@bbradar/mcp 0.1.20 → 0.2.0

package/dist/server.js

@@ -1,11 +1,12 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BBRadarApiError } from "./bbradarClient.js";
+import { NumericCursorStore } from "./cursorStore.js";
 import { stableStringify, stripUndefined } from "./json.js";
 import { FixedWindowRateLimiter } from "./rateLimit.js";
-import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
-const SERVER_VERSION = "0.1.19";
+import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeRepositoryChange, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
+const SERVER_VERSION = "0.2.0";
 const MAX_PROGRAMS_PER_SEARCH = 100;
 const MAX_TARGET_EXPORT = 500;
 const MAX_RECENT_CHANGES = 100;
@@ -29,10 +30,13 @@ const MAX_FILTER_DISCOVERY_PAGES = 5;
 const DEFAULT_FILTER_TARGET_SAMPLE_PROGRAMS = 10;
 const MAX_FILTER_TARGET_SAMPLE_PROGRAMS = 25;
 const MAX_LOCAL_EXPORT_RESOURCES = 25;
+const MAX_LOCAL_EXPORT_BYTES = 64 * 1024 * 1024;
+const LOCAL_EXPORT_TTL_MS = 10 * 60 * 1000;
 const EXPORT_PREVIEW_LIMIT = 25;
 const STALE_PROGRAM_ID_RESOLVE_PAGES = 1;
 const STALE_PROGRAM_ID_RESOLVE_BUDGET = 12;
 const PROGRAM_FALLBACK_CACHE_MAX_ENTRIES = 200;
+const MAX_IN_MEMORY_FEED_CURSORS = 500;
 const MAX_RESOLVE_SEARCH_QUERIES = 4;
 const FAST_RESOLVE_SEARCH_QUERIES = 2;
 const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 96;
@@ -45,6 +49,7 @@ const CORE_TOOL_NAMES = new Set([
     "get_program_eligible_targets_by_name",
     "get_program_targets",
     "get_recent_changes",
+    "get_repository_changes",
     "get_latest_added_targets",
     "get_opportunities",
     "find_programs",
@@ -54,6 +59,11 @@ const CORE_TOOL_NAMES = new Set([
     "get_mcp_status",
     "export_targets"
 ]);
+const TOOL_ENDPOINT_REQUIREMENTS = {
+    get_repository_changes: "repository_changes",
+    export_targets: "target_export",
+    get_opportunities: "opportunities"
+};
 const PROGRAM_ID_PLATFORM_GUESSES = [
     "HackerOne",
     "BugCrowd",
@@ -159,6 +169,7 @@ const TARGET_QUERY_STOP_WORDS = new Set([
 ]);
 const targetListModeSchema = z.enum(["identifiers", "compact", "full"]);
 const changeListModeSchema = z.enum(["compact", "full"]);
+const repositoryChangeListModeSchema = z.enum(["compact", "full"]);
 const programListModeSchema = z.enum(["compact", "full"]);
 const rewardThresholdModeSchema = z.enum(["max_at_least", "min_at_least"]);
 const vdpModeSchema = z.enum(["include", "exclude", "only_likely", "only_known_no_bounty"]);
@@ -227,6 +238,8 @@ const pageSchema = z.number().int().min(1).default(1);
 const programsPageSizeSchema = z.number().int().min(1).max(MAX_PROGRAMS_PER_SEARCH).default(20);
 const recentChangesPageSizeSchema = z.number().int().min(1).max(MAX_RECENT_CHANGES).default(50);
 const opportunityLevelSchema = z.enum(["elite", "hot", "strong", "potential"]);
+const targetOpportunityLabelSchema = z.enum(["Elite Target", "Strong Target", "Potential Target", "Normal"]);
+const competitionRiskSchema = z.enum(["Low", "Medium", "High", "Unknown"]);
 const programSortSchema = z
     .enum([
     "best_match",
@@ -278,6 +291,7 @@ function toolTimingOutputSchema() {
 function cacheOutputSchema() {
     return z.object({
         hit: z.boolean(),
+        stale_while_revalidate: z.boolean().optional(),
         coalesced_live_request: z.boolean().optional(),
         expires_at: z.string().optional()
     });
@@ -364,10 +378,12 @@ const programCandidatePresetInputSchema = {
     output_mode: programListModeSchema.default("compact"),
     upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
 };
-function createProfiledToolRegistrar(server, profile) {
+function createProfiledToolRegistrar(server, profile, client) {
     return (name, toolConfig, callback) => {
         const registeredTool = server.registerTool(name, toolConfig, callback);
-        if (profile === "core" && !CORE_TOOL_NAMES.has(name)) {
+        const requiredEndpoint = TOOL_ENDPOINT_REQUIREMENTS[name];
+        if ((profile === "core" && !CORE_TOOL_NAMES.has(name)) ||
+            (requiredEndpoint !== undefined && !client.supportsEndpoint(requiredEndpoint))) {
             registeredTool.disable();
         }
         return registeredTool;
@@ -391,7 +407,9 @@ export function createBbradarServer(client, config) {
             "Partial program name + action: run_program_name_action. Partial program name only: resolve_program.",
             "Default to bounty-eligible in-scope data. Include out-of-scope, ineligible, VDP, disclosure-only, or no-bounty data only when the user explicitly asks.",
             "Recently updated programs across platforms: find_recently_updated_programs. Do not infer a platform such as Immunefi unless the user explicitly names it.",
+            "Self-Hosted programs use Self-Hosted:slug ids and are available through program search, exact detail, and target tools. Respect data_capabilities; do not infer missing opportunity, report-count, target-change, submission-cost, or repository signals.",
             "Freshness: find_recently_updated_programs, get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
+            "Repository activity: get_repository_changes defaults to compact program-only events. Seed with after_id, then resume the in-memory per-filter cursor.",
             "Discovery: find_program_candidates, find_wildcard_programs, find_recently_added_wildcards, find_low_competition_high_reward, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
@@ -402,13 +420,26 @@ export function createBbradarServer(client, config) {
     }, {
         instructions: instructions.join("\n")
     });
-    const registerTool = createProfiledToolRegistrar(server, config.toolProfile);
+    const registerTool = createProfiledToolRegistrar(server, config.toolProfile, client);
     const rateLimiter = new FixedWindowRateLimiter();
     const exportStore = new Map();
+    const continuationStore = new Map();
+    const feedCursorStore = new NumericCursorStore(config.cursorStatePath, MAX_IN_MEMORY_FEED_CURSORS);
+    const maxProgramsPageSize = client.endpointNumber("programs", "max_page_size", MAX_PROGRAMS_PER_SEARCH);
+    const maxProgramTargetsPageSize = client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM);
+    const maxTargetChangesPageSize = client.endpointNumber("target_changes", "max_page_size", MAX_RECENT_CHANGES);
+    const maxRepositoryChangesPageSize = client.endpointNumber("repository_changes", "max_page_size", MAX_RECENT_CHANGES);
+    const maxTargetExport = client.endpointNumber("target_export", "max_targets", MAX_TARGET_EXPORT);
+    const maxTargetExportProgramIds = client.endpointNumber("target_export", "max_program_ids", 50);
+    const programsPageSizeSchema = z.number().int().min(1).max(maxProgramsPageSize).default(Math.min(20, maxProgramsPageSize));
+    const recentChangesPageSizeSchema = z.number().int().min(1).max(maxTargetChangesPageSize).default(Math.min(50, maxTargetChangesPageSize));
+    const repositoryChangesPageSizeSchema = z.number().int().min(1).max(maxRepositoryChangesPageSize).default(Math.min(50, maxRepositoryChangesPageSize));
+    const acceptedTargetLimitSchema = z.number().int().min(1).max(maxProgramTargetsPageSize);
     registerTool("search_programs", {
         title: "Search BBRadar Programs",
-        description: `List active programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
+        description: `Search or list active platform and Self-Hosted programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
