@bbradar/mcp 0.1.19 → 0.2.0

package/dist/server.js

@@ -1,11 +1,12 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BBRadarApiError } from "./bbradarClient.js";
+import { NumericCursorStore } from "./cursorStore.js";
 import { stableStringify, stripUndefined } from "./json.js";
 import { FixedWindowRateLimiter } from "./rateLimit.js";
-import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
-const SERVER_VERSION = "0.1.0";
+import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeRepositoryChange, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
+const SERVER_VERSION = "0.2.0";
 const MAX_PROGRAMS_PER_SEARCH = 100;
 const MAX_TARGET_EXPORT = 500;
 const MAX_RECENT_CHANGES = 100;
@@ -20,7 +21,7 @@ const MAX_FIND_TARGET_SAMPLE_PROGRAMS = 10;
 const MAX_FIND_TARGET_SAMPLES = 20;
 const MAX_FIND_UPSTREAM_REQUEST_BUDGET = 50;
 const DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET = 20;
-const DEFAULT_RESOLVE_UPSTREAM_REQUEST_BUDGET = 4;
+const DEFAULT_RESOLVE_UPSTREAM_REQUEST_BUDGET = 12;
 const MAX_ACCEPTED_NUMERIC_LIMIT = 1_000;
 const PROGRAM_COLLECTION_CONCURRENCY = 4;
 const TARGET_SAMPLE_CONCURRENCY = 3;
@@ -29,13 +30,40 @@ const MAX_FILTER_DISCOVERY_PAGES = 5;
 const DEFAULT_FILTER_TARGET_SAMPLE_PROGRAMS = 10;
 const MAX_FILTER_TARGET_SAMPLE_PROGRAMS = 25;
 const MAX_LOCAL_EXPORT_RESOURCES = 25;
+const MAX_LOCAL_EXPORT_BYTES = 64 * 1024 * 1024;
+const LOCAL_EXPORT_TTL_MS = 10 * 60 * 1000;
 const EXPORT_PREVIEW_LIMIT = 25;
 const STALE_PROGRAM_ID_RESOLVE_PAGES = 1;
-const STALE_PROGRAM_ID_RESOLVE_BUDGET = 8;
+const STALE_PROGRAM_ID_RESOLVE_BUDGET = 12;
 const PROGRAM_FALLBACK_CACHE_MAX_ENTRIES = 200;
+const MAX_IN_MEMORY_FEED_CURSORS = 500;
 const MAX_RESOLVE_SEARCH_QUERIES = 4;
+const FAST_RESOLVE_SEARCH_QUERIES = 2;
 const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 96;
 const SDK_VERSION = "1.29.0";
+const CORE_TOOL_NAMES = new Set([
+    "search_programs",
+    "get_program",
+    "resolve_program",
+    "run_program_name_action",
+    "get_program_eligible_targets_by_name",
+    "get_program_targets",
+    "get_recent_changes",
+    "get_repository_changes",
+    "get_latest_added_targets",
+    "get_opportunities",
+    "find_programs",
+    "find_programs_by_target",
+    "list_filters",
+    "get_bbradar_guide",
+    "get_mcp_status",
+    "export_targets"
+]);
+const TOOL_ENDPOINT_REQUIREMENTS = {
+    get_repository_changes: "repository_changes",
+    export_targets: "target_export",
+    get_opportunities: "opportunities"
+};
 const PROGRAM_ID_PLATFORM_GUESSES = [
     "HackerOne",
     "BugCrowd",
@@ -141,6 +169,7 @@ const TARGET_QUERY_STOP_WORDS = new Set([
 ]);
 const targetListModeSchema = z.enum(["identifiers", "compact", "full"]);
 const changeListModeSchema = z.enum(["compact", "full"]);
+const repositoryChangeListModeSchema = z.enum(["compact", "full"]);
 const programListModeSchema = z.enum(["compact", "full"]);
 const rewardThresholdModeSchema = z.enum(["max_at_least", "min_at_least"]);
 const vdpModeSchema = z.enum(["include", "exclude", "only_likely", "only_known_no_bounty"]);
@@ -209,6 +238,8 @@ const pageSchema = z.number().int().min(1).default(1);
 const programsPageSizeSchema = z.number().int().min(1).max(MAX_PROGRAMS_PER_SEARCH).default(20);
 const recentChangesPageSizeSchema = z.number().int().min(1).max(MAX_RECENT_CHANGES).default(50);
 const opportunityLevelSchema = z.enum(["elite", "hot", "strong", "potential"]);
+const targetOpportunityLabelSchema = z.enum(["Elite Target", "Strong Target", "Potential Target", "Normal"]);
+const competitionRiskSchema = z.enum(["Low", "Medium", "High", "Unknown"]);
 const programSortSchema = z
     .enum([
     "best_match",
@@ -260,6 +291,7 @@ function toolTimingOutputSchema() {
 function cacheOutputSchema() {
     return z.object({
         hit: z.boolean(),
+        stale_while_revalidate: z.boolean().optional(),
         coalesced_live_request: z.boolean().optional(),
         expires_at: z.string().optional()
     });
@@ -346,12 +378,28 @@ const programCandidatePresetInputSchema = {
     output_mode: programListModeSchema.default("compact"),
     upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
 };
+function createProfiledToolRegistrar(server, profile, client) {
+    return (name, toolConfig, callback) => {
+        const registeredTool = server.registerTool(name, toolConfig, callback);
+        const requiredEndpoint = TOOL_ENDPOINT_REQUIREMENTS[name];
+        if ((profile === "core" && !CORE_TOOL_NAMES.has(name)) ||
+            (requiredEndpoint !== undefined && !client.supportsEndpoint(requiredEndpoint))) {
+            registeredTool.disable();
+        }
+        return registeredTool;
+    };
+}
 export function createBbradarServer(client, config) {
-    const server = new McpServer({
-        name: "bbradar.io",
-        version: SERVER_VERSION
-    }, {
-        instructions: [
+    const instructions = config.toolProfile === "core"
+        ? [
+            "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
+            "This server uses the compact core tool profile. Start with get_bbradar_guide when unsure.",
+            "Use resolve_program or run_program_name_action for a named program.",
+            "Use find_programs for general discovery and find_programs_by_target for reverse target lookup.",
+            "Default to bounty-eligible in-scope data unless the user explicitly requests broader results.",
+            "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
+        ]
+        : [
             "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
             "When unsure which BBRadar tool to use, call get_bbradar_guide first. It is local-only and cheap.",
             "Simple default path: find_program_candidates for discovery, run_program_name_action for one named program, get_program_eligible_targets_by_name for target lists by program name.",
@@ -359,18 +407,39 @@ export function createBbradarServer(client, config) {
             "Partial program name + action: run_program_name_action. Partial program name only: resolve_program.",
             "Default to bounty-eligible in-scope data. Include out-of-scope, ineligible, VDP, disclosure-only, or no-bounty data only when the user explicitly asks.",
             "Recently updated programs across platforms: find_recently_updated_programs. Do not infer a platform such as Immunefi unless the user explicitly names it.",
+            "Self-Hosted programs use Self-Hosted:slug ids and are available through program search, exact detail, and target tools. Respect data_capabilities; do not infer missing opportunity, report-count, target-change, submission-cost, or repository signals.",
             "Freshness: find_recently_updated_programs, get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
-            "Discovery: find_program_candidates, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
+            "Repository activity: get_repository_changes defaults to compact program-only events. Seed with after_id, then resume the in-memory per-filter cursor.",
+            "Discovery: find_program_candidates, find_wildcard_programs, find_recently_added_wildcards, find_low_competition_high_reward, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
-        ].join("\n")
+        ];
+    const server = new McpServer({
+        name: "bbradar.io",
+        version: SERVER_VERSION
+    }, {
+        instructions: instructions.join("\n")
     });
+    const registerTool = createProfiledToolRegistrar(server, config.toolProfile, client);
     const rateLimiter = new FixedWindowRateLimiter();
     const exportStore = new Map();
-    server.registerTool("search_programs", {
+    const continuationStore = new Map();
+    const feedCursorStore = new NumericCursorStore(config.cursorStatePath, MAX_IN_MEMORY_FEED_CURSORS);
+    const maxProgramsPageSize = client.endpointNumber("programs", "max_page_size", MAX_PROGRAMS_PER_SEARCH);
+    const maxProgramTargetsPageSize = client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM);
+    const maxTargetChangesPageSize = client.endpointNumber("target_changes", "max_page_size", MAX_RECENT_CHANGES);
+    const maxRepositoryChangesPageSize = client.endpointNumber("repository_changes", "max_page_size", MAX_RECENT_CHANGES);
+    const maxTargetExport = client.endpointNumber("target_export", "max_targets", MAX_TARGET_EXPORT);
+    const maxTargetExportProgramIds = client.endpointNumber("target_export", "max_program_ids", 50);
+    const programsPageSizeSchema = z.number().int().min(1).max(maxProgramsPageSize).default(Math.min(20, maxProgramsPageSize));
+    const recentChangesPageSizeSchema = z.number().int().min(1).max(maxTargetChangesPageSize).default(Math.min(50, maxTargetChangesPageSize));
+    const repositoryChangesPageSizeSchema = z.number().int().min(1).max(maxRepositoryChangesPageSize).default(Math.min(50, maxRepositoryChangesPageSize));
+    const acceptedTargetLimitSchema = z.number().int().min(1).max(maxProgramTargetsPageSize);
+    registerTool("search_programs", {
         title: "Search BBRadar Programs",
-        description: `List active programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
+        description: `Search or list active platform and Self-Hosted programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
+            search: searchTextSchema.optional().describe("Server-side program name, handle, platform, policy-host, or target search."),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
@@ -393,7 +462,7 @@ export function createBbradarServer(client, config) {
             meta: sanitizeJson(data?.meta)
         });
     }));
-    server.registerTool("get_program", {
+    registerTool("get_program", {
         title: "Get BBRadar Program",
         description: "Get one program by platform:handle program_id, handle, or human program name. Names are resolved automatically when unambiguous.",
         inputSchema: {
@@ -429,7 +498,7 @@ export function createBbradarServer(client, config) {
             }
         }));
     }));
-    server.registerTool("resolve_program", {
+    registerTool("resolve_program", {
         title: "Resolve Program",
         description: "Resolve partial name/handle text to likely program_ids. Use this when the user gives a program name fragment like Nado.",
         inputSchema: {
@@ -453,7 +522,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("resolve_program", config, rateLimiter, async () => resolveProgram(client, config, args)));
-    server.registerTool("run_program_name_action", {
+    registerTool("run_program_name_action", {
         title: "Run Program Name Action",
         description: "Start here for one named program. Resolves a partial program name, then runs targets, new_targets, scope_delta, brief, or target_breakdown.",
         inputSchema: {
@@ -467,8 +536,8 @@ export function createBbradarServer(client, config) {
             language_tags: languageTagListSchema(),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(25),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(25, maxProgramTargetsPageSize)),
             group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
             target_list_mode: targetListModeSchema.default("identifiers"),
             max_resolve_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
@@ -487,7 +556,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("run_program_name_action", config, rateLimiter, async () => runProgramNameAction(client, config, args)));
-    server.registerTool("get_program_eligible_targets_by_name", {
+    registerTool("get_program_eligible_targets_by_name", {
         title: "Get Eligible Targets By Program Name",
         description: "Fast one-call path for user asks like 'find in-scope eligible targets for Aztec': resolve the program name, fetch targets, and return filtered in-scope bounty-eligible targets. Prefer this over separate resolve_program + get_program_targets calls when the user asks for a target list by name.",
         inputSchema: {
@@ -511,6 +580,7 @@ export function createBbradarServer(client, config) {
             resolved_program: jsonRecordSchema().optional(),
             program_id: z.string().optional(),
             targets: z.array(z.unknown()).optional(),
+            continuation: jsonRecordSchema().optional(),
             warnings: z.array(z.string()).optional(),
             upstream_budget: jsonRecordSchema().optional(),
             ranking_scope: jsonRecordSchema().optional(),
@@ -518,16 +588,21 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_eligible_targets_by_name", config, rateLimiter, async () => getProgramEligibleTargetsByName(client, config, args)));
-    server.registerTool("get_program_targets", {
+    registerTool("get_program_targets", {
         title: "Get Program Targets",
-        description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${MAX_TARGETS_PER_PROGRAM}.`,
+        description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${maxProgramTargetsPageSize}.`,
         inputSchema: {
             program_id: programIdentifierSchema,
+            search: searchTextSchema.optional(),
+            target_type: filterValueSchema().optional(),
+            min_target_score: z.number().int().min(0).max(100).optional(),
+            target_opportunity_label: targetOpportunityLabelSchema.optional(),
+            competition_risk: competitionRiskSchema.optional(),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             strict_scope_filter: z.boolean().default(true),
             offset: z.number().int().min(0).default(0),
-            limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
+            limit: z.number().int().min(1).max(maxProgramTargetsPageSize).default(Math.min(100, maxProgramTargetsPageSize)),
             output_mode: targetListModeSchema.default("compact")
         },
         outputSchema: {
@@ -538,13 +613,21 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
-        return runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
+        const payload = await runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
+        return applyCollectionContinuation(payload, "targets", "program targets", continuationStore, config);
     }));
-    server.registerTool("get_recent_changes", {
+    registerTool("get_recent_changes", {
         title: "Get Recent Target Changes",
         description: `List recent target changes. page_size max ${MAX_RECENT_CHANGES}.`,
         inputSchema: {
             change_type: z.enum(["added", "updated", "removed"]).optional(),
+            after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns changes after this id in ascending order."),
+            resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
+            max_cursor_pages: z.number().int().min(1).max(10).default(2),
+            cursor_time_budget_ms: z.number().int().min(100).max(10_000).default(3_000),
+            min_target_score: z.number().int().min(0).max(100).optional(),
+            target_opportunity_label: targetOpportunityLabelSchema.optional(),
