_hunt_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
-    server.registerTool("find_fresh_hunt_candidates", {
+    registerTool("find_fresh_hunt_candidates", {
         title: "Find Fresh Hunt Candidates",
         description: "Freshness-first hunt shortlist.",
         inputSchema: {
@@ -1277,7 +1330,7 @@ export function createBbradarServer(client, config) {
         output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_recently_updated_programs", {
+    registerTool("find_recently_updated_programs", {
         title: "Find Recently Updated Programs",
         description: "Recently updated program shortlist across all platforms by default. Platform filters are applied only when explicitly provided.",
         inputSchema: {
@@ -1302,7 +1355,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_recently_updated_programs", config, rateLimiter, async () => findRecentlyUpdatedPrograms(client, config, args)));
-    server.registerTool("list_filters", {
+    registerTool("list_filters", {
         title: "List BBRadar Filters",
         description: "Discover observed filter values.",
         inputSchema: {
@@ -1321,7 +1374,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("list_filters", config, rateLimiter, async () => listFilters(client, args)));
-    server.registerTool("get_bbradar_guide", {
+    registerTool("get_bbradar_guide", {
         title: "Get BBRadar Tool Guide",
         description: "Local quick-start guide for choosing BBRadar tools. Call this when the user's request is ambiguous or when a smaller model may need a decision tree.",
         inputSchema: {
@@ -1334,9 +1387,9 @@ export function createBbradarServer(client, config) {
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_bbradar_guide", config, rateLimiter, async () => ({
         request_id: randomUUID(),
-        guide: bbradarGuide(args.topic)
+        guide: bbradarGuide(args.topic, config.toolProfile)
     })));
-    server.registerTool("get_mcp_status", {
+    registerTool("get_mcp_status", {
         title: "Get BBRadar MCP Status",
         description: "Local MCP status and timing metrics.",
         inputSchema: {},
@@ -1355,10 +1408,14 @@ export function createBbradarServer(client, config) {
             web_base_url: config.webBaseUrl,
             response_cache_enabled: config.cacheTtlMs > 0 && config.cacheMaxEntries > 0,
             cache_ttl_ms: config.cacheTtlMs,
+            negative_cache_ttl_ms: config.negativeCacheTtlMs,
             cache_max_entries: config.cacheMaxEntries,
             local_program_index_enabled: false,
             default_rate_limit_per_minute: config.defaultRateLimitPerMinute,
             export_rate_limit_per_minute: config.exportRateLimitPerMinute,
+            max_concurrent_upstream_requests: config.maxConcurrentRequests,
+            compact_tool_text: config.compactToolText,
+            tool_profile: config.toolProfile,
             request_timeout_ms: config.requestTimeoutMs,
             validate_on_startup: config.validateOnStartup,
             transport: "stdio",
@@ -1367,7 +1424,7 @@ export function createBbradarServer(client, config) {
             client: client.diagnostics()
         }
     })));
-    server.registerTool("compare_programs", {
+    registerTool("compare_programs", {
         title: "Compare BBRadar Programs",
         description: "Compare programs.",
         inputSchema: {
@@ -1381,7 +1438,7 @@ export function createBbradarServer(client, config) {
         outputSchema: decisionOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("compare_programs", config, rateLimiter, async () => comparePrograms(client, config, args)));
-    server.registerTool("compare_programs_compact", {
+    registerTool("compare_programs_compact", {
         title: "Compare Programs Compact",
         description: "Compact program comparison.",
         inputSchema: {
@@ -1394,7 +1451,7 @@ export function createBbradarServer(client, config) {
         outputSchema: decisionOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("compare_programs_compact", config, rateLimiter, async () => comparePrograms(client, config, { ...args, output_mode: "compact" })));
-    server.registerTool("summarize_program_activity", {
+    registerTool("summarize_program_activity", {
         title: "Summarize Program Activity",
         description: "Summarize one program's activity.",
         inputSchema: {
@@ -1409,7 +1466,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => summarizeProgramActivity(client, config, programId, args.recent_changes_limit))));
-    server.registerTool("get_program_brief", {
+    registerTool("get_program_brief", {
         title: "Get Program Brief",
         description: "Compact worth-hunting brief for one program.",
         inputSchema: {
@@ -1432,17 +1489,28 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_brief", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramBrief(client, config, { ...args, program_id: programId }))));
-    server.registerTool("find_recently_added_wildcards", {
+    registerTool("find_recently_added_wildcards", {
         title: "Find Recently Added Wildcards",
-        description: "Recently added wildcard programs.",
+        description: "Recently added wildcard programs with platform, minimum reward, and report-count filters. Returns bounded wildcard target samples.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
+            min_added_24h: z.number().int().min(0).optional(),