+            search: searchTextSchema.optional().describe("Server-side program name, handle, platform, policy-host, or target search."),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
@@ -505,8 +536,8 @@ export function createBbradarServer(client, config) {
             language_tags: languageTagListSchema(),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(25),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(25, maxProgramTargetsPageSize)),
             group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
             target_list_mode: targetListModeSchema.default("identifiers"),
             max_resolve_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
@@ -549,6 +580,7 @@ export function createBbradarServer(client, config) {
             resolved_program: jsonRecordSchema().optional(),
             program_id: z.string().optional(),
             targets: z.array(z.unknown()).optional(),
+            continuation: jsonRecordSchema().optional(),
             warnings: z.array(z.string()).optional(),
             upstream_budget: jsonRecordSchema().optional(),
             ranking_scope: jsonRecordSchema().optional(),
@@ -558,14 +590,19 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("get_program_eligible_targets_by_name", config, rateLimiter, async () => getProgramEligibleTargetsByName(client, config, args)));
     registerTool("get_program_targets", {
         title: "Get Program Targets",
-        description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${MAX_TARGETS_PER_PROGRAM}.`,
+        description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${maxProgramTargetsPageSize}.`,
         inputSchema: {
             program_id: programIdentifierSchema,
+            search: searchTextSchema.optional(),
+            target_type: filterValueSchema().optional(),
+            min_target_score: z.number().int().min(0).max(100).optional(),
+            target_opportunity_label: targetOpportunityLabelSchema.optional(),
+            competition_risk: competitionRiskSchema.optional(),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             strict_scope_filter: z.boolean().default(true),
             offset: z.number().int().min(0).default(0),
-            limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
+            limit: z.number().int().min(1).max(maxProgramTargetsPageSize).default(Math.min(100, maxProgramTargetsPageSize)),
             output_mode: targetListModeSchema.default("compact")
         },
         outputSchema: {
@@ -576,13 +613,21 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
-        return runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
+        const payload = await runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
+        return applyCollectionContinuation(payload, "targets", "program targets", continuationStore, config);
     }));
     registerTool("get_recent_changes", {
         title: "Get Recent Target Changes",
         description: `List recent target changes. page_size max ${MAX_RECENT_CHANGES}.`,
         inputSchema: {
             change_type: z.enum(["added", "updated", "removed"]).optional(),
+            after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns changes after this id in ascending order."),
+            resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
+            max_cursor_pages: z.number().int().min(1).max(10).default(2),
+            cursor_time_budget_ms: z.number().int().min(100).max(10_000).default(3_000),
+            min_target_score: z.number().int().min(0).max(100).optional(),
+            target_opportunity_label: targetOpportunityLabelSchema.optional(),
+            competition_risk: competitionRiskSchema.optional(),
             include_removed: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             include_out_of_scope: z.boolean().default(false),
@@ -597,25 +642,102 @@ export function createBbradarServer(client, config) {
             ...apiEnvelopeOutputShape(),
             changes: z.array(jsonRecordSchema()).optional(),
             meta: jsonRecordSchema().optional(),
-            facets: jsonRecordSchema().optional()
+            facets: jsonRecordSchema().optional(),
+            cursor: jsonRecordSchema().optional(),
+            continuation: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_recent_changes", config, rateLimiter, async () => {
-        const { output_mode, ...filters } = args;
-        const api = await client.getRecentChanges(toQuery(filters));
-        const data = readObject(api.data);
+        const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
+        const cursor = resolveFeedCursor(feedCursorStore, "target_changes", filters, resume_cursor);
+        const { min_target_score, target_opportunity_label, competition_risk, ...upstreamFilters } = filters;
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRecentChanges(toQuery({
+            ...upstreamFilters,
+            minTargetScore: min_target_score,
+            targetOpportunityLabel: target_opportunity_label,
+            competitionRisk: competition_risk,
+            after_id: afterId,
+            page: afterId === undefined ? filters.page : 1
+        })));
+        const api = collected.lastApi;
+        const data = collected.lastData;
         const sanitizedMeta = readObject(sanitizeJson(data?.meta));
-        const changes = readArray(data?.results)
+        const changes = collected.results
             .map((change) => sanitizeChange(change, config.webBaseUrl))
             .map((change) => formatChange(change, output_mode));
-        return withApiMetadata(api, {
+        return applyCollectionContinuation(withApiMetadata(api, {
             changes,
             meta: stripUndefined({
                 ...(sanitizedMeta ?? {}),
-                output_mode
+                output_mode,
+                pages_fetched: collected.pagesFetched,
+                returned_across_pages: changes.length,
+                cursor_page_budget_exhausted: collected.pageBudgetExhausted,
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted
             }),
-            facets: sanitizeJson(data?.facets)
-        });
+            facets: sanitizeJson(data?.facets),
+            cursor: collected.cursor,
+            source_requests: collected.sourceRequests.length > 1 ? collected.sourceRequests : undefined
+        }), "changes", "target changes", continuationStore, config);
+    }));
+    registerTool("get_repository_changes", {
+        title: "Get Repository Changes",
+        description: "Read-only repository push/change feed. Defaults to lightweight program summaries; use after_id for efficient incremental polling. For rewarded Web3 repository targets, call this in parallel with find_programs using the same platforms, then intersect event program ids with the ranked rewarded programs.",
+        inputSchema: {
+            after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns events after this id in ascending order."),
+            resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
+            max_cursor_pages: z.number().int().min(1).max(10).default(2),
+            cursor_time_budget_ms: z.number().int().min(100).max(10_000).default(3_000),
+            include_targets: z.boolean().default(false).describe("Include matched targets. False is faster and returns affected programs only."),
+            search: searchTextSchema.optional(),
+            platforms: platformListSchema(),
+            tags: tagListSchema(),
+            free_submission_only: z.boolean().default(false),
+            include_removed: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            include_out_of_scope: z.boolean().default(false),