+            competition_risk: competitionRiskSchema.optional(),
             include_removed: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             include_out_of_scope: z.boolean().default(false),
@@ -559,35 +642,119 @@ export function createBbradarServer(client, config) {
             ...apiEnvelopeOutputShape(),
             changes: z.array(jsonRecordSchema()).optional(),
             meta: jsonRecordSchema().optional(),
-            facets: jsonRecordSchema().optional()
+            facets: jsonRecordSchema().optional(),
+            cursor: jsonRecordSchema().optional(),
+            continuation: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_recent_changes", config, rateLimiter, async () => {
-        const { output_mode, ...filters } = args;
-        const api = await client.getRecentChanges(toQuery(filters));
-        const data = readObject(api.data);
+        const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
+        const cursor = resolveFeedCursor(feedCursorStore, "target_changes", filters, resume_cursor);
+        const { min_target_score, target_opportunity_label, competition_risk, ...upstreamFilters } = filters;
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRecentChanges(toQuery({
+            ...upstreamFilters,
+            minTargetScore: min_target_score,
+            targetOpportunityLabel: target_opportunity_label,
+            competitionRisk: competition_risk,
+            after_id: afterId,
+            page: afterId === undefined ? filters.page : 1
+        })));
+        const api = collected.lastApi;
+        const data = collected.lastData;
         const sanitizedMeta = readObject(sanitizeJson(data?.meta));
-        const changes = readArray(data?.results)
+        const changes = collected.results
             .map((change) => sanitizeChange(change, config.webBaseUrl))
             .map((change) => formatChange(change, output_mode));
-        return withApiMetadata(api, {
+        return applyCollectionContinuation(withApiMetadata(api, {
             changes,
             meta: stripUndefined({
                 ...(sanitizedMeta ?? {}),
-                output_mode
+                output_mode,
+                pages_fetched: collected.pagesFetched,
+                returned_across_pages: changes.length,
+                cursor_page_budget_exhausted: collected.pageBudgetExhausted,
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted
             }),
-            facets: sanitizeJson(data?.facets)
-        });
+            facets: sanitizeJson(data?.facets),
+            cursor: collected.cursor,
+            source_requests: collected.sourceRequests.length > 1 ? collected.sourceRequests : undefined
+        }), "changes", "target changes", continuationStore, config);
+    }));
+    registerTool("get_repository_changes", {
+        title: "Get Repository Changes",
+        description: "Read-only repository push/change feed. Defaults to lightweight program summaries; use after_id for efficient incremental polling. For rewarded Web3 repository targets, call this in parallel with find_programs using the same platforms, then intersect event program ids with the ranked rewarded programs.",
+        inputSchema: {
+            after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns events after this id in ascending order."),
+            resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
+            max_cursor_pages: z.number().int().min(1).max(10).default(2),
+            cursor_time_budget_ms: z.number().int().min(100).max(10_000).default(3_000),
+            include_targets: z.boolean().default(false).describe("Include matched targets. False is faster and returns affected programs only."),
+            search: searchTextSchema.optional(),
+            platforms: platformListSchema(),
+            tags: tagListSchema(),
+            free_submission_only: z.boolean().default(false),
+            include_removed: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            include_out_of_scope: z.boolean().default(false),
+            page: pageSchema,
+            page_size: repositoryChangesPageSizeSchema,
+            output_mode: repositoryChangeListModeSchema.default("compact")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape(),
+            repository_changes: z.array(jsonRecordSchema()).optional(),
+            meta: jsonRecordSchema().optional(),
+            facets: jsonRecordSchema().optional(),
+            available_facets: jsonRecordSchema().optional(),
+            cursor: jsonRecordSchema().optional(),
+            continuation: jsonRecordSchema().optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_repository_changes", config, rateLimiter, async () => {
+        if (!client.supportsEndpoint("repository_changes")) {
+            throw new Error("The negotiated BBRadar API contract does not expose repository changes.");
+        }
+        const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
+        const cursor = resolveFeedCursor(feedCursorStore, "repository_changes", filters, resume_cursor);
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRepositoryChanges(toQuery({
+            ...filters,
+            after_id: afterId,
+            page: afterId === undefined ? filters.page : 1
+        })));
+        const api = collected.lastApi;
+        const data = collected.lastData;
+        return applyCollectionContinuation(withApiMetadata(api, {
+            repository_changes: collected.results.map((change) => sanitizeRepositoryChange(change, config.webBaseUrl)).map((change) => formatRepositoryChange(change, output_mode)),
+            meta: stripUndefined({
+                ...(readObject(sanitizeJson(data?.meta)) ?? {}),
+                output_mode,
+                pages_fetched: collected.pagesFetched,
+                returned_across_pages: collected.results.length,
+                cursor_page_budget_exhausted: collected.pageBudgetExhausted,
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted
+            }),
+            facets: sanitizeJson(data?.facets),
+            available_facets: sanitizeJson(data?.available_facets),
+            cursor: collected.cursor,
+            source_requests: collected.sourceRequests.length > 1 ? collected.sourceRequests : undefined
+        }), "repository_changes", "repository changes", continuationStore, config);
     }));
-    server.registerTool("get_latest_added_targets", {
+    registerTool("get_latest_added_targets", {
         title: "Get Latest Added Targets",
-        description: "Latest added targets by type, optionally with that program's target list.",
+        description: "Latest added targets by type with optional platform, reward, and report-count filters. For fast wildcard discovery use target_type=wildcard and include_full_target_list=false.",
         inputSchema: {
             target_type: filterValueSchema().default("domain"),
+            platforms: platformListSchema(),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false).describe("Include out-of-scope."),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
-            recent_changes_page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            include_full_target_list: z.boolean().default(true),
+            recent_changes_page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_results: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(10),
+            include_full_target_list: z.boolean().default(true).describe("Fetch the newest matching program's complete target list. Set false for the fastest cross-program discovery."),
             full_target_list_mode: targetListModeSchema.default("identifiers"),
             full_target_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
             full_list_include_out_of_scope: z.boolean().default(false),
@@ -599,13 +766,14 @@ export function createBbradarServer(client, config) {
             query: jsonRecordSchema().optional(),
             latest_added_at: z.string().optional(),
             program: programOutputSchema().optional(),
+            matches: z.array(jsonRecordSchema()).optional(),
             new_targets: z.array(z.unknown()).optional(),
             full_targets: z.array(z.unknown()).optional(),
             meta: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_latest_added_targets", config, rateLimiter, async () => getLatestAddedTargets(client, config, args)));
-    server.registerTool("get_program_scope_summary", {
+    registerTool("get_program_scope_summary", {
         title: "Get Program Scope Summary",
         description: "Grouped compact scope for one program.",
         inputSchema: {
@@ -624,7 +792,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeSummary(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeSummaryFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
-    server.registerTool("get_program_target_breakdown", {
+    registerTool("get_program_target_breakdown", {
         title: "Get Program Target Breakdown",
         description: "Target type, scope tag, language tag, and bucket counts for one program.",
         inputSchema: {
@@ -643,7 +811,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramTargetBreakdown(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramTargetBreakdownFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
-    server.registerTool("get_program_scope_delta", {
+    registerTool("get_program_scope_delta", {
         title: "Get Program Scope Delta",
         description: "Compact recent scope changes for one program.",
         inputSchema: {
@@ -655,8 +823,8 @@ export function createBbradarServer(client, config) {
             include_removed: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(50),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(50, maxProgramTargetsPageSize)),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
         outputSchema: {
@@ -669,7 +837,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_scope_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeDelta(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeDeltaFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
-    server.registerTool("get_recent_target_activity", {
+    registerTool("get_recent_target_activity", {
         title: "Get Recent Target Activity",
         description: "Recent target changes grouped by program.",
         inputSchema: {
@@ -682,7 +850,7 @@ export function createBbradarServer(client, config) {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             language_tags: languageTagListSchema(),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_programs: z.number().int().min(1).max(50).default(10),
             sample_size: z.number().int().min(1).max(20).default(5),
             target_list_mode: targetListModeSchema.default("identifiers")
@@ -695,7 +863,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_recent_target_activity", config, rateLimiter, async () => getRecentTargetActivity(client, config, args)));
-    server.registerTool("check_program_new_targets", {
+    registerTool("check_program_new_targets", {
         title: "Check Program New Targets",
         description: "Yes/no new in-scope targets for one program.",
         inputSchema: {
@@ -703,8 +871,8 @@ export function createBbradarServer(client, config) {
             since: isoDateTimeSchema.optional().describe("ISO datetime."),
             target_type: filterValueSchema().optional(),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(25),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(25, maxProgramTargetsPageSize)),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
         outputSchema: {
@@ -720,7 +888,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => checkProgramNewTargets(client, config, { ...args, program_id: programId }), (indexFallback) => checkProgramNewTargetsFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
-    server.registerTool("check_watchlist_new_targets", {
+    registerTool("check_watchlist_new_targets", {
         title: "Check Watchlist New Targets",
         description: "New in-scope targets across many known program_ids.",
         inputSchema: {
@@ -728,7 +896,7 @@ export function createBbradarServer(client, config) {
             since: isoDateTimeSchema.optional(),
             target_type: filterValueSchema().optional(),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_targets_per_program: z.number().int().min(1).max(50).default(10),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
@@ -741,7 +909,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("check_watchlist_new_targets", config, rateLimiter, async () => checkWatchlistNewTargets(client, config, args)));
-    server.registerTool("get_opportunities", {
+    registerTool("get_opportunities", {
         title: "Get BBRadar Opportunities",
         description: `List programs in one opportunity tier. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
@@ -772,16 +940,18 @@ export function createBbradarServer(client, config) {
             meta: sanitizeJson(data?.meta)
         });
     }));
-    server.registerTool("find_programs", {
+    registerTool("find_programs", {
         title: "Find BBRadar Programs",
-        description: "Ranked program discovery with filters and compact output.",
+        description: "Ranked program discovery with positive and negative platform/surface filters and compact output. Strict-filter retries reuse cached upstream pages, so relax one local filter at a time when a narrow query returns no candidates.",
         inputSchema: {
             platforms: platformListSchema(),
+            exclude_platforms: stringListSchema("Platforms to exclude after retrieval. Use list_filters first when the user asks for a geographic/platform exclusion without naming exact platform values."),
             tags: tagListSchema(),
             scope_tags: scopeTagListSchema(),
             target_types: targetTypeListSchema(),
             language_tags: languageTagListSchema(),
             web3: z.boolean().default(false).describe("Require Web3 signals."),
+            exclude_web3: z.boolean().default(false).describe("Exclude programs with Web3, blockchain, smart-contract, crypto, DeFi, NFT, Solidity, Ethereum, or Solana signals. Use this for Web2-only discovery."),
             opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
             updated_since: isoDateTimeSchema.optional(),
             min_bounty_min: z.number().int().min(0).optional(),
@@ -820,24 +990,30 @@ export function createBbradarServer(client, config) {
         ...args,
         target_samples_only_wildcards: args.min_wildcards > 0
     })));
-    server.registerTool("find_wildcard_programs", {
+    registerTool("find_wildcard_programs", {
         title: "Find Wildcard Programs",
-        description: "Wildcard program shortlist.",
+        description: "Wildcard program shortlist with platform, minimum reward, freshness, and report-count filters.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional(),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             max_public_report_count: z.number().int().min(0).default(25),