             min_added_7d: z.number().int().min(1).default(1),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(false),
             require_bounty: z.boolean().default(true),
+            min_wildcards: z.number().int().min(1).max(100).default(1),
+            sort_by: programSortSchema.default("most_new_targets"),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -1456,37 +1524,38 @@ export function createBbradarServer(client, config) {
         web3: false,
         opportunity_levels: [],
         updated_since: undefined,
-        min_bounty_min: undefined,
-        min_bounty_max: undefined,
+        min_bounty_min: args.min_reward !== undefined && args.reward_threshold_mode === "min_at_least" ? args.min_reward : undefined,
+        min_bounty_max: args.min_reward !== undefined && args.reward_threshold_mode === "max_at_least" ? args.min_reward : undefined,
         max_bounty_max: undefined,
         require_bounty: args.require_bounty,
         max_public_report_count: args.max_public_report_count,
-        require_known_report_count: false,
-        include_unknown_report_count: false,
+        require_known_report_count: args.require_known_report_count,
+        include_unknown_report_count: args.include_unknown_report_count,
         exclude_ctf: true,
         exclude_mobile_only: false,
         exclude_non_web: false,
         has_api_scope: false,
         fresh_launch_days: undefined,
-        min_wildcards: 1,
+        min_wildcards: args.min_wildcards,
         min_eligible_targets: undefined,
         min_total_targets: undefined,
-        min_added_24h: undefined,
+        min_added_24h: args.min_added_24h,
         min_added_7d: args.min_added_7d,
         max_pages: args.max_pages,
         max_results: args.max_results,
-        sort_by: "best_hunt_value",
-        include_target_samples: true,
-        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
-        target_sample_size: 5,
+        sort_by: args.sort_by,
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
         target_samples_only_wildcards: true,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_low_competition_high_reward", {
+    registerTool("find_low_competition_high_reward", {
         title: "Find Low Competition High Reward",
-        description: "Legacy low-report high-reward shortlist.",
+        description: "Low-report, high-reward shortlist with optional wildcard and technology filters.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
@@ -1495,6 +1564,7 @@ export function createBbradarServer(client, config) {
             max_public_report_count: z.number().int().min(0).default(10),
             min_bounty_max: z.number().int().min(0).default(5_000),
             min_eligible_targets: z.number().int().min(0).default(1),
+            min_wildcards: z.number().int().min(0).max(100).default(0),
             exclude_ctf: z.boolean().default(true),
             exclude_mobile_only: z.boolean().default(false),
             exclude_non_web: z.boolean().default(false),
@@ -1502,6 +1572,10 @@ export function createBbradarServer(client, config) {
             fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -1527,7 +1601,7 @@ export function createBbradarServer(client, config) {
         exclude_non_web: args.exclude_non_web,
         has_api_scope: args.has_api_scope,
         fresh_launch_days: args.fresh_launch_days,
-        min_wildcards: 0,
+        min_wildcards: args.min_wildcards,
         min_eligible_targets: args.min_eligible_targets,
         min_total_targets: undefined,
         min_added_24h: undefined,
@@ -1535,15 +1609,16 @@ export function createBbradarServer(client, config) {
         max_pages: args.max_pages,
         max_results: args.max_results,
         sort_by: "best_hunt_value",
-        include_target_samples: true,
-        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
-        target_sample_size: 5,
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
-        target_samples_only_wildcards: false,
+        target_samples_only_wildcards: args.min_wildcards > 0,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("get_program_delta", {
+    registerTool("get_program_delta", {
         title: "Get Program Delta",
         description: "Recent target changes for one program.",
         inputSchema: {
@@ -1561,7 +1636,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramDelta(client, config, { ...args, program_id: programId }))));
-    server.registerTool("export_targets", {
+    registerTool("export_targets", {
         title: "Export BBRadar Targets",
         description: `Read-only target export. limit max ${MAX_TARGET_EXPORT}.`,
         inputSchema: {
@@ -1618,11 +1693,14 @@ export function createBbradarServer(client, config) {
             });
         }
     }));
-    registerPrompts(server);
+    registerPrompts(server, config.toolProfile);
     registerResources(server, client, config, exportStore);
     return server;
 }
-function bbradarGuide(topic) {
+function bbradarGuide(topic, profile) {
+    if (profile === "core") {
+        return coreBbradarGuide(topic);
+    }
     const primaryEntryPoints = [
         {
             tool: "find_program_candidates",
@@ -1674,6 +1752,27 @@ function bbradarGuide(topic) {
             first_tool: "find_recently_updated_programs",
             then: "Use get_latest_added_targets for global added targets, or check_program_new_targets when the user names one program."