+            page: pageSchema,
+            page_size: repositoryChangesPageSizeSchema,
+            output_mode: repositoryChangeListModeSchema.default("compact")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape(),
+            repository_changes: z.array(jsonRecordSchema()).optional(),
+            meta: jsonRecordSchema().optional(),
+            facets: jsonRecordSchema().optional(),
+            available_facets: jsonRecordSchema().optional(),
+            cursor: jsonRecordSchema().optional(),
+            continuation: jsonRecordSchema().optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_repository_changes", config, rateLimiter, async () => {
+        if (!client.supportsEndpoint("repository_changes")) {
+            throw new Error("The negotiated BBRadar API contract does not expose repository changes.");
+        }
+        const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
+        const cursor = resolveFeedCursor(feedCursorStore, "repository_changes", filters, resume_cursor);
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRepositoryChanges(toQuery({
+            ...filters,
+            after_id: afterId,
+            page: afterId === undefined ? filters.page : 1
+        })));
+        const api = collected.lastApi;
+        const data = collected.lastData;
+        return applyCollectionContinuation(withApiMetadata(api, {
+            repository_changes: collected.results.map((change) => sanitizeRepositoryChange(change, config.webBaseUrl)).map((change) => formatRepositoryChange(change, output_mode)),
+            meta: stripUndefined({
+                ...(readObject(sanitizeJson(data?.meta)) ?? {}),
+                output_mode,
+                pages_fetched: collected.pagesFetched,
+                returned_across_pages: collected.results.length,
+                cursor_page_budget_exhausted: collected.pageBudgetExhausted,
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted
+            }),
+            facets: sanitizeJson(data?.facets),
+            available_facets: sanitizeJson(data?.available_facets),
+            cursor: collected.cursor,
+            source_requests: collected.sourceRequests.length > 1 ? collected.sourceRequests : undefined
+        }), "repository_changes", "repository changes", continuationStore, config);
     }));
     registerTool("get_latest_added_targets", {
         title: "Get Latest Added Targets",
@@ -630,7 +752,7 @@ export function createBbradarServer(client, config) {
             include_unknown_report_count: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false).describe("Include out-of-scope."),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
-            recent_changes_page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            recent_changes_page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_results: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(10),
             include_full_target_list: z.boolean().default(true).describe("Fetch the newest matching program's complete target list. Set false for the fastest cross-program discovery."),
             full_target_list_mode: targetListModeSchema.default("identifiers"),
@@ -701,8 +823,8 @@ export function createBbradarServer(client, config) {
             include_removed: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(50),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(50, maxProgramTargetsPageSize)),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
         outputSchema: {
@@ -728,7 +850,7 @@ export function createBbradarServer(client, config) {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             language_tags: languageTagListSchema(),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_programs: z.number().int().min(1).max(50).default(10),
             sample_size: z.number().int().min(1).max(20).default(5),
             target_list_mode: targetListModeSchema.default("identifiers")
@@ -749,8 +871,8 @@ export function createBbradarServer(client, config) {
             since: isoDateTimeSchema.optional().describe("ISO datetime."),
             target_type: filterValueSchema().optional(),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(25),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(25, maxProgramTargetsPageSize)),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
         outputSchema: {
@@ -774,7 +896,7 @@ export function createBbradarServer(client, config) {
             since: isoDateTimeSchema.optional(),
             target_type: filterValueSchema().optional(),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_targets_per_program: z.number().int().min(1).max(50).default(10),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
@@ -820,14 +942,16 @@ export function createBbradarServer(client, config) {
     }));
     registerTool("find_programs", {
         title: "Find BBRadar Programs",
-        description: "Ranked program discovery with filters and compact output.",
+        description: "Ranked program discovery with positive and negative platform/surface filters and compact output. Strict-filter retries reuse cached upstream pages, so relax one local filter at a time when a narrow query returns no candidates.",
         inputSchema: {
             platforms: platformListSchema(),
+            exclude_platforms: stringListSchema("Platforms to exclude after retrieval. Use list_filters first when the user asks for a geographic/platform exclusion without naming exact platform values."),
             tags: tagListSchema(),
             scope_tags: scopeTagListSchema(),
             target_types: targetTypeListSchema(),
             language_tags: languageTagListSchema(),
             web3: z.boolean().default(false).describe("Require Web3 signals."),
+            exclude_web3: z.boolean().default(false).describe("Exclude programs with Web3, blockchain, smart-contract, crypto, DeFi, NFT, Solidity, Ethereum, or Solana signals. Use this for Web2-only discovery."),
             opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
             updated_since: isoDateTimeSchema.optional(),
             min_bounty_min: z.number().int().min(0).optional(),
@@ -1211,7 +1335,7 @@ export function createBbradarServer(client, config) {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             language_tags: languageTagListSchema(),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_programs: z.number().int().min(1).max(50).default(10),
             sample_size: z.number().int().min(1).max(20).default(5),
             target_list_mode: targetListModeSchema.default("identifiers")
@@ -1387,7 +1511,7 @@ export function createBbradarServer(client, config) {
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_bbradar_guide", config, rateLimiter, async () => ({
         request_id: randomUUID(),
-        guide: bbradarGuide(args.topic, config.toolProfile)
+        guide: bbradarGuide(args.topic, config.toolProfile, client)
     })));
     registerTool("get_mcp_status", {
         title: "Get BBRadar MCP Status",
@@ -1417,6 +1541,13 @@ export function createBbradarServer(client, config) {
             compact_tool_text: config.compactToolText,
             tool_profile: config.toolProfile,
             request_timeout_ms: config.requestTimeoutMs,
+            feed_cursors: feedCursorStore.stats(),
+            continuations: {
+                entries: continuationStore.size,
+                max_entries: MAX_LOCAL_EXPORT_RESOURCES,
+                inline_limit: config.continuationInlineLimit ?? 50,