             require_known_report_count: z.boolean().default(true),
             include_unknown_report_count: z.boolean().default(false),
             exclude_ctf: z.boolean().default(true),
             require_bounty: z.boolean().default(true),
             min_wildcards: z.number().int().min(1).max(100).default(1),
+            min_added_24h: z.number().int().min(0).optional(),
+            min_added_7d: z.number().int().min(0).optional(),
+            sort_by: programSortSchema.default("best_hunt_value"),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
             include_target_samples: z.boolean().default(false),
             target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -851,8 +1027,8 @@ export function createBbradarServer(client, config) {
         web3: false,
         opportunity_levels: [],
         updated_since: args.updated_since,
-        min_bounty_min: undefined,
-        min_bounty_max: undefined,
+        min_bounty_min: args.min_reward !== undefined && args.reward_threshold_mode === "min_at_least" ? args.min_reward : undefined,
+        min_bounty_max: args.min_reward !== undefined && args.reward_threshold_mode === "max_at_least" ? args.min_reward : undefined,
         max_bounty_max: undefined,
         require_bounty: args.require_bounty,
         max_public_report_count: args.max_public_report_count,
@@ -867,20 +1043,21 @@ export function createBbradarServer(client, config) {
         min_wildcards: args.min_wildcards,
         min_eligible_targets: undefined,
         min_total_targets: undefined,
-        min_added_24h: undefined,
-        min_added_7d: undefined,
+        min_added_24h: args.min_added_24h,
+        min_added_7d: args.min_added_7d,
         max_pages: args.max_pages,
         max_results: args.max_results,
-        sort_by: "best_hunt_value",
+        sort_by: args.sort_by,
         include_target_samples: args.include_target_samples,
         target_sample_programs: args.target_sample_programs,
         target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
         target_samples_only_wildcards: true,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_web3_programs", {
+    registerTool("find_web3_programs", {
         title: "Find Web3 Programs",
         description: "Web3/blockchain/smart-contract program shortlist.",
         inputSchema: {
@@ -941,7 +1118,7 @@ export function createBbradarServer(client, config) {
         target_samples_only_wildcards: args.min_wildcards > 0,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_reward_programs", {
+    registerTool("find_reward_programs", {
         title: "Find Reward Programs",
         description: "Programs matching reward thresholds.",
         inputSchema: {
@@ -970,7 +1147,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_reward_programs", config, rateLimiter, async () => findRewardPrograms(client, config, args)));
-    server.registerTool("find_web3_contests", {
+    registerTool("find_web3_contests", {
         title: "Find Web3 Contests",
         description: "Web3 contest or competitive audit shortlist.",
         inputSchema: {
@@ -993,7 +1170,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_web3_contests", config, rateLimiter, async () => findWeb3Contests(client, config, args)));
-    server.registerTool("find_language_programs", {
+    registerTool("find_language_programs", {
         title: "Find Language Programs",
         description: "Language-specific program shortlist.",
         inputSchema: {
@@ -1020,7 +1197,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_language_programs", config, rateLimiter, async () => findLanguagePrograms(client, config, args)));
-    server.registerTool("find_target_type_programs", {
+    registerTool("find_target_type_programs", {
         title: "Find Target Type Programs",
         description: "Target-type program shortlist.",
         inputSchema: {
@@ -1046,7 +1223,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_target_type_programs", config, rateLimiter, async () => findTargetTypePrograms(client, config, args)));
-    server.registerTool("find_vdp_programs", {
+    registerTool("find_vdp_programs", {
         title: "Find VDP Programs",
         description: "VDP/disclosure-only/no-bounty program shortlist.",
         inputSchema: {
@@ -1066,7 +1243,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_vdp_programs", config, rateLimiter, async () => findVdpPrograms(client, config, args)));
-    server.registerTool("find_paid_programs", {
+    registerTool("find_paid_programs", {
         title: "Find Paid Programs",
         description: "Paid bounty program shortlist.",
         inputSchema: {
@@ -1089,7 +1266,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_paid_programs", config, rateLimiter, async () => findPaidPrograms(client, config, args)));
-    server.registerTool("find_stack_matches", {
+    registerTool("find_stack_matches", {
         title: "Find Stack Matches",
         description: "Combined stack/language/type/reward shortlist.",
         inputSchema: {
@@ -1119,7 +1296,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_stack_matches", config, rateLimiter, async () => findStackMatches(client, config, args)));
-    server.registerTool("find_low_noise_programs", {
+    registerTool("find_low_noise_programs", {
         title: "Find Low Noise Programs",
         description: "Low-public-report program shortlist.",
         inputSchema: {
@@ -1145,7 +1322,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_low_noise_programs", config, rateLimiter, async () => findLowNoisePrograms(client, config, args)));
-    server.registerTool("find_recent_by_type", {
+    registerTool("find_recent_by_type", {
         title: "Find Recent By Type",
         description: "Recent changes by target type grouped by program.",
         inputSchema: {
@@ -1158,7 +1335,7 @@ export function createBbradarServer(client, config) {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             language_tags: languageTagListSchema(),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_programs: z.number().int().min(1).max(50).default(10),
             sample_size: z.number().int().min(1).max(20).default(5),
             target_list_mode: targetListModeSchema.default("identifiers")
@@ -1171,7 +1348,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_recent_by_type", config, rateLimiter, async () => findRecentByType(client, config, args)));
-    server.registerTool("find_programs_by_target", {
+    registerTool("find_programs_by_target", {
         title: "Find Programs By Target",
         description: "Reverse lookup target/domain ownership. Accepts domains, URLs, wildcards, target names, and partial target text.",
         inputSchema: {
@@ -1194,21 +1371,21 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_programs_by_target", config, rateLimiter, async () => findProgramsByTarget(client, config, args)));
-    server.registerTool("find_program_candidates", {
+    registerTool("find_program_candidates", {
         title: "Find BBRadar Program Candidates",
         description: "Start here for broad program discovery. Default ranked hunt-candidate preset with safe filters and compact output.",
         inputSchema: programCandidatePresetInputSchema,
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_program_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
-    server.registerTool("find_hunt_candidates", {
+    registerTool("find_hunt_candidates", {
         title: "Find BBRadar Hunt Candidates",
         description: "Legacy alias for find_program_candidates. Prefer find_program_candidates for new calls.",
         inputSchema: programCandidatePresetInputSchema,
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_hunt_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
-    server.registerTool("find_fresh_hunt_candidates", {
+    registerTool("find_fresh_hunt_candidates", {
         title: "Find Fresh Hunt Candidates",
         description: "Freshness-first hunt shortlist.",
         inputSchema: {
@@ -1277,7 +1454,7 @@ export function createBbradarServer(client, config) {
         output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_recently_updated_programs", {
+    registerTool("find_recently_updated_programs", {
         title: "Find Recently Updated Programs",
         description: "Recently updated program shortlist across all platforms by default. Platform filters are applied only when explicitly provided.",
         inputSchema: {
@@ -1302,7 +1479,7 @@ export function createBbradarServer(client, config) {
         outputSchema: findProgramsOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("find_recently_updated_programs", config, rateLimiter, async () => findRecentlyUpdatedPrograms(client, config, args)));
-    server.registerTool("list_filters", {
+    registerTool("list_filters", {
         title: "List BBRadar Filters",
         description: "Discover observed filter values.",
         inputSchema: {
@@ -1321,7 +1498,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("list_filters", config, rateLimiter, async () => listFilters(client, args)));
-    server.registerTool("get_bbradar_guide", {
+    registerTool("get_bbradar_guide", {
         title: "Get BBRadar Tool Guide",
         description: "Local quick-start guide for choosing BBRadar tools. Call this when the user's request is ambiguous or when a smaller model may need a decision tree.",
         inputSchema: {
@@ -1334,9 +1511,9 @@ export function createBbradarServer(client, config) {
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_bbradar_guide", config, rateLimiter, async () => ({
         request_id: randomUUID(),
-        guide: bbradarGuide(args.topic)
+        guide: bbradarGuide(args.topic, config.toolProfile, client)
     })));
-    server.registerTool("get_mcp_status", {
+    registerTool("get_mcp_status", {
         title: "Get BBRadar MCP Status",
         description: "Local MCP status and timing metrics.",
         inputSchema: {},
@@ -1355,11 +1532,22 @@ export function createBbradarServer(client, config) {
             web_base_url: config.webBaseUrl,
             response_cache_enabled: config.cacheTtlMs > 0 && config.cacheMaxEntries > 0,
             cache_ttl_ms: config.cacheTtlMs,
+            negative_cache_ttl_ms: config.negativeCacheTtlMs,
             cache_max_entries: config.cacheMaxEntries,
             local_program_index_enabled: false,
             default_rate_limit_per_minute: config.defaultRateLimitPerMinute,
             export_rate_limit_per_minute: config.exportRateLimitPerMinute,
+            max_concurrent_upstream_requests: config.maxConcurrentRequests,
+            compact_tool_text: config.compactToolText,
+            tool_profile: config.toolProfile,
             request_timeout_ms: config.requestTimeoutMs,
+            feed_cursors: feedCursorStore.stats(),
+            continuations: {
+                entries: continuationStore.size,
+                max_entries: MAX_LOCAL_EXPORT_RESOURCES,
+                inline_limit: config.continuationInlineLimit ?? 50,
+                ttl_ms: config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS
+            },
             validate_on_startup: config.validateOnStartup,
             transport: "stdio",
             remote_streamable_http: "not_enabled_for_local_setup",
@@ -1367,7 +1555,7 @@ export function createBbradarServer(client, config) {
             client: client.diagnostics()
         }
     })));
-    server.registerTool("compare_programs", {
+    registerTool("compare_programs", {
         title: "Compare BBRadar Programs",
         description: "Compare programs.",
         inputSchema: {
@@ -1381,7 +1569,7 @@ export function createBbradarServer(client, config) {
         outputSchema: decisionOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("compare_programs", config, rateLimiter, async () => comparePrograms(client, config, args)));
-    server.registerTool("compare_programs_compact", {
+    registerTool("compare_programs_compact", {
         title: "Compare Programs Compact",
         description: "Compact program comparison.",
         inputSchema: {
@@ -1394,7 +1582,7 @@ export function createBbradarServer(client, config) {
         outputSchema: decisionOutputShape(),
         annotations: readOnlyAnnotations
     }, (args) => runTool("compare_programs_compact", config, rateLimiter, async () => comparePrograms(client, config, { ...args, output_mode: "compact" })));
-    server.registerTool("summarize_program_activity", {
+    registerTool("summarize_program_activity", {
         title: "Summarize Program Activity",
         description: "Summarize one program's activity.",
         inputSchema: {
@@ -1409,7 +1597,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => summarizeProgramActivity(client, config, programId, args.recent_changes_limit))));
-    server.registerTool("get_program_brief", {
+    registerTool("get_program_brief", {
         title: "Get Program Brief",
         description: "Compact worth-hunting brief for one program.",
         inputSchema: {
@@ -1432,17 +1620,28 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_brief", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramBrief(client, config, { ...args, program_id: programId }))));
-    server.registerTool("find_recently_added_wildcards", {
+    registerTool("find_recently_added_wildcards", {
         title: "Find Recently Added Wildcards",
-        description: "Recently added wildcard programs.",
+        description: "Recently added wildcard programs with platform, minimum reward, and report-count filters. Returns bounded wildcard target samples.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
+            min_added_24h: z.number().int().min(0).optional(),
             min_added_7d: z.number().int().min(1).default(1),
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(false),
             require_bounty: z.boolean().default(true),
+            min_wildcards: z.number().int().min(1).max(100).default(1),
+            sort_by: programSortSchema.default("most_new_targets"),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -1456,37 +1655,38 @@ export function createBbradarServer(client, config) {
         web3: false,
         opportunity_levels: [],
         updated_since: undefined,
-        min_bounty_min: undefined,
-        min_bounty_max: undefined,
+        min_bounty_min: args.min_reward !== undefined && args.reward_threshold_mode === "min_at_least" ? args.min_reward : undefined,
+        min_bounty_max: args.min_reward !== undefined && args.reward_threshold_mode === "max_at_least" ? args.min_reward : undefined,
         max_bounty_max: undefined,
         require_bounty: args.require_bounty,
         max_public_report_count: args.max_public_report_count,
-        require_known_report_count: false,
-        include_unknown_report_count: false,
+        require_known_report_count: args.require_known_report_count,