         },
+        {
+            user_goal: "latest added wildcard targets with platform, reward, or report-count filters",
+            first_tool: "get_latest_added_targets",
+            arguments: {
+                target_type: "wildcard",
+                platforms: ["requested platform"],
+                min_reward: 5000,
+                max_public_report_count: 10,
+                include_full_target_list: false
+            }
+        },
+        {
+            user_goal: "wildcard programs with low report count and good rewards",
+            first_tool: "find_wildcard_programs",
+            arguments: {
+                platforms: ["requested platform"],
+                min_reward: 5000,
+                max_public_report_count: 10,
+                include_target_samples: true
+            }
+        },
         {
             user_goal: "compare a short list",
             first_tool: "compare_programs_compact",
@@ -1691,8 +1790,8 @@ function bbradarGuide(topic) {
         }
     ];
     const advancedTools = {
-        discovery: ["find_stack_matches", "find_language_programs", "find_target_type_programs", "find_reward_programs", "find_paid_programs", "find_web3_contests", "find_low_noise_programs"],
-        freshness: ["find_recently_updated_programs", "find_fresh_hunt_candidates", "get_latest_added_targets", "get_recent_target_activity", "get_program_scope_delta", "check_watchlist_new_targets"],
+        discovery: ["find_wildcard_programs", "find_low_competition_high_reward", "find_stack_matches", "find_language_programs", "find_target_type_programs", "find_reward_programs", "find_paid_programs", "find_web3_contests", "find_low_noise_programs"],
+        freshness: ["find_recently_added_wildcards", "find_recently_updated_programs", "find_fresh_hunt_candidates", "get_latest_added_targets", "get_recent_target_activity", "get_program_scope_delta", "check_watchlist_new_targets"],
         details: ["get_program_brief", "get_program_scope_summary", "get_program_target_breakdown", "find_programs_by_target"],
         exports: ["export_targets"]
     };
@@ -1724,6 +1823,20 @@ function bbradarGuide(topic) {
         {
             user_says: "who owns https://api.example.com/v1/users",
             call: { tool: "find_programs_by_target", arguments: { target_query: "https://api.example.com/v1/users" } }
+        },
+        {
+            user_says: "latest HackerOne wildcard targets with rewards over 5000",
+            call: {
+                tool: "get_latest_added_targets",
+                arguments: { target_type: "wildcard", platforms: ["HackerOne"], min_reward: 5000, include_full_target_list: false }
+            }
+        },
+        {
+            user_says: "wildcard programs with under 10 reports and good rewards",
+            call: {
+                tool: "find_wildcard_programs",
+                arguments: { max_public_report_count: 10, min_reward: 5000, include_target_samples: true }
+            }
         }
     ];
     return {
@@ -1744,6 +1857,67 @@ function bbradarGuide(topic) {
         examples
     };
 }
+function coreBbradarGuide(topic) {
+    const decisionTree = [
+        {
+            user_goal: "find programs to hunt",
+            first_tool: "find_programs",
+            arguments: { max_results: 10, output_mode: "compact" }
+        },
+        {
+            user_goal: "named program summary or action",
+            first_tool: "run_program_name_action",
+            arguments: { query: "program name", action: "brief" }
+        },
+        {
+            user_goal: "named program targets",
+            first_tool: "get_program_eligible_targets_by_name",
+            arguments: { query: "program name", target_list_mode: "identifiers" }
+        },
+        {
+            user_goal: "find which program owns a target",
+            first_tool: "find_programs_by_target",
+            arguments: { target_query: "domain, URL, wildcard, package/repo name, or short target phrase", match_mode: "smart" }
+        },
+        {
+            user_goal: "fresh or recently changed scope",
+            first_tool: "get_recent_changes",
+            then: "Use get_latest_added_targets when only newly added targets are needed."
+        },
+        {
+            user_goal: "export targets",
+            first_tool: "export_targets",
+            then: "Use the returned bbradar://exports resource_uri for the full local export payload."
+        },
+        {
+            user_goal: "unknown filter values",
+            first_tool: "list_filters",
+            then: "Reuse observed platforms, tags, target types, and language tags in find_programs."