+                ttl_ms: config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS
+            },
             validate_on_startup: config.validateOnStartup,
             transport: "stdio",
             remote_streamable_http: "not_enabled_for_local_setup",
@@ -1626,7 +1757,7 @@ export function createBbradarServer(client, config) {
             include_removed: z.boolean().default(true),
             include_ineligible: z.boolean().default(false),
             include_out_of_scope: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(50)
+            page_size: recentChangesPageSizeSchema.default(Math.min(50, maxTargetChangesPageSize))
         },
         outputSchema: {
             ...apiEnvelopeOutputShape(),
@@ -1638,16 +1769,16 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("get_program_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramDelta(client, config, { ...args, program_id: programId }))));
     registerTool("export_targets", {
         title: "Export BBRadar Targets",
-        description: `Read-only target export. limit max ${MAX_TARGET_EXPORT}.`,
+        description: `Read-only target export. limit max ${maxTargetExport}.`,
         inputSchema: {
-            program_ids: z.array(programIdentifierSchema).max(50).default([]),
+            program_ids: z.array(programIdentifierSchema).max(maxTargetExportProgramIds).default([]),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             opportunity_levels: z.array(z.enum(["elite", "hot", "strong", "potential"])).max(4).default([]),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             format: z.enum(["json", "csv"]).default("json"),
-            limit: z.number().int().min(1).max(MAX_TARGET_EXPORT).default(MAX_TARGET_EXPORT)
+            limit: z.number().int().min(1).max(maxTargetExport).default(maxTargetExport)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape(),
@@ -1694,12 +1825,12 @@ export function createBbradarServer(client, config) {
         }
     }));
     registerPrompts(server, config.toolProfile);
-    registerResources(server, client, config, exportStore);
+    registerResources(server, client, config, exportStore, continuationStore);
     return server;
 }
-function bbradarGuide(topic, profile) {
+function bbradarGuide(topic, profile, client) {
     if (profile === "core") {
-        return coreBbradarGuide(topic);
+        return coreBbradarGuide(topic, client);
     }
     const primaryEntryPoints = [
         {
@@ -1732,6 +1863,11 @@ function bbradarGuide(topic, profile) {
             first_tool: "find_program_candidates",
             then: "Use get_program_brief on the best program_id if the user wants details."
         },
+        {
+            user_goal: "Web2 programs with broad scope, good rewards, recent target activity, and excluded platforms",
+            first_tool: "list_filters",
+            then: "Resolve the excluded platform names, then call find_programs with exclude_platforms, exclude_web3=true, exclude_non_web=true, reward/scope/freshness thresholds, and sort_by=most_new_targets. If strict local filters return zero, relax one threshold and retry; cached source pages make the retry cheap."
+        },
         {
             user_goal: "named program summary",
             first_tool: "run_program_name_action",
@@ -1752,6 +1888,22 @@ function bbradarGuide(topic, profile) {
             first_tool: "find_recently_updated_programs",
             then: "Use get_latest_added_targets for global added targets, or check_program_new_targets when the user names one program."
         },
+        {
+            user_goal: "repository changes or repository polling",
+            first_tool: "get_repository_changes",
+            arguments: { include_targets: false, max_cursor_pages: 2 },
+            then: "For incremental polling, seed once with after_id and later set resume_cursor=true with the same filters."
+        },
+        {
+            user_goal: "rewarded Web3 targets with recent repository changes on named platforms",
+            first_tool: "get_repository_changes",
+            arguments: { platforms: ["requested platforms"], include_targets: true, output_mode: "full", page_size: 100 },
+            parallel_with: {
+                tool: "find_programs",
+                arguments: { platforms: ["requested platforms"], web3: true, require_bounty: true, min_bounty_max: 5000, sort_by: "highest_reward", include_target_samples: false }
+            },
+            then: "Intersect repository-event program ids with ranked program ids. Targets belong to the repository event association even when target rows omit program_id; keep strong target scores/labels and only the requested program platforms."
+        },
         {
             user_goal: "latest added wildcard targets with platform, reward, or report-count filters",
             first_tool: "get_latest_added_targets",
@@ -1797,10 +1949,12 @@ function bbradarGuide(topic, profile) {
     };
     const filters = {
         platforms: "Only set when the user explicitly names a platform. Do not infer Immunefi, HackerOne, etc.",
+        exclude_platforms: "Use exact observed values from list_filters for user-requested platform or geographic exclusions.",
         tags: "Broad combined tag filter across scope, language, and target-type signals.",
         scope_tags: "Scope category signals such as domain, api, mobile, smart-contract, wildcard.",
         target_types: "Target-kind signals such as domain, api, url, mobile, smart-contract.",
         language_tags: "Technology/language signals such as javascript, solidity, web3, php, python.",
+        exclude_web3: "Set true for Web2-only requests.",
         vdp_mode: "Default exclude. Include VDP/no-bounty data only when asked."
     };
     const examples = [
@@ -1851,19 +2005,25 @@ function bbradarGuide(topic, profile) {
             require_bounty: true
         },
         primary_entry_points: topic === "start" ? primaryEntryPoints : primaryEntryPoints.filter((entry) => entry.tool !== "get_bbradar_guide"),
-        decision_tree: decisionTree.filter((entry) => topic === "start" || guideEntryMatchesTopic(topic, entry)),
+        decision_tree: decisionTree.filter((entry) => toolAvailableForContract(client, String(entry.first_tool)) &&
+            (topic === "start" || guideEntryMatchesTopic(topic, entry))),
         filters,
         advanced_tools: advancedTools,
         examples
     };
 }
-function coreBbradarGuide(topic) {
+function coreBbradarGuide(topic, client) {
     const decisionTree = [
         {
             user_goal: "find programs to hunt",
             first_tool: "find_programs",
             arguments: { max_results: 10, output_mode: "compact" }
         },
+        {
+            user_goal: "Web2 programs with broad scope, good rewards, recent target activity, and excluded platforms",
+            first_tool: "list_filters",
+            then: "Resolve excluded platform names, then call find_programs with exclude_platforms, exclude_web3=true, exclude_non_web=true, reward/scope/freshness thresholds, and sort_by=most_new_targets. Relax one local threshold on an empty result; cached source pages make retries fast."
+        },
         {
             user_goal: "named program summary or action",
             first_tool: "run_program_name_action",
@@ -1884,6 +2044,21 @@ function coreBbradarGuide(topic) {
             first_tool: "get_recent_changes",
             then: "Use get_latest_added_targets when only newly added targets are needed."