+        include_unknown_report_count: args.include_unknown_report_count,
         exclude_ctf: true,
         exclude_mobile_only: false,
         exclude_non_web: false,
         has_api_scope: false,
         fresh_launch_days: undefined,
-        min_wildcards: 1,
+        min_wildcards: args.min_wildcards,
         min_eligible_targets: undefined,
         min_total_targets: undefined,
-        min_added_24h: undefined,
+        min_added_24h: args.min_added_24h,
         min_added_7d: args.min_added_7d,
         max_pages: args.max_pages,
         max_results: args.max_results,
-        sort_by: "best_hunt_value",
-        include_target_samples: true,
-        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
-        target_sample_size: 5,
+        sort_by: args.sort_by,
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
         target_samples_only_wildcards: true,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("find_low_competition_high_reward", {
+    registerTool("find_low_competition_high_reward", {
         title: "Find Low Competition High Reward",
-        description: "Legacy low-report high-reward shortlist.",
+        description: "Low-report, high-reward shortlist with optional wildcard and technology filters.",
         inputSchema: {
             platforms: platformListSchema(),
             tags: tagListSchema(),
@@ -1495,6 +1695,7 @@ export function createBbradarServer(client, config) {
             max_public_report_count: z.number().int().min(0).default(10),
             min_bounty_max: z.number().int().min(0).default(5_000),
             min_eligible_targets: z.number().int().min(0).default(1),
+            min_wildcards: z.number().int().min(0).max(100).default(0),
             exclude_ctf: z.boolean().default(true),
             exclude_mobile_only: z.boolean().default(false),
             exclude_non_web: z.boolean().default(false),
@@ -1502,6 +1703,10 @@ export function createBbradarServer(client, config) {
             fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            output_mode: programListModeSchema.default("compact"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
         },
         outputSchema: findProgramsOutputShape(),
@@ -1527,7 +1732,7 @@ export function createBbradarServer(client, config) {
         exclude_non_web: args.exclude_non_web,
         has_api_scope: args.has_api_scope,
         fresh_launch_days: args.fresh_launch_days,
-        min_wildcards: 0,
+        min_wildcards: args.min_wildcards,
         min_eligible_targets: args.min_eligible_targets,
         min_total_targets: undefined,
         min_added_24h: undefined,
@@ -1535,15 +1740,16 @@ export function createBbradarServer(client, config) {
         max_pages: args.max_pages,
         max_results: args.max_results,
         sort_by: "best_hunt_value",
-        include_target_samples: true,
-        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
-        target_sample_size: 5,
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
         only_in_scope_targets: true,
         only_bounty_eligible_targets: true,
-        target_samples_only_wildcards: false,
+        target_samples_only_wildcards: args.min_wildcards > 0,
+        output_mode: args.output_mode,
         upstream_request_budget: args.upstream_request_budget
     })));
-    server.registerTool("get_program_delta", {
+    registerTool("get_program_delta", {
         title: "Get Program Delta",
         description: "Recent target changes for one program.",
         inputSchema: {
@@ -1551,7 +1757,7 @@ export function createBbradarServer(client, config) {
             include_removed: z.boolean().default(true),
             include_ineligible: z.boolean().default(false),
             include_out_of_scope: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(50)
+            page_size: recentChangesPageSizeSchema.default(Math.min(50, maxTargetChangesPageSize))
         },
         outputSchema: {
             ...apiEnvelopeOutputShape(),
@@ -1561,18 +1767,18 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramDelta(client, config, { ...args, program_id: programId }))));
-    server.registerTool("export_targets", {
+    registerTool("export_targets", {
         title: "Export BBRadar Targets",
-        description: `Read-only target export. limit max ${MAX_TARGET_EXPORT}.`,
+        description: `Read-only target export. limit max ${maxTargetExport}.`,
         inputSchema: {
-            program_ids: z.array(programIdentifierSchema).max(50).default([]),
+            program_ids: z.array(programIdentifierSchema).max(maxTargetExportProgramIds).default([]),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             opportunity_levels: z.array(z.enum(["elite", "hot", "strong", "potential"])).max(4).default([]),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             format: z.enum(["json", "csv"]).default("json"),
-            limit: z.number().int().min(1).max(MAX_TARGET_EXPORT).default(MAX_TARGET_EXPORT)
+            limit: z.number().int().min(1).max(maxTargetExport).default(maxTargetExport)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape(),
@@ -1618,11 +1824,14 @@ export function createBbradarServer(client, config) {
             });
         }
     }));
-    registerPrompts(server);
-    registerResources(server, client, config, exportStore);
+    registerPrompts(server, config.toolProfile);
+    registerResources(server, client, config, exportStore, continuationStore);
     return server;
 }
-function bbradarGuide(topic) {
+function bbradarGuide(topic, profile, client) {
+    if (profile === "core") {
+        return coreBbradarGuide(topic, client);
+    }
     const primaryEntryPoints = [
         {
             tool: "find_program_candidates",
@@ -1654,6 +1863,11 @@ function bbradarGuide(topic) {
             first_tool: "find_program_candidates",
             then: "Use get_program_brief on the best program_id if the user wants details."
         },
+        {
+            user_goal: "Web2 programs with broad scope, good rewards, recent target activity, and excluded platforms",
+            first_tool: "list_filters",
+            then: "Resolve the excluded platform names, then call find_programs with exclude_platforms, exclude_web3=true, exclude_non_web=true, reward/scope/freshness thresholds, and sort_by=most_new_targets. If strict local filters return zero, relax one threshold and retry; cached source pages make the retry cheap."
+        },
         {
             user_goal: "named program summary",
             first_tool: "run_program_name_action",
@@ -1674,6 +1888,43 @@ function bbradarGuide(topic) {
             first_tool: "find_recently_updated_programs",
             then: "Use get_latest_added_targets for global added targets, or check_program_new_targets when the user names one program."
         },
+        {
+            user_goal: "repository changes or repository polling",
+            first_tool: "get_repository_changes",
+            arguments: { include_targets: false, max_cursor_pages: 2 },
+            then: "For incremental polling, seed once with after_id and later set resume_cursor=true with the same filters."
+        },
+        {
+            user_goal: "rewarded Web3 targets with recent repository changes on named platforms",
+            first_tool: "get_repository_changes",
+            arguments: { platforms: ["requested platforms"], include_targets: true, output_mode: "full", page_size: 100 },
+            parallel_with: {
+                tool: "find_programs",
+                arguments: { platforms: ["requested platforms"], web3: true, require_bounty: true, min_bounty_max: 5000, sort_by: "highest_reward", include_target_samples: false }
+            },
+            then: "Intersect repository-event program ids with ranked program ids. Targets belong to the repository event association even when target rows omit program_id; keep strong target scores/labels and only the requested program platforms."
+        },
+        {
+            user_goal: "latest added wildcard targets with platform, reward, or report-count filters",
+            first_tool: "get_latest_added_targets",
+            arguments: {
+                target_type: "wildcard",
+                platforms: ["requested platform"],
+                min_reward: 5000,
+                max_public_report_count: 10,
+                include_full_target_list: false
+            }
+        },
+        {
+            user_goal: "wildcard programs with low report count and good rewards",
+            first_tool: "find_wildcard_programs",
+            arguments: {
+                platforms: ["requested platform"],
+                min_reward: 5000,
+                max_public_report_count: 10,
+                include_target_samples: true
+            }
+        },
         {
             user_goal: "compare a short list",
             first_tool: "compare_programs_compact",
@@ -1691,17 +1942,19 @@ function bbradarGuide(topic) {
         }
     ];
     const advancedTools = {
-        discovery: ["find_stack_matches", "find_language_programs", "find_target_type_programs", "find_reward_programs", "find_paid_programs", "find_web3_contests", "find_low_noise_programs"],
-        freshness: ["find_recently_updated_programs", "find_fresh_hunt_candidates", "get_latest_added_targets", "get_recent_target_activity", "get_program_scope_delta", "check_watchlist_new_targets"],
+        discovery: ["find_wildcard_programs", "find_low_competition_high_reward", "find_stack_matches", "find_language_programs", "find_target_type_programs", "find_reward_programs", "find_paid_programs", "find_web3_contests", "find_low_noise_programs"],
+        freshness: ["find_recently_added_wildcards", "find_recently_updated_programs", "find_fresh_hunt_candidates", "get_latest_added_targets", "get_recent_target_activity", "get_program_scope_delta", "check_watchlist_new_targets"],
         details: ["get_program_brief", "get_program_scope_summary", "get_program_target_breakdown", "find_programs_by_target"],
         exports: ["export_targets"]
     };
     const filters = {
         platforms: "Only set when the user explicitly names a platform. Do not infer Immunefi, HackerOne, etc.",
+        exclude_platforms: "Use exact observed values from list_filters for user-requested platform or geographic exclusions.",
         tags: "Broad combined tag filter across scope, language, and target-type signals.",
         scope_tags: "Scope category signals such as domain, api, mobile, smart-contract, wildcard.",
         target_types: "Target-kind signals such as domain, api, url, mobile, smart-contract.",
         language_tags: "Technology/language signals such as javascript, solidity, web3, php, python.",
+        exclude_web3: "Set true for Web2-only requests.",
         vdp_mode: "Default exclude. Include VDP/no-bounty data only when asked."
     };
     const examples = [
@@ -1724,6 +1977,20 @@ function bbradarGuide(topic) {
         {
             user_says: "who owns https://api.example.com/v1/users",
             call: { tool: "find_programs_by_target", arguments: { target_query: "https://api.example.com/v1/users" } }
+        },
+        {
+            user_says: "latest HackerOne wildcard targets with rewards over 5000",
+            call: {
+                tool: "get_latest_added_targets",
+                arguments: { target_type: "wildcard", platforms: ["HackerOne"], min_reward: 5000, include_full_target_list: false }
+            }
+        },
+        {
+            user_says: "wildcard programs with under 10 reports and good rewards",
+            call: {
+                tool: "find_wildcard_programs",
+                arguments: { max_public_report_count: 10, min_reward: 5000, include_target_samples: true }
+            }
         }
     ];
     return {
@@ -1738,12 +2005,99 @@ function bbradarGuide(topic) {
             require_bounty: true
         },
         primary_entry_points: topic === "start" ? primaryEntryPoints : primaryEntryPoints.filter((entry) => entry.tool !== "get_bbradar_guide"),
-        decision_tree: decisionTree.filter((entry) => topic === "start" || guideEntryMatchesTopic(topic, entry)),
+        decision_tree: decisionTree.filter((entry) => toolAvailableForContract(client, String(entry.first_tool)) &&
+            (topic === "start" || guideEntryMatchesTopic(topic, entry))),
         filters,
         advanced_tools: advancedTools,
         examples
     };
 }
+function coreBbradarGuide(topic, client) {
+    const decisionTree = [
+        {
+            user_goal: "find programs to hunt",
+            first_tool: "find_programs",
+            arguments: { max_results: 10, output_mode: "compact" }
+        },
+        {
+            user_goal: "Web2 programs with broad scope, good rewards, recent target activity, and excluded platforms",
+            first_tool: "list_filters",
+            then: "Resolve excluded platform names, then call find_programs with exclude_platforms, exclude_web3=true, exclude_non_web=true, reward/scope/freshness thresholds, and sort_by=most_new_targets. Relax one local threshold on an empty result; cached source pages make retries fast."
+        },
+        {
+            user_goal: "named program summary or action",
+            first_tool: "run_program_name_action",
+            arguments: { query: "program name", action: "brief" }
+        },
+        {
+            user_goal: "named program targets",
+            first_tool: "get_program_eligible_targets_by_name",
+            arguments: { query: "program name", target_list_mode: "identifiers" }
+        },
+        {
+            user_goal: "find which program owns a target",
+            first_tool: "find_programs_by_target",
+            arguments: { target_query: "domain, URL, wildcard, package/repo name, or short target phrase", match_mode: "smart" }
+        },
+        {
+            user_goal: "fresh or recently changed scope",
+            first_tool: "get_recent_changes",
+            then: "Use get_latest_added_targets when only newly added targets are needed."
+        },
+        {
+            user_goal: "repository changes or repository polling",
+            first_tool: "get_repository_changes",
+            arguments: { include_targets: false, max_cursor_pages: 2 }
+        },
+        {
+            user_goal: "rewarded Web3 targets with recent repository changes on named platforms",
+            first_tool: "get_repository_changes",
+            arguments: { platforms: ["requested platforms"], include_targets: true, output_mode: "full", page_size: 100 },
+            parallel_with: {
+                tool: "find_programs",
+                arguments: { platforms: ["requested platforms"], web3: true, require_bounty: true, min_bounty_max: 5000, sort_by: "highest_reward", include_target_samples: false }
+            },
+            then: "Intersect event program ids with ranked program ids. Treat targets as event-level associations when target rows omit program_id, keep strong target scores/labels, and discard non-requested associated platforms."