+        }
+    ];
+    return {
+        topic,
+        tool_profile: "core",
+        rule_zero: "BBRadar is passive intelligence only. Never scan or contact targets.",
+        defaults: {
+            output_mode: "compact",
+            target_list_mode: "identifiers",
+            target_match_mode: "smart",
+            include_out_of_scope: false,
+            include_ineligible: false,
+            require_bounty: true
+        },
+        primary_entry_points: [
+            "find_programs",
+            "run_program_name_action",
+            "get_program_eligible_targets_by_name",
+            "find_programs_by_target",
+            "get_bbradar_guide"
+        ],
+        decision_tree: decisionTree.filter((entry) => topic === "start" || guideEntryMatchesTopic(topic, entry)),
+        available_tools: [...CORE_TOOL_NAMES]
+    };
+}
 function guideEntryMatchesTopic(topic, entry) {
     const goal = typeof entry.user_goal === "string" ? entry.user_goal : "";
     const firstTool = typeof entry.first_tool === "string" ? entry.first_tool : "";
@@ -3178,13 +3352,26 @@ async function findProgramsByTarget(client, config, input) {
     };
     const sourceRequests = [];
     const matches = [];
+    const directHandleFirst = !queryLooksLikeTargetIdentifier(input.target_query) &&
+        !/\s/.test(input.target_query.trim()) &&
+        looksLikeDirectProgramHandleQuery(input.target_query);
+    if (input.use_api_search && !directHandleFirst) {
+        const directResult = await searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests);
+        if (directResult) {
+            return directResult;
+        }
+    }
     const directHandles = await collectDirectHandlePrograms(client, {
         query: input.target_query,
         platforms: input.platforms,
         budget,
         warnings,
         source: "target_query_program_id_guess",
-        maxProgramIds: queryLooksLikeTargetIdentifier(input.target_query) || looksLikeDirectProgramHandleQuery(input.target_query) ? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS : 4,
+        maxProgramIds: input.use_api_search && directHandleFirst
+            ? 4
+            : queryLooksLikeTargetIdentifier(input.target_query) || looksLikeDirectProgramHandleQuery(input.target_query)
+                ? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS
+                : 4,
         maxHandleVariants: 1,
         stopOnFirstMatch: true
     });
@@ -3204,8 +3391,8 @@ async function findProgramsByTarget(client, config, input) {
             }
         });
     }
-    if (input.use_api_search) {
-        const directResult = await searchProgramsByTargetApi(client, config, input, warnings);
+    if (input.use_api_search && directHandleFirst) {
+        const directResult = await searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests);
         if (directResult) {
             return directResult;
         }
@@ -3310,13 +3497,18 @@ function programsByTargetResult(input, warnings, sourceRequests, matches, budget
         meta: options.meta
     });
 }
-async function searchProgramsByTargetApi(client, config, input, warnings) {
+async function searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests) {
     const searchQueries = targetApiSearchQueries(input.target_query);
     const grouped = new Map();
-    const sourceRequests = [];
     let rawMatchesScanned = 0;
+    let searchQueriesChecked = 0;
     let lastMeta;
     for (const searchQuery of searchQueries) {
+        if (!tryConsumeBudget(budget)) {
+            addUniqueWarning(warnings, "Upstream request budget was exhausted before all target search variants could be checked.");
+            break;
+        }
+        searchQueriesChecked += 1;
         let api;
         try {
             api = await client.searchTargets({
@@ -3329,8 +3521,10 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
                 page: 1,
                 page_size: Math.max(input.max_results * input.max_targets_per_program, input.max_results)
             });
+            refundBudgetIfNoUpstreamRequest(budget, api);
         }
         catch (error) {
+            refundBudgetIfNoUpstreamError(budget, error);
             if (error instanceof BBRadarApiError && (error.status === 404 || error.status === 405)) {
                 warnings.push("Direct target search API is unavailable; fell back to sampled program target lists.");
                 return undefined;
@@ -3371,15 +3565,93 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
                 if (!targetMatchesQuery(target, input.target_query, input.match_mode)) {
                     continue;
                 }
-                const existing = grouped.get(programId) ?? { program: addProgramResourceLinks({ ...program, id: programId }), targets: [] };
-                existing.targets.push(target);
+                const existing = grouped.get(programId) ?? {
+                    program: addProgramResourceLinks({ ...program, id: programId }),
+                    targets: [],
+                    targetKeys: new Set()
+                };
+                const targetKey = stableStringify({
+                    identifier: targetIdentifier(target),
+                    target_type: stringField(target, "target_type")
+                });
+                if (!existing.targetKeys.has(targetKey)) {
+                    existing.targetKeys.add(targetKey);
+                    existing.targets.push(target);
+                }
                 grouped.set(programId, existing);
             }
         }
-        if (grouped.size >= input.max_results) {
+        if (grouped.size >= input.max_results ||
+            (grouped.size > 0 && input.match_mode === "smart")) {
             break;
         }
     }
+    if (grouped.size > 0 && input.match_mode === "smart") {
+        await mapWithConcurrency([...grouped.entries()].slice(0, input.max_results), TARGET_SAMPLE_CONCURRENCY, async ([programId, entry]) => {
+            if (!tryConsumeBudget(budget)) {
+                addUniqueWarning(warnings, "Upstream request budget was exhausted before matched program target lists could be hydrated.");
+                return;
+            }
+            try {