         },
+        {
+            user_goal: "repository changes or repository polling",
+            first_tool: "get_repository_changes",
+            arguments: { include_targets: false, max_cursor_pages: 2 }
+        },
+        {
+            user_goal: "rewarded Web3 targets with recent repository changes on named platforms",
+            first_tool: "get_repository_changes",
+            arguments: { platforms: ["requested platforms"], include_targets: true, output_mode: "full", page_size: 100 },
+            parallel_with: {
+                tool: "find_programs",
+                arguments: { platforms: ["requested platforms"], web3: true, require_bounty: true, min_bounty_max: 5000, sort_by: "highest_reward", include_target_samples: false }
+            },
+            then: "Intersect event program ids with ranked program ids. Treat targets as event-level associations when target rows omit program_id, keep strong target scores/labels, and discard non-requested associated platforms."
+        },
         {
             user_goal: "export targets",
             first_tool: "export_targets",
@@ -1914,10 +2089,15 @@ function coreBbradarGuide(topic) {
             "find_programs_by_target",
             "get_bbradar_guide"
         ],
-        decision_tree: decisionTree.filter((entry) => topic === "start" || guideEntryMatchesTopic(topic, entry)),
-        available_tools: [...CORE_TOOL_NAMES]
+        decision_tree: decisionTree.filter((entry) => toolAvailableForContract(client, String(entry.first_tool)) &&
+            (topic === "start" || guideEntryMatchesTopic(topic, entry))),
+        available_tools: [...CORE_TOOL_NAMES].filter((name) => toolAvailableForContract(client, name))
     };
 }
+function toolAvailableForContract(client, toolName) {
+    const endpoint = TOOL_ENDPOINT_REQUIREMENTS[toolName];
+    return endpoint === undefined || client.supportsEndpoint(endpoint);
+}
 function guideEntryMatchesTopic(topic, entry) {
     const goal = typeof entry.user_goal === "string" ? entry.user_goal : "";
     const firstTool = typeof entry.first_tool === "string" ? entry.first_tool : "";
@@ -1944,15 +2124,52 @@ function guideEntryMatchesTopic(topic, entry) {
     }
     return true;
 }
-function registerResources(server, client, config, exportStore) {
+function registerResources(server, client, config, exportStore, continuationStore) {
+    server.registerResource("continuation", new ResourceTemplate("bbradar://continuations{?continuation_id,offset,limit}", { list: undefined }), {
+        title: "BBRadar Result Continuation",
+        description: "Bounded, short-lived in-memory continuation page for a large tool result.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const continuationId = uri.searchParams.get("continuation_id") ?? "";
+        pruneExpiredContinuations(continuationStore);
+        const stored = continuationStore.get(continuationId);
+        if (!stored) {
+            return jsonResource(uri.toString(), {
+                request_id: randomUUID(),
+                error: { message: "Continuation not found or expired from local memory." }
+            });
+        }
+        const offset = boundedResourceInteger(uri.searchParams.get("offset"), 0, 0, stored.items.length);
+        const limit = boundedResourceInteger(uri.searchParams.get("limit"), config.continuationInlineLimit ?? 50, 1, 100);
+        const items = stored.items.slice(offset, offset + limit);
+        const nextOffset = offset + items.length;
+        const hasMore = nextOffset < stored.items.length;
+        return jsonResource(uri.toString(), {
+            request_id: randomUUID(),
+            continuation_id: continuationId,
+            label: stored.label,
+            items,
+            meta: {
+                offset,
+                limit,
+                returned: items.length,
+                total: stored.items.length,
+                has_more: hasMore,
+                next_resource_uri: hasMore
+                    ? continuationResourceUri(continuationId, nextOffset, limit)
+                    : undefined
+            }
+        });
+    });
     server.registerResource("target-export", new ResourceTemplate("bbradar://exports{?export_id}", { list: undefined }), {
         title: "BBRadar Target Export",
-        description: "In-memory local target export payload by export_id query parameter.",
+        description: "Bounded, short-lived in-memory target export payload by export_id query parameter.",
         mimeType: "application/json"
     }, async (uri) => {
         const exportId = uri.searchParams.get("export_id") ?? "";
-        const payload = exportStore.get(exportId);
-        if (!payload) {
+        pruneExpiredExports(exportStore);
+        const storedExport = exportStore.get(exportId);
+        if (!storedExport) {
             return jsonResource(uri.toString(), {
                 request_id: randomUUID(),
                 error: {
@@ -1963,7 +2180,7 @@ function registerResources(server, client, config, exportStore) {
         return jsonResource(uri.toString(), {
             request_id: randomUUID(),
             export_id: exportId,
-            export: payload
+            export: storedExport.payload
         });
     });
     server.registerResource("program", new ResourceTemplate("bbradar://program{?program_id}", { list: undefined }), {
@@ -3498,6 +3715,10 @@ function programsByTargetResult(input, warnings, sourceRequests, matches, budget
     });
 }
 async function searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests) {
+    if (!client.supportsEndpoint("target_search")) {
+        warnings.push("The negotiated API contract does not expose direct target search; using sampled program target lists.");
+        return undefined;
+    }
     const searchQueries = targetApiSearchQueries(input.target_query);
     const grouped = new Map();
     let rawMatchesScanned = 0;
@@ -3519,7 +3740,7 @@ async function searchProgramsByTargetApi(client, config, input, budget, warnings
                 include_out_of_scope: input.include_out_of_scope,
                 include_ineligible: input.include_ineligible,
                 page: 1,
-                page_size: Math.max(input.max_results * input.max_targets_per_program, input.max_results)
+                page_size: Math.min(client.endpointNumber("target_search", "max_page_size", MAX_TARGETS_PER_PROGRAM), Math.max(input.max_results * input.max_targets_per_program, input.max_results))
             });
             refundBudgetIfNoUpstreamRequest(budget, api);
         }
@@ -4096,8 +4317,18 @@ function latestAddedProgramMatches(change, input, platformFilters) {
     return true;
 }
 async function getProgramTargetsPayload(client, input, programId) {
-    const api = await client.getProgramTargets(programId);
+    const api = await client.getProgramTargets(programId, {
+        search: input.search,
+        target_type: input.target_type,
+        eligibility: input.include_ineligible ? "all" : "eligible",
+        minTargetScore: input.min_target_score,
+        targetOpportunityLabel: input.target_opportunity_label,
+        competitionRisk: input.competition_risk,
+        page: 1,
+        page_size: client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM)
+    });
     const data = readObject(api.data);
+    const upstreamMeta = readObject(data?.meta);
     const rawTargets = readArray(data?.targets);
     const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, input));
     const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
@@ -4108,10 +4339,13 @@ async function getProgramTargetsPayload(client, input, programId) {
             offset: input.offset,
             limit: input.limit,
             output_mode: input.output_mode,
-            total_active_targets: rawTargets.length,
+            total_active_targets: readNumber(upstreamMeta?.total) ?? rawTargets.length,
             total_after_filters: sanitizedTargets.length,
             returned: targets.length,
-            has_more: input.offset + input.limit < sanitizedTargets.length,
+            has_more: input.offset + input.limit < sanitizedTargets.length || readBoolean(upstreamMeta?.has_more) === true,
+            upstream_has_more: readBoolean(upstreamMeta?.has_more),
+            possibly_incomplete: readBoolean(upstreamMeta?.has_more) === true,
+            data_capabilities: readObject(upstreamMeta?.data_capabilities),
             target_source: "program_targets"
         }
     });
@@ -5196,6 +5430,79 @@ function programTargetsResourceUri(programId) {
 function exportResourceUri(exportId) {
     return `bbradar://exports?export_id=${encodeURIComponent(exportId)}`;
 }
+function continuationResourceUri(continuationId, offset, limit) {
+    return `bbradar://continuations?continuation_id=${encodeURIComponent(continuationId)}&offset=${offset}&limit=${limit}`;
+}
+function applyCollectionContinuation(payload, field, label, store, config) {
+    const items = Array.isArray(payload[field]) ? payload[field] : undefined;
+    const inlineLimit = Math.min(100, Math.max(1, config.continuationInlineLimit ?? 50));
+    if (!items || items.length <= inlineLimit) {
+        return payload;
+    }
+    const continuationId = randomUUID();
+    const expiresAt = Date.now() + (config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS);
+    const stored = rememberContinuation(store, continuationId, label, items, expiresAt);
+    if (!stored) {
+        return {
+            ...payload,
+            [field]: items.slice(0, inlineLimit),
+            warnings: uniqueStrings([
+                ...readArray(payload.warnings).filter((entry) => typeof entry === "string"),
+                "The complete result exceeded the local continuation-store byte limit; only the inline prefix is available."