+        },
+        {
+            user_goal: "export targets",
+            first_tool: "export_targets",
+            then: "Use the returned bbradar://exports resource_uri for the full local export payload."
+        },
+        {
+            user_goal: "unknown filter values",
+            first_tool: "list_filters",
+            then: "Reuse observed platforms, tags, target types, and language tags in find_programs."
+        }
+    ];
+    return {
+        topic,
+        tool_profile: "core",
+        rule_zero: "BBRadar is passive intelligence only. Never scan or contact targets.",
+        defaults: {
+            output_mode: "compact",
+            target_list_mode: "identifiers",
+            target_match_mode: "smart",
+            include_out_of_scope: false,
+            include_ineligible: false,
+            require_bounty: true
+        },
+        primary_entry_points: [
+            "find_programs",
+            "run_program_name_action",
+            "get_program_eligible_targets_by_name",
+            "find_programs_by_target",
+            "get_bbradar_guide"
+        ],
+        decision_tree: decisionTree.filter((entry) => toolAvailableForContract(client, String(entry.first_tool)) &&
+            (topic === "start" || guideEntryMatchesTopic(topic, entry))),
+        available_tools: [...CORE_TOOL_NAMES].filter((name) => toolAvailableForContract(client, name))
+    };
+}
+function toolAvailableForContract(client, toolName) {
+    const endpoint = TOOL_ENDPOINT_REQUIREMENTS[toolName];
+    return endpoint === undefined || client.supportsEndpoint(endpoint);
+}
 function guideEntryMatchesTopic(topic, entry) {
     const goal = typeof entry.user_goal === "string" ? entry.user_goal : "";
     const firstTool = typeof entry.first_tool === "string" ? entry.first_tool : "";
@@ -1770,15 +2124,52 @@ function guideEntryMatchesTopic(topic, entry) {
     }
     return true;
 }
-function registerResources(server, client, config, exportStore) {
+function registerResources(server, client, config, exportStore, continuationStore) {
+    server.registerResource("continuation", new ResourceTemplate("bbradar://continuations{?continuation_id,offset,limit}", { list: undefined }), {
+        title: "BBRadar Result Continuation",
+        description: "Bounded, short-lived in-memory continuation page for a large tool result.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const continuationId = uri.searchParams.get("continuation_id") ?? "";
+        pruneExpiredContinuations(continuationStore);
+        const stored = continuationStore.get(continuationId);
+        if (!stored) {
+            return jsonResource(uri.toString(), {
+                request_id: randomUUID(),
+                error: { message: "Continuation not found or expired from local memory." }
+            });
+        }
+        const offset = boundedResourceInteger(uri.searchParams.get("offset"), 0, 0, stored.items.length);
+        const limit = boundedResourceInteger(uri.searchParams.get("limit"), config.continuationInlineLimit ?? 50, 1, 100);
+        const items = stored.items.slice(offset, offset + limit);
+        const nextOffset = offset + items.length;
+        const hasMore = nextOffset < stored.items.length;
+        return jsonResource(uri.toString(), {
+            request_id: randomUUID(),
+            continuation_id: continuationId,
+            label: stored.label,
+            items,
+            meta: {
+                offset,
+                limit,
+                returned: items.length,
+                total: stored.items.length,
+                has_more: hasMore,
+                next_resource_uri: hasMore
+                    ? continuationResourceUri(continuationId, nextOffset, limit)
+                    : undefined
+            }
+        });
+    });
     server.registerResource("target-export", new ResourceTemplate("bbradar://exports{?export_id}", { list: undefined }), {
         title: "BBRadar Target Export",
-        description: "In-memory local target export payload by export_id query parameter.",
+        description: "Bounded, short-lived in-memory target export payload by export_id query parameter.",
         mimeType: "application/json"
     }, async (uri) => {
         const exportId = uri.searchParams.get("export_id") ?? "";
-        const payload = exportStore.get(exportId);
-        if (!payload) {
+        pruneExpiredExports(exportStore);
+        const storedExport = exportStore.get(exportId);
+        if (!storedExport) {
             return jsonResource(uri.toString(), {
                 request_id: randomUUID(),
                 error: {
@@ -1789,7 +2180,7 @@ function registerResources(server, client, config, exportStore) {
         return jsonResource(uri.toString(), {
             request_id: randomUUID(),
             export_id: exportId,
-            export: payload
+            export: storedExport.payload
         });
     });
     server.registerResource("program", new ResourceTemplate("bbradar://program{?program_id}", { list: undefined }), {
@@ -3178,13 +3569,26 @@ async function findProgramsByTarget(client, config, input) {
     };
     const sourceRequests = [];
     const matches = [];
+    const directHandleFirst = !queryLooksLikeTargetIdentifier(input.target_query) &&
+        !/\s/.test(input.target_query.trim()) &&
+        looksLikeDirectProgramHandleQuery(input.target_query);
+    if (input.use_api_search && !directHandleFirst) {
+        const directResult = await searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests);
+        if (directResult) {
+            return directResult;
+        }
+    }
     const directHandles = await collectDirectHandlePrograms(client, {
         query: input.target_query,
         platforms: input.platforms,
         budget,
         warnings,
         source: "target_query_program_id_guess",
-        maxProgramIds: queryLooksLikeTargetIdentifier(input.target_query) || looksLikeDirectProgramHandleQuery(input.target_query) ? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS : 4,
+        maxProgramIds: input.use_api_search && directHandleFirst
+            ? 4
+            : queryLooksLikeTargetIdentifier(input.target_query) || looksLikeDirectProgramHandleQuery(input.target_query)
+                ? MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS
+                : 4,
         maxHandleVariants: 1,
         stopOnFirstMatch: true
     });
@@ -3204,8 +3608,8 @@ async function findProgramsByTarget(client, config, input) {
             }
         });
     }
-    if (input.use_api_search) {
-        const directResult = await searchProgramsByTargetApi(client, config, input, warnings);
+    if (input.use_api_search && directHandleFirst) {
+        const directResult = await searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests);
         if (directResult) {
             return directResult;
         }
@@ -3310,13 +3714,22 @@ function programsByTargetResult(input, warnings, sourceRequests, matches, budget
         meta: options.meta
     });
 }
-async function searchProgramsByTargetApi(client, config, input, warnings) {
+async function searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests) {
+    if (!client.supportsEndpoint("target_search")) {
+        warnings.push("The negotiated API contract does not expose direct target search; using sampled program target lists.");
+        return undefined;
+    }
     const searchQueries = targetApiSearchQueries(input.target_query);
     const grouped = new Map();
-    const sourceRequests = [];
     let rawMatchesScanned = 0;
+    let searchQueriesChecked = 0;
     let lastMeta;
     for (const searchQuery of searchQueries) {
+        if (!tryConsumeBudget(budget)) {
+            addUniqueWarning(warnings, "Upstream request budget was exhausted before all target search variants could be checked.");
+            break;
+        }
+        searchQueriesChecked += 1;
         let api;
         try {
             api = await client.searchTargets({
@@ -3327,10 +3740,12 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
                 include_out_of_scope: input.include_out_of_scope,
                 include_ineligible: input.include_ineligible,
                 page: 1,
-                page_size: Math.max(input.max_results * input.max_targets_per_program, input.max_results)
+                page_size: Math.min(client.endpointNumber("target_search", "max_page_size", MAX_TARGETS_PER_PROGRAM), Math.max(input.max_results * input.max_targets_per_program, input.max_results))
             });
+            refundBudgetIfNoUpstreamRequest(budget, api);
         }
         catch (error) {
+            refundBudgetIfNoUpstreamError(budget, error);
             if (error instanceof BBRadarApiError && (error.status === 404 || error.status === 405)) {
                 warnings.push("Direct target search API is unavailable; fell back to sampled program target lists.");
                 return undefined;
@@ -3371,15 +3786,93 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
                 if (!targetMatchesQuery(target, input.target_query, input.match_mode)) {
                     continue;
                 }
-                const existing = grouped.get(programId) ?? { program: addProgramResourceLinks({ ...program, id: programId }), targets: [] };
-                existing.targets.push(target);
+                const existing = grouped.get(programId) ?? {
+                    program: addProgramResourceLinks({ ...program, id: programId }),
+                    targets: [],
+                    targetKeys: new Set()
+                };
+                const targetKey = stableStringify({
+                    identifier: targetIdentifier(target),
+                    target_type: stringField(target, "target_type")
+                });
+                if (!existing.targetKeys.has(targetKey)) {
+                    existing.targetKeys.add(targetKey);
+                    existing.targets.push(target);
+                }
                 grouped.set(programId, existing);
             }
         }
-        if (grouped.size >= input.max_results) {
+        if (grouped.size >= input.max_results ||
+            (grouped.size > 0 && input.match_mode === "smart")) {
             break;
         }
     }
+    if (grouped.size > 0 && input.match_mode === "smart") {
+        await mapWithConcurrency([...grouped.entries()].slice(0, input.max_results), TARGET_SAMPLE_CONCURRENCY, async ([programId, entry]) => {
+            if (!tryConsumeBudget(budget)) {
+                addUniqueWarning(warnings, "Upstream request budget was exhausted before matched program target lists could be hydrated.");
+                return;
+            }
+            try {
+                const targetsApi = await client.getProgramTargets(programId);
+                refundBudgetIfNoUpstreamRequest(budget, targetsApi);
+                sourceRequests.push({
+                    source: "program_targets",
+                    program_id: programId,
+                    request_id: targetsApi.requestId,
+                    upstream_request_id: targetsApi.upstreamRequestId,
+                    ...apiSourceMetadata(targetsApi)
+                });
+                const targetsData = readObject(targetsApi.data);
+                const hydratedTargets = readArray(targetsData?.targets).map(sanitizeTarget);
+                const hydratedTargetOrder = new Map(hydratedTargets.map((target, index) => [
+                    stableStringify({
+                        identifier: targetIdentifier(target),
+                        target_type: stringField(target, "target_type")
+                    }),
+                    index
+                ]));
+                for (const target of hydratedTargets) {
+                    if (!targetIdentifier(target) ||
+                        !targetHasAllowedScope(target, {
+                            include_out_of_scope: input.include_out_of_scope,
+                            include_ineligible: input.include_ineligible,
+                            strict_scope_filter: false
+                        }) ||
+                        !targetMatchesQuery(target, input.target_query, input.match_mode)) {
+                        continue;
+                    }
+                    const targetKey = stableStringify({
+                        identifier: targetIdentifier(target),
+                        target_type: stringField(target, "target_type")
+                    });
+                    if (!entry.targetKeys.has(targetKey)) {
+                        entry.targetKeys.add(targetKey);
+                        entry.targets.push(target);
+                    }
+                }
+                entry.targets.sort((left, right) => {
+                    const leftKey = stableStringify({
+                        identifier: targetIdentifier(left),
+                        target_type: stringField(left, "target_type")
+                    });
+                    const rightKey = stableStringify({
+                        identifier: targetIdentifier(right),
+                        target_type: stringField(right, "target_type")
+                    });
+                    return ((hydratedTargetOrder.get(leftKey) ?? Number.MAX_SAFE_INTEGER) -
+                        (hydratedTargetOrder.get(rightKey) ?? Number.MAX_SAFE_INTEGER));
+                });
+            }
+            catch (error) {
+                refundBudgetIfNoUpstreamError(budget, error);
+                if (!isProgramNotFoundError(error)) {
+                    throw error;
+                }
+                addUniqueWarning(warnings, `Could not hydrate target matches for ${programId}; returned direct target-search matches only.`);
+            }
+        });
+    }
     const matches = [...grouped.values()].slice(0, input.max_results).map((entry) => stripUndefined({
         program: formatProgram(entry.program, "compact"),
         match_count: entry.targets.length,
@@ -3407,6 +3900,14 @@ async function searchProgramsByTargetApi(client, config, input, warnings) {
         },
         matches,
         programs: matches.map((match) => readObject(match.program)).filter((program) => program !== undefined),
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        },
+        ranking_scope: {
+            mode: "target_search_api",
+            possibly_incomplete: grouped.size < input.max_results && searchQueriesChecked < searchQueries.length
+        },
         meta: stripUndefined({
             ...(lastMeta ?? {}),
             returned: matches.length,
@@ -3503,7 +4004,8 @@ async function listFilters(client, input) {
             }
         }
     }
-    catch {
+    catch (error) {
+        refundBudgetIfNoUpstreamError(budget, error);
         // Facets are best-effort; list_filters should still return observed program filters.