+                const targetsApi = await client.getProgramTargets(programId);
+                refundBudgetIfNoUpstreamRequest(budget, targetsApi);
+                sourceRequests.push({
+                    source: "program_targets",
+                    program_id: programId,
+                    request_id: targetsApi.requestId,
+                    upstream_request_id: targetsApi.upstreamRequestId,
+                    ...apiSourceMetadata(targetsApi)
+                });
+                const targetsData = readObject(targetsApi.data);
+                const hydratedTargets = readArray(targetsData?.targets).map(sanitizeTarget);
+                const hydratedTargetOrder = new Map(hydratedTargets.map((target, index) => [
+                    stableStringify({
+                        identifier: targetIdentifier(target),
+                        target_type: stringField(target, "target_type")
+                    }),
+                    index
+                ]));
+                for (const target of hydratedTargets) {
+                    if (!targetIdentifier(target) ||
+                        !targetHasAllowedScope(target, {
+                            include_out_of_scope: input.include_out_of_scope,
+                            include_ineligible: input.include_ineligible,
+                            strict_scope_filter: false
+                        }) ||
+                        !targetMatchesQuery(target, input.target_query, input.match_mode)) {
+                        continue;
+                    }
+                    const targetKey = stableStringify({
+                        identifier: targetIdentifier(target),
+                        target_type: stringField(target, "target_type")
+                    });
+                    if (!entry.targetKeys.has(targetKey)) {
+                        entry.targetKeys.add(targetKey);
+                        entry.targets.push(target);
+                    }
+                }
+                entry.targets.sort((left, right) => {
+                    const leftKey = stableStringify({
+                        identifier: targetIdentifier(left),
+                        target_type: stringField(left, "target_type")
+                    });
+                    const rightKey = stableStringify({
+                        identifier: targetIdentifier(right),
+                        target_type: stringField(right, "target_type")
+                    });
+                    return ((hydratedTargetOrder.get(leftKey) ?? Number.MAX_SAFE_INTEGER) -
+                        (hydratedTargetOrder.get(rightKey) ?? Number.MAX_SAFE_INTEGER));
+                });
+            }
+            catch (error) {
+                refundBudgetIfNoUpstreamError(budget, error);
+                if (!isProgramNotFoundError(error)) {
+                    throw error;
+                }
+                addUniqueWarning(warnings, `Could not hydrate target matches for ${programId}; returned direct target-search matches only.`);
+            }
+        });
+    }
     const matches = [...grouped.values()].slice(0, input.max_results).map((entry) => stripUndefined({
         program: formatProgram(entry.program, "compact"),
         match_count: entry.targets.length,
@@ -3407,6 +3679,14 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
         },
         matches,
         programs: matches.map((match) => readObject(match.program)).filter((program) => program !== undefined),
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        },
+        ranking_scope: {
+            mode: "target_search_api",
+            possibly_incomplete: grouped.size < input.max_results && searchQueriesChecked < searchQueries.length
+        },
         meta: stripUndefined({
             ...(lastMeta ?? {}),
             returned: matches.length,
@@ -3503,7 +3783,8 @@ async function listFilters(client, input) {
             }
         }
     }
-    catch {
+    catch (error) {
+        refundBudgetIfNoUpstreamError(budget, error);
         // Facets are best-effort; list_filters should still return observed program filters.
     }
     if (input.include_target_facets && input.target_sample_programs > 0) {
@@ -3639,11 +3920,15 @@ async function comparePrograms(client, config, input) {
     });
 }
 async function summarizeProgramActivity(client, config, programId, recentChangesLimit) {
-    const programApi = await client.getProgram(programId);
+    const [programApi, changes] = await Promise.all([
+        client.getProgram(programId),
+        recentChangesLimit > 0
+            ? fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true)
+            : Promise.resolve(undefined)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
     const scopeSummary = readObject(program.scope_summary);
     const targetActivity = readObject(scopeSummary?.target_activity);
-    const changes = recentChangesLimit > 0 ? await fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true) : undefined;
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -3670,12 +3955,14 @@ async function getLatestAddedTargets(client, config, input) {
         include_removed: false,
         include_ineligible: input.include_ineligible,
         include_out_of_scope: input.include_out_of_scope,
+        platforms: input.platforms,
         tags: [input.target_type],
         page: 1,
         page_size: input.recent_changes_page_size
     });
     const recentData = readObject(recentApi.data);
     const changes = readArray(recentData?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const platformFilters = new Set(input.platforms.map(normalizeTag));
     const matchingChanges = changes
         .filter((change) => {
         const target = readObject(change.target);
@@ -3684,6 +3971,7 @@ async function getLatestAddedTargets(client, config, input) {
             programId !== undefined &&
             target !== undefined &&
             targetMatchesRequestedType(target, input.target_type) &&
+            latestAddedProgramMatches(change, input, platformFilters) &&
             targetHasAllowedScope(target, {
                 include_out_of_scope: input.include_out_of_scope,
                 include_ineligible: input.include_ineligible,