+            ])
+        };
+    }
+    return {
+        ...payload,
+        [field]: items.slice(0, inlineLimit),
+        continuation: {
+            continuation_id: continuationId,
+            resource_uri: continuationResourceUri(continuationId, inlineLimit, inlineLimit),
+            collection: field,
+            total: items.length,
+            inline_returned: inlineLimit,
+            remaining: items.length - inlineLimit,
+            expires_at: new Date(expiresAt).toISOString()
+        }
+    };
+}
+function rememberContinuation(store, id, label, items, expiresAt) {
+    const byteLength = Buffer.byteLength(JSON.stringify(items), "utf8");
+    pruneExpiredContinuations(store);
+    if (byteLength > MAX_LOCAL_EXPORT_BYTES) {
+        return false;
+    }
+    while (store.size >= MAX_LOCAL_EXPORT_RESOURCES ||
+        retainedContinuationBytes(store) + byteLength > MAX_LOCAL_EXPORT_BYTES) {
+        const oldest = store.keys().next().value;
+        if (oldest === undefined) {
+            break;
+        }
+        store.delete(oldest);
+    }
+    store.set(id, { items, label, byteLength, expiresAt });
+    return true;
+}
+function pruneExpiredContinuations(store, now = Date.now()) {
+    for (const [id, value] of store) {
+        if (value.expiresAt <= now) {
+            store.delete(id);
+        }
+    }
+}
+function retainedContinuationBytes(store) {
+    let total = 0;
+    for (const value of store.values()) {
+        total += value.byteLength;
+    }
+    return total;
+}
+function boundedResourceInteger(raw, fallback, minimum, maximum) {
+    const parsed = raw === null ? fallback : Number.parseInt(raw, 10);
+    return Number.isFinite(parsed)
+        ? Math.min(maximum, Math.max(minimum, parsed))
+        : fallback;
+}
 function jsonResource(uri, payload) {
     return {
         contents: [
@@ -5208,41 +5515,86 @@ function jsonResource(uri, payload) {
     };
 }
 function rememberExport(exportStore, exportId, payload) {
+    const now = Date.now();
+    const byteLength = Buffer.byteLength(JSON.stringify(payload), "utf8");
+    pruneExpiredExports(exportStore, now);
     if (exportStore.has(exportId)) {
         exportStore.delete(exportId);
     }
-    while (exportStore.size >= MAX_LOCAL_EXPORT_RESOURCES) {
+    while (exportStore.size >= MAX_LOCAL_EXPORT_RESOURCES ||
+        retainedExportBytes(exportStore) + byteLength > MAX_LOCAL_EXPORT_BYTES) {
         const oldestKey = exportStore.keys().next().value;
         if (oldestKey === undefined) {
             break;
         }
         exportStore.delete(oldestKey);
     }
-    exportStore.set(exportId, payload);
+    exportStore.set(exportId, {
+        payload,
+        byteLength,
+        expiresAt: now + LOCAL_EXPORT_TTL_MS
+    });
+}
+function pruneExpiredExports(exportStore, now = Date.now()) {
+    for (const [exportId, storedExport] of exportStore) {
+        if (storedExport.expiresAt <= now) {
+            exportStore.delete(exportId);
+        }
+    }
+}
+function retainedExportBytes(exportStore) {
+    let total = 0;
+    for (const storedExport of exportStore.values()) {
+        total += storedExport.byteLength;
+    }
+    return total;
 }
 function previewExportPayload(payload) {
+    if (typeof payload === "string") {
+        return previewExportText(payload);
+    }
     if (Array.isArray(payload)) {
         return payload.slice(0, EXPORT_PREVIEW_LIMIT);
     }
-    if (readObject(payload) && Array.isArray(payload.targets)) {
+    const object = readObject(payload);
+    if (object && typeof object.content === "string") {
         return {
-            ...payload,
-            targets: payload.targets.slice(0, EXPORT_PREVIEW_LIMIT)
+            ...object,
+            content: previewExportText(object.content)
+        };
+    }
+    if (object && Array.isArray(object.targets)) {
+        return {
+            ...object,
+            targets: object.targets.slice(0, EXPORT_PREVIEW_LIMIT)
         };
     }
     return payload;
 }
 function previewExportCount(payload) {
+    if (typeof payload === "string") {
+        return Math.min(Math.max(0, payload.split(/\r?\n/).length - 1), EXPORT_PREVIEW_LIMIT);
+    }
     if (Array.isArray(payload)) {
         return Math.min(payload.length, EXPORT_PREVIEW_LIMIT);
     }
     const object = readObject(payload);
+    if (typeof object?.content === "string") {
+        return Math.min(Math.max(0, object.content.split(/\r?\n/).length - 1), EXPORT_PREVIEW_LIMIT);
+    }
     const targets = object?.targets;
     if (Array.isArray(targets)) {
         return Math.min(targets.length, EXPORT_PREVIEW_LIMIT);
     }
     return payload === undefined || payload === null ? 0 : 1;
 }
+function previewExportText(payload) {
+    const lines = payload.split(/\r?\n/);
+    const preview = lines.slice(0, EXPORT_PREVIEW_LIMIT + 1).join("\n");
+    return lines.length > EXPORT_PREVIEW_LIMIT + 1
+        ? `${preview}\n[preview truncated; read the export resource for the complete payload]`
+        : preview;
+}
 function collectResourceLinks(payload) {
     const links = new Map();
     for (const program of extractProgramsFromPayload(payload)) {
@@ -5284,6 +5636,19 @@ function collectResourceLinks(payload) {
             mimeType: "application/json"
         });
     }
+    const continuation = readObject(payload.continuation);
+    const continuationUri = stringField(continuation, "resource_uri");
+    const continuationId = stringField(continuation, "continuation_id");
+    if (continuationUri && continuationId) {
+        links.set(continuationUri, {
+            type: "resource_link",
+            uri: continuationUri,
+            name: `${continuationId} continuation`,
+            title: "Result continuation",
+            description: "Read the next bounded page of this local in-memory result.",
+            mimeType: "application/json"
+        });
+    }
     return [...links.values()];
 }
 function extractProgramsFromPayload(payload) {
@@ -5333,9 +5698,18 @@ function compactProgram(program) {
         handle: stringField(program, "handle"),
         name: stringField(program, "name"),
         platform: stringField(program, "platform"),
+        catalog: stringField(program, "catalog"),
+        program_type: stringField(program, "program_type"),
         platform_url: stringField(program, "platform_url"),
         bbradar_url: stringField(program, "bbradar_url"),
+        policy_url: stringField(program, "policy_url"),