     }
     if (input.include_target_facets && input.target_sample_programs > 0) {
@@ -3639,11 +4141,15 @@ async function comparePrograms(client, config, input) {
     });
 }
 async function summarizeProgramActivity(client, config, programId, recentChangesLimit) {
-    const programApi = await client.getProgram(programId);
+    const [programApi, changes] = await Promise.all([
+        client.getProgram(programId),
+        recentChangesLimit > 0
+            ? fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true)
+            : Promise.resolve(undefined)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
     const scopeSummary = readObject(program.scope_summary);
     const targetActivity = readObject(scopeSummary?.target_activity);
-    const changes = recentChangesLimit > 0 ? await fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true) : undefined;
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -3670,12 +4176,14 @@ async function getLatestAddedTargets(client, config, input) {
         include_removed: false,
         include_ineligible: input.include_ineligible,
         include_out_of_scope: input.include_out_of_scope,
+        platforms: input.platforms,
         tags: [input.target_type],
         page: 1,
         page_size: input.recent_changes_page_size
     });
     const recentData = readObject(recentApi.data);
     const changes = readArray(recentData?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const platformFilters = new Set(input.platforms.map(normalizeTag));
     const matchingChanges = changes
         .filter((change) => {
         const target = readObject(change.target);
@@ -3684,6 +4192,7 @@ async function getLatestAddedTargets(client, config, input) {
             programId !== undefined &&
             target !== undefined &&
             targetMatchesRequestedType(target, input.target_type) &&
+            latestAddedProgramMatches(change, input, platformFilters) &&
             targetHasAllowedScope(target, {
                 include_out_of_scope: input.include_out_of_scope,
                 include_ineligible: input.include_ineligible,
@@ -3691,6 +4200,11 @@ async function getLatestAddedTargets(client, config, input) {
             }));
     })
         .sort((left, right) => timestampField(right, "changed_at") - timestampField(left, "changed_at"));
+    const limitedMatches = matchingChanges.slice(0, input.max_results);
+    const matches = limitedMatches.map((change, index) => ({
+        rank: index + 1,
+        ...formatChange(change, "compact")
+    }));
     const latest = matchingChanges[0];
     const sourceRequests = [
         {
@@ -3705,9 +4219,12 @@ async function getLatestAddedTargets(client, config, input) {
             request_id: randomUUID(),
             source_requests: sourceRequests,
             query: latestAddedTargetsQuery(input),
+            matches: [],
             new_targets: [],
             meta: {
                 recent_changes_scanned: changes.length,
+                matching_changes_scanned: 0,
+                matches_returned: 0,
                 no_match: true
             }
         };
@@ -3750,11 +4267,14 @@ async function getLatestAddedTargets(client, config, input) {
         query: latestAddedTargetsQuery(input),
         latest_added_at: latestAddedAt,
         program,
+        matches,
         new_targets: formatTargetList(latestNewTargets, input.full_target_list_mode),
         full_targets: input.include_full_target_list ? formatTargetList(limitedFullTargets, input.full_target_list_mode) : undefined,
         meta: stripUndefined({
             recent_changes_scanned: changes.length,
             matching_changes_scanned: matchingChanges.length,
+            matches_returned: matches.length,
+            matches_has_more: matches.length < matchingChanges.length,
             new_targets_returned: formatTargetList(latestNewTargets, input.full_target_list_mode).length,
             full_targets_total_active: totalActiveTargets,
             full_targets_total_after_filters: totalAfterFilters,
@@ -3763,9 +4283,52 @@ async function getLatestAddedTargets(client, config, input) {
         })
     });
 }
+function latestAddedProgramMatches(change, input, platformFilters) {
+    const rawProgram = readObject(change.program);
+    if (!rawProgram) {
+        return false;
+    }
+    const program = addProgramResourceLinks(rawProgram);
+    const rewardRange = readObject(program.reward_range);
+    const platform = normalizeTag(stringField(program, "platform") ?? "");
+    const bountyMin = numberField(rewardRange, "min");
+    const bountyMax = numberField(rewardRange, "max");
+    const publicReportCount = numberField(program, "public_report_count");
+    if (platformFilters.size > 0 && !platformFilters.has(platform)) {
+        return false;
+    }
+    if (input.min_reward !== undefined) {
+        const reward = input.reward_threshold_mode === "min_at_least" ? bountyMin : bountyMax;
+        if ((reward ?? 0) < input.min_reward) {
+            return false;
+        }
+    }
+    if (input.require_known_report_count && publicReportCount === undefined) {
+        return false;
+    }
+    if (input.max_public_report_count !== undefined) {
+        if (publicReportCount === undefined) {
+            return input.include_unknown_report_count;
+        }
+        if (publicReportCount > input.max_public_report_count) {
+            return false;
+        }
+    }
+    return true;
+}
 async function getProgramTargetsPayload(client, input, programId) {
-    const api = await client.getProgramTargets(programId);
+    const api = await client.getProgramTargets(programId, {
+        search: input.search,
+        target_type: input.target_type,
+        eligibility: input.include_ineligible ? "all" : "eligible",
+        minTargetScore: input.min_target_score,
+        targetOpportunityLabel: input.target_opportunity_label,
+        competitionRisk: input.competition_risk,
+        page: 1,
+        page_size: client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM)
+    });
     const data = readObject(api.data);
+    const upstreamMeta = readObject(data?.meta);
     const rawTargets = readArray(data?.targets);
     const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, input));
     const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
@@ -3776,10 +4339,13 @@ async function getProgramTargetsPayload(client, input, programId) {
             offset: input.offset,
             limit: input.limit,
             output_mode: input.output_mode,
-            total_active_targets: rawTargets.length,
+            total_active_targets: readNumber(upstreamMeta?.total) ?? rawTargets.length,
             total_after_filters: sanitizedTargets.length,
             returned: targets.length,
-            has_more: input.offset + input.limit < sanitizedTargets.length,
+            has_more: input.offset + input.limit < sanitizedTargets.length || readBoolean(upstreamMeta?.has_more) === true,
+            upstream_has_more: readBoolean(upstreamMeta?.has_more),
+            possibly_incomplete: readBoolean(upstreamMeta?.has_more) === true,
+            data_capabilities: readObject(upstreamMeta?.data_capabilities),
             target_source: "program_targets"
         }
     });
@@ -4319,9 +4885,11 @@ async function getProgramTargetBreakdownFromIndexFallback(client, indexFallback,
     });
 }
 async function getProgramScopeDelta(client, config, input) {
-    const programApi = await client.getProgram(input.program_id);
+    const [programApi, changesPayload] = await Promise.all([
+        client.getProgram(input.program_id),
+        fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed || input.change_type === "removed", input.include_ineligible, input.include_out_of_scope, input.max_targets)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
-    const changesPayload = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed || input.change_type === "removed", input.include_ineligible, input.include_out_of_scope, input.max_targets);
     const filteredChanges = filterProgramScopeDeltaChanges(changesPayload.changes, input);
     const limitedChanges = filteredChanges.slice(0, input.max_targets);
     return stripUndefined({
@@ -4776,9 +5344,11 @@ async function getProgramBrief(client, config, input) {
     });
 }
 async function getProgramDelta(client, config, input) {
-    const programApi = await client.getProgram(input.program_id);
+    const [programApi, changes] = await Promise.all([
+        client.getProgram(input.program_id),
+        fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed, input.include_ineligible, input.include_out_of_scope)
+    ]);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
-    const changes = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed, input.include_ineligible, input.include_out_of_scope);
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -4860,6 +5430,79 @@ function programTargetsResourceUri(programId) {
 function exportResourceUri(exportId) {
     return `bbradar://exports?export_id=${encodeURIComponent(exportId)}`;
 }
+function continuationResourceUri(continuationId, offset, limit) {
+    return `bbradar://continuations?continuation_id=${encodeURIComponent(continuationId)}&offset=${offset}&limit=${limit}`;
+}
+function applyCollectionContinuation(payload, field, label, store, config) {
+    const items = Array.isArray(payload[field]) ? payload[field] : undefined;
+    const inlineLimit = Math.min(100, Math.max(1, config.continuationInlineLimit ?? 50));
+    if (!items || items.length <= inlineLimit) {
+        return payload;
+    }
+    const continuationId = randomUUID();
+    const expiresAt = Date.now() + (config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS);
+    const stored = rememberContinuation(store, continuationId, label, items, expiresAt);
+    if (!stored) {
+        return {
+            ...payload,
+            [field]: items.slice(0, inlineLimit),
+            warnings: uniqueStrings([
+                ...readArray(payload.warnings).filter((entry) => typeof entry === "string"),
+                "The complete result exceeded the local continuation-store byte limit; only the inline prefix is available."