@@ -3691,6 +3979,11 @@ async function getLatestAddedTargets(client, config, input) {
             }));
     })
         .sort((left, right) => timestampField(right, "changed_at") - timestampField(left, "changed_at"));
+    const limitedMatches = matchingChanges.slice(0, input.max_results);
+    const matches = limitedMatches.map((change, index) => ({
+        rank: index + 1,
+        ...formatChange(change, "compact")
+    }));
     const latest = matchingChanges[0];
     const sourceRequests = [
         {
@@ -3705,9 +3998,12 @@ async function getLatestAddedTargets(client, config, input) {
             request_id: randomUUID(),
             source_requests: sourceRequests,
             query: latestAddedTargetsQuery(input),
+            matches: [],
             new_targets: [],
             meta: {
                 recent_changes_scanned: changes.length,
+                matching_changes_scanned: 0,
+                matches_returned: 0,
                 no_match: true
             }
         };
@@ -3750,11 +4046,14 @@ async function getLatestAddedTargets(client, config, input) {
         query: latestAddedTargetsQuery(input),
         latest_added_at: latestAddedAt,
         program,
+        matches,
         new_targets: formatTargetList(latestNewTargets, input.full_target_list_mode),
         full_targets: input.include_full_target_list ? formatTargetList(limitedFullTargets, input.full_target_list_mode) : undefined,
         meta: stripUndefined({
             recent_changes_scanned: changes.length,
             matching_changes_scanned: matchingChanges.length,
+            matches_returned: matches.length,
+            matches_has_more: matches.length < matchingChanges.length,
             new_targets_returned: formatTargetList(latestNewTargets, input.full_target_list_mode).length,
             full_targets_total_active: totalActiveTargets,
             full_targets_total_after_filters: totalAfterFilters,
@@ -3763,6 +4062,39 @@ async function getLatestAddedTargets(client, config, input) {
         })
     });
 }
+function latestAddedProgramMatches(change, input, platformFilters) {
+    const rawProgram = readObject(change.program);
+    if (!rawProgram) {
+        return false;
+    }
+    const program = addProgramResourceLinks(rawProgram);
+    const rewardRange = readObject(program.reward_range);
+    const platform = normalizeTag(stringField(program, "platform") ?? "");
+    const bountyMin = numberField(rewardRange, "min");
+    const bountyMax = numberField(rewardRange, "max");
+    const publicReportCount = numberField(program, "public_report_count");
+    if (platformFilters.size > 0 && !platformFilters.has(platform)) {
+        return false;
+    }
+    if (input.min_reward !== undefined) {
+        const reward = input.reward_threshold_mode === "min_at_least" ? bountyMin : bountyMax;
+        if ((reward ?? 0) < input.min_reward) {
+            return false;
+        }
+    }
+    if (input.require_known_report_count && publicReportCount === undefined) {
+        return false;
+    }
+    if (input.max_public_report_count !== undefined) {
+        if (publicReportCount === undefined) {
+            return input.include_unknown_report_count;
+        }
+        if (publicReportCount > input.max_public_report_count) {
+            return false;
+        }
+    }
+    return true;
+}
 async function getProgramTargetsPayload(client, input, programId) {
     const api = await client.getProgramTargets(programId);
     const data = readObject(api.data);
@@ -4319,9 +4651,11 @@ async function getProgramTargetBreakdownFromIndexFallback(client, indexFallback,
     });
 }
 async function getProgramScopeDelta(client, config, input) {
-    const programApi = await client.getProgram(input.program_id);
+    const [programApi, changesPayload] = await Promise.all([
+        client.getProgram(input.program_id),
+        fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed || input.change_type === "removed", input.include_ineligible, input.include_out_of_scope, input.max_targets)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
-    const changesPayload = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed || input.change_type === "removed", input.include_ineligible, input.include_out_of_scope, input.max_targets);
     const filteredChanges = filterProgramScopeDeltaChanges(changesPayload.changes, input);
     const limitedChanges = filteredChanges.slice(0, input.max_targets);
     return stripUndefined({
@@ -4776,9 +5110,11 @@ async function getProgramBrief(client, config, input) {
     });
 }
 async function getProgramDelta(client, config, input) {
-    const programApi = await client.getProgram(input.program_id);
+    const [programApi, changes] = await Promise.all([
+        client.getProgram(input.program_id),
+        fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed, input.include_ineligible, input.include_out_of_scope)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
-    const changes = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed, input.include_ineligible, input.include_out_of_scope);
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -5372,6 +5708,9 @@ function hasHighConfidenceProgramResolutionMatch(programs, webBaseUrl, query) {
     const threshold = looksLikeDirectProgramHandleQuery(query) ? 95 : 85;
     return programs.some((program) => programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score >= threshold);
 }
+function hasViableProgramResolutionMatch(programs, scorePrograms) {
+    return scorePrograms ? scorePrograms(programs) >= 80 : programs.length > 0;
+}
 function bestProgramResolutionScore(programs, webBaseUrl, query) {
     return programs.reduce((best, program) => Math.max(best, programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score), 0);
 }
@@ -5511,7 +5850,13 @@ async function findPrograms(client, config, input) {
         initial: input.upstream_request_budget,
         remaining: input.upstream_request_budget
     };
-    const upstreamTags = uniqueStrings([...input.tags, ...input.scope_tags, ...input.target_types, ...input.language_tags]);
+    const upstreamTags = uniqueStrings([
+        ...input.tags,
+        ...input.scope_tags,
+        ...input.target_types,
+        ...input.language_tags,