+        reporting_url: stringField(program, "reporting_url"),
+        reward_status: stringField(program, "reward_status"),
+        data_capabilities: readObject(program.data_capabilities),
         opportunity_tag: readObject(program.opportunity_tag),
+        competition_risk: stringField(program, "competition_risk"),
+        competition_risk_reason: stringField(program, "competition_risk_reason"),
+        submission_cost: readObject(program.submission_cost),
         reward_range: readObject(program.reward_range),
         public_report_count: readNumber(program.public_report_count),
         public_report_count_label: stringField(program, "public_report_count_label"),
@@ -5385,6 +5759,30 @@ function formatChange(change, mode) {
         target: target ? compactTarget(target) : undefined
     });
 }
+function formatRepositoryChange(change, mode) {
+    if (mode === "full") {
+        return change;
+    }
+    const repository = readObject(change.repository);
+    return stripUndefined({
+        id: change.id,
+        event_type: stringField(change, "event_type"),
+        ref_name: stringField(change, "ref_name"),
+        observed_at: stringField(change, "observed_at"),
+        repository: repository
+            ? stripUndefined({
+                provider: stringField(repository, "provider"),
+                full_name: stringField(repository, "full_name"),
+                url: stringField(repository, "url")
+            })
+            : undefined,
+        changes_url: stringField(change, "changes_url"),
+        programs: readArray(change.programs).map((program) => formatProgram(readObject(program) ?? {}, "compact")),
+        targets: Array.isArray(change.targets)
+            ? change.targets.map((target) => compactTarget(readObject(target) ?? {}))
+            : undefined
+    });
+}
 function buildTargetScopeSummary(targets, mode, groupLimit, includeOutOfScope, includeIneligible) {
     const bountyTargets = targets.filter((target) => target.in_scope === true && target.eligible_for_bounty === true);
     const groups = {
@@ -5636,6 +6034,14 @@ function candidateLooksContestLike(candidate) {
     return tagIncludesAnyNormalized(candidate.normalizedSearchSignals, WEB3_CONTEST_SIGNALS);
 }
 function candidateHasKnownNoBounty(candidate) {
+    const programType = normalizeTag(stringField(candidate.program, "program_type") ?? "");
+    const rewardStatus = normalizeTag(stringField(candidate.program, "reward_status") ?? "");
+    if (programType === "vdp" || rewardStatus === "no_reward" || rewardStatus === "no reward") {
+        return true;
+    }
+    if (programType === "paid" || rewardStatus === "paid") {
+        return false;
+    }
     if (candidate.bountyMin === undefined && candidate.bountyMax === undefined) {
         return false;
     }
@@ -5824,6 +6230,16 @@ function normalizeFindProgramsInput(input) {
     const warnings = [];
     const normalized = { ...input };
     normalized.vdp_mode ??= "exclude";
+    normalized.exclude_platforms = uniqueStrings(normalized.exclude_platforms ?? []);
+    if (normalized.web3 && normalized.exclude_web3) {
+        normalized.web3 = false;
+        warnings.push("exclude_web3=true took precedence over the contradictory web3=true filter.");
+    }
+    const includedPlatforms = new Set(normalized.platforms.map(normalizeTag));
+    const overlappingPlatforms = normalized.exclude_platforms.filter((platform) => includedPlatforms.has(normalizeTag(platform)));
+    if (overlappingPlatforms.length > 0) {
+        warnings.push(`Excluded platform filters take precedence over included values: ${overlappingPlatforms.join(", ")}.`);
+    }
     normalized.max_pages = clampLimit("max_pages", normalized.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
     normalized.max_results = clampLimit("max_results", normalized.max_results, MAX_FIND_PROGRAM_RESULTS, warnings);
     normalized.target_sample_programs = clampLimit("target_sample_programs", normalized.target_sample_programs, MAX_FIND_TARGET_SAMPLE_PROGRAMS, warnings);
@@ -5890,8 +6306,10 @@ async function findPrograms(client, config, input) {
         warnings: warnings.length > 0 ? warnings : undefined,
         filters: stripUndefined({
             platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            exclude_platforms: input.exclude_platforms && input.exclude_platforms.length > 0 ? input.exclude_platforms : undefined,
             tags: upstreamTags.length > 0 ? upstreamTags : undefined,
             web3: input.web3 ? true : undefined,
+            exclude_web3: input.exclude_web3 ? true : undefined,
             opportunity_levels: input.opportunity_levels.length > 0 ? input.opportunity_levels : undefined,
             updated_since: input.updated_since,
             min_bounty_min: input.min_bounty_min,
@@ -6423,12 +6841,19 @@ function programCandidateMatches(candidate, filters) {
     if (filters.platforms.length > 0 && !filters.platforms.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
         return false;
     }
+    if ((filters.exclude_platforms?.length ?? 0) > 0 &&
+        filters.exclude_platforms?.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
+        return false;
+    }
     if (filters.tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.tags)) {
         return false;
     }
     if (filters.web3 && !candidateHasWeb3Surface(candidate)) {
         return false;
     }
+    if (filters.exclude_web3 && candidateHasWeb3Surface(candidate)) {
+        return false;
+    }
     if (filters.scope_tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.scope_tags)) {
         return false;
     }
@@ -6441,7 +6866,9 @@ function programCandidateMatches(candidate, filters) {
     if (candidate.wildcardCount < filters.min_wildcards) {
         return false;
     }
-    if (filters.require_bounty && (candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
+    const explicitlyPaid = normalizeTag(stringField(candidate.program, "program_type") ?? "") === "paid" ||
+        normalizeTag(stringField(candidate.program, "reward_status") ?? "") === "paid";
+    if (filters.require_bounty && !explicitlyPaid && (candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
         return false;
     }
     if (filters.min_bounty_min !== undefined && (candidate.bountyMin ?? 0) < filters.min_bounty_min) {
@@ -6812,6 +7239,111 @@ The plan must:
 - Prioritize targets by bounty eligibility, freshness, wildcard status, target type, and severity labels.