+            ])
+        };
+    }
+    return {
+        ...payload,
+        [field]: items.slice(0, inlineLimit),
+        continuation: {
+            continuation_id: continuationId,
+            resource_uri: continuationResourceUri(continuationId, inlineLimit, inlineLimit),
+            collection: field,
+            total: items.length,
+            inline_returned: inlineLimit,
+            remaining: items.length - inlineLimit,
+            expires_at: new Date(expiresAt).toISOString()
+        }
+    };
+}
+function rememberContinuation(store, id, label, items, expiresAt) {
+    const byteLength = Buffer.byteLength(JSON.stringify(items), "utf8");
+    pruneExpiredContinuations(store);
+    if (byteLength > MAX_LOCAL_EXPORT_BYTES) {
+        return false;
+    }
+    while (store.size >= MAX_LOCAL_EXPORT_RESOURCES ||
+        retainedContinuationBytes(store) + byteLength > MAX_LOCAL_EXPORT_BYTES) {
+        const oldest = store.keys().next().value;
+        if (oldest === undefined) {
+            break;
+        }
+        store.delete(oldest);
+    }
+    store.set(id, { items, label, byteLength, expiresAt });
+    return true;
+}
+function pruneExpiredContinuations(store, now = Date.now()) {
+    for (const [id, value] of store) {
+        if (value.expiresAt <= now) {
+            store.delete(id);
+        }
+    }
+}
+function retainedContinuationBytes(store) {
+    let total = 0;
+    for (const value of store.values()) {
+        total += value.byteLength;
+    }
+    return total;
+}
+function boundedResourceInteger(raw, fallback, minimum, maximum) {
+    const parsed = raw === null ? fallback : Number.parseInt(raw, 10);
+    return Number.isFinite(parsed)
+        ? Math.min(maximum, Math.max(minimum, parsed))
+        : fallback;
+}
 function jsonResource(uri, payload) {
     return {
         contents: [
@@ -4872,41 +5515,86 @@ function jsonResource(uri, payload) {
     };
 }
 function rememberExport(exportStore, exportId, payload) {
+    const now = Date.now();
+    const byteLength = Buffer.byteLength(JSON.stringify(payload), "utf8");
+    pruneExpiredExports(exportStore, now);
     if (exportStore.has(exportId)) {
         exportStore.delete(exportId);
     }
-    while (exportStore.size >= MAX_LOCAL_EXPORT_RESOURCES) {
+    while (exportStore.size >= MAX_LOCAL_EXPORT_RESOURCES ||
+        retainedExportBytes(exportStore) + byteLength > MAX_LOCAL_EXPORT_BYTES) {
         const oldestKey = exportStore.keys().next().value;
         if (oldestKey === undefined) {
             break;
         }
         exportStore.delete(oldestKey);
     }
-    exportStore.set(exportId, payload);
+    exportStore.set(exportId, {
+        payload,
+        byteLength,
+        expiresAt: now + LOCAL_EXPORT_TTL_MS
+    });
+}
+function pruneExpiredExports(exportStore, now = Date.now()) {
+    for (const [exportId, storedExport] of exportStore) {
+        if (storedExport.expiresAt <= now) {
+            exportStore.delete(exportId);
+        }
+    }
+}
+function retainedExportBytes(exportStore) {
+    let total = 0;
+    for (const storedExport of exportStore.values()) {
+        total += storedExport.byteLength;
+    }
+    return total;
 }
 function previewExportPayload(payload) {
+    if (typeof payload === "string") {
+        return previewExportText(payload);
+    }
     if (Array.isArray(payload)) {
         return payload.slice(0, EXPORT_PREVIEW_LIMIT);
     }
-    if (readObject(payload) && Array.isArray(payload.targets)) {
+    const object = readObject(payload);
+    if (object && typeof object.content === "string") {
+        return {
+            ...object,
+            content: previewExportText(object.content)
+        };
+    }
+    if (object && Array.isArray(object.targets)) {
         return {
-            ...payload,
-            targets: payload.targets.slice(0, EXPORT_PREVIEW_LIMIT)
+            ...object,
+            targets: object.targets.slice(0, EXPORT_PREVIEW_LIMIT)
         };
     }
     return payload;
 }
 function previewExportCount(payload) {
+    if (typeof payload === "string") {
+        return Math.min(Math.max(0, payload.split(/\r?\n/).length - 1), EXPORT_PREVIEW_LIMIT);
+    }
     if (Array.isArray(payload)) {
         return Math.min(payload.length, EXPORT_PREVIEW_LIMIT);
     }
     const object = readObject(payload);
+    if (typeof object?.content === "string") {
+        return Math.min(Math.max(0, object.content.split(/\r?\n/).length - 1), EXPORT_PREVIEW_LIMIT);
+    }
     const targets = object?.targets;
     if (Array.isArray(targets)) {
         return Math.min(targets.length, EXPORT_PREVIEW_LIMIT);
     }
     return payload === undefined || payload === null ? 0 : 1;
 }
+function previewExportText(payload) {
+    const lines = payload.split(/\r?\n/);
+    const preview = lines.slice(0, EXPORT_PREVIEW_LIMIT + 1).join("\n");
+    return lines.length > EXPORT_PREVIEW_LIMIT + 1
+        ? `${preview}\n[preview truncated; read the export resource for the complete payload]`
+        : preview;
+}
 function collectResourceLinks(payload) {
     const links = new Map();
     for (const program of extractProgramsFromPayload(payload)) {
@@ -4948,6 +5636,19 @@ function collectResourceLinks(payload) {
             mimeType: "application/json"
         });
     }
+    const continuation = readObject(payload.continuation);
+    const continuationUri = stringField(continuation, "resource_uri");
+    const continuationId = stringField(continuation, "continuation_id");
+    if (continuationUri && continuationId) {
+        links.set(continuationUri, {
+            type: "resource_link",
+            uri: continuationUri,
+            name: `${continuationId} continuation`,
+            title: "Result continuation",
+            description: "Read the next bounded page of this local in-memory result.",
+            mimeType: "application/json"
+        });
+    }
     return [...links.values()];
 }
 function extractProgramsFromPayload(payload) {
@@ -4997,9 +5698,18 @@ function compactProgram(program) {
         handle: stringField(program, "handle"),
         name: stringField(program, "name"),
         platform: stringField(program, "platform"),
+        catalog: stringField(program, "catalog"),
+        program_type: stringField(program, "program_type"),
         platform_url: stringField(program, "platform_url"),
         bbradar_url: stringField(program, "bbradar_url"),
+        policy_url: stringField(program, "policy_url"),
+        reporting_url: stringField(program, "reporting_url"),
+        reward_status: stringField(program, "reward_status"),
+        data_capabilities: readObject(program.data_capabilities),
         opportunity_tag: readObject(program.opportunity_tag),
+        competition_risk: stringField(program, "competition_risk"),
+        competition_risk_reason: stringField(program, "competition_risk_reason"),
+        submission_cost: readObject(program.submission_cost),
         reward_range: readObject(program.reward_range),
         public_report_count: readNumber(program.public_report_count),
         public_report_count_label: stringField(program, "public_report_count_label"),
@@ -5049,6 +5759,30 @@ function formatChange(change, mode) {
         target: target ? compactTarget(target) : undefined
     });
 }
+function formatRepositoryChange(change, mode) {
+    if (mode === "full") {
+        return change;
+    }
+    const repository = readObject(change.repository);
+    return stripUndefined({
+        id: change.id,
+        event_type: stringField(change, "event_type"),
+        ref_name: stringField(change, "ref_name"),
+        observed_at: stringField(change, "observed_at"),
+        repository: repository
+            ? stripUndefined({
+                provider: stringField(repository, "provider"),
+                full_name: stringField(repository, "full_name"),
+                url: stringField(repository, "url")
+            })
+            : undefined,
+        changes_url: stringField(change, "changes_url"),
+        programs: readArray(change.programs).map((program) => formatProgram(readObject(program) ?? {}, "compact")),
+        targets: Array.isArray(change.targets)
+            ? change.targets.map((target) => compactTarget(readObject(target) ?? {}))
+            : undefined
+    });
+}
 function buildTargetScopeSummary(targets, mode, groupLimit, includeOutOfScope, includeIneligible) {
     const bountyTargets = targets.filter((target) => target.in_scope === true && target.eligible_for_bounty === true);
     const groups = {
@@ -5300,6 +6034,14 @@ function candidateLooksContestLike(candidate) {
     return tagIncludesAnyNormalized(candidate.normalizedSearchSignals, WEB3_CONTEST_SIGNALS);
 }
 function candidateHasKnownNoBounty(candidate) {
+    const programType = normalizeTag(stringField(candidate.program, "program_type") ?? "");
+    const rewardStatus = normalizeTag(stringField(candidate.program, "reward_status") ?? "");
+    if (programType === "vdp" || rewardStatus === "no_reward" || rewardStatus === "no reward") {
+        return true;
+    }
+    if (programType === "paid" || rewardStatus === "paid") {
+        return false;
+    }
     if (candidate.bountyMin === undefined && candidate.bountyMax === undefined) {
         return false;
     }
@@ -5372,6 +6114,9 @@ function hasHighConfidenceProgramResolutionMatch(programs, webBaseUrl, query) {
     const threshold = looksLikeDirectProgramHandleQuery(query) ? 95 : 85;
     return programs.some((program) => programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score >= threshold);
 }
+function hasViableProgramResolutionMatch(programs, scorePrograms) {
+    return scorePrograms ? scorePrograms(programs) >= 80 : programs.length > 0;
+}
 function bestProgramResolutionScore(programs, webBaseUrl, query) {
     return programs.reduce((best, program) => Math.max(best, programResolutionMatch(toProgramCandidate(program, webBaseUrl), query).score), 0);
 }
@@ -5485,6 +6230,16 @@ function normalizeFindProgramsInput(input) {
     const warnings = [];
     const normalized = { ...input };
     normalized.vdp_mode ??= "exclude";
+    normalized.exclude_platforms = uniqueStrings(normalized.exclude_platforms ?? []);
+    if (normalized.web3 && normalized.exclude_web3) {
+        normalized.web3 = false;
+        warnings.push("exclude_web3=true took precedence over the contradictory web3=true filter.");
+    }
+    const includedPlatforms = new Set(normalized.platforms.map(normalizeTag));
+    const overlappingPlatforms = normalized.exclude_platforms.filter((platform) => includedPlatforms.has(normalizeTag(platform)));
+    if (overlappingPlatforms.length > 0) {
+        warnings.push(`Excluded platform filters take precedence over included values: ${overlappingPlatforms.join(", ")}.`);
+    }
     normalized.max_pages = clampLimit("max_pages", normalized.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
     normalized.max_results = clampLimit("max_results", normalized.max_results, MAX_FIND_PROGRAM_RESULTS, warnings);
     normalized.target_sample_programs = clampLimit("target_sample_programs", normalized.target_sample_programs, MAX_FIND_TARGET_SAMPLE_PROGRAMS, warnings);
@@ -5511,7 +6266,13 @@ async function findPrograms(client, config, input) {
         initial: input.upstream_request_budget,
         remaining: input.upstream_request_budget
     };
-    const upstreamTags = uniqueStrings([...input.tags, ...input.scope_tags, ...input.target_types, ...input.language_tags]);
+    const upstreamTags = uniqueStrings([
+        ...input.tags,
+        ...input.scope_tags,
+        ...input.target_types,
+        ...input.language_tags,
+        ...(input.min_wildcards > 0 ? ["wildcard"] : [])
+    ]);
     const collected = await collectPrograms(client, {
         platforms: input.platforms,
         tags: upstreamTags,
@@ -5545,8 +6306,10 @@ async function findPrograms(client, config, input) {
         warnings: warnings.length > 0 ? warnings : undefined,
         filters: stripUndefined({
             platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            exclude_platforms: input.exclude_platforms && input.exclude_platforms.length > 0 ? input.exclude_platforms : undefined,
             tags: upstreamTags.length > 0 ? upstreamTags : undefined,
             web3: input.web3 ? true : undefined,
+            exclude_web3: input.exclude_web3 ? true : undefined,
             opportunity_levels: input.opportunity_levels.length > 0 ? input.opportunity_levels : undefined,
             updated_since: input.updated_since,
             min_bounty_min: input.min_bounty_min,
@@ -5623,8 +6386,33 @@ async function collectProgramsForResolution(client, options) {
     const collections = [];
     const queryCollections = [];
     const queries = options.searchQueries.length > 0 ? options.searchQueries : [undefined];
+    const fastQueries = queries.slice(0, FAST_RESOLVE_SEARCH_QUERIES);
+    const remainingQueries = queries.slice(FAST_RESOLVE_SEARCH_QUERIES);
     const primaryDirectPlatforms = options.platforms.length > 0 ? options.platforms : PRIMARY_PROGRAM_ID_PLATFORM_GUESSES;
     const primaryDirectProgramIds = new Set(directProgramIdCandidates(options.query, primaryDirectPlatforms, { maxHandleVariants: 1 }));
+    for (const search of fastQueries) {
+        if (options.budget.remaining <= 0) {
+            addUniqueWarning(options.warnings, "Program name search stopped at the request budget; pass a higher upstream_request_budget for a deeper resolution attempt.");
+            break;
+        }
+        const collection = await collectPrograms(client, {
+            search,
+            platforms: options.platforms,
+            tags: options.tags,
+            updated_since: undefined,
+            opportunity_levels: options.opportunity_levels,
+            max_pages: 1,
+            budget: options.budget,
+            warnings: options.warnings
+        });
+        collections.push(collection);
+        queryCollections.push({ search, collection });
+        const merged = mergeProgramCollections(collections);
+        if (options.isHighConfidenceMatch?.(merged.programs) ||
+            hasViableProgramResolutionMatch(merged.programs, options.scorePrograms)) {
+            return merged;
+        }
+    }
     if (primaryDirectProgramIds.size > 0 && options.budget.remaining > 0) {
         const primaryDirectHandles = await collectDirectHandlePrograms(client, {
             query: options.query,
@@ -5644,7 +6432,7 @@ async function collectProgramsForResolution(client, options) {
             return mergeProgramCollections(collections);
         }
     }
-    for (const search of queries) {
+    for (const search of remainingQueries) {
         if (options.budget.remaining <= 0) {
             addUniqueWarning(options.warnings, "Program name search stopped at the request budget; pass a higher upstream_request_budget for a deeper resolution attempt.");
             break;
@@ -5665,7 +6453,9 @@ async function collectProgramsForResolution(client, options) {
             return mergeProgramCollections(collections);
         }
     }
-    if (options.budget.remaining > 0) {
+    const searchedCollection = collections.length > 0 ? mergeProgramCollections(collections) : undefined;
+    if (options.budget.remaining > 0 &&
+        (!searchedCollection || !hasViableProgramResolutionMatch(searchedCollection.programs, options.scorePrograms))) {
         const directHandles = await collectDirectHandlePrograms(client, {
             query: options.query,
             platforms: options.platforms,
@@ -5752,9 +6542,14 @@ async function collectDirectHandlePrograms(client, options) {
     const sourceRequests = [];
     let requestsScanned = 0;
     for (const programId of programIds) {
+        if (!tryConsumeBudget(options.budget)) {
+            addUniqueWarning(options.warnings, "Upstream request budget was exhausted before all direct program handle guesses could be checked.");
+            break;
+        }
         requestsScanned += 1;
         try {
             const targetsApi = await client.getProgramTargets(programId);
+            refundBudgetIfNoUpstreamRequest(options.budget, targetsApi);
             const targetsData = readObject(targetsApi.data);
             const hasTargetsArray = Array.isArray(targetsData?.targets);
             const targets = readArray(targetsData?.targets).map(sanitizeTarget);
@@ -5775,6 +6570,7 @@ async function collectDirectHandlePrograms(client, options) {
             }
         }
         catch (error) {
+            refundBudgetIfNoUpstreamError(options.budget, error);
             if (error instanceof BBRadarApiError && error.status === 404) {
                 sourceRequests.push({
                     source: options.source,
@@ -5782,7 +6578,9 @@ async function collectDirectHandlePrograms(client, options) {
                     program_id: programId,
                     request_id: error.requestId,
                     upstream_request_id: error.upstreamRequestId,
-                    status: error.status
+                    status: error.status,
+                    cache_hit: error.cached,
+                    cache_expires_at: error.cacheExpiresAt
                 });
                 continue;
             }
@@ -6043,12 +6841,19 @@ function programCandidateMatches(candidate, filters) {
     if (filters.platforms.length > 0 && !filters.platforms.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
         return false;
     }
+    if ((filters.exclude_platforms?.length ?? 0) > 0 &&
+        filters.exclude_platforms?.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
+        return false;
+    }
     if (filters.tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.tags)) {
         return false;
     }
     if (filters.web3 && !candidateHasWeb3Surface(candidate)) {
         return false;
     }
+    if (filters.exclude_web3 && candidateHasWeb3Surface(candidate)) {
+        return false;
+    }
     if (filters.scope_tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.scope_tags)) {
         return false;
     }
@@ -6061,7 +6866,9 @@ function programCandidateMatches(candidate, filters) {
     if (candidate.wildcardCount < filters.min_wildcards) {
         return false;
     }
-    if (filters.require_bounty && (candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
+    const explicitlyPaid = normalizeTag(stringField(candidate.program, "program_type") ?? "") === "paid" ||
+        normalizeTag(stringField(candidate.program, "reward_status") ?? "") === "paid";
+    if (filters.require_bounty && !explicitlyPaid && (candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
         return false;
     }
     if (filters.min_bounty_min !== undefined && (candidate.bountyMin ?? 0) < filters.min_bounty_min) {
@@ -6195,7 +7002,8 @@ async function collectTargetSamples(client, candidates, input, budget) {
                 .slice(0, input.target_sample_size);
             samples[programId] = targets;
         }
-        catch {
+        catch (error) {
+            refundBudgetIfNoUpstreamError(budget, error);
             samples[programId] = [];
         }
     });
@@ -6258,6 +7066,11 @@ function refundBudgetIfNoUpstreamRequest(budget, api, cost = 1) {
         budget.remaining = Math.min(budget.initial, budget.remaining + cost);
     }
 }
+function refundBudgetIfNoUpstreamError(budget, error, cost = 1) {
+    if (error instanceof BBRadarApiError && (error.cached || error.coalesced)) {
+        budget.remaining = Math.min(budget.initial, budget.remaining + cost);
+    }
+}
 function addUniqueWarning(warnings, warning) {
     if (warnings && !warnings.includes(warning)) {
         warnings.push(warning);
@@ -6360,7 +7173,12 @@ function readStringArrayField(value, field) {
     const fieldValue = value[field];
     return Array.isArray(fieldValue) ? fieldValue.filter((entry) => typeof entry === "string") : [];
 }
-function registerPrompts(server) {
+function registerPrompts(server, profile) {
+    const discoveryToolInstructions = profile === "core"
+        ? `- Start with find_programs and pass opportunity_levels from the requested value below unless the user asked for a broader search.