+        ...(input.min_wildcards > 0 ? ["wildcard"] : [])
+    ]);
     const collected = await collectPrograms(client, {
         platforms: input.platforms,
         tags: upstreamTags,
@@ -5623,8 +5968,33 @@ async function collectProgramsForResolution(client, options) {
     const collections = [];
     const queryCollections = [];
     const queries = options.searchQueries.length > 0 ? options.searchQueries : [undefined];
+    const fastQueries = queries.slice(0, FAST_RESOLVE_SEARCH_QUERIES);
+    const remainingQueries = queries.slice(FAST_RESOLVE_SEARCH_QUERIES);
     const primaryDirectPlatforms = options.platforms.length > 0 ? options.platforms : PRIMARY_PROGRAM_ID_PLATFORM_GUESSES;
     const primaryDirectProgramIds = new Set(directProgramIdCandidates(options.query, primaryDirectPlatforms, { maxHandleVariants: 1 }));
+    for (const search of fastQueries) {
+        if (options.budget.remaining <= 0) {
+            addUniqueWarning(options.warnings, "Program name search stopped at the request budget; pass a higher upstream_request_budget for a deeper resolution attempt.");
+            break;
+        }
+        const collection = await collectPrograms(client, {
+            search,
+            platforms: options.platforms,
+            tags: options.tags,
+            updated_since: undefined,
+            opportunity_levels: options.opportunity_levels,
+            max_pages: 1,
+            budget: options.budget,
+            warnings: options.warnings
+        });
+        collections.push(collection);
+        queryCollections.push({ search, collection });
+        const merged = mergeProgramCollections(collections);
+        if (options.isHighConfidenceMatch?.(merged.programs) ||
+            hasViableProgramResolutionMatch(merged.programs, options.scorePrograms)) {
+            return merged;
+        }
+    }
     if (primaryDirectProgramIds.size > 0 && options.budget.remaining > 0) {
         const primaryDirectHandles = await collectDirectHandlePrograms(client, {
             query: options.query,
@@ -5644,7 +6014,7 @@ async function collectProgramsForResolution(client, options) {
             return mergeProgramCollections(collections);
         }
     }
-    for (const search of queries) {
+    for (const search of remainingQueries) {
         if (options.budget.remaining <= 0) {
             addUniqueWarning(options.warnings, "Program name search stopped at the request budget; pass a higher upstream_request_budget for a deeper resolution attempt.");
             break;
@@ -5665,7 +6035,9 @@ async function collectProgramsForResolution(client, options) {
             return mergeProgramCollections(collections);
         }
     }
-    if (options.budget.remaining > 0) {
+    const searchedCollection = collections.length > 0 ? mergeProgramCollections(collections) : undefined;
+    if (options.budget.remaining > 0 &&
+        (!searchedCollection || !hasViableProgramResolutionMatch(searchedCollection.programs, options.scorePrograms))) {
         const directHandles = await collectDirectHandlePrograms(client, {
             query: options.query,
             platforms: options.platforms,
@@ -5752,9 +6124,14 @@ async function collectDirectHandlePrograms(client, options) {
     const sourceRequests = [];
     let requestsScanned = 0;
     for (const programId of programIds) {
+        if (!tryConsumeBudget(options.budget)) {
+            addUniqueWarning(options.warnings, "Upstream request budget was exhausted before all direct program handle guesses could be checked.");
+            break;
+        }
         requestsScanned += 1;
         try {
             const targetsApi = await client.getProgramTargets(programId);
+            refundBudgetIfNoUpstreamRequest(options.budget, targetsApi);
             const targetsData = readObject(targetsApi.data);
             const hasTargetsArray = Array.isArray(targetsData?.targets);
             const targets = readArray(targetsData?.targets).map(sanitizeTarget);
@@ -5775,6 +6152,7 @@ async function collectDirectHandlePrograms(client, options) {
             }
         }
         catch (error) {
+            refundBudgetIfNoUpstreamError(options.budget, error);
             if (error instanceof BBRadarApiError && error.status === 404) {
                 sourceRequests.push({
                     source: options.source,
@@ -5782,7 +6160,9 @@ async function collectDirectHandlePrograms(client, options) {
                     program_id: programId,
                     request_id: error.requestId,
                     upstream_request_id: error.upstreamRequestId,
-                    status: error.status
+                    status: error.status,
+                    cache_hit: error.cached,
+                    cache_expires_at: error.cacheExpiresAt
                 });
                 continue;
             }
@@ -6195,7 +6575,8 @@ async function collectTargetSamples(client, candidates, input, budget) {
                 .slice(0, input.target_sample_size);
             samples[programId] = targets;
         }
-        catch {
+        catch (error) {
+            refundBudgetIfNoUpstreamError(budget, error);
             samples[programId] = [];
         }
     });
@@ -6258,6 +6639,11 @@ function refundBudgetIfNoUpstreamRequest(budget, api, cost = 1) {
         budget.remaining = Math.min(budget.initial, budget.remaining + cost);
     }
 }
+function refundBudgetIfNoUpstreamError(budget, error, cost = 1) {
+    if (error instanceof BBRadarApiError && (error.cached || error.coalesced)) {
+        budget.remaining = Math.min(budget.initial, budget.remaining + cost);
+    }
+}
 function addUniqueWarning(warnings, warning) {
     if (warnings && !warnings.includes(warning)) {
         warnings.push(warning);
@@ -6360,7 +6746,12 @@ function readStringArrayField(value, field) {
     const fieldValue = value[field];
     return Array.isArray(fieldValue) ? fieldValue.filter((entry) => typeof entry === "string") : [];
 }
-function registerPrompts(server) {
+function registerPrompts(server, profile) {
+    const discoveryToolInstructions = profile === "core"
+        ? `- Start with find_programs and pass opportunity_levels from the requested value below unless the user asked for a broader search.