 - Include a short checklist of BBRadar follow-up tool calls and decision points.`));
 }
+function resolveFeedCursor(store, endpoint, filters, resume) {
+    const normalizedFilters = stableStringify(normalizeFeedCursorFilters(filters));
+    const key = `${endpoint}:${createHash("sha256").update(normalizedFilters).digest("hex")}`;
+    const explicitAfterId = readNumber(filters.after_id);
+    if (explicitAfterId !== undefined) {
+        return { endpoint, key, afterId: explicitAfterId, resumed: false };
+    }
+    if (!resume) {
+        return { endpoint, key, afterId: undefined, resumed: false };
+    }
+    const stored = store.get(key);
+    if (stored === undefined) {
+        throw new Error(`No in-memory ${endpoint} cursor exists for this filter set. Provide after_id once to seed it.`);
+    }
+    return { endpoint, key, afterId: stored, resumed: true };
+}
+function advanceFeedCursor(store, cursor, rawMeta) {
+    if (cursor.afterId === undefined) {
+        return undefined;
+    }
+    const meta = readObject(rawMeta);
+    const nextAfterId = readNumber(meta?.next_after_id) ?? cursor.afterId;
+    store.set(cursor.key, nextAfterId);
+    return {
+        endpoint: cursor.endpoint,
+        mode: cursor.resumed ? "resumed" : "seeded",
+        used_after_id: cursor.afterId,
+        next_after_id: nextAfterId,
+        has_more: readBoolean(meta?.has_more) ?? false,
+        stored_in_memory: true
+    };
+}
+async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudgetMs, fetchPage) {
+    const startedAt = Date.now();
+    const results = [];
+    const sourceRequests = [];
+    let currentCursor = initialCursor;
+    let lastApi;
+    let lastData;
+    let cursorPayload;
+    let pagesFetched = 0;
+    let hasMore = false;
+    let pageBudgetExhausted = false;
+    let timeBudgetExhausted = false;
+    do {
+        const api = await fetchPage(currentCursor.afterId);
+        const data = readObject(api.data);
+        const pageResults = readArray(data?.results);
+        lastApi = api;
+        lastData = data;
+        results.push(...pageResults);
+        pagesFetched += 1;
+        sourceRequests.push({
+            source: currentCursor.endpoint,
+            page: pagesFetched,
+            request_id: api.requestId,
+            upstream_request_id: api.upstreamRequestId,
+            ...apiSourceMetadata(api)
+        });
+        cursorPayload = advanceFeedCursor(store, currentCursor, data?.meta);
+        hasMore = readBoolean(readObject(data?.meta)?.has_more) === true;
+        if (currentCursor.afterId === undefined || !hasMore) {
+            break;
+        }
+        if (pagesFetched >= maxPages) {
+            pageBudgetExhausted = true;
+            break;
+        }
+        if (Date.now() - startedAt >= timeBudgetMs) {
+            timeBudgetExhausted = true;
+            break;
+        }
+        currentCursor = {
+            ...currentCursor,
+            afterId: readNumber(cursorPayload?.next_after_id) ?? currentCursor.afterId,
+            resumed: true
+        };
+    } while (true);
+    if (!lastApi) {
+        throw new Error(`No ${initialCursor.endpoint} response was collected.`);
+    }
+    return {
+        lastApi,
+        lastData,
+        results,
+        cursor: cursorPayload,
+        pagesFetched,
+        pageBudgetExhausted,
+        timeBudgetExhausted,
+        sourceRequests
+    };
+}
+function normalizeFeedCursorFilters(filters) {
+    return Object.fromEntries(Object.entries(filters)
+        .filter(([key, value]) => key !== "after_id" && key !== "page" && value !== undefined)
+        .map(([key, value]) => [key, normalizeFeedCursorFilterValue(value)]));
+}
+function normalizeFeedCursorFilterValue(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map((entry) => normalizeFeedCursorFilterValue(entry))
+            .sort((left, right) => String(left).localeCompare(String(right)));
+    }
+    return typeof value === "string" ? value.trim().toLowerCase() : value;
+}
 async function runTool(toolName, config, rateLimiter, callback) {
     const startedAt = Date.now();
     const decision = rateLimiter.consume(toolName, rateLimitForTool(toolName, config));
@@ -6870,7 +7402,8 @@ function compactToolText(payload, isError) {
         [
             readArray(payload.programs).length,
             readArray(payload.targets).length,
-            readArray(payload.changes).length
+            readArray(payload.changes).length,
+            readArray(payload.repository_changes).length
         ].find((count) => count > 0);
     return JSON.stringify(stripUndefined({
         request_id: payload.request_id,
@@ -6901,6 +7434,7 @@ function withApiMetadata(api, payload) {
         upstream_request_id: api.upstreamRequestId,
         cache: stripUndefined({
             hit: api.cached,
+            stale_while_revalidate: api.stale,
             coalesced_live_request: api.coalesced,
             expires_at: api.cacheExpiresAt
         }),
@@ -7053,7 +7587,11 @@ function compactTarget(target) {
         target_type: stringField(target, "target_type"),
         in_scope: readBoolean(target.in_scope),
         eligible_for_bounty: readBoolean(target.eligible_for_bounty),
-        wildcard: readBoolean(target.wildcard)
+        wildcard: readBoolean(target.wildcard),
+        target_opportunity_score: readNumber(target.target_opportunity_score),
+        target_opportunity_label: stringField(target, "target_opportunity_label"),
+        competition_risk: stringField(target, "competition_risk"),
+        why_this_target: stringField(target, "why_this_target")
     });
 }
 function targetIdentifier(target) {