+- Express language, target type, reward, Web3, wildcard, VDP, and platform needs through find_programs filters.`
+        : `- Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from the requested value below.
+- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.`;
     server.registerPrompt("find_best_programs_to_hunt", {
         title: "Find Best Programs To Hunt",
         description: "Rank fresh BBRadar program data only. Do not invoke external bug bounty skills unless the user explicitly asks for methodology.",
@@ -6373,8 +7191,8 @@ function registerPrompts(server) {
     }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Treat results as fresh API reads; do not describe them as cached.
 
 Find the best BBRadar program candidates.
-- Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from this JSON array unless the user asked for a broader search: ${promptJson([args.opportunity_level ?? "elite"])}.
-- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
+${discoveryToolInstructions}
+- Use this opportunity level JSON array: ${promptJson([args.opportunity_level ?? "elite"])}.
 - Apply platform filters from this JSON string if provided: ${promptJson(args.platforms ?? "")}.
 - Apply tag filters from this JSON string if provided: ${promptJson(args.tags ?? "")}.
 - Keep the shortlist to this JSON value: ${promptJson(args.max_programs ?? "10")}.
@@ -6421,6 +7239,111 @@ The plan must:
 - Prioritize targets by bounty eligibility, freshness, wildcard status, target type, and severity labels.
 - Include a short checklist of BBRadar follow-up tool calls and decision points.`));
 }
+function resolveFeedCursor(store, endpoint, filters, resume) {
+    const normalizedFilters = stableStringify(normalizeFeedCursorFilters(filters));
+    const key = `${endpoint}:${createHash("sha256").update(normalizedFilters).digest("hex")}`;
+    const explicitAfterId = readNumber(filters.after_id);
+    if (explicitAfterId !== undefined) {
+        return { endpoint, key, afterId: explicitAfterId, resumed: false };
+    }
+    if (!resume) {
+        return { endpoint, key, afterId: undefined, resumed: false };
+    }
+    const stored = store.get(key);
+    if (stored === undefined) {
+        throw new Error(`No in-memory ${endpoint} cursor exists for this filter set. Provide after_id once to seed it.`);
+    }
+    return { endpoint, key, afterId: stored, resumed: true };
+}
+function advanceFeedCursor(store, cursor, rawMeta) {
+    if (cursor.afterId === undefined) {
+        return undefined;
+    }
+    const meta = readObject(rawMeta);
+    const nextAfterId = readNumber(meta?.next_after_id) ?? cursor.afterId;
+    store.set(cursor.key, nextAfterId);
+    return {
+        endpoint: cursor.endpoint,
+        mode: cursor.resumed ? "resumed" : "seeded",
+        used_after_id: cursor.afterId,
+        next_after_id: nextAfterId,
+        has_more: readBoolean(meta?.has_more) ?? false,
+        stored_in_memory: true
+    };
+}
+async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudgetMs, fetchPage) {
+    const startedAt = Date.now();
+    const results = [];
+    const sourceRequests = [];
+    let currentCursor = initialCursor;
+    let lastApi;
+    let lastData;
+    let cursorPayload;
+    let pagesFetched = 0;
+    let hasMore = false;
+    let pageBudgetExhausted = false;
+    let timeBudgetExhausted = false;
+    do {
+        const api = await fetchPage(currentCursor.afterId);
+        const data = readObject(api.data);
+        const pageResults = readArray(data?.results);
+        lastApi = api;
+        lastData = data;
+        results.push(...pageResults);
+        pagesFetched += 1;
+        sourceRequests.push({
+            source: currentCursor.endpoint,
+            page: pagesFetched,
+            request_id: api.requestId,
+            upstream_request_id: api.upstreamRequestId,
+            ...apiSourceMetadata(api)
+        });
+        cursorPayload = advanceFeedCursor(store, currentCursor, data?.meta);
+        hasMore = readBoolean(readObject(data?.meta)?.has_more) === true;
+        if (currentCursor.afterId === undefined || !hasMore) {
+            break;
+        }
+        if (pagesFetched >= maxPages) {
+            pageBudgetExhausted = true;
+            break;
+        }
+        if (Date.now() - startedAt >= timeBudgetMs) {
+            timeBudgetExhausted = true;
+            break;
+        }
+        currentCursor = {
+            ...currentCursor,
+            afterId: readNumber(cursorPayload?.next_after_id) ?? currentCursor.afterId,
+            resumed: true
+        };
+    } while (true);
+    if (!lastApi) {
+        throw new Error(`No ${initialCursor.endpoint} response was collected.`);
+    }
+    return {
+        lastApi,
+        lastData,
+        results,
+        cursor: cursorPayload,
+        pagesFetched,
+        pageBudgetExhausted,
+        timeBudgetExhausted,
+        sourceRequests
+    };
+}
+function normalizeFeedCursorFilters(filters) {
+    return Object.fromEntries(Object.entries(filters)
+        .filter(([key, value]) => key !== "after_id" && key !== "page" && value !== undefined)
+        .map(([key, value]) => [key, normalizeFeedCursorFilterValue(value)]));
+}
+function normalizeFeedCursorFilterValue(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map((entry) => normalizeFeedCursorFilterValue(entry))
+            .sort((left, right) => String(left).localeCompare(String(right)));
+    }
+    return typeof value === "string" ? value.trim().toLowerCase() : value;
+}
 async function runTool(toolName, config, rateLimiter, callback) {
     const startedAt = Date.now();
     const decision = rateLimiter.consume(toolName, rateLimitForTool(toolName, config));
@@ -6434,7 +7357,7 @@ async function runTool(toolName, config, rateLimiter, callback) {
             },
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
-        }, true);
+        }, true, config.compactToolText);
     }
     try {
         const payload = await callback();
@@ -6444,21 +7367,21 @@ async function runTool(toolName, config, rateLimiter, callback) {
             ...payload,
             mcp_rate_limit: toRateLimitPayload(decision),
             mcp_timing: toolTimingPayload(toolName, durationMs)
-        });
+        }, false, config.compactToolText);
     }
     catch (error) {
         const durationMs = Date.now() - startedAt;
         recordToolMetric(toolName, durationMs, "error");
-        return toolResult(errorPayload(error, decision, toolName, durationMs), true);
+        return toolResult(errorPayload(error, decision, toolName, durationMs), true, config.compactToolText);
     }
 }
-function toolResult(payload, isError = false) {
+function toolResult(payload, isError = false, compactText = false) {
     const resourceLinks = collectResourceLinks(payload);
     return {
         content: [
             {
                 type: "text",
-                text: JSON.stringify(payload)
+                text: compactText ? compactToolText(payload, isError) : JSON.stringify(payload)
             },
             ...resourceLinks
         ],
@@ -6466,6 +7389,29 @@ function toolResult(payload, isError = false) {
         ...(isError ? { isError: true } : {})
     };
 }
+function compactToolText(payload, isError) {
+    if (isError) {
+        return JSON.stringify(stripUndefined({
+            request_id: payload.request_id,
+            error: payload.error,
+            mcp_timing: payload.mcp_timing
+        }));
+    }
+    const meta = readObject(payload.meta);
+    const returned = numberField(meta, "returned") ??
+        [
+            readArray(payload.programs).length,
+            readArray(payload.targets).length,
+            readArray(payload.changes).length,
+            readArray(payload.repository_changes).length
+        ].find((count) => count > 0);
+    return JSON.stringify(stripUndefined({
+        request_id: payload.request_id,
+        summary: "Full tool result is available in structuredContent.",
+        returned,
+        mcp_timing: payload.mcp_timing
+    }));
+}
 function promptResult(text) {
     return {
         messages: [
@@ -6488,6 +7434,7 @@ function withApiMetadata(api, payload) {
         upstream_request_id: api.upstreamRequestId,
         cache: stripUndefined({
             hit: api.cached,
+            stale_while_revalidate: api.stale,
             coalesced_live_request: api.coalesced,
             expires_at: api.cacheExpiresAt
         }),
@@ -6605,18 +7552,25 @@ function compactRecord(values) {
     }));
 }
 function latestAddedTargetsQuery(input) {
-    return {
+    return stripUndefined({
         change_type: "added",
         target_type: input.target_type,
+        platforms: input.platforms.length > 0 ? input.platforms : undefined,
+        min_reward: input.min_reward,
+        reward_threshold_mode: input.reward_threshold_mode,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: input.require_known_report_count,
+        include_unknown_report_count: input.include_unknown_report_count,
         include_out_of_scope: input.include_out_of_scope,
         include_ineligible: input.include_ineligible,
         recent_changes_page_size: input.recent_changes_page_size,
+        max_results: input.max_results,
         include_full_target_list: input.include_full_target_list,
         full_target_list_mode: input.full_target_list_mode,
         full_target_limit: input.full_target_limit,
         full_list_include_out_of_scope: input.full_list_include_out_of_scope,
         full_list_include_ineligible: input.full_list_include_ineligible
-    };
+    });
 }
 function formatTargetList(targets, mode) {
     if (mode === "identifiers") {
@@ -6633,7 +7587,11 @@ function compactTarget(target) {
         target_type: stringField(target, "target_type"),
         in_scope: readBoolean(target.in_scope),
         eligible_for_bounty: readBoolean(target.eligible_for_bounty),
-        wildcard: readBoolean(target.wildcard)
+        wildcard: readBoolean(target.wildcard),
+        target_opportunity_score: readNumber(target.target_opportunity_score),
+        target_opportunity_label: stringField(target, "target_opportunity_label"),
+        competition_risk: stringField(target, "competition_risk"),
+        why_this_target: stringField(target, "why_this_target")
     });
 }
 function targetIdentifier(target) {