+- Express language, target type, reward, Web3, wildcard, VDP, and platform needs through find_programs filters.`
+        : `- Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from the requested value below.
+- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.`;
     server.registerPrompt("find_best_programs_to_hunt", {
         title: "Find Best Programs To Hunt",
         description: "Rank fresh BBRadar program data only. Do not invoke external bug bounty skills unless the user explicitly asks for methodology.",
@@ -6373,8 +6764,8 @@ function registerPrompts(server) {
     }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Treat results as fresh API reads; do not describe them as cached.
 
 Find the best BBRadar program candidates.
-- Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from this JSON array unless the user asked for a broader search: ${promptJson([args.opportunity_level ?? "elite"])}.
-- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
+${discoveryToolInstructions}
+- Use this opportunity level JSON array: ${promptJson([args.opportunity_level ?? "elite"])}.
 - Apply platform filters from this JSON string if provided: ${promptJson(args.platforms ?? "")}.
 - Apply tag filters from this JSON string if provided: ${promptJson(args.tags ?? "")}.
 - Keep the shortlist to this JSON value: ${promptJson(args.max_programs ?? "10")}.
@@ -6434,7 +6825,7 @@ async function runTool(toolName, config, rateLimiter, callback) {
             },
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
-        }, true);
+        }, true, config.compactToolText);
     }
     try {
         const payload = await callback();
@@ -6444,21 +6835,21 @@ async function runTool(toolName, config, rateLimiter, callback) {
             ...payload,
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
-        });
+        }, false, config.compactToolText);
     }
     catch (error) {
         const durationMs = Date.now() - startedAt;
         recordToolMetric(toolName, durationMs, "error");
-        return toolResult(errorPayload(error, decision, toolName, durationMs), true);
+        return toolResult(errorPayload(error, decision, toolName, durationMs), true, config.compactToolText);
     }
 }
-function toolResult(payload, isError = false) {
+function toolResult(payload, isError = false, compactText = false) {
     const resourceLinks = collectResourceLinks(payload);
     return {
         content: [
             {
                 type: "text",
-                text: JSON.stringify(payload)
+                text: compactText ? compactToolText(payload, isError) : JSON.stringify(payload)
             },
             ...resourceLinks
         ],
@@ -6466,6 +6857,28 @@ function toolResult(payload, isError = false) {
         ...(isError ? { isError: true } : {})
     };
 }
+function compactToolText(payload, isError) {
+    if (isError) {
+        return JSON.stringify(stripUndefined({
+            request_id: payload.request_id,
+            error: payload.error,
+            mcp_timing: payload.mcp_timing
+        }));
+    }
+    const meta = readObject(payload.meta);
+    const returned = numberField(meta, "returned") ??
+        [
+            readArray(payload.programs).length,
+            readArray(payload.targets).length,
+            readArray(payload.changes).length
+        ].find((count) => count > 0);
+    return JSON.stringify(stripUndefined({
+        request_id: payload.request_id,
+        summary: "Full tool result is available in structuredContent.",
+        returned,
+        mcp_timing: payload.mcp_timing
+    }));
+}
 function promptResult(text) {
     return {
         messages: [
@@ -6605,18 +7018,25 @@ function compactRecord(values) {
     }));
 }
 function latestAddedTargetsQuery(input) {
-    return {
+    return stripUndefined({
         change_type: "added",
         target_type: input.target_type,
+        platforms: input.platforms.length > 0 ? input.platforms : undefined,
+        min_reward: input.min_reward,
+        reward_threshold_mode: input.reward_threshold_mode,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: input.require_known_report_count,
+        include_unknown_report_count: input.include_unknown_report_count,
         include_out_of_scope: input.include_out_of_scope,
         include_ineligible: input.include_ineligible,
         recent_changes_page_size: input.recent_changes_page_size,
+        max_results: input.max_results,
         include_full_target_list: input.include_full_target_list,
         full_target_list_mode: input.full_target_list_mode,
         full_target_limit: input.full_target_limit,
         full_list_include_out_of_scope: input.full_list_include_out_of_scope,
         full_list_include_ineligible: input.full_list_include_ineligible
-    };
+    });
 }
 function formatTargetList(targets, mode) {
     if (mode === "identifiers") {